@tillstack/cli 0.2.0

package/dist/index.js

@@ -0,0 +1,3447 @@
+#!/usr/bin/env node
+import { createInterface } from 'node:readline/promises';
+import { stdin as input, stdout as output, exit } from 'node:process';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { loadConfig, saveConfig, updateConfig, configFilePath } from './config.js';
+import * as api from './api.js';
+import { ApiError } from './api.js';
+import { toDoc, parseDoc, planApply, toApiBody } from './rules.js';
+import { c, table, kv, printJson, ok, info, warn, fail, truncate, ago } from './output.js';
+const VERSION = '0.2.0';
+function parseArgs(argv) {
+    const positional = [];
+    const named = {};
+    const bool = new Set();
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (!a)
+            continue;
+        if (a === '-h') {
+            bool.add('help');
+            continue;
+        }
+        if (a.startsWith('--')) {
+            const eq = a.indexOf('=');
+            if (eq !== -1) {
+                named[a.slice(2, eq)] = a.slice(eq + 1);
+                continue;
+            }
+            const key = a.slice(2);
+            const next = argv[i + 1];
+            if (next != null && !next.startsWith('--')) {
+                named[key] = next;
+                i++;
+            }
+            else {
+                bool.add(key);
+            }
+        }
+        else {
+            positional.push(a);
+        }
+    }
+    return { positional, named, bool };
+}
+// ── Prompts ──────────────────────────────────────────────────────────────────
+async function promptInput(promptText, opts = {}) {
+    const rl = createInterface({ input, output, terminal: true });
+    try {
+        if (opts.hidden && output.isTTY) {
+            output.write(promptText);
+            return await new Promise((resolve) => {
+                const stdinAny = process.stdin;
+                stdinAny.setRawMode?.(true);
+                let answer = '';
+                const onData = (data) => {
+                    const s = data.toString('utf8');
+                    if (s === '\u0003') {
+                        stdinAny.setRawMode?.(false);
+                        rl.close();
+                        exit(130);
+                    }
+                    if (s === '\r' || s === '\n') {
+                        stdinAny.setRawMode?.(false);
+                        stdinAny.removeListener('data', onData);
+                        output.write('\n');
+                        resolve(answer);
+                        return;
+                    }
+                    if (s === '\u007f')
+                        answer = answer.slice(0, -1);
+                    else
+                        answer += s;
+                };
+                stdinAny.on('data', onData);
+            });
+        }
+        return await rl.question(promptText);
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Read all of stdin to a string (for `--<flag>-stdin` secret piping in CI). */
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+// Resolve a secret-valued argument WITHOUT forcing it onto the command line,
+// where it would be captured in shell history and `ps` output. Precedence:
+//   1. --<name> <value>      convenient, but leaks to history — we warn.
+//   2. --<name>-stdin        CI-safe: `printf %s "$TOKEN" | tilldev … --token-stdin`
+//   3. interactive hidden prompt (TTY only).
+async function readSecretArg(flags, name, label) {
+    const direct = flags.named[name];
+    if (direct !== undefined) {
+        warn(`Passing --${name} on the command line leaks it to shell history; prefer --${name}-stdin or the prompt.`);
+        return direct;
+    }
+    if (flags.bool.has(`${name}-stdin`)) {
+        const v = (await readStdin()).trim();
+        if (!v)
+            throw new Error(`--${name}-stdin was set but stdin was empty`);
+        return v;
+    }
+    if (process.stdin.isTTY) {
+        const v = (await promptInput(`${label}: `, { hidden: true })).trim();
+        if (!v)
+            throw new Error(`${label} is required`);
+        return v;
+    }
+    throw new Error(`missing ${label}: pass --${name}, pipe it with --${name}-stdin, or run interactively`);
+}
+// ── Help ─────────────────────────────────────────────────────────────────────
+const HELP = `${c.bold('tilldev')} — the TillDev command line ${c.dim('(v' + VERSION + ')')}
+
+${c.bold('USAGE')}
+  tilldev <command> [subcommand] [args] [flags]
+
+${c.bold('ACCOUNT')}
+  login                     Sign in and store a token at ${c.dim('~/.tilldev/config.json')}
+  logout                    Forget the stored token
+  whoami                    Show the signed-in user, org, and API URL
+  config get [key]          Show config (api-url | org | project | token)
+  config set <key> <value>  Set api-url / org / project
+
+${c.bold('STACKS')} ${c.dim('(one app across products)')}  ${c.gray('tilldev stacks …')}
+  stacks ls                             List your stacks
+  stacks show <slug>                    Products + resource counts for a stack
+  stacks create <name> [--slug <s>] [--accent <hex>] [--modules pulse,auth,cache,…]
+  stacks enable  <slug> <product>       Turn a product on for the stack
+  stacks disable <slug> <product>       Pause a product (keeps attached resources)
+  stacks attach  <slug> <product> <resource-id>   Wire an existing resource in
+  stacks detach  <slug> <product> <resource-id>   Un-group a resource
+  stacks rm <slug>                      Delete a stack ${c.dim('(resources un-grouped, not deleted)')}
+
+${c.bold('TILLPULSE')} ${c.dim('(observability)')}   ${c.gray('tilldev pulse …')}
+  pulse projects            List projects
+  pulse projects create <name> --platform <ios|android|react-native|flutter|web>
+  pulse project <id>        Show a project (incl. DSN)
+  pulse issues [--project <id>] [--limit <n>]
+  pulse issue <id>          Show an issue
+  pulse metrics [--project <id>]
+  pulse alerts              List alerts that have fired
+  pulse alerts rules [projectId]   List the alert rules that fire them
+  pulse releases create <projectId> <version> [--build <b>] [--env <e>] [--commit <sha>]
+  pulse sourcemaps upload <projectId> --release <v> --file <path>
+  pulse proguard upload   <projectId> --release <v> --file <path>
+  pulse dsym upload       <projectId> --release <v> --file <path>
+  pulse dsn rotate <projectId>
+  pulse ask "<question>"    Ask your telemetry in natural language
+  pulse tracker ls <projectId>                    List Jira/Linear integrations
+  pulse tracker connect <projectId> --provider <jira|linear> --target <KEY> [--token…]
+  pulse tracker webhook <projectId> --provider <jira|linear>   Show inbound webhook URL/status
+  pulse tracker webhook-secret <projectId> --provider <jira|linear>  Set the per-project secret
+  pulse tracker disconnect <projectId> --provider <jira|linear>
+
+${c.bold('TILLSHIELD')} ${c.dim('(edge WAF)')}       ${c.gray('tilldev shield …')}
+  shield rules ls                       List inline edge rules
+  shield rules export [-f <file>]       Export rules to a JSON file ${c.dim('(rules-as-code)')}
+  shield rules apply -f <file> [--dry-run] [--prune]   Reconcile rules from a file
+  shield rules rm <id>                  Delete a rule
+  shield edge-keys ls                   List edge auth keys
+  shield edge-keys create --project <id> [--name <n>]  Mint an edge key
+  shield edge-keys revoke <id>          Revoke an edge key
+  shield settings                       Show TillShield settings
+  shield incidents [--status <s>]       List security incidents
+
+${c.bold('TILLGATE')} ${c.dim('(bot challenge)')}    ${c.gray('tilldev gate …')}
+  gate sites ls                         List challenge sites
+  gate sites create --project <id> [--name <n>] [--mode <m>] [--difficulty <8-26>] [--ttl <s>] [--hosts a,b]
+  gate sites update <id> [--mode <m>] [--difficulty <n>] [--ttl <s>] [--hosts a,b]
+  gate sites rm <id>                    Delete a site
+
+${c.bold('TILLCACHE')} ${c.dim('(KV, queues, pub/sub)')}  ${c.gray('tilldev cache …')}
+  cache ns ls                           List cache namespaces
+  cache ns create --name <n> --slug <s> [--backend upstash|durable|byo|auto] [--consistency strong|eventual]
+                                        (backend byo also needs --byo-url + --byo-token)
+  cache ns get <id>                     Show a namespace
+  cache ns pause|resume <id>            Pause / resume serving
+  cache ns rm <id>                      Delete a namespace
+  cache tokens ls --ns <id>             List data-plane tokens
+  cache tokens create --ns <id> [--name <n>] [--scope rw|ro]   Mint a tc_… token
+  cache tokens revoke <tokenId> --ns <id>
+  cache queues --ns <id>                Queue depths + dead-letter counts
+  cache keys --ns <id>                  Hot keys
+  cache usage --ns <id>                 Command/queue/publish usage (7d)
+
+${c.bold('TILLSECRETS')} ${c.dim('(config + secrets)')}  ${c.gray('tilldev secrets …')}
+  secrets projects ls                         List secrets projects
+  secrets projects create --name <n> --slug <s>
+  secrets env ls --project <id>               List environments
+  secrets env create --project <id> --name <n> --slug <s>
+  secrets ls --env <id>                        List secret keys (no values)
+  secrets set <KEY> --env <id> [--value <v>]   Set a value (new version); prompts if no --value
+  secrets get <secret-id> [--version <n>]      Reveal a value (audited)
+  secrets versions <secret-id>                 Version history
+  secrets rollback <secret-id> --version <n>   Re-point to an older version
+  secrets rm <secret-id>                       Delete a secret
+  secrets tokens ls --project <id>             List service tokens
+  secrets tokens create --project <id> [--scope read|read_write] [--env <id>]  Mint a ts_… token
+  secrets tokens revoke <token-id> --project <id>
+  secrets pull [--env <id>]                    Boot-time bulk pull → ${c.dim('.env on stdout (--json for JSON)')}
+  secrets lease <KEY> [--ttl <sec>]            Lease a short-lived dynamic credential ${c.dim('(--backend <id> instead of KEY)')}
+  secrets lease revoke <lease-id>              Revoke a lease early
+  secrets sync ls|add|rm|pause|resume|push --project <id>   ${c.dim('One-way push targets')}
+  ${c.dim('pull/lease authenticate with a ts_ service token: --token ts_… or $TILLSECRETS_TOKEN.')}
+  ${c.dim('lease targets the dynamic-lease service — override with --lease-url / $TILLSECRETS_LEASE_URL.')}
+
+${c.bold('TILLARK')} ${c.dim('(backup & disaster recovery)')}  ${c.gray('tilldev ark …')}
+  ark sources ls | get <id> | rm <id>
+  ark sources create --name <n> --type <postgres|…|object> --provider <p> [--residency <z>] [--with-dsn]
+  ark targets ls | get <id> | rm <id>
+  ark targets create --name <n> --provider <s3|r2|…> [--bucket <b>] [--endpoint <url>] [--lock-days <n>] [--with-creds]
+  ark policies ls [--source <id>]
+  ark policies create --source <id> [--cron <expr>] [--rpo <s>] [--rto <s>] [--keep-daily <n> …] [--verify-cron <expr>]
+  ark backups ls [--source <id>]        List the backup catalog
+  ark backups run --source <id> [--policy <id>]   Queue a backup run
+  ark verify <backup-id>                Non-destructive restore-verification
+  ark restore <backup-id> --into <source-id> --approved-by <uid> --approval-ref <ref>  ${c.dim('(four-eyes)')}
+  ark restores [--backup <id>]          Restore + verification history
+  ark failover status --source <id>     Current failover state + replicas
+  ark failover promote --source <id> [--to <node>] --approved-by <uid> --approval-ref <ref>  ${c.dim('(four-eyes)')}
+  ark failover failback --source <id> [--lag <s>] --approved-by <uid> --approval-ref <ref>   ${c.dim('(four-eyes)')}
+  ark replicas                          List replicas across the org
+  ark tokens ls                         List tark_ control-plane tokens
+  ark tokens create [--scope read|operator|admin] [--can-approve] [--expires <days>]
+  ark tokens revoke <token-id>
+  ark audit [--limit <n>]               The append-only compliance trail
+
+${c.bold('TILLFORGE')} ${c.dim('(sovereign code hosting)')}  ${c.gray('tilldev forge …')}
+  forge login [--scope read|write]             Sign in for git via the browser (device flow — no pasting tokens)
+  forge clone <org>/<repo> [dir]               Clone over HTTPS (token via helper, never in the URL)
+  forge setup-git                              Wire git's credential helper for the forge host, once
+  forge repos ls | get <slug> | rm <slug>
+  forge repos create --name <n> [--slug <s>] [--visibility private|internal|public]
+  forge tokens ls | revoke <id>
+  forge tokens create [--scope read|write|admin] [--repo <slug>] [--expires <days>]  ${c.dim('(tfp_ — the git password)')}
+  forge tree <repo> [--rev <r>] [--path <p>]   Browse a directory
+  forge search <repo> <query> [--rev <r>]      Code search (fixed-string) across a repo
+  forge blob <repo> --path <p> [--rev <r>]     Read a file
+  forge log <repo> [--rev <r>] [--limit <n>]   Commit log
+  forge refs <repo> | blame <repo> --path <p>
+  forge policy ls <repo>
+  forge policy set <repo> --pattern <p> [--require-signed] [--require-linear] [--approvals <n>] [--checks a,b] [--require-mfa] [--allow-force] [--allow-delete]
+  forge reflog <repo>                          Ref-change history (recovery)
+  forge recover <repo> <reflog-id>             One-click restore a ref ${c.dim('(mistake ≠ fatal)')}
+  forge findings <repo>                        Secrets rejected at the push boundary
+  forge allowlist <repo> <finding-id> --reason <r>
+  forge pr ls <repo> [--state open|merged|closed]
+  forge pr create <repo> --title <t> --source <ref> [--target <ref>] [--draft]
+  forge pr get <repo> <number> | review <repo> <number> --state approved|changes_requested|commented
+  forge pr merge <repo> <number> [--strategy merge|squash|rebase]  ${c.dim('(enforces approvals+checks)')}
+  forge pr close <repo> <number> | reopen <repo> <number> | comment <repo> <number> --body <b> [--file <p>] [--line <n>]
+  forge release ls <repo> | get <repo> <tag> | rm <repo> <tag>
+  forge release create <repo> --tag <t> [--name <n>] [--target <ref>] [--generate|--notes <md>] [--prerelease] [--draft]  ${c.dim('(auto-changelog)')}
+  forge asset add <repo> <tag> --name <n> --platform linux|darwin|windows|android|ios --url <u> [--arch <a>] [--sha256 <h>]
+  forge env ls <repo> | set <repo> --name <n> [--production] [--url <u>] [--approvals <n>]
+  forge deploy ls <repo> [--env <e>] | create <repo> --env <e> --ref <r> [--url <u>] | status <repo> <id> --state <s>
+  forge webhook ls | add --url <u> --events push,release,deployment [--repo <slug>] [--secret <s>] | rm <id> | ping <id> | deliveries <id>
+  forge pr diff <repo> <number> | forge compare <repo> --base <ref> --head <ref>  ${c.dim('(changed files)')}
+  forge issue ls <repo> [--state open|closed|all] [--label <l>]
+  forge issue create <repo> --title <t> [--body <b>] [--labels a,b] [--assignee <uid>]
+  forge issue get <repo> <number> | close <repo> <number> | comment <repo> <number> --body <b>
+  forge label ls <repo> | create <repo> --name <n> [--color #rrggbb] [--desc <d>]
+  forge collab ls <repo> | add <repo> --user <uid> [--role read|triage|write|admin] | rm <repo> <id>
+  forge checks <repo> [--sha <s>] | check <repo> --sha <s> --context <c> --state <st> [--url <u>]
+  forge ci list --repo <slug> [--status <st>] [--workflow <w>]   CI runs, newest first
+  forge ci logs <job-id> --repo <slug>         One run's full log
+  forge ci run --repo <slug> [--sha <s>] [--ref <r>]  Enqueue .tillforge/ci.yml jobs ${c.dim('(defaults to the default branch tip)')}
+  forge correlation <repo> [--rev <r>]         Release-granular commit→crash
+  forge egress policy <repo> | set <repo> [--allow] [--sensitive] [--providers a,b] [--max-bytes <n>] [--no-redact] | audit
+  forge mirror <repo> --url <u> [--direction pull|push] | forge mirror <repo> --remove  ${c.dim('(SSRF-guarded)')}
+  forge keys ls <repo> | add <repo> --name <n> --key "<ssh pubkey>" [--scope read|write] [--expires <days>] | revoke <repo> <id>
+  forge keys-account ls | add --name <n> --key "<ssh pubkey>" [--scope read|write] [--expires <days>] | rm <id>  ${c.dim('(org-wide keys)')}
+  forge codeowners <repo> [--rev <r>]
+  forge audit [--limit <n>]
+
+${c.bold('TILLAUTH')} ${c.dim('(auth)')}            ${c.gray('tilldev auth …')}
+  auth apps                 List auth apps
+  auth apps create <name>   Create an auth app
+  auth app <appId>          Show an auth app
+
+${c.bold('WORKSPACE')}
+  team                      List org members
+  keys                      List API keys
+  keys create <name> [--scopes read,write,admin]
+
+${c.bold('GLOBAL FLAGS')}
+  --api-url <url>   Override API base URL ${c.dim('(env: TILLDEV_API_URL)')}
+  --token <token>   Override stored token ${c.dim('(env: TILLDEV_TOKEN)')}
+  --json            Print raw JSON instead of tables
+  --help, -h        Show help`;
+// ── Helpers ──────────────────────────────────────────────────────────────────
+// Guard the base URL before we ever attach the Bearer token to a request. An
+// http:// (or otherwise attacker-controlled) base would send the token in
+// cleartext or straight to a foreign host. Allow https everywhere; allow http
+// ONLY for localhost/127.0.0.1 (local dev).
+function assertSafeApiUrl(apiUrl) {
+    let u;
+    try {
+        u = new URL(apiUrl);
+    }
+    catch {
+        throw new Error(`Invalid --api-url: ${apiUrl}`);
+    }
+    const isLocal = u.hostname === 'localhost' || u.hostname === '127.0.0.1';
+    if (u.protocol !== 'https:' && !(u.protocol === 'http:' && isLocal)) {
+        throw new Error(`Refusing to send your token to ${apiUrl} — the API URL must be https:// (http:// is allowed only for localhost).`);
+    }
+}
+function resolveOpts(flags) {
+    const cfg = loadConfig();
+    const apiUrl = flags.named['api-url'] ?? cfg.api_url;
+    const token = flags.named['token'] ?? process.env['TILLDEV_TOKEN'] ?? process.env['TILLPULSE_TOKEN'] ?? cfg.token;
+    // Only enforce when a token would actually be attached — unauthenticated calls
+    // to a custom http endpoint (rare) shouldn't be blocked, but a token must never
+    // leave over http to a non-local host.
+    if (token !== undefined)
+        assertSafeApiUrl(apiUrl);
+    const opts = { apiUrl, ...(token !== undefined ? { token } : {}) };
+    return { opts, apiUrl, ...(cfg.org !== undefined ? { org: cfg.org } : {}) };
+}
+/** Print `data` as JSON when --json, else run the human renderer. */
+function render(flags, data, human) {
+    if (flags.bool.has('json'))
+        printJson(data);
+    else
+        human();
+}
+function need(value, usage) {
+    if (!value)
+        throw new Error(`usage: ${usage}`);
+    return value;
+}
+// Quote a value for dotenv output. Barewords pass through; anything with
+// whitespace/quotes/special chars is double-quoted with escapes, so
+// `tilldev secrets pull > .env` round-trips cleanly.
+function dotenvQuote(v) {
+    if (/^[A-Za-z0-9_@%+=:,./-]*$/.test(v))
+        return v;
+    return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n') + '"';
+}
+// ── Command handlers ─────────────────────────────────────────────────────────
+async function cmdLogin(flags) {
+    const { opts, apiUrl } = resolveOpts(flags);
+    const email = flags.named['email'] ?? (await promptInput('Email: '));
+    const password = flags.named['password'] ?? (await promptInput('Password: ', { hidden: true }));
+    let r = await api.login(opts, email, password);
+    if (r.totpRequired) {
+        const code = await promptInput('2FA code: ');
+        r = await api.login(opts, email, password, code);
+    }
+    saveConfig({ api_url: apiUrl, token: r.token, org: r.org });
+    ok(`Signed in as ${c.bold(email)} — token saved to ${c.dim(configFilePath())} (0600)`);
+    info(`Org: ${c.bold(r.org)}`);
+}
+function cmdLogout() {
+    const cfg = loadConfig();
+    saveConfig({ api_url: cfg.api_url, ...(cfg.org ? { org: cfg.org } : {}) });
+    ok('Logged out — token removed.');
+}
+async function cmdWhoami(flags) {
+    const { opts, apiUrl, org } = resolveOpts(flags);
+    if (!opts.token) {
+        fail('Not signed in. Run `tilldev login`.');
+        exit(1);
+    }
+    const me = await api.getMe(opts).catch(() => null);
+    render(flags, me ?? { api_url: apiUrl, org }, () => {
+        console.log(kv([
+            ['API URL', apiUrl],
+            ['User', me?.user?.email ?? c.dim('<unknown>')],
+            ['Org', me?.org?.slug ?? org ?? c.dim('<not set>')],
+            ['Role', me?.org?.role ?? me?.role ?? c.dim('-')],
+        ]));
+    });
+}
+function cmdConfig(flags) {
+    const sub = flags.positional[1];
+    const cfg = loadConfig();
+    if (sub === 'set') {
+        const key = need(flags.positional[2], 'tilldev config set <api-url|org|project> <value>');
+        const value = need(flags.positional[3], 'tilldev config set <key> <value>');
+        const map = { 'api-url': 'api_url', org: 'org', project: 'project' };
+        const field = map[key];
+        if (!field)
+            throw new Error(`unknown config key: ${key} (api-url | org | project)`);
+        updateConfig({ [field]: value });
+        ok(`Set ${key} = ${value}`);
+        return;
+    }
+    // get (default)
+    render(flags, { ...cfg, token: cfg.token ? '<set>' : undefined, forge_token: cfg.forge_token ? '<set>' : undefined }, () => {
+        console.log(kv([
+            ['api-url', cfg.api_url],
+            ['org', cfg.org ?? c.dim('<not set>')],
+            ['project', cfg.project ?? c.dim('<not set>')],
+            ['token', cfg.token ? c.green('<set>') : c.dim('<missing>')],
+            ['forge-token', cfg.forge_token ? c.green('<set>') : c.dim('<missing>')],
+        ]));
+    });
+}
+const now = Date.now();
+async function cmdPulse(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1];
+    const cfgProject = loadConfig().project;
+    switch (sub) {
+        case undefined:
+        case 'projects': {
+            if (flags.positional[2] === 'create') {
+                const name = need(flags.positional[3], 'tilldev pulse projects create <name> --platform <p>');
+                const platform = need(flags.named['platform'], 'tilldev pulse projects create <name> --platform <ios|android|react-native|flutter|web>');
+                const r = await api.createProject(opts, name, platform);
+                render(flags, r, () => {
+                    ok(`Created project ${c.bold(r.project.name)}`);
+                    console.log(kv([['id', r.project.id], ['dsn', r.project.dsn ?? c.dim('-')]]));
+                });
+                return;
+            }
+            const r = await api.listProjects(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (p) => c.bold(p.name) },
+                    { header: 'PLATFORM', get: (p) => p.platform ?? '-' },
+                    { header: 'ID', get: (p) => c.dim(p.id) },
+                ];
+                console.log(table(r.projects, cols));
+            });
+            return;
+        }
+        case 'project': {
+            const id = need(flags.positional[2] ?? cfgProject, 'tilldev pulse project <id>');
+            const r = await api.getProject(opts, id);
+            render(flags, r, () => console.log(kv([
+                ['name', r.project.name],
+                ['id', r.project.id],
+                ['platform', r.project.platform ?? '-'],
+                ['dsn', r.project.dsn ?? c.dim('-')],
+            ])));
+            return;
+        }
+        case 'issues': {
+            const projectId = flags.named['project'] ?? cfgProject;
+            const r = await api.listIssues(opts, {
+                ...(projectId ? { projectId } : {}),
+                ...(flags.named['limit'] ? { limit: Number(flags.named['limit']) } : {}),
+            });
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'TITLE', get: (i) => c.bold(truncate(i.title ?? '(untitled)', 48)) },
+                    { header: 'LEVEL', get: (i) => levelColor(i.level) },
+                    { header: 'EVENTS', get: (i) => String(i.events_count ?? 0) },
+                    { header: 'LAST SEEN', get: (i) => ago(i.last_seen, now) },
+                    { header: 'ID', get: (i) => c.dim(i.id) },
+                ];
+                console.log(table(r.issues, cols));
+            });
+            return;
+        }
+        case 'issue': {
+            const id = need(flags.positional[2], 'tilldev pulse issue <id>');
+            const r = await api.getIssue(opts, id);
+            printJson(r);
+            return;
+        }
+        case 'metrics': {
+            const r = await api.getMetrics(opts, flags.named['project'] ?? cfgProject);
+            printJson(r);
+            return;
+        }
+        case 'alerts': {
+            // `pulse alerts`       → alerts that have fired (what you check after a page)
+            // `pulse alerts rules` → the rules that fire them
+            if (flags.positional[2] === 'rules') {
+                const r = await api.listAlertRules(opts, flags.named.project ?? flags.positional[3]);
+                render(flags, r, () => {
+                    const cols = [
+                        { header: 'NAME', get: (a) => c.bold(truncate(a.name ?? '-', 40)) },
+                        { header: 'TRIGGER', get: (a) => a.trigger_type ?? '-' },
+                        { header: 'ENABLED', get: (a) => (a.enabled ? c.green('yes') : c.dim('no')) },
+                        { header: 'ID', get: (a) => c.dim(a.id) },
+                    ];
+                    console.log(table(r.rules, cols));
+                });
+                return;
+            }
+            const r = await api.listAlerts(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'TITLE', get: (a) => c.bold(truncate(a.title ?? '-', 48)) },
+                    { header: 'SEVERITY', get: (a) => levelColor(a.severity) },
+                    { header: 'PROJECT', get: (a) => a.project ?? '-' },
+                    { header: 'ACK', get: (a) => (a.acknowledged ? c.dim('yes') : c.yellow('no')) },
+                    { header: 'WHEN', get: (a) => ago(a.created_at, now) },
+                ];
+                console.log(table(r.alerts, cols));
+            });
+            return;
+        }
+        case 'releases': {
+            if (flags.positional[2] !== 'create')
+                throw new Error('usage: tilldev pulse releases create <projectId> <version> [flags]');
+            const projectId = need(flags.positional[3], 'tilldev pulse releases create <projectId> <version>');
+            const version = need(flags.positional[4], 'tilldev pulse releases create <projectId> <version>');
+            const r = await api.createRelease(opts, projectId, {
+                version,
+                ...(flags.named['build'] ? { build: flags.named['build'] } : {}),
+                ...(flags.named['env'] ? { environment: flags.named['env'] } : {}),
+                ...(flags.named['commit'] ? { commit_sha: flags.named['commit'] } : {}),
+            });
+            render(flags, r, () => ok(`Created release ${c.bold(version)}`));
+            return;
+        }
+        case 'sourcemaps':
+        case 'proguard':
+        case 'dsym': {
+            if (flags.positional[2] !== 'upload')
+                throw new Error(`usage: tilldev pulse ${sub} upload <projectId> --release <v> --file <path>`);
+            const projectId = need(flags.positional[3], `tilldev pulse ${sub} upload <projectId> --release <v> --file <path>`);
+            const release = need(flags.named['release'], `--release required`);
+            const file = need(flags.named['file'], `--file required`);
+            const fn = sub === 'sourcemaps' ? api.uploadSourceMap : sub === 'proguard' ? api.uploadProguardMapping : api.uploadDsym;
+            const r = await fn(opts, projectId, { release, filePath: file });
+            render(flags, r, () => ok(`Uploaded ${sub} for release ${c.bold(release)}`));
+            return;
+        }
+        case 'dsn': {
+            if (flags.positional[2] !== 'rotate')
+                throw new Error('usage: tilldev pulse dsn rotate <projectId>');
+            const projectId = need(flags.positional[3], 'tilldev pulse dsn rotate <projectId>');
+            const r = await api.rotateDsn(opts, projectId);
+            render(flags, r, () => ok('DSN rotated.'));
+            return;
+        }
+        case 'ask': {
+            const { org } = resolveOpts(flags);
+            const question = need(flags.positional[2], 'tilldev pulse ask "<question>"');
+            const orgSlug = flags.named['org'] ?? org;
+            if (!orgSlug)
+                throw new Error('no org set — run `tilldev config set org <slug>` or `tilldev login`');
+            await api.askStream(opts, orgSlug, question, (chunk) => output.write(chunk));
+            output.write('\n');
+            return;
+        }
+        case 'tracker':
+            return cmdTracker(flags, opts, cfgProject);
+        default:
+            throw new Error(`unknown: tilldev pulse ${sub}`);
+    }
+}
+// ── TillPulse: issue-tracker (Jira / Linear) ──────────────────────────────────
+// `pulse tracker <action> <projectId> …`. The webhook-secret action is the
+// user-facing half of the per-project webhook fix — each project gets its own
+// inbound secret so a leak can never reach another tenant.
+function trackerProvider(flags) {
+    const p = flags.named['provider'];
+    if (p !== 'jira' && p !== 'linear')
+        throw new Error('--provider must be jira or linear');
+    return p;
+}
+async function cmdTracker(flags, opts, cfgProject) {
+    const action = flags.positional[2];
+    const projectId = flags.positional[3] ?? flags.named['project'] ?? cfgProject;
+    switch (action) {
+        case undefined:
+        case 'ls':
+        case 'list': {
+            const pid = need(projectId, 'tilldev pulse tracker ls <projectId>');
+            const r = await api.listTracker(opts, pid);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'PROVIDER', get: (t) => c.bold(t.provider) },
+                    { header: 'TARGET', get: (t) => t.default_target },
+                    { header: 'SITE', get: (t) => t.site_url ?? c.dim('-') },
+                    { header: 'WEBHOOK', get: (t) => (t.has_webhook_secret ? c.green('secured') : c.yellow('unset')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.integrations, cols));
+            });
+            return;
+        }
+        case 'connect': {
+            const pid = need(projectId, 'tilldev pulse tracker connect <projectId> --provider <p> --target <KEY>');
+            const provider = trackerProvider(flags);
+            const target = need(flags.named['target'], '--target required (project/team key issues are filed under)');
+            const token = await readSecretArg(flags, 'token', `${provider} API token`);
+            const body = { provider, api_token: token, default_target: target };
+            if (provider === 'jira') {
+                body.site_url = need(flags.named['site-url'], 'jira requires --site-url (e.g. https://acme.atlassian.net)');
+                body.auth_email = need(flags.named['email'], 'jira requires --email (the Atlassian account email)');
+            }
+            if (flags.named['issue-type'])
+                body.default_issue_type = flags.named['issue-type'];
+            const r = await api.connectTracker(opts, pid, body);
+            render(flags, r, () => {
+                ok(`Connected ${c.bold(provider)} for project ${c.dim(pid)}`);
+                info(`Next: secure inbound status syncs with \`tilldev pulse tracker webhook-secret ${pid} --provider ${provider}\``);
+            });
+            return;
+        }
+        case 'webhook': {
+            const pid = need(projectId, 'tilldev pulse tracker webhook <projectId> --provider <p>');
+            const provider = trackerProvider(flags);
+            const r = await api.getTrackerWebhook(opts, pid, provider);
+            render(flags, r, () => {
+                console.log(kv([
+                    ['provider', provider],
+                    ['configured', r.configured ? c.green('yes') : c.yellow('no')],
+                    ['webhook url', r.webhook_url],
+                    ...(r.header ? [['header', r.header]] : []),
+                ]));
+                if (!r.configured)
+                    info(`Set it with \`tilldev pulse tracker webhook-secret ${pid} --provider ${provider}\``);
+            });
+            return;
+        }
+        case 'webhook-secret': {
+            const pid = need(projectId, 'tilldev pulse tracker webhook-secret <projectId> --provider <p>');
+            const provider = trackerProvider(flags);
+            if (provider === 'linear') {
+                // Linear signs with its own generated secret — the customer pastes it in.
+                const secret = await readSecretArg(flags, 'secret', 'Linear webhook signing secret');
+                const r = await api.setTrackerWebhook(opts, pid, { provider, secret });
+                render(flags, r, () => {
+                    ok('Stored the Linear signing secret (encrypted). Inbound webhooks are now verified.');
+                    console.log(kv([['webhook url', r.webhook_url]]));
+                });
+                return;
+            }
+            // Jira doesn't sign, so WE mint a token and hand it back once.
+            const r = await api.setTrackerWebhook(opts, pid, { provider });
+            render(flags, r, () => {
+                ok('Generated a Jira webhook token.');
+                console.log(kv([
+                    ['webhook url', r.webhook_url],
+                    ['header', r.header ?? 'X-TillPulse-Webhook-Token'],
+                    ['token', c.yellow(r.secret ?? '-')],
+                ]));
+                info('Add the token as that header on your Jira Automation "Send web request" rule.');
+                info('Copy it now — it will not be shown again.');
+            });
+            return;
+        }
+        case 'disconnect':
+        case 'rm': {
+            const pid = need(projectId, 'tilldev pulse tracker disconnect <projectId> --provider <p>');
+            const provider = trackerProvider(flags);
+            const r = await api.disconnectTracker(opts, pid, provider);
+            render(flags, r, () => ok(`Disconnected ${c.bold(provider)} from project ${c.dim(pid)}`));
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev pulse tracker ${action}`);
+    }
+}
+async function cmdAuth(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1];
+    switch (sub) {
+        case undefined:
+        case 'apps': {
+            if (flags.positional[2] === 'create') {
+                const name = need(flags.positional[3], 'tilldev auth apps create <name>');
+                const r = await api.createAuthApp(opts, name);
+                render(flags, r, () => {
+                    ok(`Created auth app ${c.bold(r.app.name)}`);
+                    console.log(kv([['id', r.app.id], ['public_id', r.app.public_id ?? '-'], ['slug', r.app.slug ?? '-']]));
+                });
+                return;
+            }
+            const r = await api.listAuthApps(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (a) => c.bold(a.name) },
+                    { header: 'SLUG', get: (a) => a.slug ?? '-' },
+                    { header: 'PUBLIC ID', get: (a) => c.dim(a.public_id ?? a.id) },
+                ];
+                console.log(table(r.apps, cols));
+            });
+            return;
+        }
+        case 'app': {
+            const appId = need(flags.positional[2], 'tilldev auth app <appId>');
+            const r = await api.getAuthApp(opts, appId);
+            printJson(r);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev auth ${sub}`);
+    }
+}
+async function cmdTeam(flags) {
+    const { opts } = resolveOpts(flags);
+    const r = await api.listTeam(opts);
+    const members = r.members ?? r.team ?? [];
+    render(flags, r, () => {
+        const cols = [
+            { header: 'EMAIL', get: (m) => c.bold(m.email ?? '-') },
+            { header: 'NAME', get: (m) => m.name ?? '-' },
+            { header: 'ROLE', get: (m) => roleColor(m.role) },
+            { header: 'ID', get: (m) => c.dim(m.user_id ?? m.id ?? '-') },
+        ];
+        console.log(table(members, cols));
+    });
+}
+async function cmdKeys(flags) {
+    const { opts } = resolveOpts(flags);
+    if (flags.positional[1] === 'create') {
+        const name = need(flags.positional[2], 'tilldev keys create <name> [--scopes read,write]');
+        const scopes = (flags.named['scopes'] ?? 'read').split(',').map((s) => s.trim()).filter(Boolean);
+        const r = await api.createApiKey(opts, name, scopes);
+        const key = r.key ?? r.api_key;
+        render(flags, r, () => {
+            ok(`Created API key ${c.bold(name)}`);
+            if (key) {
+                console.log(kv([['key', c.yellow(key)]]));
+                info('Copy it now — it will not be shown again.');
+            }
+        });
+        return;
+    }
+    const r = await api.listApiKeys(opts);
+    render(flags, r, () => {
+        const cols = [
+            { header: 'NAME', get: (k) => c.bold(k.name) },
+            { header: 'SCOPES', get: (k) => (k.scopes ?? []).join(',') || '-' },
+            { header: 'LAST USED', get: (k) => ago(k.last_used_at, now) },
+            { header: 'ID', get: (k) => c.dim(k.id) },
+        ];
+        console.log(table(r.keys, cols));
+    });
+}
+// ── TillShield ────────────────────────────────────────────────────────────────
+async function cmdShield(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1];
+    switch (sub) {
+        case 'rules':
+            return cmdShieldRules(flags, opts);
+        case 'edge-keys':
+        case 'keys':
+            return cmdShieldEdgeKeys(flags, opts);
+        case 'settings': {
+            const { settings } = await api.getShieldSettings(opts);
+            render(flags, { settings }, () => console.log(kv([
+                ['panic mode', boolCell(settings.panic_mode)],
+                ['auto-quarantine compromised', boolCell(settings.auto_quarantine_compromised)],
+                ['auto-incident on indicator', boolCell(settings.auto_incident_on_confirmed_indicator)],
+                ['contribute threat intel', boolCell(settings.contribute_threat_intel)],
+            ])));
+            return;
+        }
+        case 'incidents': {
+            const r = await api.listIncidents(opts, flags.named['status']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'SEVERITY', get: (i) => levelColor(i.severity) },
+                    { header: 'STATUS', get: (i) => i.status ?? '-' },
+                    { header: 'TITLE', get: (i) => c.bold(truncate(i.title, 44)) },
+                    { header: 'TYPE', get: (i) => i.security_type ?? '-' },
+                    { header: 'WHEN', get: (i) => ago(i.created_at, now) },
+                    { header: 'ID', get: (i) => c.dim(i.id) },
+                ];
+                console.log(table(r.incidents, cols));
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev shield <rules|edge-keys|settings|incidents>');
+    }
+}
+async function cmdShieldRules(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listEdgeRules(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'PRI', get: (rule) => String(rule.priority) },
+                    { header: 'NAME', get: (rule) => c.bold(rule.name) },
+                    { header: 'MODE', get: (rule) => modeColor(rule.mode) },
+                    { header: 'ENABLED', get: (rule) => (rule.enabled ? c.green('on') : c.dim('off')) },
+                    { header: 'SCOPE', get: (rule) => (rule.project_id ? c.dim(truncate(rule.project_id, 12)) : 'org') },
+                    { header: 'ID', get: (rule) => c.dim(rule.id) },
+                ];
+                console.log(table(r.rules, cols));
+            });
+            return;
+        }
+        case 'export': {
+            const { rules } = await api.listEdgeRules(opts);
+            const doc = toDoc(rules);
+            const json = JSON.stringify(doc, null, 2) + '\n';
+            const file = flags.named['file'] ?? flags.named['f'];
+            if (file) {
+                writeFileSync(file, json, 'utf8');
+                ok(`Exported ${rules.length} rule${rules.length === 1 ? '' : 's'} → ${c.bold(file)}`);
+            }
+            else {
+                output.write(json);
+            }
+            return;
+        }
+        case 'apply': {
+            const file = flags.named['file'] ?? flags.named['f'];
+            if (!file)
+                throw new Error('usage: tilldev shield rules apply -f <file> [--dry-run] [--prune]');
+            const desired = parseDoc(readFileSync(file, 'utf8'));
+            const { rules: existing } = await api.listEdgeRules(opts);
+            const prune = flags.bool.has('prune');
+            const plan = planApply(existing, desired, { prune });
+            const changes = plan.create.length + plan.update.length + plan.del.length;
+            if (flags.bool.has('json')) {
+                printJson({
+                    create: plan.create.map((r) => r.name),
+                    update: plan.update.map((u) => u.name),
+                    delete: plan.del.map((d) => d.name),
+                    unchanged: plan.unchanged.length,
+                    dry_run: flags.bool.has('dry-run'),
+                });
+            }
+            else {
+                printRulePlan(plan, prune);
+            }
+            if (changes === 0) {
+                if (!flags.bool.has('json'))
+                    ok('Already in sync — nothing to apply.');
+                return;
+            }
+            if (flags.bool.has('dry-run')) {
+                if (!flags.bool.has('json'))
+                    info(`Dry run — ${changes} change${changes === 1 ? '' : 's'} not applied.`);
+                return;
+            }
+            for (const r of plan.create) {
+                await api.createEdgeRule(opts, toApiBody(r));
+                if (!flags.bool.has('json'))
+                    ok(`${c.green('+')} created ${c.bold(r.name)}`);
+            }
+            for (const u of plan.update) {
+                await api.updateEdgeRule(opts, u.id, toApiBody(u.to));
+                if (!flags.bool.has('json'))
+                    ok(`${c.yellow('~')} updated ${c.bold(u.name)}`);
+            }
+            for (const d of plan.del) {
+                await api.deleteEdgeRule(opts, d.id);
+                if (!flags.bool.has('json'))
+                    ok(`${c.red('-')} deleted ${c.bold(d.name)}`);
+            }
+            if (!flags.bool.has('json'))
+                ok(`Applied — ${plan.create.length} created, ${plan.update.length} updated, ${plan.del.length} deleted.`);
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const id = need(flags.positional[3], 'tilldev shield rules rm <id>');
+            await api.deleteEdgeRule(opts, id);
+            ok(`Deleted rule ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev shield rules ${action}`);
+    }
+}
+function printRulePlan(plan, prune) {
+    const line = (sym, name) => console.log(`  ${sym} ${name}`);
+    for (const r of plan.create)
+        line(c.green('+ create'), c.bold(r.name));
+    for (const u of plan.update)
+        line(c.yellow('~ update'), c.bold(u.name));
+    for (const d of plan.del)
+        line(c.red('- delete'), c.bold(d.name));
+    if (plan.unchanged.length)
+        console.log(c.dim(`  = ${plan.unchanged.length} unchanged`));
+    const summary = `plan: ${plan.create.length} to create, ${plan.update.length} to update, ${plan.del.length} to delete`;
+    console.log(c.dim(prune ? summary : `${summary} (server-only rules kept — pass --prune to delete them)`));
+}
+async function cmdShieldEdgeKeys(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listEdgeKeys(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (k) => c.bold(k.name) },
+                    { header: 'PREFIX', get: (k) => k.key_prefix },
+                    { header: 'PROJECT', get: (k) => c.dim(truncate(k.project_id, 12)) },
+                    { header: 'LAST USED', get: (k) => ago(k.last_used_at, now) },
+                    { header: 'STATUS', get: (k) => (k.revoked_at ? c.red('revoked') : c.green('active')) },
+                    { header: 'ID', get: (k) => c.dim(k.id) },
+                ];
+                console.log(table(r.keys, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const projectId = need(flags.named['project'] ?? flags.positional[3], 'tilldev shield edge-keys create --project <id> [--name <n>]');
+            const name = flags.named['name'] ?? 'default';
+            const { key } = await api.createEdgeKey(opts, projectId, name);
+            render(flags, { key }, () => {
+                ok(`Created edge key ${c.bold(key.name)}`);
+                console.log(kv([['id', key.id], ['prefix', key.key_prefix], ['secret', c.yellow(key.secret ?? '-')]]));
+                info('Copy the secret now — it will not be shown again.');
+            });
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev shield edge-keys revoke <id>');
+            await api.revokeEdgeKey(opts, id);
+            ok(`Revoked edge key ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev shield edge-keys ${action}`);
+    }
+}
+// ── TillGate ──────────────────────────────────────────────────────────────────
+async function cmdGate(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1];
+    if (sub !== undefined && sub !== 'sites')
+        throw new Error('usage: tilldev gate sites <ls|create|update|rm>');
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listGateSites(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (s) => c.bold(s.name) },
+                    { header: 'SITE KEY', get: (s) => c.dim(s.site_key) },
+                    { header: 'MODE', get: (s) => s.mode },
+                    { header: 'DIFF', get: (s) => String(s.difficulty) },
+                    { header: 'TTL', get: (s) => `${s.token_ttl_seconds}s` },
+                    { header: 'HOSTS', get: (s) => (s.hostname_allowlist.length ? String(s.hostname_allowlist.length) : c.dim('any')) },
+                    { header: 'ID', get: (s) => c.dim(s.id) },
+                ];
+                console.log(table(r.sites, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const projectId = need(flags.named['project'] ?? flags.positional[3], 'tilldev gate sites create --project <id>');
+            const body = { project_id: projectId };
+            if (flags.named['name'])
+                body.name = flags.named['name'];
+            if (flags.named['mode'])
+                body.mode = flags.named['mode'];
+            if (flags.named['difficulty'])
+                body.difficulty = Number(flags.named['difficulty']);
+            if (flags.named['ttl'])
+                body.token_ttl_seconds = Number(flags.named['ttl']);
+            if (flags.named['hosts'])
+                body.hostname_allowlist = flags.named['hosts'].split(',').map((h) => h.trim()).filter(Boolean);
+            const { site } = await api.createGateSite(opts, body);
+            render(flags, { site }, () => {
+                ok(`Created TillGate site ${c.bold(site.name)}`);
+                console.log(kv([
+                    ['id', site.id],
+                    ['site key', site.site_key],
+                    ['secret', c.yellow(site.secret ?? '-')],
+                    ['mode', site.mode],
+                    ['difficulty', String(site.difficulty)],
+                ]));
+                info('The site key is public (embed it client-side); copy the secret now — it will not be shown again.');
+            });
+            return;
+        }
+        case 'update': {
+            const id = need(flags.positional[3], 'tilldev gate sites update <id> [flags]');
+            const body = {};
+            if (flags.named['name'])
+                body.name = flags.named['name'];
+            if (flags.named['mode'])
+                body.mode = flags.named['mode'];
+            if (flags.named['difficulty'])
+                body.difficulty = Number(flags.named['difficulty']);
+            if (flags.named['ttl'])
+                body.token_ttl_seconds = Number(flags.named['ttl']);
+            if (flags.named['hosts'])
+                body.hostname_allowlist = flags.named['hosts'].split(',').map((h) => h.trim()).filter(Boolean);
+            if (Object.keys(body).length === 0)
+                throw new Error('nothing to update — pass --name/--mode/--difficulty/--ttl/--hosts');
+            const { site } = await api.updateGateSite(opts, id, body);
+            render(flags, { site }, () => ok(`Updated site ${c.bold(site.name)}`));
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const id = need(flags.positional[3], 'tilldev gate sites rm <id>');
+            await api.deleteGateSite(opts, id);
+            ok(`Deleted site ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev gate sites ${action}`);
+    }
+}
+// ── Small color helpers for status/level cells ───────────────────────────────
+function boolCell(v) {
+    return v ? c.green('on') : c.dim('off');
+}
+function modeColor(mode) {
+    switch (mode) {
+        case 'block':
+            return c.red('block');
+        case 'challenge':
+            return c.yellow('challenge');
+        case 'log':
+            return c.blue('log');
+        default:
+            return mode ?? '-';
+    }
+}
+function levelColor(level) {
+    switch ((level ?? '').toLowerCase()) {
+        case 'critical':
+        case 'fatal':
+            return c.red(level);
+        case 'high':
+        case 'error':
+            return c.red(level);
+        case 'medium':
+        case 'warning':
+            return c.yellow(level);
+        case 'low':
+        case 'info':
+            return c.blue(level);
+        default:
+            return level ?? '-';
+    }
+}
+function roleColor(role) {
+    switch ((role ?? '').toLowerCase()) {
+        case 'owner':
+            return c.magenta('owner');
+        case 'admin':
+            return c.cyan('admin');
+        default:
+            return role ?? '-';
+    }
+}
+// ── TillCache ──────────────────────────────────────────────────────────────────
+async function cmdCache(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1] ?? 'ns';
+    switch (sub) {
+        case 'ns':
+        case 'namespaces':
+            return cmdCacheNs(flags, opts);
+        case 'tokens':
+        case 'token':
+            return cmdCacheTokens(flags, opts);
+        case 'queues': {
+            const nsId = need(flags.named['ns'] ?? flags.positional[2], 'tilldev cache queues --ns <id>');
+            const r = await api.listCacheQueues(opts, nsId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'QUEUE', get: (q) => c.bold(q.name) },
+                    { header: 'DEPTH', get: (q) => String(q.depth) },
+                    { header: 'IN-FLIGHT', get: (q) => String(q.in_flight) },
+                    { header: 'DLQ', get: (q) => (q.dead_lettered ? c.red(String(q.dead_lettered)) : c.dim('0')) },
+                    { header: 'DELIVERED', get: (q) => String(q.delivered_total) },
+                ];
+                console.log(table(r.queues, cols));
+            });
+            return;
+        }
+        case 'keys': {
+            const nsId = need(flags.named['ns'] ?? flags.positional[2], 'tilldev cache keys --ns <id>');
+            const r = await api.listCacheKeys(opts, nsId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'KEY', get: (k) => c.bold(truncate(k.key, 40)) },
+                    { header: 'KIND', get: (k) => k.kind },
+                    { header: 'HITS', get: (k) => String(k.hits) },
+                    { header: 'BYTES', get: (k) => String(k.bytes) },
+                    { header: 'HOT', get: (k) => (k.hot ? c.yellow('hot') : c.dim('-')) },
+                ];
+                console.log(table(r.keys, cols));
+            });
+            return;
+        }
+        case 'usage': {
+            const nsId = need(flags.named['ns'] ?? flags.positional[2], 'tilldev cache usage --ns <id>');
+            const r = await api.getCacheUsage(opts, nsId);
+            render(flags, r, () => {
+                ok('Usage (last 7 days)');
+                console.log(kv([
+                    ['commands', String(r.totals.commands)],
+                    ['queue messages', String(r.totals.queue_messages)],
+                    ['publishes', String(r.totals.publishes)],
+                    ['peak storage (bytes)', String(r.totals.storage_bytes)],
+                ]));
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev cache <ns|tokens|queues|keys|usage>');
+    }
+}
+async function cmdCacheNs(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listNamespaces(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (n) => c.bold(n.name) },
+                    { header: 'SLUG', get: (n) => n.slug },
+                    { header: 'BACKEND', get: (n) => n.backend },
+                    { header: 'CONSIST', get: (n) => n.consistency },
+                    { header: 'STATUS', get: (n) => (n.status === 'active' ? c.green(n.status) : c.yellow(n.status)) },
+                    { header: 'ID', get: (n) => c.dim(n.id) },
+                ];
+                console.log(table(r.namespaces, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const name = need(flags.named['name'] ?? flags.positional[3], 'tilldev cache ns create --name <n> --slug <s> [--backend upstash|durable|byo|auto]');
+            const slug = need(flags.named['slug'], 'tilldev cache ns create --name <n> --slug <s>');
+            const backend = flags.named['backend'] ?? 'upstash';
+            const input = { name, slug, backend };
+            if (flags.named['consistency'])
+                input.consistency = flags.named['consistency'];
+            if (flags.named['region'])
+                input.region = flags.named['region'];
+            if (backend === 'byo') {
+                const url = need(flags.named['byo-url'], 'backend byo requires --byo-url <https url>');
+                const token = await readSecretArg(flags, 'byo-token', 'BYO backend token');
+                input.byo = { url, token };
+            }
+            const { namespace } = await api.createNamespace(opts, input);
+            render(flags, { namespace }, () => {
+                ok(`Created namespace ${c.bold(namespace.name)} (${namespace.slug})`);
+                console.log(kv([['id', namespace.id], ['backend', namespace.backend], ['consistency', namespace.consistency]]));
+                info('Mint a data-plane token: tilldev cache tokens create --ns ' + namespace.id);
+            });
+            return;
+        }
+        case 'get': {
+            const id = need(flags.positional[3], 'tilldev cache ns get <id>');
+            const r = await api.getNamespace(opts, id);
+            render(flags, r, () => console.log(kv(Object.entries(r.namespace).map(([k, v]) => [k, String(v)]))));
+            return;
+        }
+        case 'pause':
+        case 'resume': {
+            const id = need(flags.positional[3], `tilldev cache ns ${action} <id>`);
+            const { namespace } = await api.updateNamespace(opts, id, { status: action === 'pause' ? 'paused' : 'active' });
+            ok(`Namespace ${c.bold(namespace.name)} is now ${namespace.status}`);
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const id = need(flags.positional[3], 'tilldev cache ns rm <id>');
+            await api.deleteNamespace(opts, id);
+            ok(`Deleted namespace ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev cache ns ${action}`);
+    }
+}
+async function cmdCacheTokens(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    const nsId = need(flags.named['ns'], 'tilldev cache tokens <ls|create|revoke> --ns <namespace-id>');
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listCacheTokens(opts, nsId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (t) => c.bold(t.name) },
+                    { header: 'PREFIX', get: (t) => t.token_prefix },
+                    { header: 'SCOPE', get: (t) => t.scope },
+                    { header: 'LAST USED', get: (t) => ago(t.last_used_at, now) },
+                    { header: 'STATUS', get: (t) => (t.revoked_at ? c.red('revoked') : c.green('active')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.tokens, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const name = flags.named['name'] ?? 'default';
+            const scope = flags.named['scope'] ?? 'rw';
+            const { token } = await api.createCacheToken(opts, nsId, name, scope);
+            render(flags, { token }, () => {
+                ok(`Created ${scope} token ${c.bold(token.name)}`);
+                console.log(kv([['id', token.id], ['prefix', token.token_prefix], ['secret', c.yellow(token.secret ?? '-')]]));
+                info('Copy the secret now — it will not be shown again.');
+            });
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev cache tokens revoke <token-id> --ns <namespace-id>');
+            await api.revokeCacheToken(opts, nsId, id);
+            ok(`Revoked token ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev cache tokens ${action}`);
+    }
+}
+// ── TillSecrets ────────────────────────────────────────────────────────────────
+async function cmdSecrets(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1] ?? 'ls';
+    switch (sub) {
+        case 'projects':
+        case 'project': {
+            const action = flags.positional[2] ?? 'ls';
+            if (action === 'create') {
+                const name = need(flags.named['name'] ?? flags.positional[3], 'tilldev secrets projects create --name <n> --slug <s>');
+                const slug = need(flags.named['slug'], 'tilldev secrets projects create --name <n> --slug <s>');
+                const { project } = await api.createSecretsProject(opts, name, slug, flags.named['description'] ?? '');
+                render(flags, { project }, () => ok(`Created project ${c.bold(project.name)} (${project.slug}) — ${c.dim(project.id)}`));
+                return;
+            }
+            const r = await api.listSecretsProjects(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (p) => c.bold(p.name) },
+                    { header: 'SLUG', get: (p) => p.slug },
+                    { header: 'ID', get: (p) => c.dim(p.id) },
+                ];
+                console.log(table(r.projects, cols));
+            });
+            return;
+        }
+        case 'env':
+        case 'envs':
+        case 'environments': {
+            const projectId = need(flags.named['project'] ?? flags.positional[3], 'tilldev secrets env <ls|create> --project <id>');
+            const action = flags.positional[2] ?? 'ls';
+            if (action === 'create') {
+                const name = need(flags.named['name'], 'tilldev secrets env create --project <id> --name <n> --slug <s>');
+                const slug = need(flags.named['slug'], 'tilldev secrets env create --project <id> --name <n> --slug <s>');
+                const { environment } = await api.createSecretsEnvironment(opts, projectId, name, slug);
+                render(flags, { environment }, () => ok(`Created environment ${c.bold(environment.name)} — ${c.dim(environment.id)}`));
+                return;
+            }
+            const r = await api.listSecretsEnvironments(opts, projectId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (e) => c.bold(e.name) },
+                    { header: 'SLUG', get: (e) => e.slug },
+                    { header: 'ID', get: (e) => c.dim(e.id) },
+                ];
+                console.log(table(r.environments, cols));
+            });
+            return;
+        }
+        case 'ls':
+        case 'list': {
+            const envId = need(flags.named['env'], 'tilldev secrets ls --env <environment-id>');
+            const r = await api.listSecrets(opts, envId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'KEY', get: (s) => c.bold(s.key) },
+                    { header: 'KIND', get: (s) => (s.kind === 'dynamic' ? c.magenta('dynamic') : 'static') },
+                    { header: 'VER', get: (s) => `v${s.current_version}` },
+                    { header: 'ID', get: (s) => c.dim(s.id) },
+                ];
+                console.log(table(r.secrets, cols));
+            });
+            return;
+        }
+        case 'set': {
+            const envId = need(flags.named['env'], 'tilldev secrets set <KEY> --env <id> [--value <v>]');
+            const key = need(flags.positional[2], 'tilldev secrets set <KEY> --env <id>');
+            const value = await readSecretArg(flags, 'value', `value for ${key}`);
+            const { secret } = await api.setSecret(opts, envId, key, value, flags.named['comment'] ?? '');
+            render(flags, { secret }, () => ok(`Set ${c.bold(secret.key)} → v${secret.version}`));
+            return;
+        }
+        case 'get':
+        case 'reveal': {
+            const secretId = need(flags.positional[2], 'tilldev secrets get <secret-id> [--version <n>]');
+            const version = flags.named['version'] ? Number(flags.named['version']) : undefined;
+            const r = await api.revealSecret(opts, secretId, version);
+            render(flags, r, () => {
+                warn('Revealing a secret is audited.');
+                console.log(kv([['key', r.key], ['version', String(r.version)], ['value', c.yellow(r.value)]]));
+            });
+            return;
+        }
+        case 'versions': {
+            const secretId = need(flags.positional[2], 'tilldev secrets versions <secret-id>');
+            const r = await api.listSecretVersions(opts, secretId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'VER', get: (v) => (v.version === r.current_version ? c.green(`v${v.version} *`) : `v${v.version}`) },
+                    { header: 'HASH', get: (v) => c.dim(truncate(v.value_hash, 12)) },
+                    { header: 'COMMENT', get: (v) => v.comment ?? '' },
+                    { header: 'WHEN', get: (v) => ago(v.created_at, now) },
+                ];
+                console.log(table(r.versions, cols));
+            });
+            return;
+        }
+        case 'rollback': {
+            const secretId = need(flags.positional[2], 'tilldev secrets rollback <secret-id> --version <n>');
+            const version = Number(need(flags.named['version'], 'tilldev secrets rollback <secret-id> --version <n>'));
+            const r = await api.rollbackSecret(opts, secretId, version);
+            ok(`Rolled back to v${r.current_version}`);
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const secretId = need(flags.positional[2], 'tilldev secrets rm <secret-id>');
+            await api.deleteSecret(opts, secretId);
+            ok(`Deleted secret ${c.bold(secretId)}`);
+            return;
+        }
+        case 'sync': {
+            const projectId = need(flags.named['project'], 'tilldev secrets sync <ls|add|rm|pause|resume|push> --project <id>');
+            const action = flags.positional[2] ?? 'ls';
+            if (action === 'add') {
+                const environment_id = need(flags.named['env'], 'tilldev secrets sync add --project <id> --env <envId> --provider <p> --config <json>');
+                const provider = need(flags.named['provider'], 'sync add … --provider <cloudflare|vercel|railway|github|aws_ssm|dotenv|custom>');
+                const configRaw = need(flags.named['config'], "sync add … --config '{\"token\":\"…\"}'");
+                let config;
+                try {
+                    config = JSON.parse(configRaw);
+                }
+                catch {
+                    throw new Error('--config must be a valid JSON object');
+                }
+                const { target } = await api.createSyncTarget(opts, projectId, { environment_id, provider, config });
+                render(flags, { target }, () => ok(`Added ${c.bold(target.provider)} sync target — ${c.dim(target.id)}`));
+                return;
+            }
+            if (action === 'rm' || action === 'delete') {
+                const targetId = need(flags.positional[3], 'tilldev secrets sync rm <target-id> --project <id>');
+                await api.deleteSyncTarget(opts, projectId, targetId);
+                ok(`Deleted sync target ${c.bold(targetId)}`);
+                return;
+            }
+            if (action === 'pause' || action === 'resume') {
+                const targetId = need(flags.positional[3], `tilldev secrets sync ${action} <target-id> --project <id>`);
+                const status = action === 'pause' ? 'paused' : 'active';
+                await api.setSyncTargetStatus(opts, projectId, targetId, status);
+                ok(`Sync target ${c.bold(targetId)} → ${status}`);
+                return;
+            }
+            if (action === 'push') {
+                const targetId = need(flags.positional[3], 'tilldev secrets sync push <target-id> --project <id>');
+                await api.pushSyncTarget(opts, projectId, targetId);
+                ok(`Pushed sync target ${c.bold(targetId)}`);
+                return;
+            }
+            const r = await api.listSyncTargets(opts, projectId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'PROVIDER', get: (t) => c.bold(t.provider) },
+                    { header: 'ENV', get: (t) => c.dim(t.environment_id) },
+                    {
+                        header: 'STATUS',
+                        get: (t) => (t.status === 'error' ? c.red(t.status) : t.status === 'paused' ? c.yellow(t.status) : c.green(t.status)),
+                    },
+                    { header: 'LAST SYNC', get: (t) => (t.last_synced_at ? ago(t.last_synced_at, now) : c.dim('never')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.targets, cols));
+                for (const t of r.targets)
+                    if (t.last_error)
+                        warn(`${t.provider} (${t.id.slice(0, 8)}): ${t.last_error}`);
+            });
+            return;
+        }
+        case 'tokens':
+        case 'token': {
+            const projectId = need(flags.named['project'], 'tilldev secrets tokens <ls|create|revoke> --project <id>');
+            const action = flags.positional[2] ?? 'ls';
+            if (action === 'create') {
+                const body = {
+                    name: flags.named['name'] ?? 'default',
+                    scope: flags.named['scope'] ?? 'read',
+                };
+                if (flags.named['env'])
+                    body.environment_id = flags.named['env'];
+                const { token } = await api.createSecretsToken(opts, projectId, body);
+                render(flags, { token }, () => {
+                    ok(`Created ${token.scope} token ${c.bold(token.name)}`);
+                    console.log(kv([['id', token.id], ['prefix', token.token_prefix], ['secret', c.yellow(token.secret ?? '-')]]));
+                    info('Copy the secret now — it will not be shown again.');
+                });
+                return;
+            }
+            if (action === 'revoke' || action === 'rm') {
+                const id = need(flags.positional[3], 'tilldev secrets tokens revoke <token-id> --project <id>');
+                await api.revokeSecretsToken(opts, projectId, id);
+                ok(`Revoked token ${c.bold(id)}`);
+                return;
+            }
+            const r = await api.listSecretsTokens(opts, projectId);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (t) => c.bold(t.name) },
+                    { header: 'PREFIX', get: (t) => t.token_prefix },
+                    { header: 'SCOPE', get: (t) => t.scope },
+                    { header: 'LAST USED', get: (t) => ago(t.last_used_at, now) },
+                    { header: 'STATUS', get: (t) => (t.revoked_at ? c.red('revoked') : c.green('active')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.tokens, cols));
+            });
+            return;
+        }
+        case 'pull': {
+            // Boot-time bulk pull. Uses a `ts_…` service token (NOT the dashboard
+            // session token). Default output is dotenv on stdout (redirect to .env);
+            // --json prints the raw key→value map plus the dynamic-key list.
+            const svcToken = flags.named['token'] ?? process.env['TILLSECRETS_TOKEN'] ?? opts.token;
+            if (!svcToken)
+                throw new Error('secrets pull needs a ts_ service token — pass --token ts_… or set TILLSECRETS_TOKEN');
+            assertSafeApiUrl(opts.apiUrl);
+            const pullOpts = { apiUrl: opts.apiUrl, token: svcToken };
+            const r = await api.pullSecrets(pullOpts, flags.named['env']);
+            if (flags.bool.has('json')) {
+                printJson(r);
+                return;
+            }
+            const keys = Object.keys(r.secrets).sort();
+            for (const k of keys)
+                output.write(`${k}=${dotenvQuote(r.secrets[k] ?? '')}\n`);
+            for (const d of r.dynamic)
+                output.write(`# dynamic: ${d} — lease with \`tilldev secrets lease ${d}\`\n`);
+            if (keys.length === 0 && r.dynamic.length === 0)
+                output.write('# (no secrets in this environment)\n');
+            return;
+        }
+        case 'lease': {
+            // Dynamic-secret leasing hits the SEPARATE lease service (default
+            // secrets.tilldev.dev), not the dashboard host. Needs a read_write ts_ token.
+            const action = flags.positional[2];
+            const svcToken = flags.named['token'] ?? process.env['TILLSECRETS_TOKEN'] ?? opts.token;
+            if (!svcToken)
+                throw new Error('secrets lease needs a read_write ts_ service token — pass --token ts_… or set TILLSECRETS_TOKEN');
+            const leaseBase = (flags.named['lease-url'] ?? process.env['TILLSECRETS_LEASE_URL'] ?? 'https://secrets.tilldev.dev').replace(/\/$/, '');
+            assertSafeApiUrl(leaseBase);
+            const leaseOpts = { apiUrl: leaseBase, token: svcToken };
+            if (action === 'revoke') {
+                const id = need(flags.positional[3], 'tilldev secrets lease revoke <lease-id>');
+                const r = await api.revokeLease(leaseOpts, id);
+                render(flags, r, () => ok(r.already ? `Lease ${c.bold(id)} already ${r.already}` : `Revoked lease ${c.bold(id)}`));
+                return;
+            }
+            // `secrets lease <secret-key>` or `secrets lease --backend <id>`.
+            const positionalKey = action && action !== 'issue' ? action : undefined;
+            const secretKey = flags.named['key'] ?? positionalKey;
+            const backendId = flags.named['backend'];
+            if (!secretKey && !backendId) {
+                throw new Error('usage: tilldev secrets lease <secret-key> [--ttl <sec>]  (or --backend <id>)');
+            }
+            const body = {};
+            if (secretKey)
+                body.secret_key = secretKey;
+            if (backendId)
+                body.backend_id = backendId;
+            if (flags.named['ttl'])
+                body.ttl_seconds = Number(flags.named['ttl']);
+            const r = await api.leaseSecret(leaseOpts, body);
+            render(flags, r, () => {
+                ok(`Leased ${c.bold(secretKey ?? backendId ?? 'credential')}`);
+                console.log(kv([['lease id', r.lease_id], ['expires', r.expires_at], ['ttl', `${r.ttl_seconds}s`]]));
+                for (const [k, v] of Object.entries(r.credential))
+                    console.log(kv([[k, c.yellow(v)]]));
+                info(`Credential shown once. Revoke early: \`tilldev secrets lease revoke ${r.lease_id}\``);
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev secrets <projects|env|ls|set|get|versions|rollback|rm|pull|lease|sync|tokens>');
+    }
+}
+// ── TillArk ────────────────────────────────────────────────────────────────────
+// Backup / disaster-recovery control plane. Dangerous verbs (real restore,
+// failover promote/failback) demand a four-eyes approval: a DIFFERENT owner/
+// admin's user id (--approved-by) plus a reference (--approval-ref, e.g. a
+// change ticket). The server re-verifies the approver — it is never trusted here.
+function arkApproval(flags) {
+    const approved_by = need(flags.named['approved-by'], 'this action needs --approved-by <second approver user id> --approval-ref <ref>');
+    const approval_ref = need(flags.named['approval-ref'], 'this action needs --approval-ref <change ticket / incident id>');
+    return { approved_by, approval_ref };
+}
+const ARK_DEFAULT_RETENTION = {
+    keepLast: 7, keepHourly: 24, keepDaily: 7, keepWeekly: 4, keepMonthly: 12, keepYearly: 3,
+};
+function arkRetentionFromFlags(flags) {
+    const keys = [
+        ['keep-last', 'keepLast'], ['keep-hourly', 'keepHourly'], ['keep-daily', 'keepDaily'],
+        ['keep-weekly', 'keepWeekly'], ['keep-monthly', 'keepMonthly'], ['keep-yearly', 'keepYearly'],
+    ];
+    if (!keys.some(([flag]) => flags.named[flag] !== undefined))
+        return undefined;
+    const r = { ...ARK_DEFAULT_RETENTION };
+    for (const [flag, field] of keys) {
+        if (flags.named[flag] !== undefined)
+            r[field] = Number(flags.named[flag]);
+    }
+    return r;
+}
+function arkState(state) {
+    switch (state) {
+        case 'healthy':
+            return c.green(state);
+        case 'promoted':
+        case 'failback':
+            return c.cyan(state);
+        case 'failed':
+            return c.red(state);
+        case 'suspect':
+        case 'fencing':
+        case 'reverse_sync':
+            return c.yellow(state);
+        default:
+            return state;
+    }
+}
+function arkHealth(h) {
+    switch (h) {
+        case 'healthy':
+            return c.green(h);
+        case 'lagging':
+            return c.yellow(h);
+        case 'down':
+            return c.red(h);
+        default:
+            return c.dim(h);
+    }
+}
+async function cmdArk(flags) {
+    const { opts } = resolveOpts(flags);
+    const sub = flags.positional[1] ?? 'sources';
+    switch (sub) {
+        case 'sources':
+        case 'source':
+            return cmdArkSources(flags, opts);
+        case 'targets':
+        case 'target':
+            return cmdArkTargets(flags, opts);
+        case 'policies':
+        case 'policy':
+            return cmdArkPolicies(flags, opts);
+        case 'backups':
+        case 'backup':
+            return cmdArkBackups(flags, opts);
+        case 'restores':
+            return cmdArkRestoresList(flags, opts);
+        case 'verify': {
+            const backupId = need(flags.positional[2], 'tilldev ark verify <backup-id>');
+            const { restore } = await api.startArkRestore(opts, { backup_id: backupId, kind: 'verification' });
+            render(flags, { restore }, () => ok(`Queued verification restore ${c.bold(restore.id)} (${restore.status})`));
+            return;
+        }
+        case 'restore': {
+            // Real, destructive restore INTO a registered source — four-eyes gated.
+            const backupId = need(flags.positional[2], 'tilldev ark restore <backup-id> --into <source-id> --approved-by <uid> --approval-ref <ref>');
+            const into = need(flags.named['into'], 'a real restore needs --into <destination source id>');
+            const { restore } = await api.startArkRestore(opts, {
+                backup_id: backupId,
+                kind: 'real',
+                target_source_id: into,
+                ...arkApproval(flags),
+            });
+            render(flags, { restore }, () => {
+                ok(`Authorized real restore ${c.bold(restore.id)} → source ${c.dim(into)} (${restore.status})`);
+                info('The agent verifies the manifest signature before trusting a single byte.');
+            });
+            return;
+        }
+        case 'failover':
+            return cmdArkFailover(flags, opts);
+        case 'canary':
+            return cmdArkCanary(flags, opts);
+        case 'clone':
+        case 'clones':
+            return cmdArkClones(flags, opts);
+        case 'replicas': {
+            const r = await api.listArkReplicas(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'ROLE', get: (x) => (x.role === 'primary' ? c.magenta('primary') : 'replica') },
+                    { header: 'PROVIDER', get: (x) => x.provider },
+                    { header: 'REGION', get: (x) => x.region || c.dim('-') },
+                    { header: 'MODE', get: (x) => x.mode },
+                    { header: 'LAG(s)', get: (x) => String(x.lag_sec) },
+                    { header: 'HEALTH', get: (x) => arkHealth(x.health) },
+                    { header: 'ID', get: (x) => c.dim(x.id) },
+                ];
+                console.log(table(r.replicas, cols));
+            });
+            return;
+        }
+        case 'tokens':
+        case 'token':
+            return cmdArkTokens(flags, opts);
+        case 'audit': {
+            const r = await api.listArkAudit(opts, flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'WHEN', get: (a) => ago(a.created_at, now) },
+                    { header: 'ACTOR', get: (a) => `${a.actor_type}${a.actor_id ? c.dim(':' + truncate(a.actor_id, 8)) : ''}` },
+                    { header: 'ACTION', get: (a) => c.bold(a.action) },
+                    { header: 'CONTEXT', get: (a) => c.dim(truncate(JSON.stringify(a.metadata ?? {}), 40)) },
+                ];
+                console.log(table(r.audit, cols));
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev ark <sources|targets|policies|backups|restore|verify|restores|failover|replicas|canary|clone|tokens|audit>');
+    }
+}
+// ── Ransomware canary (§20) ───────────────────────────────────────────────────
+function canaryVerdict(v) {
+    return v === 'alarm' ? c.red(c.bold(v)) : c.yellow(v);
+}
+async function cmdArkCanary(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkCanary(opts);
+            render(flags, r, () => {
+                if (r.events.length === 0) {
+                    ok('No canary events — entropy nominal across all sources.');
+                    return;
+                }
+                const cols = [
+                    { header: 'WHEN', get: (e) => ago(e.created_at ?? '', now) },
+                    { header: 'VERDICT', get: (e) => canaryVerdict(e.verdict) },
+                    { header: 'SEV', get: (e) => e.severity },
+                    { header: 'ENTROPY', get: (e) => `${e.entropy_bpb.toFixed(2)}${c.dim(' / ' + e.baseline_entropy_bpb.toFixed(2))}` },
+                    { header: 'DEDUP', get: (e) => `×${e.dedup_ratio.toFixed(1)}${c.dim(' / ×' + e.baseline_dedup_ratio.toFixed(1))}` },
+                    { header: 'STATUS', get: (e) => (e.status === 'open' ? c.yellow(e.status) : c.dim(e.status)) },
+                    { header: 'ID', get: (e) => c.dim(e.id) },
+                ];
+                console.log(table(r.events, cols));
+            });
+            return;
+        }
+        case 'ack':
+        case 'confirm':
+        case 'dismiss': {
+            const id = need(flags.positional[3], `tilldev ark canary ${action} <event-id>`);
+            const status = action === 'ack' ? 'acknowledged' : action === 'confirm' ? 'confirmed' : 'dismissed';
+            await api.ackArkCanary(opts, id, status);
+            render(flags, { ok: true }, () => ok(`Canary event ${c.bold(id)} → ${status}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev ark canary <ls|ack|confirm|dismiss> [event-id]');
+    }
+}
+// ── PII-scrubbed instant clones (§21) ─────────────────────────────────────────
+function cloneStatus(s) {
+    if (s === 'ready')
+        return c.green(s);
+    if (s === 'failed')
+        return c.red(s);
+    if (s === 'expired')
+        return c.dim(s);
+    return c.yellow(s);
+}
+async function cmdArkClones(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkClones(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (x) => c.bold(x.name) },
+                    { header: 'PROFILE', get: (x) => (x.masking_profile === 'none' ? c.red('raw pii') : x.masking_profile) },
+                    { header: 'STATUS', get: (x) => cloneStatus(x.status) },
+                    { header: 'MASKED', get: (x) => (x.masking_profile === 'none' ? c.dim('—') : `${x.columns_masked} cols`) },
+                    { header: 'EXPIRES', get: (x) => (x.expires_at ? ago(x.expires_at, now).replace(' ago', '') : c.dim('—')) },
+                    { header: 'ID', get: (x) => c.dim(x.id) },
+                ];
+                console.log(table(r.clones, cols));
+            });
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const backupId = need(flags.positional[3] ?? flags.named['backup'], 'tilldev ark clone create <backup-id> [--profile standard|strict|none] [--ttl <minutes>] [--name <n>]');
+            const profileRaw = flags.named['profile'] ?? 'standard';
+            if (profileRaw !== 'standard' && profileRaw !== 'strict' && profileRaw !== 'none') {
+                throw new Error("--profile must be one of: standard, strict, none");
+            }
+            const body = { backup_id: backupId, masking_profile: profileRaw };
+            if (flags.named['name'])
+                body.name = flags.named['name'];
+            if (flags.named['ttl'])
+                body.ttl_minutes = Number(flags.named['ttl']);
+            // A raw (unmasked) clone is four-eyes-gated, like a real restore.
+            if (profileRaw === 'none')
+                Object.assign(body, arkApproval(flags));
+            const { clone } = await api.createArkClone(opts, body);
+            render(flags, { clone }, () => {
+                ok(`Queued clone ${c.bold(clone.name)} (${clone.status}) — profile ${clone.masking_profile}`);
+                if (clone.masking_profile === 'none')
+                    info('Raw clone — this contains REAL customer PII. Treat as production data.');
+                else
+                    info('The agent restores to a scratch target and masks every PII column before it goes ready.');
+            });
+            return;
+        }
+        case 'expire':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev ark clone expire <clone-id>');
+            await api.expireArkClone(opts, id);
+            render(flags, { ok: true }, () => ok(`Clone ${c.bold(id)} torn down.`));
+            return;
+        }
+        case 'show': {
+            const id = need(flags.positional[3], 'tilldev ark clone show <clone-id>');
+            const r = await api.listArkClones(opts);
+            const clone = r.clones.find((x) => x.id === id);
+            if (!clone)
+                throw new Error(`Clone ${id} not found.`);
+            render(flags, { clone }, () => {
+                ok(`${c.bold(clone.name)} · ${cloneStatus(clone.status)} · profile ${clone.masking_profile}`);
+                if (clone.mask_plan.length === 0) {
+                    info(clone.masking_profile === 'none' ? 'Raw clone — no masking applied.' : 'Masking plan not yet computed.');
+                }
+                else {
+                    console.log(c.dim('  proof of masking:'));
+                    for (const m of clone.mask_plan) {
+                        console.log(`    ${m.table}.${c.bold(m.column)} ${c.dim('·')} ${m.pii} ${c.dim('→')} ${m.transform}`);
+                    }
+                }
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev ark clone <ls|create|show|expire> [args]');
+    }
+}
+async function cmdArkSources(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkSources(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (s) => c.bold(s.name) },
+                    { header: 'TYPE', get: (s) => s.type },
+                    { header: 'PROVIDER', get: (s) => s.provider },
+                    { header: 'RESIDENCY', get: (s) => s.residency_zone },
+                    { header: 'DSN', get: (s) => (s.has_dsn ? c.green('set') : c.dim('none')) },
+                    { header: 'STATUS', get: (s) => (s.status === 'active' ? c.green(s.status) : c.yellow(s.status)) },
+                    { header: 'ID', get: (s) => c.dim(s.id) },
+                ];
+                console.log(table(r.sources, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const name = need(flags.named['name'] ?? flags.positional[3], 'tilldev ark sources create --name <n> --type <t> --provider <p>');
+            const type = need(flags.named['type'], 'tilldev ark sources create --type <postgres|mysql|mongo|clickhouse|meili|redis|object>');
+            const provider = need(flags.named['provider'], '--provider required (neon|rds|supabase|self|s3|r2|…)');
+            const body = { name, type, provider };
+            if (flags.named['region'])
+                body.region = flags.named['region'];
+            if (flags.named['residency'])
+                body.residency_zone = flags.named['residency'];
+            if (flags.bool.has('unmanaged'))
+                body.managed = false;
+            // The DSN is a secret — accept it via prompt/stdin, not bare on argv.
+            if (flags.named['dsn'] !== undefined || flags.bool.has('dsn-stdin') || flags.bool.has('with-dsn')) {
+                body.dsn = await readSecretArg(flags, 'dsn', `${type} connection string`);
+            }
+            const { source } = await api.createArkSource(opts, body);
+            render(flags, { source }, () => {
+                ok(`Registered source ${c.bold(source.name)} (${source.type})`);
+                console.log(kv([['id', source.id], ['provider', source.provider], ['dsn', source.has_dsn ? c.green('encrypted') : c.dim('not set')]]));
+            });
+            return;
+        }
+        case 'get': {
+            const id = need(flags.positional[3], 'tilldev ark sources get <id>');
+            const r = await api.getArkSource(opts, id);
+            render(flags, r, () => console.log(kv(Object.entries(r.source).map(([k, v]) => [k, String(v)]))));
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const id = need(flags.positional[3], 'tilldev ark sources rm <id>');
+            await api.deleteArkSource(opts, id);
+            ok(`Deleted source ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark sources ${action}`);
+    }
+}
+async function cmdArkTargets(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkTargets(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (t) => c.bold(t.name) },
+                    { header: 'PROVIDER', get: (t) => t.provider },
+                    { header: 'BUCKET', get: (t) => t.bucket || c.dim('-') },
+                    { header: 'RESIDENCY', get: (t) => t.residency_zone },
+                    { header: 'WORM', get: (t) => (t.immutable ? c.green(`lock ${t.object_lock_days}d`) : c.yellow('off')) },
+                    { header: 'CREDS', get: (t) => (t.has_creds ? c.green('set') : c.dim('none')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.targets, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const name = need(flags.named['name'] ?? flags.positional[3], 'tilldev ark targets create --name <n> --provider <p>');
+            const provider = need(flags.named['provider'], 'tilldev ark targets create --provider <s3|r2|b2|wasabi|gcs|azure|minio|sftp>');
+            const body = { name, provider };
+            if (flags.named['bucket'])
+                body.bucket = flags.named['bucket'];
+            if (flags.named['region'])
+                body.region = flags.named['region'];
+            if (flags.named['residency'])
+                body.residency_zone = flags.named['residency'];
+            if (flags.named['endpoint'])
+                body.endpoint = flags.named['endpoint'];
+            if (flags.named['credential-domain'])
+                body.credential_domain = flags.named['credential-domain'];
+            if (flags.bool.has('mutable'))
+                body.immutable = false;
+            if (flags.named['lock-days'])
+                body.object_lock_days = Number(flags.named['lock-days']);
+            // Provider creds (a JSON object) are secret — take via prompt/stdin.
+            if (flags.named['creds-json'] !== undefined || flags.bool.has('creds-json-stdin') || flags.bool.has('with-creds')) {
+                const raw = await readSecretArg(flags, 'creds-json', 'target credentials JSON');
+                let creds;
+                try {
+                    creds = JSON.parse(raw);
+                }
+                catch {
+                    throw new Error('--creds-json must be a JSON object, e.g. \'{"access_key_id":"…","secret_access_key":"…"}\'');
+                }
+                body.creds = creds;
+            }
+            const { target } = await api.createArkTarget(opts, body);
+            render(flags, { target }, () => {
+                ok(`Registered target ${c.bold(target.name)} (${target.provider})`);
+                console.log(kv([['id', target.id], ['immutable', String(target.immutable)], ['creds', target.has_creds ? c.green('encrypted') : c.dim('not set')]]));
+            });
+            return;
+        }
+        case 'get': {
+            const id = need(flags.positional[3], 'tilldev ark targets get <id>');
+            const r = await api.getArkTarget(opts, id);
+            render(flags, r, () => console.log(kv(Object.entries(r.target).map(([k, v]) => [k, String(v)]))));
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const id = need(flags.positional[3], 'tilldev ark targets rm <id>');
+            await api.deleteArkTarget(opts, id);
+            ok(`Deleted target ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark targets ${action}`);
+    }
+}
+async function cmdArkPolicies(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkPolicies(opts, flags.named['source']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (p) => c.bold(p.name) },
+                    { header: 'CRON', get: (p) => p.schedule_cron },
+                    { header: 'RPO(s)', get: (p) => String(p.rpo_slo_sec) },
+                    { header: 'RTO(s)', get: (p) => String(p.rto_slo_sec) },
+                    { header: 'ENABLED', get: (p) => (p.enabled ? c.green('yes') : c.dim('no')) },
+                    { header: 'SOURCE', get: (p) => c.dim(truncate(p.source_id, 12)) },
+                    { header: 'ID', get: (p) => c.dim(p.id) },
+                ];
+                console.log(table(r.policies, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const sourceId = need(flags.named['source'] ?? flags.positional[3], 'tilldev ark policies create --source <id> [flags]');
+            const body = { source_id: sourceId };
+            if (flags.named['name'])
+                body.name = flags.named['name'];
+            if (flags.named['cron'])
+                body.schedule_cron = flags.named['cron'];
+            if (flags.named['rpo'])
+                body.rpo_slo_sec = Number(flags.named['rpo']);
+            if (flags.named['rto'])
+                body.rto_slo_sec = Number(flags.named['rto']);
+            if (flags.named['verify-cron'])
+                body.verify_cadence = flags.named['verify-cron'];
+            if (flags.bool.has('byok'))
+                body.byok = true;
+            const retention = arkRetentionFromFlags(flags);
+            if (retention)
+                body.retention = retention;
+            const { policy } = await api.createArkPolicy(opts, body);
+            render(flags, { policy }, () => {
+                ok(`Created policy ${c.bold(policy.name)} on source ${c.dim(sourceId)}`);
+                console.log(kv([['id', policy.id], ['cron', policy.schedule_cron], ['rpo', `${policy.rpo_slo_sec}s`], ['verify', policy.verify_cadence]]));
+            });
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark policies ${action}`);
+    }
+}
+async function cmdArkBackups(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkBackups(opts, flags.named['source']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'WHEN', get: (b) => ago(b.created_at, now) },
+                    { header: 'ENGINE', get: (b) => b.engine },
+                    { header: 'STATUS', get: (b) => arkBackupStatus(b.status) },
+                    { header: 'FLAGS', get: (b) => arkBackupFlags(b) },
+                    { header: 'SIZE', get: (b) => humanBytes(b.size_bytes) },
+                    { header: 'DEDUP', get: (b) => `${b.dedup_ratio.toFixed(1)}x` },
+                    { header: 'SOURCE', get: (b) => c.dim(truncate(b.source_id, 12)) },
+                    { header: 'ID', get: (b) => c.dim(b.id) },
+                ];
+                console.log(table(r.backups, cols));
+            });
+            return;
+        }
+        case 'run': {
+            const sourceId = need(flags.named['source'] ?? flags.positional[3], 'tilldev ark backups run --source <id> [--policy <id>]');
+            const { backup } = await api.runArkBackup(opts, sourceId, flags.named['policy']);
+            render(flags, { backup }, () => {
+                ok(`Queued ${c.bold(backup.engine)} backup ${c.dim(backup.id)} (${backup.status})`);
+                info('The agent claims the run and reports a signed manifest back — no bytes transit the control plane.');
+            });
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark backups ${action}`);
+    }
+}
+async function cmdArkRestoresList(flags, opts) {
+    const r = await api.listArkRestores(opts, flags.named['backup']);
+    render(flags, r, () => {
+        const cols = [
+            { header: 'WHEN', get: (x) => ago(x.created_at, now) },
+            { header: 'KIND', get: (x) => (x.kind === 'real' ? c.magenta('real') : c.blue('verify')) },
+            { header: 'STATUS', get: (x) => arkRestoreStatus(x.status) },
+            { header: 'APPROVED BY', get: (x) => (x.authorized_by ? c.dim(truncate(x.authorized_by, 10)) : c.dim('-')) },
+            { header: 'BACKUP', get: (x) => c.dim(truncate(x.backup_id, 12)) },
+            { header: 'ID', get: (x) => c.dim(x.id) },
+        ];
+        console.log(table(r.restores, cols));
+    });
+}
+async function cmdArkFailover(flags, opts) {
+    const action = flags.positional[2] ?? 'status';
+    switch (action) {
+        case 'status': {
+            const sourceId = need(flags.named['source'] ?? flags.positional[3], 'tilldev ark failover status --source <id>');
+            const r = await api.getArkFailover(opts, sourceId);
+            render(flags, r, () => {
+                if (r.failover) {
+                    console.log(kv([
+                        ['state', arkState(r.failover.state)],
+                        ['fence', r.failover.fence_status],
+                        ['trigger', r.failover.trigger],
+                        ['approved by', r.failover.approved_by ? truncate(r.failover.approved_by, 12) : c.dim('-')],
+                        ['reason', r.failover.reason ?? c.dim('-')],
+                    ]));
+                }
+                else {
+                    info('No failover events for this source — healthy.');
+                }
+                const cols = [
+                    { header: 'ROLE', get: (x) => (x.role === 'primary' ? c.magenta('primary') : 'replica') },
+                    { header: 'REGION', get: (x) => x.region || c.dim('-') },
+                    { header: 'LAG(s)', get: (x) => String(x.lag_sec) },
+                    { header: 'PROMOTABLE', get: (x) => (x.promotable ? c.green('yes') : c.dim('no')) },
+                    { header: 'HEALTH', get: (x) => arkHealth(x.health) },
+                ];
+                console.log(table(r.replicas, cols));
+            });
+            return;
+        }
+        case 'promote': {
+            const sourceId = need(flags.named['source'], 'tilldev ark failover promote --source <id> --approved-by <uid> --approval-ref <ref>');
+            const body = {
+                source_id: sourceId,
+                ...arkApproval(flags),
+            };
+            if (flags.named['to'])
+                body.to_node = flags.named['to'];
+            const r = await api.promoteArkFailover(opts, body);
+            render(flags, r, () => {
+                ok(`Failover authorized for source ${c.dim(sourceId)} — state ${arkState(r.failover.state)}`);
+                warn(r.note);
+            });
+            return;
+        }
+        case 'failback': {
+            const sourceId = need(flags.named['source'], 'tilldev ark failover failback --source <id> --approved-by <uid> --approval-ref <ref>');
+            const body = {
+                source_id: sourceId,
+                ...arkApproval(flags),
+            };
+            if (flags.named['lag'])
+                body.replica_lag_sec = Number(flags.named['lag']);
+            const r = await api.failbackArkFailover(opts, body);
+            render(flags, r, () => ok(`Failback advanced to ${arkState(r.state)} — ${r.effects.join(', ') || 'no effects'}`));
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark failover ${action} (status|promote|failback)`);
+    }
+}
+async function cmdArkTokens(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listArkTokens(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (t) => c.bold(t.name) },
+                    { header: 'PREFIX', get: (t) => t.token_prefix },
+                    { header: 'SCOPE', get: (t) => arkScope(t.scope) },
+                    { header: 'APPROVER', get: (t) => (t.can_approve ? c.cyan('yes') : c.dim('no')) },
+                    { header: 'LAST USED', get: (t) => ago(t.last_used_at, now) },
+                    { header: 'STATUS', get: (t) => (t.revoked_at ? c.red('revoked') : c.green('active')) },
+                    { header: 'ID', get: (t) => c.dim(t.id) },
+                ];
+                console.log(table(r.tokens, cols));
+            });
+            return;
+        }
+        case 'create': {
+            const body = {
+                name: flags.named['name'] ?? 'default',
+                scope: flags.named['scope'] ?? 'read',
+            };
+            if (flags.bool.has('can-approve'))
+                body.can_approve = true;
+            if (flags.named['expires'])
+                body.expires_in_days = Number(flags.named['expires']);
+            const { token } = await api.createArkToken(opts, body);
+            render(flags, { token }, () => {
+                ok(`Minted ${arkScope(token.scope)} token ${c.bold(token.name)}`);
+                console.log(kv([['id', token.id], ['prefix', token.token_prefix], ['secret', c.yellow(token.secret ?? '-')]]));
+                info('Copy the secret now — it will not be shown again.');
+            });
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev ark tokens revoke <token-id>');
+            await api.revokeArkToken(opts, id);
+            ok(`Revoked token ${c.bold(id)}`);
+            return;
+        }
+        default:
+            throw new Error(`unknown: tilldev ark tokens ${action}`);
+    }
+}
+// ── Small helpers for TillArk cells ───────────────────────────────────────────
+function arkScope(scope) {
+    switch (scope) {
+        case 'admin':
+            return c.magenta('admin');
+        case 'operator':
+            return c.cyan('operator');
+        default:
+            return c.dim('read');
+    }
+}
+/** Compact per-backup flags: a ransomware-canary quarantine (loud) and whether the
+ *  signed manifest was server-verified at report time. */
+function arkBackupFlags(b) {
+    const parts = [];
+    if (b.quarantined)
+        parts.push(c.red('⚠ quarantined'));
+    if (b.manifest_verified)
+        parts.push(c.green('✓ signed'));
+    return parts.length ? parts.join(' ') : c.dim('—');
+}
+function arkBackupStatus(s) {
+    switch (s) {
+        case 'succeeded':
+        case 'verified':
+            return c.green(s);
+        case 'failed':
+            return c.red(s);
+        case 'running':
+        case 'verifying':
+            return c.yellow(s);
+        default:
+            return c.dim(s);
+    }
+}
+function arkRestoreStatus(s) {
+    switch (s) {
+        case 'passed':
+            return c.green(s);
+        case 'failed':
+            return c.red(s);
+        case 'running':
+            return c.yellow(s);
+        default:
+            return c.dim(s);
+    }
+}
+function humanBytes(n) {
+    if (n <= 0)
+        return c.dim('0');
+    const units = ['B', 'KB', 'MB', 'GB', 'TB', 'PB'];
+    let v = n;
+    let i = 0;
+    while (v >= 1024 && i < units.length - 1) {
+        v /= 1024;
+        i++;
+    }
+    return `${v.toFixed(i === 0 ? 0 : 1)}${units[i]}`;
+}
+// ── TillForge ─────────────────────────────────────────────────────────────────
+// ── Forge git ergonomics — clone + a git credential helper ──────────────────
+// The point: never put a token in a clone URL or shell history. `setup-git`
+// wires git's credential helper to call this CLI back for the forge host; the
+// helper serves the token from the env. `clone` does it inline for one repo.
+function forgeGitHost() {
+    return process.env['TILLDEV_FORGE_GIT_HOST'] ?? 'git.tilldev.dev';
+}
+function forgeGitToken(flags) {
+    const cfg = loadConfig();
+    return (flags.named['git-token'] ??
+        process.env['TILLDEV_FORGE_TOKEN'] ??
+        process.env['TILLDEV_TOKEN'] ??
+        cfg.forge_token ?? // saved by `tilldev forge login`
+        cfg.token);
+}
+// `tilldev forge login` — the device flow. No password, no token pasted into a
+// terminal: we print a short code, the human approves it in a signed-in
+// browser, and the minted tfp_ token lands in the config file where the
+// credential helper (and `forge clone`) already look.
+async function cmdForgeLogin(flags) {
+    const cfg = loadConfig();
+    const apiUrl = flags.named['api-url'] ?? cfg.api_url;
+    assertSafeApiUrl(apiUrl);
+    const scope = flags.named['scope'] ?? 'read';
+    if (scope !== 'read' && scope !== 'write') {
+        throw new Error('usage: tilldev forge login [--scope read|write]');
+    }
+    const opts = { apiUrl };
+    const grant = await api.forgeDeviceCode(opts, scope);
+    info(`Open ${c.bold(grant.verification_uri)} in a signed-in browser and enter:`);
+    console.log(`\n    ${c.bold(grant.user_code)}\n`);
+    info(`Waiting for approval — ${c.bold(scope)} scope, code expires in ${Math.round(grant.expires_in / 60)} min. Ctrl-C to abort.`);
+    const deadline = Date.now() + grant.expires_in * 1000;
+    let intervalMs = Math.max(1, grant.interval || 5) * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        const poll = await api.forgeDeviceToken(opts, grant.device_code);
+        if (poll.status === 'pending')
+            continue;
+        if (poll.status === 'slow_down') {
+            // RFC 8628: back the polling interval off by 5s and keep waiting.
+            intervalMs += 5000;
+            continue;
+        }
+        if (poll.status === 'expired') {
+            fail('The code expired or was denied. Run `tilldev forge login` again.');
+            exit(1);
+        }
+        updateConfig({ forge_token: poll.token });
+        ok(`Signed in to TillForge — ${poll.scope} token saved to ${c.dim(configFilePath())} (0600)`);
+        info('git (via `forge setup-git`) and `tilldev forge clone` will use it automatically.');
+        info(`For CI, mint a dedicated token instead: ${c.dim('tilldev forge tokens create --scope ' + poll.scope)}`);
+        return;
+    }
+    fail('Timed out waiting for approval. Run `tilldev forge login` again.');
+    exit(1);
+}
+// The value git runs as a credential helper. `!` = run via the shell; we point
+// it back at this exact node + script so it works regardless of PATH.
+function credentialHelperArg() {
+    return `!'${process.execPath}' '${process.argv[1] ?? ''}' forge credential`;
+}
+// git credential helper. git invokes `<helper> get|store|erase` and streams the
+// request on stdin; for `get` on the forge host we answer with the token.
+async function cmdForgeCredential(flags) {
+    const op = flags.positional[2] ?? 'get';
+    if (op !== 'get')
+        return; // store/erase: nothing to persist — the token lives in the env
+    let raw = '';
+    try {
+        raw = readFileSync(0, 'utf8'); // fd 0 = stdin (git closes it after writing)
+    }
+    catch {
+        /* no stdin */
+    }
+    const req = {};
+    for (const line of raw.split('\n')) {
+        const i = line.indexOf('=');
+        if (i > 0)
+            req[line.slice(0, i)] = line.slice(i + 1).trim();
+    }
+    const host = req['host'] ?? '';
+    const token = forgeGitToken(flags);
+    // Decline (print nothing) if it's not our host or we have no token — git then
+    // falls back to its normal prompt. Never answer for another host.
+    if (!token || (host && host !== forgeGitHost()))
+        return;
+    process.stdout.write(`username=tilldev\npassword=${token}\n`);
+}
+async function cmdForgeClone(flags) {
+    const spec = need(flags.positional[2], 'tilldev forge clone <org>/<repo> [dir]   (or <repo> with --org <org>)');
+    let org;
+    let slug;
+    if (spec.includes('/')) {
+        ;
+        [org, slug] = [spec.slice(0, spec.indexOf('/')), spec.slice(spec.indexOf('/') + 1)];
+    }
+    else {
+        org = flags.named['org'];
+        slug = spec;
+    }
+    if (!org)
+        throw new Error('an org is required: `tilldev forge clone <org>/<repo>` or `--org <org>`');
+    const host = forgeGitHost();
+    const url = `https://${host}/${org}/${slug.replace(/\.git$/, '')}.git`;
+    const token = forgeGitToken(flags);
+    if (!token)
+        warn('No token found — set TILLDEV_FORGE_TOKEN or pass --git-token; git will prompt otherwise.');
+    const args = ['-c', 'credential.helper=', '-c', `credential.helper=${credentialHelperArg()}`, 'clone', url];
+    const dir = flags.positional[3];
+    if (dir)
+        args.push(dir);
+    info(`Cloning ${c.bold(`${org}/${slug}`)} from ${host}…`);
+    const res = spawnSync('git', args, { stdio: 'inherit', env: { ...process.env, ...(token ? { TILLDEV_FORGE_TOKEN: token } : {}) } });
+    if (res.error)
+        throw new Error(`could not run git (${res.error.code ?? res.error.message}). Is git installed?`);
+    if (res.status !== 0)
+        exit(res.status ?? 1);
+    ok(`Cloned ${org}/${slug}`);
+}
+async function cmdForgeSetupGit(flags) {
+    const host = forgeGitHost();
+    const res = spawnSync('git', ['config', '--global', `credential.https://${host}.helper`, credentialHelperArg()], { stdio: 'inherit' });
+    if (res.error)
+        throw new Error(`could not run git (${res.error.code ?? res.error.message}). Is git installed?`);
+    if (res.status !== 0)
+        throw new Error('git config failed');
+    ok(`git will now authenticate ${c.bold(host)} through TillForge.`);
+    info('Set your git token so the helper can use it (mint one with `tilldev forge tokens create --scope write`):');
+    console.log(`  ${c.dim('export TILLDEV_FORGE_TOKEN=tfp_…')}`);
+    info(`Then plain git just works — no token in the URL:`);
+    console.log(`  ${c.dim(`git clone https://${host}/<org>/<repo>.git`)}`);
+}
+async function cmdForge(flags) {
+    const sub = flags.positional[1] ?? 'repos';
+    // Git-ergonomics commands shell out to git rather than the API, and the
+    // credential helper must run even without an API token (git invokes it).
+    if (sub === 'credential' || sub === 'credential-helper')
+        return cmdForgeCredential(flags);
+    if (sub === 'clone')
+        return cmdForgeClone(flags);
+    if (sub === 'setup-git')
+        return cmdForgeSetupGit(flags);
+    if (sub === 'login')
+        return cmdForgeLogin(flags); // device flow — needs no existing token
+    const { opts } = resolveOpts(flags);
+    switch (sub) {
+        case 'repos':
+        case 'repo':
+            return cmdForgeRepos(flags, opts);
+        case 'tree': {
+            const repo = need(flags.positional[2], 'tilldev forge tree <repo> [--rev <r>] [--path <p>]');
+            const r = await api.forgeTree(opts, repo, flags.named['rev'], flags.named['path']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'TYPE', get: (e) => (e.type === 'tree' ? c.blue('dir') : e.type === 'commit' ? c.magenta('sub') : 'file') },
+                    { header: 'NAME', get: (e) => (e.type === 'tree' ? c.bold(e.name) : e.name) },
+                    { header: 'SIZE', get: (e) => (e.size >= 0 ? humanBytes(e.size) : c.dim('-')) },
+                ];
+                console.log(table(r.entries, cols));
+            });
+            return;
+        }
+        case 'blob': {
+            const repo = need(flags.positional[2], 'tilldev forge blob <repo> --path <p> [--rev <r>]');
+            const path = need(flags.named['path'], 'a file path is required (--path)');
+            const r = await api.forgeBlob(opts, repo, path, flags.named['rev']);
+            render(flags, r, () => {
+                if (r.blob.binary)
+                    info(`${path} is binary (${humanBytes(r.blob.size)})`);
+                else if (r.blob.truncated)
+                    info(`${path} is too large to display (${humanBytes(r.blob.size)})`);
+                else
+                    process.stdout.write(r.blob.content);
+            });
+            return;
+        }
+        case 'log': {
+            const repo = need(flags.positional[2], 'tilldev forge log <repo> [--rev <r>] [--limit <n>]');
+            const r = await api.forgeCommits(opts, repo, flags.named['rev'], flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                for (const cm of r.commits) {
+                    console.log(`${c.yellow(cm.short)}  ${truncate(cm.subject, 68)}  ${c.dim(cm.author + ' · ' + ago(cm.date, now))}`);
+                }
+            });
+            return;
+        }
+        case 'refs': {
+            const repo = need(flags.positional[2], 'tilldev forge refs <repo>');
+            const r = await api.forgeRefs(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'KIND', get: (x) => (x.kind === 'tag' ? c.magenta('tag') : c.green('branch')) },
+                    { header: 'NAME', get: (x) => c.bold(x.name) },
+                    { header: 'TARGET', get: (x) => c.dim((x.target || x.oid).slice(0, 12)) },
+                ];
+                console.log(table(r.refs, cols));
+            });
+            return;
+        }
+        case 'blame': {
+            const repo = need(flags.positional[2], 'tilldev forge blame <repo> --path <p> [--rev <r>]');
+            const path = need(flags.named['path'], 'a file path is required (--path)');
+            const r = await api.forgeBlame(opts, repo, path, flags.named['rev']);
+            render(flags, r, () => printJson(r));
+            return;
+        }
+        case 'policy':
+        case 'policies':
+            return cmdForgePolicy(flags, opts);
+        case 'reflog': {
+            const repo = need(flags.positional[2], 'tilldev forge reflog <repo>');
+            const r = await api.listForgeReflog(opts, repo, flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'ID', get: (e) => c.bold(String(e.id)) },
+                    { header: 'OP', get: (e) => (e.operation === 'force_update' || e.operation === 'delete' ? c.red(e.operation) : e.operation) },
+                    { header: 'REF', get: (e) => e.ref },
+                    { header: 'FROM→TO', get: (e) => c.dim(`${(e.old_oid || '∅').slice(0, 8)}→${(e.new_oid || '∅').slice(0, 8)}`) },
+                    { header: 'WHEN', get: (e) => ago(e.created_at, now) },
+                ];
+                console.log(table(r.reflog, cols));
+                info('Recover a change with: tilldev forge recover <repo> <id>');
+            });
+            return;
+        }
+        case 'recover': {
+            const repo = need(flags.positional[2], 'tilldev forge recover <repo> <reflog-id>');
+            const id = need(flags.positional[3], 'tilldev forge recover <repo> <reflog-id>');
+            const r = await api.recoverForgeRef(opts, repo, id);
+            render(flags, r, () => ok(`Restored ${c.bold(r.recovered.ref)} → ${c.yellow(r.recovered.oid.slice(0, 12))}`));
+            return;
+        }
+        case 'findings': {
+            const repo = need(flags.positional[2], 'tilldev forge findings <repo>');
+            const r = await api.listForgeFindings(opts, repo, flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'STATE', get: (f) => (f.action === 'rejected' ? c.red('rejected') : c.yellow('allowlisted')) },
+                    { header: 'RULE', get: (f) => c.bold(f.rule) },
+                    { header: 'WHERE', get: (f) => c.dim(`${f.file_path ?? '?'}:${f.line ?? '?'}`) },
+                    { header: 'WHEN', get: (f) => ago(f.created_at, now) },
+                    { header: 'ID', get: (f) => c.dim(truncate(f.id, 8)) },
+                ];
+                console.log(table(r.findings, cols));
+            });
+            return;
+        }
+        case 'allowlist': {
+            const repo = need(flags.positional[2], 'tilldev forge allowlist <repo> <finding-id> --reason <r>');
+            const id = need(flags.positional[3], 'tilldev forge allowlist <repo> <finding-id> --reason <r>');
+            const reason = need(flags.named['reason'], 'a reason is required (--reason)');
+            const r = await api.allowlistForgeFinding(opts, repo, id, reason);
+            render(flags, r, () => ok(`Allowlisted finding ${c.bold(r.finding.id)} (${r.finding.rule})`));
+            return;
+        }
+        case 'pr':
+        case 'pull':
+        case 'pulls':
+            return cmdForgePR(flags, opts);
+        case 'checks': {
+            const repo = need(flags.positional[2], 'tilldev forge checks <repo> [--sha <s>]');
+            const r = await api.listForgeChecks(opts, repo, flags.named['sha']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'STATE', get: (x) => (x.state === 'success' ? c.green(x.state) : x.state === 'pending' ? c.yellow(x.state) : c.red(x.state)) },
+                    { header: 'CONTEXT', get: (x) => c.bold(x.context) },
+                    { header: 'SHA', get: (x) => c.dim(x.commit_sha.slice(0, 8)) },
+                ];
+                console.log(table(r.checks, cols));
+            });
+            return;
+        }
+        case 'check': {
+            const repo = need(flags.positional[2], 'tilldev forge check <repo> --sha <s> --context <c> --state <st> [--url <u>]');
+            const r = await api.reportForgeCheck(opts, repo, {
+                commit_sha: need(flags.named['sha'], 'a commit sha is required (--sha)'),
+                context: need(flags.named['context'], 'a context is required (--context)'),
+                state: need(flags.named['state'], 'a state is required (--state success|failure|pending|error|cancelled)'),
+                ...(flags.named['url'] ? { target_url: flags.named['url'] } : {}),
+                ...(flags.named['description'] ? { description: flags.named['description'] } : {}),
+            });
+            render(flags, r, () => ok(`Reported ${c.bold(r.check.context)} = ${r.check.state} for ${c.dim(r.check.commit_sha.slice(0, 8))}`));
+            return;
+        }
+        case 'ci':
+            return cmdForgeCi(flags, opts);
+        case 'correlation':
+        case 'crash': {
+            const repo = need(flags.positional[2], 'tilldev forge correlation <repo> [--rev <r>]');
+            const r = await api.forgeCorrelation(opts, repo, flags.named['rev']);
+            render(flags, r, () => {
+                info(`${r.shipped} of ${r.commits_scanned} recent commits mapped to a release (release-granular)`);
+                for (const e of r.correlation) {
+                    const cf = e.release.crash_free_pct == null ? c.dim('n/a') : `${e.release.crash_free_pct}%`;
+                    const grade = e.release.grade ? c.bold(e.release.grade) : c.dim('-');
+                    console.log(`${c.yellow(e.short)}  ${truncate(e.subject, 44)}  ${c.dim('→')} ${c.bold(e.release.version)} [${grade}] crash-free ${cf}`);
+                }
+            });
+            return;
+        }
+        case 'tokens':
+        case 'token':
+            return cmdForgeTokens(flags, opts);
+        case 'egress':
+            return cmdForgeEgress(flags, opts);
+        case 'mirror': {
+            const repo = need(flags.positional[2], 'tilldev forge mirror <repo> --url <u> | tilldev forge mirror <repo> --remove');
+            if (flags.bool.has('remove')) {
+                const r = await api.removeForgeMirror(opts, repo);
+                render(flags, r, () => ok(`Mirror removed for ${c.bold(repo)}`));
+                return;
+            }
+            const url = need(flags.named['url'], 'a mirror URL is required (--url); it is SSRF-checked and encrypted at rest');
+            const r = await api.setForgeMirror(opts, repo, { url, ...(flags.named['direction'] ? { direction: flags.named['direction'] } : {}) });
+            render(flags, r, () => ok(`Mirror configured for ${c.bold(repo)}`));
+            return;
+        }
+        case 'keys':
+        case 'key':
+            return cmdForgeKeys(flags, opts);
+        case 'keys-account':
+        case 'account-keys':
+            return cmdForgeAccountKeys(flags, opts);
+        case 'issue':
+        case 'issues':
+            return cmdForgeIssue(flags, opts);
+        case 'label':
+        case 'labels':
+            return cmdForgeLabel(flags, opts);
+        case 'collab':
+        case 'collaborators':
+        case 'collaborator':
+            return cmdForgeCollab(flags, opts);
+        case 'compare': {
+            const repo = need(flags.positional[2], 'tilldev forge compare <repo> --base <ref> --head <ref>');
+            const base = need(flags.named['base'], 'a base revision is required (--base)');
+            const head = need(flags.named['head'], 'a head revision is required (--head)');
+            const r = await api.forgeCompare(opts, repo, base, head);
+            render(flags, r, () => {
+                info(`${r.files.length} file(s) changed ${c.dim(`${base} → ${head}`)}`);
+                for (const f of r.files)
+                    console.log(`  ${f.path}`);
+            });
+            return;
+        }
+        case 'codeowners': {
+            const repo = need(flags.positional[2], 'tilldev forge codeowners <repo> [--rev <r>]');
+            const r = await api.getForgeCodeowners(opts, repo, flags.named['rev']);
+            render(flags, r, () => {
+                if (!r.configured) {
+                    info('No CODEOWNERS file found.');
+                    return;
+                }
+                info(`CODEOWNERS (${r.source}):`);
+                for (const rule of r.rules)
+                    console.log(`  ${c.bold(rule.pattern)}  ${c.dim(rule.owners.join(' '))}`);
+            });
+            return;
+        }
+        case 'audit': {
+            const r = await api.listForgeAudit(opts, flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'WHEN', get: (a) => ago(a.created_at, now) },
+                    { header: 'ACTOR', get: (a) => `${a.actor_type}${a.actor_id ? c.dim(':' + truncate(a.actor_id, 8)) : ''}` },
+                    { header: 'ACTION', get: (a) => c.bold(a.action) },
+                    { header: 'CONTEXT', get: (a) => c.dim(truncate(JSON.stringify(a.metadata ?? {}), 40)) },
+                ];
+                console.log(table(r.audit, cols));
+            });
+            return;
+        }
+        case 'search': {
+            const repo = need(flags.positional[2], 'tilldev forge search <repo> <query> [--rev <r>]');
+            const query = need(flags.positional[3], 'a search query is required');
+            const r = await api.forgeSearch(opts, repo, query, flags.named['rev'], flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                if (r.matches.length === 0) {
+                    info('no matches');
+                    return;
+                }
+                for (const m of r.matches)
+                    console.log(`${c.dim(m.path + ':' + m.line)}  ${truncate(m.text.trim(), 90)}`);
+            });
+            return;
+        }
+        case 'env':
+        case 'environments': {
+            const action = flags.positional[2] ?? 'ls';
+            const repo = need(flags.positional[3], `tilldev forge env ${action} <repo> …`);
+            if (action === 'set') {
+                const r = await api.forgeSetEnvironment(opts, repo, {
+                    name: need(flags.named['name'], '--name is required'),
+                    production: flags.bool.has('production'),
+                    url: flags.named['url'],
+                    required_approvals: flags.named['approvals'] ? Number(flags.named['approvals']) : undefined,
+                });
+                render(flags, r, () => ok(`environment ${r.environment.name} set`));
+                return;
+            }
+            const r = await api.forgeEnvironments(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (e) => c.bold(e.name) },
+                    { header: 'KIND', get: (e) => (e.production ? c.magenta('production') : c.dim('preview')) },
+                    { header: 'URL', get: (e) => e.url || c.dim('-') },
+                    { header: 'APPROVALS', get: (e) => String(e.required_approvals) },
+                ];
+                console.log(table(r.environments, cols));
+            });
+            return;
+        }
+        case 'deploy':
+        case 'deployments': {
+            const action = flags.positional[2] ?? 'ls';
+            const repo = need(flags.positional[3], `tilldev forge deploy ${action} <repo> …`);
+            if (action === 'create') {
+                const r = await api.forgeCreateDeployment(opts, repo, { environment: need(flags.named['env'], '--env is required'), ref: need(flags.named['ref'], '--ref is required'), url: flags.named['url'], description: flags.named['desc'] });
+                render(flags, r, () => ok(`deployment to ${r.deployment.environment} queued`));
+                return;
+            }
+            if (action === 'status') {
+                const id = need(flags.positional[4], 'tilldev forge deploy status <repo> <id> --state <s>');
+                const r = await api.forgeUpdateDeployment(opts, repo, id, { state: need(flags.named['state'], '--state is required'), url: flags.named['url'] });
+                render(flags, r, () => ok(`deployment ${r.deployment.state}`));
+                return;
+            }
+            const r = await api.forgeDeployments(opts, repo, flags.named['env']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'WHEN', get: (d) => ago(d.created_at, now) },
+                    { header: 'ENV', get: (d) => c.bold(d.environment) },
+                    { header: 'STATE', get: (d) => d.state },
+                    { header: 'REF', get: (d) => d.ref.replace('refs/heads/', '') },
+                    { header: 'URL', get: (d) => d.url || c.dim('-') },
+                ];
+                console.log(table(r.deployments, cols));
+            });
+            return;
+        }
+        case 'release':
+        case 'releases': {
+            const action = flags.positional[2] ?? 'ls';
+            const repo = need(flags.positional[3], `tilldev forge release ${action} <repo> …`);
+            if (action === 'create') {
+                const r = await api.forgeCreateRelease(opts, repo, { tag: need(flags.named['tag'], '--tag is required'), name: flags.named['name'], target_sha: flags.named['target'], body: flags.named['notes'], generate_notes: flags.bool.has('generate') || !flags.named['notes'], prerelease: flags.bool.has('prerelease'), draft: flags.bool.has('draft') });
+                render(flags, r, () => ok(`release ${r.release.tag} created`));
+                return;
+            }
+            if (action === 'get') {
+                const tag = need(flags.positional[4], 'tilldev forge release get <repo> <tag>');
+                const r = await api.forgeGetRelease(opts, repo, tag);
+                render(flags, r, () => { info(c.bold(r.release.tag) + (r.release.name ? ` — ${r.release.name}` : '')); if (r.release.body)
+                    console.log('\n' + r.release.body); });
+                return;
+            }
+            if (action === 'rm') {
+                const tag = need(flags.positional[4], 'tilldev forge release rm <repo> <tag>');
+                await api.forgeDeleteRelease(opts, repo, tag);
+                ok(`release ${tag} deleted`);
+                return;
+            }
+            const r = await api.forgeReleases(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'TAG', get: (x) => c.bold(x.tag) },
+                    { header: 'NAME', get: (x) => x.name || c.dim('-') },
+                    { header: 'STATE', get: (x) => (x.draft ? c.dim('draft') : x.prerelease ? c.yellow('pre') : c.green('published')) },
+                    { header: 'BUILDS', get: (x) => String(x.assets.length) },
+                    { header: 'WHEN', get: (x) => (x.published_at ? ago(x.published_at, now) : c.dim('-')) },
+                ];
+                console.log(table(r.releases, cols));
+            });
+            return;
+        }
+        case 'asset':
+        case 'assets': {
+            const action = flags.positional[2] ?? 'add';
+            const repo = need(flags.positional[3], `tilldev forge asset ${action} <repo> <tag> …`);
+            const tag = need(flags.positional[4], 'a release tag is required');
+            if (action === 'rm') {
+                const id = need(flags.positional[5], 'tilldev forge asset rm <repo> <tag> <id>');
+                await api.forgeRemoveAsset(opts, repo, tag, id);
+                ok('build removed');
+                return;
+            }
+            const r = await api.forgeAddAsset(opts, repo, tag, { name: need(flags.named['name'], '--name is required'), platform: flags.named['platform'] ?? 'any', arch: flags.named['arch'], url: need(flags.named['url'], '--url is required'), sha256: flags.named['sha256'] });
+            render(flags, r, () => ok(`build attached to ${tag}`));
+            return;
+        }
+        case 'webhook':
+        case 'webhooks': {
+            const action = flags.positional[2] ?? 'ls';
+            if (action === 'add') {
+                const r = await api.forgeCreateWebhook(opts, { url: need(flags.named['url'], '--url is required'), events: (flags.named['events'] ?? 'push').split(',').map((s) => s.trim()).filter(Boolean), repo: flags.named['repo'], secret: flags.named['secret'] });
+                render(flags, r, () => ok(`webhook ${r.webhook.id} created`));
+                return;
+            }
+            if (action === 'rm') {
+                await api.forgeDeleteWebhook(opts, need(flags.positional[3], 'tilldev forge webhook rm <id>'));
+                ok('webhook deleted');
+                return;
+            }
+            if (action === 'ping') {
+                const r = await api.forgePingWebhook(opts, need(flags.positional[3], 'tilldev forge webhook ping <id>'));
+                render(flags, r, () => { const d = r.delivery; (d.success ? ok : warn)(`${d.status_code || 'no response'} · ${d.duration_ms}ms${d.error ? ' · ' + d.error : ''}`); });
+                return;
+            }
+            if (action === 'deliveries') {
+                const r = await api.forgeWebhookDeliveries(opts, need(flags.positional[3], 'tilldev forge webhook deliveries <id>'));
+                render(flags, r, () => {
+                    const cols = [
+                        { header: 'WHEN', get: (d) => ago(d.created_at, now) },
+                        { header: 'EVENT', get: (d) => d.event },
+                        { header: 'STATUS', get: (d) => (d.success ? c.green(String(d.status_code)) : c.red(String(d.status_code || '-'))) },
+                        { header: 'MS', get: (d) => String(d.duration_ms) },
+                    ];
+                    console.log(table(r.deliveries, cols));
+                });
+                return;
+            }
+            const r = await api.forgeWebhooks(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'URL', get: (w) => truncate(w.url, 46) },
+                    { header: 'EVENTS', get: (w) => w.events.join(',') || c.dim('all') },
+                    { header: 'SCOPE', get: (w) => (w.repo_id ? 'repo' : c.dim('org')) },
+                    { header: 'ACTIVE', get: (w) => (w.active ? c.green('yes') : c.dim('no')) },
+                ];
+                console.log(table(r.webhooks, cols));
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge <clone|setup-git|repos|tree|blob|log|refs|blame|search|policy|reflog|recover|findings|allowlist|pr|compare|issue|label|collab|checks|check|ci|correlation|env|deploy|release|asset|webhook|tokens|keys|keys-account|audit>');
+    }
+}
+async function cmdForgeRepos(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listForgeRepos(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (x) => c.bold(x.slug) },
+                    { header: 'VIS', get: (x) => (x.visibility === 'public' ? c.yellow(x.visibility) : x.visibility) },
+                    { header: 'BRANCH', get: (x) => x.default_branch },
+                    { header: 'SIZE', get: (x) => humanBytes(x.size_bytes) },
+                    { header: 'STATUS', get: (x) => (x.status === 'active' ? c.green(x.status) : c.yellow(x.status)) },
+                ];
+                console.log(table(r.repos, cols));
+            });
+            return;
+        }
+        case 'get': {
+            const repo = need(flags.positional[3], 'tilldev forge repos get <slug>');
+            const r = await api.getForgeRepo(opts, repo);
+            render(flags, r, () => console.log(kv([
+                ['slug', r.repo.slug],
+                ['name', r.repo.name],
+                ['visibility', r.repo.visibility],
+                ['default branch', r.repo.default_branch],
+                ['size', humanBytes(r.repo.size_bytes)],
+                ['status', r.repo.status],
+                ['id', c.dim(r.repo.id)],
+            ])));
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const name = need(flags.named['name'] ?? flags.positional[3], 'tilldev forge repos create --name <n> [--slug <s>] [--visibility <v>]');
+            const r = await api.createForgeRepo(opts, {
+                name,
+                ...(flags.named['slug'] ? { slug: flags.named['slug'] } : {}),
+                ...(flags.named['desc'] ? { description: flags.named['desc'] } : {}),
+                ...(flags.named['visibility'] ? { visibility: flags.named['visibility'] } : {}),
+                ...(flags.named['default-branch'] ? { default_branch: flags.named['default-branch'] } : {}),
+            });
+            render(flags, r, () => {
+                ok(`Created ${c.bold(r.repo.slug)} (${r.repo.visibility})`);
+                info('Protected default branch seeded. Mint a push token with: tilldev forge tokens create --scope write');
+            });
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const repo = need(flags.positional[3], 'tilldev forge repos rm <slug>');
+            const r = await api.deleteForgeRepo(opts, repo);
+            render(flags, r, () => ok(`Deleted ${c.bold(repo)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge repos <ls|get|create|rm>');
+    }
+}
+async function cmdForgePolicy(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    if (action === 'ls' || action === 'list') {
+        const repo = need(flags.positional[3], 'tilldev forge policy ls <repo>');
+        const r = await api.listForgePolicies(opts, repo);
+        render(flags, r, () => {
+            const cols = [
+                { header: 'PATTERN', get: (p) => c.bold(p.pattern) },
+                { header: 'PROT', get: (p) => (p.protected ? c.green('yes') : c.dim('no')) },
+                { header: 'SIGNED', get: (p) => (p.require_signed ? c.green('req') : c.dim('-')) },
+                { header: 'LINEAR', get: (p) => (p.require_linear ? c.green('req') : c.dim('-')) },
+                { header: 'APPROVALS', get: (p) => String(p.required_approvals) },
+                { header: 'MFA', get: (p) => (p.require_mfa_to_push ? c.green('req') : c.dim('-')) },
+            ];
+            console.log(table(r.policies, cols));
+        });
+        return;
+    }
+    if (action === 'set') {
+        const repo = need(flags.positional[3], 'tilldev forge policy set <repo> --pattern <p> [flags]');
+        const pattern = need(flags.named['pattern'], 'a branch pattern is required (--pattern), e.g. main or release/*');
+        const body = { pattern };
+        if (flags.bool.has('unprotect'))
+            body['protected'] = false;
+        if (flags.bool.has('require-signed'))
+            body['require_signed'] = true;
+        if (flags.bool.has('require-linear'))
+            body['require_linear'] = true;
+        if (flags.bool.has('require-mfa'))
+            body['require_mfa_to_push'] = true;
+        if (flags.bool.has('allow-force'))
+            body['allow_force_push'] = true;
+        if (flags.bool.has('allow-delete'))
+            body['allow_deletions'] = true;
+        if (flags.named['approvals'])
+            body['required_approvals'] = Number(flags.named['approvals']);
+        if (flags.named['checks'])
+            body['required_checks'] = flags.named['checks'].split(',').map((s) => s.trim()).filter(Boolean);
+        const r = await api.putForgePolicy(opts, repo, body);
+        render(flags, r, () => ok(`Policy for ${c.bold(r.policy.pattern)} saved (protected: ${r.policy.protected})`));
+        return;
+    }
+    throw new Error('usage: tilldev forge policy <ls|set>');
+}
+async function cmdForgePR(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const repo = need(flags.positional[3], 'tilldev forge pr ls <repo> [--state <s>]');
+            const r = await api.listForgePulls(opts, repo, flags.named['state']);
+            render(flags, r, () => {
+                const cols = [
+                    { header: '#', get: (p) => c.bold('#' + p.number) },
+                    { header: 'STATE', get: (p) => (p.state === 'merged' ? c.magenta(p.state) : p.state === 'open' ? c.green(p.state) : c.dim(p.state)) },
+                    { header: 'TITLE', get: (p) => truncate(p.title, 44) },
+                    { header: 'HEAD→BASE', get: (p) => c.dim(`${p.source_ref.replace('refs/heads/', '')}→${p.target_ref.replace('refs/heads/', '')}`) },
+                ];
+                console.log(table(r.pulls, cols));
+            });
+            return;
+        }
+        case 'create':
+        case 'open': {
+            const repo = need(flags.positional[3], 'tilldev forge pr create <repo> --title <t> --source <ref> [--target <ref>]');
+            const r = await api.createForgePull(opts, repo, {
+                title: need(flags.named['title'], 'a title is required (--title)'),
+                source_ref: need(flags.named['source'], 'a source branch is required (--source)'),
+                ...(flags.named['target'] ? { target_ref: flags.named['target'] } : {}),
+                ...(flags.named['body'] ? { body: flags.named['body'] } : {}),
+                ...(flags.bool.has('draft') ? { draft: true } : {}),
+            });
+            render(flags, r, () => ok(`Opened PR ${c.bold('#' + r.pull.number)}: ${r.pull.title}`));
+            return;
+        }
+        case 'get':
+        case 'show': {
+            const repo = need(flags.positional[3], 'tilldev forge pr get <repo> <number>');
+            const num = Number(need(flags.positional[4], 'tilldev forge pr get <repo> <number>'));
+            const r = await api.getForgePull(opts, repo, num);
+            render(flags, r, () => {
+                console.log(kv([
+                    ['pr', '#' + r.pull.number],
+                    ['title', r.pull.title],
+                    ['state', r.pull.state],
+                    ['source', r.pull.source_ref],
+                    ['target', r.pull.target_ref],
+                    ['head', r.pull.source_sha ? r.pull.source_sha.slice(0, 12) : c.dim('-')],
+                    ...(r.pull.merged_sha ? [['merged', r.pull.merged_sha.slice(0, 12)]] : []),
+                ]));
+                if (r.reviews.length) {
+                    console.log(c.dim('\nReviews:'));
+                    for (const rv of r.reviews)
+                        console.log(`  ${rv.state === 'approved' ? c.green(rv.state) : c.yellow(rv.state)} ${c.dim(rv.reviewer_id ?? '')}`);
+                }
+            });
+            return;
+        }
+        case 'merge': {
+            const repo = need(flags.positional[3], 'tilldev forge pr merge <repo> <number> [--strategy <s>] [--message <m>]');
+            const num = Number(need(flags.positional[4], 'tilldev forge pr merge <repo> <number>'));
+            const r = await api.mergeForgePull(opts, repo, num, {
+                ...(flags.named['strategy'] ? { strategy: flags.named['strategy'] } : {}),
+                ...(flags.named['message'] ? { message: flags.named['message'] } : {}),
+            });
+            render(flags, r, () => ok(`Merged PR ${c.bold('#' + num)} → ${c.yellow(r.merged_sha.slice(0, 12))}`));
+            return;
+        }
+        case 'review': {
+            const repo = need(flags.positional[3], 'tilldev forge pr review <repo> <number> --state <approved|changes_requested|commented>');
+            const num = Number(need(flags.positional[4], 'tilldev forge pr review <repo> <number> --state <s>'));
+            const state = need(flags.named['state'], '--state approved|changes_requested|commented');
+            const r = await api.reviewForgePull(opts, repo, num, { state, ...(flags.named['body'] ? { body: flags.named['body'] } : {}) });
+            render(flags, r, () => ok(`Review submitted: ${r.review.state}`));
+            return;
+        }
+        case 'close':
+        case 'reopen': {
+            const repo = need(flags.positional[3], `tilldev forge pr ${action} <repo> <number>`);
+            const num = Number(need(flags.positional[4], `tilldev forge pr ${action} <repo> <number>`));
+            const r = await api.updateForgePull(opts, repo, num, {
+                state: action === 'close' ? 'closed' : 'open',
+                ...(flags.named['title'] ? { title: flags.named['title'] } : {}),
+                ...(flags.named['body'] ? { body: flags.named['body'] } : {}),
+            });
+            render(flags, r, () => ok(`PR ${c.bold('#' + num)} is now ${r.pull.state}`));
+            return;
+        }
+        case 'comment': {
+            const repo = need(flags.positional[3], 'tilldev forge pr comment <repo> <number> --body <b> [--file <p>] [--line <n>]');
+            const num = Number(need(flags.positional[4], 'tilldev forge pr comment <repo> <number> --body <b>'));
+            const r = await api.commentForgePull(opts, repo, num, {
+                body: need(flags.named['body'], 'a comment body is required (--body)'),
+                ...(flags.named['file'] ? { file_path: flags.named['file'] } : {}),
+                ...(flags.named['line'] ? { line: Number(flags.named['line']) } : {}),
+                ...(flags.named['sha'] ? { commit_sha: flags.named['sha'] } : {}),
+            });
+            render(flags, r, () => ok(`Comment added to PR ${c.bold('#' + num)}`));
+            return;
+        }
+        case 'diff': {
+            const repo = need(flags.positional[3], 'tilldev forge pr diff <repo> <number>');
+            const num = Number(need(flags.positional[4], 'tilldev forge pr diff <repo> <number>'));
+            const r = await api.forgePullDiff(opts, repo, num);
+            render(flags, r, () => {
+                info(`${r.files.length} file(s) changed ${c.dim(`${r.base} → ${r.head}`)}`);
+                for (const f of r.files)
+                    console.log(`  ${f.path}`);
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge pr <ls|create|get|merge|review|close|reopen|comment|diff>');
+    }
+}
+// Self-hosted CI: runs are repo-scoped, so every subcommand pins --repo. `list`
+// shows the ledger, `logs` streams one run's stored log to stdout (pipe-friendly),
+// `run` enqueues .tillforge/ci.yml at a chosen (or default-tip) commit.
+async function cmdForgeCi(flags, opts) {
+    const action = flags.positional[2] ?? 'list';
+    const ciStatus = (s) => s === 'success' ? c.green(s)
+        : s === 'failure' || s === 'error' ? c.red(s)
+            : s === 'running' ? c.blue(s)
+                : s === 'timed_out' ? c.yellow('timed out')
+                    : c.dim(s);
+    switch (action) {
+        case 'list':
+        case 'ls': {
+            const repo = need(flags.named['repo'], 'tilldev forge ci list --repo <slug> [--status <st>] [--workflow <w>]');
+            const r = await api.listForgeCiJobs(opts, repo, flags.named['status'], flags.named['workflow'], flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'STATUS', get: (j) => ciStatus(j.status) },
+                    { header: 'WORKFLOW', get: (j) => c.bold(j.workflow) },
+                    { header: 'TRIGGER', get: (j) => j.trigger.replace('_', ' ') },
+                    { header: 'SHA', get: (j) => c.dim(j.sha.slice(0, 8)) },
+                    { header: 'RUNNER', get: (j) => j.runner_name ?? c.dim('-') },
+                    { header: 'WHEN', get: (j) => ago(j.created_at, now) },
+                    { header: 'ID', get: (j) => c.dim(j.id) },
+                ];
+                console.log(table(r.jobs, cols));
+                info(`Full log: tilldev forge ci logs <job-id> --repo ${repo}`);
+            });
+            return;
+        }
+        case 'logs':
+        case 'log': {
+            const id = need(flags.positional[3], 'tilldev forge ci logs <job-id> --repo <slug>');
+            const repo = need(flags.named['repo'], 'a repo slug is required (--repo)');
+            const r = await api.getForgeCiJob(opts, repo, id);
+            render(flags, r, () => {
+                const j = r.job;
+                info(`${c.bold(j.workflow)} · ${ciStatus(j.status)} · ${c.dim(j.sha.slice(0, 8))}${j.failure_reason ? ` · ${j.failure_reason}` : ''}`);
+                if (j.log_truncated)
+                    warn('log truncated at 1 MiB — the job kept running past this point');
+                if (j.log)
+                    process.stdout.write(j.log.endsWith('\n') ? j.log : j.log + '\n');
+                else
+                    info(j.status === 'queued' ? 'not started yet' : 'no output recorded');
+            });
+            return;
+        }
+        case 'run': {
+            const repo = need(flags.named['repo'], 'tilldev forge ci run --repo <slug> [--sha <s>] [--ref <r>]');
+            const r = await api.runForgeCi(opts, repo, flags.named['sha'], flags.named['ref']);
+            render(flags, r, () => {
+                if (r.config_missing) {
+                    warn(`no .tillforge/ci.yml at ${r.sha.slice(0, 8)} — nothing to run`);
+                    return;
+                }
+                if (r.config_error) {
+                    warn(`ci.yml invalid: ${r.config_error} (a visible 'config' error run was recorded)`);
+                    return;
+                }
+                ok(`enqueued ${r.enqueued} job(s) for ${c.dim(r.sha.slice(0, 8))} on ${r.ref.replace('refs/heads/', '')}`);
+            });
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge ci <list|logs|run>');
+    }
+}
+async function cmdForgeTokens(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listForgeTokens(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (t) => c.bold(t.name) },
+                    { header: 'SCOPE', get: (t) => t.scope },
+                    { header: 'PIN', get: (t) => (t.repo_id ? c.dim('repo') : c.green('org')) },
+                    { header: 'MFA', get: (t) => (t.mfa_verified ? c.green('yes') : c.dim('no')) },
+                    { header: 'PREFIX', get: (t) => c.dim(t.token_prefix) },
+                    { header: 'STATE', get: (t) => (t.revoked_at ? c.red('revoked') : c.green('active')) },
+                ];
+                console.log(table(r.tokens, cols));
+            });
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const r = await api.createForgeToken(opts, {
+                ...(flags.named['name'] ? { name: flags.named['name'] } : {}),
+                ...(flags.named['scope'] ? { scope: flags.named['scope'] } : {}),
+                ...(flags.named['repo'] ? { repo: flags.named['repo'] } : {}),
+                ...(flags.named['expires'] ? { expires_in_days: Number(flags.named['expires']) } : {}),
+            });
+            render(flags, r, () => {
+                ok(`Minted ${c.bold(r.token.scope)} token ${c.dim(r.token.token_prefix + '…')}`);
+                console.log(`\n  ${c.bold(r.token.secret)}\n`);
+                warn('This is the ONLY time the token is shown. Use it as the git password: git clone https://<token>@<host>/<org>/<repo>.git');
+            });
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev forge tokens revoke <token-id>');
+            const r = await api.revokeForgeToken(opts, id);
+            render(flags, r, () => ok(`Revoked ${c.bold(id)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge tokens <ls|create|revoke>');
+    }
+}
+async function cmdForgeEgress(flags, opts) {
+    const action = flags.positional[2] ?? 'policy';
+    switch (action) {
+        case 'policy': {
+            const repo = need(flags.positional[3], 'tilldev forge egress policy <repo>');
+            const r = await api.getForgeAiPolicy(opts, repo);
+            render(flags, r, () => {
+                const p = r.policy;
+                console.log(kv([
+                    ['allow egress', p.allow_egress ? c.green('yes') : c.red('no (default-deny)')],
+                    ['sensitive', p.sensitive ? c.red('yes (always refuse)') : 'no'],
+                    ['redact secrets', p.redact_secrets ? c.green('yes') : c.red('no')],
+                    ['providers', p.allowed_providers.length ? p.allowed_providers.join(', ') : c.dim('any configured')],
+                    ['max context', p.max_context_bytes ? String(p.max_context_bytes) + ' bytes' : c.dim('unbounded')],
+                ]));
+            });
+            return;
+        }
+        case 'set': {
+            const repo = need(flags.positional[3], 'tilldev forge egress set <repo> [--allow] [--sensitive] [--providers a,b] [--max-bytes n] [--no-redact]');
+            const body = {};
+            if (flags.bool.has('allow'))
+                body['allow_egress'] = true;
+            if (flags.bool.has('sensitive'))
+                body['sensitive'] = true;
+            if (flags.bool.has('no-redact'))
+                body['redact_secrets'] = false;
+            if (flags.named['providers'])
+                body['allowed_providers'] = flags.named['providers'].split(',').map((s) => s.trim()).filter(Boolean);
+            if (flags.named['max-bytes'])
+                body['max_context_bytes'] = Number(flags.named['max-bytes']);
+            const r = await api.putForgeAiPolicy(opts, repo, body);
+            render(flags, r, () => ok(`Egress policy set (allow: ${r.policy.allow_egress}, sensitive: ${r.policy.sensitive})`));
+            return;
+        }
+        case 'audit': {
+            const r = await api.listForgeEgress(opts, flags.named['limit'] ? Number(flags.named['limit']) : undefined);
+            render(flags, r, () => printJson(r));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge egress <policy|set|audit>');
+    }
+}
+async function cmdForgeKeys(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const repo = need(flags.positional[3], 'tilldev forge keys ls <repo>');
+            const r = await api.listForgeKeys(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (k) => c.bold(k.name) },
+                    { header: 'SCOPE', get: (k) => k.scope },
+                    { header: 'FINGERPRINT', get: (k) => c.dim(truncate(k.fingerprint ?? '-', 24)) },
+                    { header: 'STATE', get: (k) => (k.revoked_at ? c.red('revoked') : k.expires_at && new Date(k.expires_at) < new Date() ? c.yellow('expired') : c.green('active')) },
+                ];
+                console.log(table(r.keys, cols));
+            });
+            return;
+        }
+        case 'add': {
+            const repo = need(flags.positional[3], 'tilldev forge keys add <repo> --name <n> --key "<ssh public key>" [--scope read|write] [--expires <days>]');
+            const publicKey = need(flags.named['key'], 'the SSH public key is required (--key "ssh-ed25519 AAAA…")');
+            const r = await api.addForgeKey(opts, repo, {
+                name: need(flags.named['name'], 'a key name is required (--name)'),
+                public_key: publicKey,
+                ...(flags.named['scope'] ? { scope: flags.named['scope'] } : {}),
+                ...(flags.named['expires'] ? { expires_in_days: Number(flags.named['expires']) } : {}),
+            });
+            render(flags, r, () => ok(`Registered key ${c.bold(r.key.name)} (${c.dim(r.key.fingerprint ?? '')})`));
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const repo = need(flags.positional[3], 'tilldev forge keys revoke <repo> <key-id>');
+            const id = need(flags.positional[4], 'tilldev forge keys revoke <repo> <key-id>');
+            const r = await api.revokeForgeKey(opts, repo, id);
+            render(flags, r, () => ok(`Revoked key ${c.bold(id)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge keys <ls|add|revoke>');
+    }
+}
+async function cmdForgeAccountKeys(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const r = await api.listForgeAccountKeys(opts);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (k) => c.bold(k.name) },
+                    { header: 'SCOPE', get: (k) => k.scope },
+                    { header: 'FINGERPRINT', get: (k) => c.dim(truncate(k.fingerprint ?? '-', 24)) },
+                    { header: 'STATE', get: (k) => (k.revoked_at ? c.red('revoked') : k.expires_at && new Date(k.expires_at) < new Date() ? c.yellow('expired') : c.green('active')) },
+                ];
+                console.log(table(r.keys, cols));
+            });
+            return;
+        }
+        case 'add': {
+            const publicKey = need(flags.named['key'], 'the SSH public key is required (--key "ssh-ed25519 AAAA…")');
+            const r = await api.addForgeAccountKey(opts, {
+                name: need(flags.named['name'], 'a key name is required (--name)'),
+                public_key: publicKey,
+                ...(flags.named['scope'] ? { scope: flags.named['scope'] } : {}),
+                ...(flags.named['expires'] ? { expires_in_days: Number(flags.named['expires']) } : {}),
+            });
+            render(flags, r, () => ok(`Registered org-wide key ${c.bold(r.key.name)} (${c.dim(r.key.fingerprint ?? '')})`));
+            return;
+        }
+        case 'revoke':
+        case 'rm': {
+            const id = need(flags.positional[3], 'tilldev forge keys-account revoke <key-id>');
+            const r = await api.revokeForgeAccountKey(opts, id);
+            render(flags, r, () => ok(`Revoked key ${c.bold(id)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge keys-account <ls|add|rm>');
+    }
+}
+async function cmdForgeIssue(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const repo = need(flags.positional[3], 'tilldev forge issue ls <repo> [--state open|closed|all] [--label <l>]');
+            const r = await api.listForgeIssues(opts, repo, {
+                ...(flags.named['state'] ? { state: flags.named['state'] } : {}),
+                ...(flags.named['label'] ? { label: flags.named['label'] } : {}),
+            });
+            render(flags, r, () => {
+                const cols = [
+                    { header: '#', get: (i) => c.bold('#' + i.number) },
+                    { header: 'STATE', get: (i) => (i.state === 'open' ? c.green(i.state) : c.dim(i.state)) },
+                    { header: 'TITLE', get: (i) => truncate(i.title, 50) },
+                    { header: 'LABELS', get: (i) => c.dim(i.labels.join(', ')) },
+                    { header: 'COMMENTS', get: (i) => String(i.comment_count) },
+                ];
+                console.log(table(r.issues, cols));
+            });
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const repo = need(flags.positional[3], 'tilldev forge issue create <repo> --title <t> [--body <b>] [--labels a,b] [--assignee <uid>]');
+            const r = await api.createForgeIssue(opts, repo, {
+                title: need(flags.named['title'], 'a title is required (--title)'),
+                ...(flags.named['body'] ? { body: flags.named['body'] } : {}),
+                ...(flags.named['labels'] ? { labels: flags.named['labels'].split(',').map((s) => s.trim()).filter(Boolean) } : {}),
+                ...(flags.named['assignee'] ? { assignee_id: flags.named['assignee'] } : {}),
+            });
+            render(flags, r, () => ok(`Opened issue ${c.bold('#' + r.issue.number)}: ${r.issue.title}`));
+            return;
+        }
+        case 'get':
+        case 'show': {
+            const repo = need(flags.positional[3], 'tilldev forge issue get <repo> <number>');
+            const num = Number(need(flags.positional[4], 'tilldev forge issue get <repo> <number>'));
+            const r = await api.getForgeIssue(opts, repo, num);
+            render(flags, r, () => {
+                console.log(kv([
+                    ['issue', '#' + r.issue.number],
+                    ['title', r.issue.title],
+                    ['state', r.issue.state],
+                    ['labels', r.issue.labels.length ? r.issue.labels.join(', ') : c.dim('-')],
+                    ['assignee', r.issue.assignee_id ?? c.dim('-')],
+                ]));
+                if (r.issue.body)
+                    console.log('\n' + r.issue.body);
+                if (r.comments.length) {
+                    console.log(c.dim(`\nComments (${r.comments.length}):`));
+                    for (const cm of r.comments)
+                        console.log(`  ${c.dim(ago(cm.created_at, now))} ${c.dim(cm.author_id ?? '')}\n  ${truncate(cm.body, 100)}`);
+                }
+            });
+            return;
+        }
+        case 'close':
+        case 'reopen': {
+            const repo = need(flags.positional[3], `tilldev forge issue ${action} <repo> <number>`);
+            const num = Number(need(flags.positional[4], `tilldev forge issue ${action} <repo> <number>`));
+            const r = await api.updateForgeIssue(opts, repo, num, { state: action === 'close' ? 'closed' : 'open' });
+            render(flags, r, () => ok(`Issue ${c.bold('#' + num)} is now ${r.issue.state}`));
+            return;
+        }
+        case 'comment': {
+            const repo = need(flags.positional[3], 'tilldev forge issue comment <repo> <number> --body <b>');
+            const num = Number(need(flags.positional[4], 'tilldev forge issue comment <repo> <number> --body <b>'));
+            const body = need(flags.named['body'], 'a comment body is required (--body)');
+            const r = await api.commentForgeIssue(opts, repo, num, body);
+            render(flags, r, () => ok(`Comment added to issue ${c.bold('#' + num)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge issue <ls|create|get|close|reopen|comment>');
+    }
+}
+async function cmdForgeLabel(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const repo = need(flags.positional[3], 'tilldev forge label ls <repo>');
+            const r = await api.listForgeLabels(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'NAME', get: (l) => c.bold(l.name) },
+                    { header: 'COLOR', get: (l) => c.dim(l.color) },
+                    { header: 'DESCRIPTION', get: (l) => truncate(l.description, 50) },
+                ];
+                console.log(table(r.labels, cols));
+            });
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const repo = need(flags.positional[3], 'tilldev forge label create <repo> --name <n> [--color #rrggbb] [--desc <d>]');
+            const r = await api.createForgeLabel(opts, repo, {
+                name: need(flags.named['name'], 'a label name is required (--name)'),
+                ...(flags.named['color'] ? { color: flags.named['color'] } : {}),
+                ...(flags.named['desc'] ? { description: flags.named['desc'] } : {}),
+            });
+            render(flags, r, () => ok(`Created label ${c.bold(r.label.name)} (${c.dim(r.label.color)})`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge label <ls|create>');
+    }
+}
+async function cmdForgeCollab(flags, opts) {
+    const action = flags.positional[2] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const repo = need(flags.positional[3], 'tilldev forge collab ls <repo>');
+            const r = await api.listForgeCollaborators(opts, repo);
+            render(flags, r, () => {
+                const cols = [
+                    { header: 'USER', get: (x) => c.bold(x.user_id) },
+                    { header: 'ROLE', get: (x) => x.role },
+                    { header: 'ADDED', get: (x) => ago(x.created_at, now) },
+                ];
+                console.log(table(r.collaborators, cols));
+            });
+            return;
+        }
+        case 'add': {
+            const repo = need(flags.positional[3], 'tilldev forge collab add <repo> --user <uid> [--role read|triage|write|admin]');
+            const r = await api.addForgeCollaborator(opts, repo, {
+                user_id: need(flags.named['user'], 'a user id is required (--user)'),
+                ...(flags.named['role'] ? { role: flags.named['role'] } : {}),
+            });
+            render(flags, r, () => ok(`Granted ${c.bold(r.collaborator.role)} to ${c.dim(r.collaborator.user_id)}`));
+            return;
+        }
+        case 'rm':
+        case 'remove': {
+            const repo = need(flags.positional[3], 'tilldev forge collab rm <repo> <collaborator-id>');
+            const id = need(flags.positional[4], 'tilldev forge collab rm <repo> <collaborator-id>');
+            const r = await api.removeForgeCollaborator(opts, repo, id);
+            render(flags, r, () => ok(`Removed collaborator ${c.bold(id)}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev forge collab <ls|add|rm>');
+    }
+}
+// ── Dispatch ─────────────────────────────────────────────────────────────────
+async function main() {
+    const argv = process.argv.slice(2);
+    const flags = parseArgs(argv);
+    const cmd = flags.positional[0];
+    if (!cmd || flags.bool.has('help')) {
+        console.log(HELP);
+        return;
+    }
+    if (cmd === 'version' || flags.bool.has('version')) {
+        console.log(VERSION);
+        return;
+    }
+    switch (cmd) {
+        case 'help':
+            console.log(HELP);
+            return;
+        case 'login':
+            return cmdLogin(flags);
+        case 'logout':
+            return cmdLogout();
+        case 'whoami':
+            return cmdWhoami(flags);
+        case 'config':
+            return cmdConfig(flags);
+        case 'pulse':
+            return cmdPulse(flags);
+        case 'shield':
+            return cmdShield(flags);
+        case 'cache':
+            return cmdCache(flags);
+        case 'secrets':
+            return cmdSecrets(flags);
+        case 'ark':
+        case 'tillark':
+            return cmdArk(flags);
+        case 'forge':
+        case 'tillforge':
+            return cmdForge(flags);
+        case 'gate':
+        case 'tillgate':
+            return cmdGate(flags);
+        case 'auth':
+            return cmdAuth(flags);
+        case 'stacks':
+        case 'stack':
+            return cmdStacks(flags);
+        case 'team':
+            return cmdTeam(flags);
+        case 'keys':
+            return cmdKeys(flags);
+        default:
+            throw new Error(`unknown command: ${cmd}\n\nRun \`tilldev help\` for usage.`);
+    }
+}
+// ── TillDev Stacks — the global "app" that spans products ────────────────────
+async function cmdStacks(flags) {
+    const { opts, org } = resolveOpts(flags);
+    const action = flags.positional[1] ?? 'ls';
+    switch (action) {
+        case 'ls':
+        case 'list': {
+            const { stacks } = await api.listStacks(opts);
+            render(flags, { stacks }, () => {
+                console.log(table(stacks, [
+                    { header: 'SLUG', get: (s) => c.bold(s.slug) },
+                    { header: 'NAME', get: (s) => s.name },
+                    { header: 'PRODUCTS', get: (s) => String((s.modules ?? []).filter((m) => m.status === 'active').length) },
+                    { header: 'STATUS', get: (s) => (s.status === 'active' ? c.green(s.status) : c.gray(s.status)) },
+                ]));
+            });
+            return;
+        }
+        case 'show':
+        case 'get': {
+            const slug = need(flags.positional[2], 'tilldev stacks show <slug>');
+            const detail = await api.getStack(opts, slug);
+            render(flags, detail, () => {
+                ok(`Stack ${c.bold(detail.stack.name)} ${c.dim(`(${detail.stack.slug})`)}`);
+                console.log(kv([
+                    ['id', detail.stack.id],
+                    ['accent', detail.stack.accent],
+                    ['status', detail.stack.status],
+                    ['description', detail.stack.description || c.dim('—')],
+                ]));
+                console.log();
+                console.log(table(detail.modules, [
+                    { header: 'PRODUCT', get: (m) => c.bold(m.module) },
+                    { header: 'STATUS', get: (m) => (m.status === 'active' ? c.green(m.status) : c.yellow(m.status)) },
+                    { header: 'RESOURCES', get: (m) => String(detail.counts[m.module] ?? 0) },
+                ]));
+            });
+            return;
+        }
+        case 'create':
+        case 'new': {
+            const name = need(flags.named['name'] ?? flags.positional[2], 'tilldev stacks create <name> [--slug <s>] [--accent <hex>] [--modules pulse,auth,cache,…]');
+            const input = { name };
+            if (flags.named['slug'])
+                input.slug = flags.named['slug'];
+            if (flags.named['description'])
+                input.description = flags.named['description'];
+            if (flags.named['accent'])
+                input.accent = flags.named['accent'];
+            if (flags.named['modules'])
+                input.modules = flags.named['modules'].split(',').map((s) => s.trim()).filter(Boolean);
+            const { stack } = await api.createStack(opts, input);
+            render(flags, { stack }, () => {
+                ok(`Created stack ${c.bold(stack.name)} ${c.dim(`(${stack.slug})`)}`);
+                console.log(kv([['id', stack.id], ['accent', stack.accent], ['products', String((stack.modules ?? []).length)]]));
+                if (org)
+                    info(`Console: ${opts.apiUrl}/${org}/stacks/${stack.slug}`);
+                info(`Add a product:   tilldev stacks enable ${stack.slug} <product>`);
+                info(`Attach a resource: tilldev stacks attach ${stack.slug} <product> <resource-id>`);
+            });
+            return;
+        }
+        case 'enable':
+        case 'disable': {
+            const slug = need(flags.positional[2], `tilldev stacks ${action} <slug> <product>`);
+            const module = need(flags.positional[3], `tilldev stacks ${action} <slug> <product>`);
+            const status = action === 'enable' ? 'active' : 'paused';
+            const r = await api.setStackModule(opts, slug, module, status);
+            render(flags, r, () => ok(`${action === 'enable' ? 'Enabled' : 'Paused'} ${c.bold(module)} for ${c.bold(slug)}`));
+            return;
+        }
+        case 'attach':
+        case 'detach': {
+            const usage = `tilldev stacks ${action} <slug> <product> <resource-id>`;
+            const slug = need(flags.positional[2], usage);
+            const module = need(flags.positional[3], usage);
+            const rid = need(flags.positional[4], usage);
+            const r = await api.setStackResource(opts, slug, module, rid, action === 'attach' ? 'attach' : 'detach');
+            render(flags, r, () => ok(`${action === 'attach' ? 'Attached' : 'Detached'} ${c.bold(module)} ${c.dim(rid)} ${action === 'attach' ? 'to' : 'from'} ${c.bold(slug)}`));
+            return;
+        }
+        case 'rm':
+        case 'delete': {
+            const slug = need(flags.positional[2], 'tilldev stacks rm <slug>');
+            await api.deleteStack(opts, slug);
+            render(flags, { ok: true }, () => ok(`Deleted stack ${c.bold(slug)} ${c.dim('(resources un-grouped, not deleted)')}`));
+            return;
+        }
+        default:
+            throw new Error('usage: tilldev stacks <ls|show|create|enable|disable|attach|detach|rm>');
+    }
+}
+main().catch((err) => {
+    if (err instanceof ApiError) {
+        fail(err.message);
+        if (err.status === 401)
+            console.error(c.dim('hint: run `tilldev login` to refresh your token.'));
+    }
+    else {
+        fail(err instanceof Error ? err.message : String(err));
+    }
+    exit(1);
+});
+//# sourceMappingURL=index.js.map