@tpsdev-ai/flair 0.53.0 → 0.54.2

package/dist/commands/fleet.js

@@ -0,0 +1,73 @@
+import * as render from "../render.js";
+import { sweepFleet, renderFleetSweepTable, } from "../fleet-verify.js";
+let cli;
+/** Bind shared CLI helpers. cli.ts calls this immediately before register(program). */
+export function bindCli(fns) {
+    cli = fns;
+}
+function resolveFabricCredentials(opts) {
+    return cli.resolveFabricCredentials(opts);
+}
+export function register(program) {
+    // ─── flair fleet ────────────────────────────────────────────────────────────
+    //
+    // Fabric fleet operations (flair#636). `flair deploy` / `flair upgrade
+    // --target` already run this sweep automatically post-deploy (skippable
+    // with --no-fleet-verify) — this is the standalone entry point for running
+    // it independently, e.g. as a periodic health check or before a rolling
+    // restart step (see the flair#636 decision comment: this sweep is the gate
+    // between peers during a rolling restart, not the restart mechanism itself).
+    const fleet = program.command("fleet").description("Fabric fleet operations (post-deploy convergence verification)");
+    fleet
+        .command("verify")
+        .description("Sweep a Fabric origin + its known federation peers for version/health convergence")
+        .requiredOption("--target <url>", "Fabric URL to verify (the origin node)")
+        .option("--fabric-user <user>", "Fabric admin username (env: FABRIC_USER — preferred; inline leaks to ps/shell history)")
+        .option("--fabric-password <pass>", "Fabric admin password (prefer FABRIC_PASSWORD env or --fabric-password-file; inline leaks to shell history)")
+        .option("--fabric-password-file <path>", "Read the Fabric admin password from a mode-0600 file (keeps it out of argv and env)")
+        .option("--expect-version <semver>", "Version every node must report (default: the origin's own reported version — a self-consistency check)")
+        .option("--timeout <ms>", "Per-node /Health poll timeout in ms", "60000")
+        .option("--json", "Emit JSON (also: pipe + FLAIR_OUTPUT=json)")
+        .addHelpText("after", `
+Exit codes:
+  0  all probed nodes verified (unverifiable peers — no endpoint on file —
+     are listed as a warning and do not fail the run)
+  1  origin failed (unreachable, unauthenticated, or wrong version)
+  2  a reachable node diverged (wrong version) — NOT converged
+  3  a reachable peer was unreachable or rejected auth (not unverifiable)
+
+"peer" here means a Flair federation peer (GET /FederationPeers on the
+origin) — NOT Harper's own cluster-replication nodes, which the OSS
+harper build this CLI ships does not expose (cluster_status is
+a harper-pro-only operation). A Fabric replica that was never
+federation-paired (\`flair federation pair\`) is invisible to this sweep —
+see src/fleet-verify.ts's file header for the full caveat.`)
+        .action(async (opts) => {
+        // Single source of truth for cred resolution + shell-history warnings,
+        // shared with `flair upgrade --target` and `flair deploy`.
+        const { fabricUser, fabricPassword, warnings } = resolveFabricCredentials(opts);
+        for (const w of warnings)
+            console.error(render.wrap(render.c.dim, w));
+        if (!fabricUser || !fabricPassword) {
+            console.error(render.wrap(render.c.red, "flair fleet verify: credentials required"));
+            console.error("  set FABRIC_USER + FABRIC_PASSWORD env, or --fabric-password-file, or (discouraged) --fabric-user/--fabric-password inline");
+            process.exit(1);
+        }
+        const result = await sweepFleet({
+            target: opts.target,
+            fabricUser,
+            fabricPassword,
+            expectVersion: opts.expectVersion,
+            timeoutMs: Number(opts.timeout ?? 60_000),
+        });
+        const mode = render.resolveOutputMode(opts);
+        if (mode === "json") {
+            console.log(render.asJSON(result));
+        }
+        else {
+            console.log(render.wrap(render.c.bold, `Fleet verify — ${result.target}`));
+            console.log(renderFleetSweepTable(result));
+        }
+        process.exit(result.exitCode);
+    });
+}

package/dist/commands/grant.js

@@ -0,0 +1,109 @@
+let cli;
+/** Bind the cli-locals this module depends on. */
+export function bindCli(fns) {
+    cli = fns;
+}
+function resolveHttpPort(...args) {
+    return cli.resolveHttpPort(...args);
+}
+function resolveOpsPort(...args) {
+    return cli.resolveOpsPort(...args);
+}
+function resolveAdminUser(...args) {
+    return cli.resolveAdminUser(...args);
+}
+export function register(program) {
+    // ─── flair grant / revoke ─────────────────────────────────────────────────────
+    program
+        .command("grant <from-agent> <to-agent>")
+        .description("Grant an agent read access to another agent's memories")
+        .option("--scope <scope>", "Grant scope: read or search", "read")
+        .option("--port <port>", "Harper HTTP port")
+        .option("--ops-port <port>", "Harper operations API port")
+        .option("--admin-pass <pass>", "Admin password (or set FLAIR_ADMIN_PASS env)")
+        .option("--admin-user <name>", "Admin username for Basic auth (env: FLAIR_ADMIN_USER; default: admin)")
+        .option("--keys-dir <dir>", "Directory for Ed25519 keys (for from-agent Ed25519 auth)")
+        .action(async (fromAgent, toAgent, opts) => {
+        const httpPort = resolveHttpPort(opts);
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        const adminUser = resolveAdminUser(opts.adminUser);
+        const scope = opts.scope ?? "read";
+        if (!adminPass) {
+            console.error("Error: --admin-pass or FLAIR_ADMIN_PASS required for grant");
+            process.exit(1);
+        }
+        const auth = `Basic ${Buffer.from(`${adminUser}:${adminPass}`).toString("base64")}`;
+        const grantId = `${fromAgent}:${toAgent}`;
+        const body = {
+            operation: "insert",
+            database: "flair",
+            table: "MemoryGrant",
+            records: [{
+                    id: grantId,
+                    ownerId: fromAgent,
+                    granteeId: toAgent,
+                    scope,
+                    createdAt: new Date().toISOString(),
+                }],
+        };
+        const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: auth },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            if (res.status === 409 || text.includes("duplicate") || text.includes("already exists")) {
+                console.log(`ℹ️  Grant already exists: '${toAgent}' can already read '${fromAgent}'s memories`);
+                return;
+            }
+            throw new Error(`Failed to create grant (${res.status}): ${text}`);
+        }
+        console.log(`✅ Grant created: '${toAgent}' can now read '${fromAgent}'s memories`);
+        console.log(`   ID:    ${grantId}`);
+        console.log(`   Scope: ${scope}`);
+    });
+    program
+        .command("revoke <from-agent> <to-agent>")
+        .description("Revoke a memory grant between two agents")
+        .option("--port <port>", "Harper HTTP port")
+        .option("--ops-port <port>", "Harper operations API port")
+        .option("--admin-pass <pass>", "Admin password (or set FLAIR_ADMIN_PASS env)")
+        .option("--admin-user <name>", "Admin username for Basic auth (env: FLAIR_ADMIN_USER; default: admin)")
+        .action(async (fromAgent, toAgent, opts) => {
+        const httpPort = resolveHttpPort(opts);
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        const adminUser = resolveAdminUser(opts.adminUser);
+        if (!adminPass) {
+            console.error("Error: --admin-pass or FLAIR_ADMIN_PASS required for revoke");
+            process.exit(1);
+        }
+        const auth = `Basic ${Buffer.from(`${adminUser}:${adminPass}`).toString("base64")}`;
+        const grantId = `${fromAgent}:${toAgent}`;
+        const body = {
+            operation: "delete",
+            database: "flair",
+            table: "MemoryGrant",
+            ids: [grantId],
+        };
+        const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: auth },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            if (res.status === 404 || text.includes("not found")) {
+                console.log(`ℹ️  No grant found: '${toAgent}' does not have access to '${fromAgent}'s memories`);
+                return;
+            }
+            throw new Error(`Failed to revoke grant (${res.status}): ${text}`);
+        }
+        console.log(`✅ Grant revoked: '${toAgent}' can no longer read '${fromAgent}'s memories`);
+        console.log(`   Removed grant ID: ${grantId}`);
+    });
+}

package/dist/commands/hook.js

@@ -0,0 +1,193 @@
+import { homedir } from "node:os";
+import * as render from "../render.js";
+import { unpinnedSpecWarning } from "../lib/mcp-spec.js";
+import { readClientMcpBlock } from "../doctor-client.js";
+import { installHook, uninstallHook, hookStatus, hookStatusIdentityLines, HOOK_STATUS_UNPARSED, installContinuityHooks, uninstallContinuityHooks, continuityHookStatus, isSupportedHarness, SUPPORTED_HARNESSES, hookInstallHint, harnessSupportsContinuity, resolveHookAgentId, } from "../hook-install.js";
+let cli;
+/** Bind shared CLI helpers. cli.ts calls this immediately before register(program). */
+export function bindCli(fns) {
+    cli = fns;
+}
+function resolveBaseUrl(opts) {
+    return cli.resolveBaseUrl(opts);
+}
+/** Register the `flair hook` command group. */
+export function register(program) {
+    // ─── flair hook ──────────────────────────────────────────────────────────────
+    // Ambient memory via harness SessionStart hooks (flair#745, design record
+    // #719 — the "Paved-paths" round). `flair doctor --fix`/`flair init` already
+    // wire the same SessionStart hook as a side effect of a bigger flow; this is
+    // the standalone, symmetric command family (install/uninstall/status) an
+    // operator or a headless/scheduled setup script can run on its own. All the
+    // mutation logic (fail-closed on malformed settings.json, idempotent merge,
+    // dry-run delta, symmetric removal) lives in src/hook-install.ts — this
+    // section is pure CLI plumbing: option parsing, default resolution, and
+    // rendering the pure functions' results.
+    function resolveHookFlairUrl(opts, homeDir, harness) {
+        return (opts.url ||
+            process.env.FLAIR_TARGET ||
+            process.env.FLAIR_URL ||
+            readClientMcpBlock(harness, homeDir).flairUrl ||
+            (harness !== "claude-code" ? readClientMcpBlock("claude-code", homeDir).flairUrl : undefined) ||
+            resolveBaseUrl({}));
+    }
+    function requireSupportedHarness(raw) {
+        const name = raw || "claude-code";
+        if (!isSupportedHarness(name)) {
+            console.error(`Unknown harness '${name}'. Supported: ${SUPPORTED_HARNESSES.join(", ")}`);
+            process.exit(1);
+        }
+        return name;
+    }
+    const hook = program.command("hook").description("Manage ambient-memory harness SessionStart hooks (flair#745)");
+    hook
+        .command("install")
+        .description("Wire the Flair SessionStart hook into the harness config so memory loads automatically at session start")
+        .option("--harness <name>", `Target harness (${SUPPORTED_HARNESSES.join(", ")})`, "claude-code")
+        .option("--dry-run", "Print the exact JSON delta without writing")
+        .option("--agent <id>", "Agent ID to wire (else FLAIR_AGENT_ID, else the agent already wired for this harness's MCP client)")
+        .option("--agent-id <id>", "Alias for --agent")
+        .option("--url <url>", "Flair URL to wire (else FLAIR_TARGET/FLAIR_URL, else this harness's MCP wiring, else the local default)")
+        .option("--continuity", "Wire the continuity capture hooks instead (PostToolUse + Stop — flair#1257; installing them IS the opt-in)")
+        .action((opts) => {
+        const harness = requireSupportedHarness(opts.harness);
+        const home = homedir();
+        const agentId = resolveHookAgentId(opts, home, harness);
+        if (!agentId) {
+            console.error("No agent id known — pass --agent <id>, set FLAIR_AGENT_ID, or run `flair init` / `flair agent add` first.");
+            process.exit(1);
+        }
+        const flairUrl = resolveHookFlairUrl(opts, home, harness);
+        const dryRun = !!opts.dryRun;
+        if (opts.continuity) {
+            const result = installContinuityHooks({ homeDir: home, harness, agentId, flairUrl, dryRun });
+            console.log(`\n${render.wrap(render.c.bold, "🪝 flair hook install --continuity")}${dryRun ? render.wrap(render.c.dim, " (dry run)") : ""}\n`);
+            console.log(`  ${result.ok ? render.icons.ok : render.icons.error} ${result.message}`);
+            if (result.backupPath) {
+                console.log(`     ${render.wrap(render.c.dim, `backup: ${result.backupPath}`)}`);
+            }
+            console.log("");
+            if (!result.ok)
+                process.exit(1);
+            return;
+        }
+        const result = installHook({ homeDir: home, harness, agentId, flairUrl, dryRun });
+        console.log(`\n${render.wrap(render.c.bold, "🪝 flair hook install")}${dryRun ? render.wrap(render.c.dim, " (dry run)") : ""}\n`);
+        console.log(`  ${result.ok ? render.icons.ok : render.icons.error} ${result.message}`);
+        const pinWarning = unpinnedSpecWarning();
+        if (pinWarning && result.ok) {
+            for (const line of pinWarning.split("\n"))
+                console.error(`   ⚠ ${line}`);
+        }
+        if (result.backupPath) {
+            console.log(`     ${render.wrap(render.c.dim, `backup: ${result.backupPath}`)}`);
+        }
+        if (result.delta) {
+            console.log(`\n  ${render.wrap(render.c.dim, `${dryRun ? "would apply" : "applied"} (${result.delta.action}):`)}`);
+            console.log(render.asJSON(result.delta));
+        }
+        console.log("");
+        if (!result.ok)
+            process.exit(1);
+    });
+    hook
+        .command("uninstall")
+        .description("Remove the Flair SessionStart hook entry — only ours, everything else in the file is left untouched")
+        .option("--harness <name>", `Target harness (${SUPPORTED_HARNESSES.join(", ")})`, "claude-code")
+        .option("--dry-run", "Print the exact JSON delta without writing")
+        .option("--continuity", "Remove the continuity capture hooks instead (PostToolUse + Stop — flair#1257)")
+        .action((opts) => {
+        const harness = requireSupportedHarness(opts.harness);
+        const home = homedir();
+        const dryRun = !!opts.dryRun;
+        if (opts.continuity) {
+            const result = uninstallContinuityHooks({ homeDir: home, harness, dryRun });
+            console.log(`\n${render.wrap(render.c.bold, "🪝 flair hook uninstall --continuity")}${dryRun ? render.wrap(render.c.dim, " (dry run)") : ""}\n`);
+            console.log(`  ${result.ok ? render.icons.ok : render.icons.error} ${result.message}`);
+            if (result.backupPath) {
+                console.log(`     ${render.wrap(render.c.dim, `backup: ${result.backupPath}`)}`);
+            }
+            console.log("");
+            if (!result.ok)
+                process.exit(1);
+            return;
+        }
+        const result = uninstallHook({ homeDir: home, harness, dryRun });
+        console.log(`\n${render.wrap(render.c.bold, "🪝 flair hook uninstall")}${dryRun ? render.wrap(render.c.dim, " (dry run)") : ""}\n`);
+        console.log(`  ${result.ok ? render.icons.ok : render.icons.error} ${result.message}`);
+        if (result.backupPath) {
+            console.log(`     ${render.wrap(render.c.dim, `backup: ${result.backupPath}`)}`);
+        }
+        if (result.delta) {
+            console.log(`\n  ${render.wrap(render.c.dim, `${dryRun ? "would apply" : "applied"} (${result.delta.action}):`)}`);
+            console.log(render.asJSON(result.delta));
+        }
+        console.log("");
+        if (!result.ok)
+            process.exit(1);
+    });
+    hook
+        .command("status")
+        .description("Show whether the SessionStart hook is wired, its shape, and which Flair instance it targets")
+        .option("--harness <name>", `Target harness (${SUPPORTED_HARNESSES.join(", ")})`, "claude-code")
+        .action((opts) => {
+        const harness = requireSupportedHarness(opts.harness);
+        const home = homedir();
+        const status = hookStatus(home, harness);
+        // Continuity pair (flair#1257) — reported alongside the SessionStart
+        // status in every branch below. "absent" is NOT a failure: installing the
+        // pair is the opt-in, so absence renders as "not enabled".
+        const renderContinuity = () => {
+            // Continuity is Claude Code only. Do not tip `--continuity --harness
+            // <other>` — that writes Claude tool matchers into the wrong file.
+            if (!harnessSupportsContinuity(harness))
+                return;
+            const cont = continuityHookStatus(home, harness);
+            if (cont.state === "installed") {
+                console.log(`  ${render.icons.ok} continuity capture: PostToolUse + Stop wired`);
+            }
+            else if (cont.state === "absent") {
+                console.log(`  ${render.icons.info} continuity capture: not enabled ${render.wrap(render.c.dim, `(opt-in: ${hookInstallHint(harness, "--continuity")})`)}`);
+            }
+            else {
+                const missing = !cont.postToolUse.present ? "PostToolUse missing" : !cont.stop.present ? "Stop missing" : "stale form";
+                console.log(`  ${render.icons.warn} continuity capture: ${cont.state} (${missing}) ${render.wrap(render.c.dim, `— re-run: ${hookInstallHint(harness, "--continuity")}`)}`);
+            }
+        };
+        console.log(`\n${render.wrap(render.c.bold, "🪝 flair hook status")}\n`);
+        console.log(`  ${render.wrap(render.c.dim, "Harness:")} ${status.harness}`);
+        console.log(`  ${render.wrap(render.c.dim, "Config:")}  ${status.path}`);
+        if (status.parseError) {
+            console.log(`  ${render.icons.error} ${status.parseError}`);
+            console.log("");
+            process.exit(1);
+        }
+        if (!status.wired) {
+            console.log(`  ${render.icons.error} not wired`);
+            console.log(`     ${render.wrap(render.c.dim, "Fix:")} ${hookInstallHint(status.harness)}`);
+            renderContinuity();
+            console.log("");
+            process.exit(1);
+        }
+        console.log(`  ${status.correctShape ? render.icons.ok : render.icons.warn} wired${status.correctShape ? "" : " (unexpected shape — was it hand-edited?)"}`);
+        // flair#1325 — skip the URL line only when agentId was recovered
+        // (the installer form that omits FLAIR_URL). A wired correct-shape
+        // command with no env assignments still prints unknown, not a
+        // silent all-clear.
+        for (const line of hookStatusIdentityLines(status)) {
+            const label = line.label === "Agent" ? "Agent:    " : "Flair URL:";
+            const value = line.value === HOOK_STATUS_UNPARSED ? render.wrap(render.c.dim, line.value) : line.value;
+            console.log(`     ${render.wrap(render.c.dim, label)} ${value}`);
+        }
+        // flair#1007 — whether a command that stopped resolving would fail quietly
+        // or print an error on every session start.
+        if (status.silenced) {
+            console.log(`     ${render.wrap(render.c.dim, "On failure:")} silent (exit 0, no output)`);
+        }
+        else {
+            console.log(`     ${render.icons.warn} ${render.wrap(render.c.dim, "On failure:")} prints an error on every session — run \`${hookInstallHint(status.harness)}\` to adopt the silent form`);
+        }
+        renderContinuity();
+        console.log("");
+    });
+}

package/dist/commands/idp.js

@@ -0,0 +1,193 @@
+import { randomUUID } from "node:crypto";
+import * as render from "../render.js";
+import { resolveAdminUser } from "../lib/auth-resolve.js";
+let cli;
+/** Bind shared CLI helpers. cli.ts calls this immediately before register(program). */
+export function bindCli(fns) {
+    cli = fns;
+}
+function api(...args) {
+    return cli.api(...args);
+}
+function resolveOpsPort(opts) {
+    return cli.resolveOpsPort(opts);
+}
+/** Register the `flair idp` command group. */
+export function register(program) {
+    // ─── flair idp ───────────────────────────────────────────────────────────────
+    // XAA Enterprise IdP configuration (per FLAIR-XAA spec § 4).
+    const idp = program.command("idp").description("Manage enterprise IdP configurations (XAA)");
+    idp
+        .command("add")
+        .description("Register a trusted enterprise IdP")
+        .requiredOption("--name <name>", "Display name (e.g., 'Harper Corporate')")
+        .requiredOption("--issuer <url>", "IdP issuer URL (e.g., https://accounts.google.com)")
+        .requiredOption("--jwks-uri <url>", "JWKS endpoint URL")
+        .requiredOption("--client-id <id>", "Flair's client_id at this IdP")
+        .option("--required-domain <domain>", "Reject tokens without this domain (hd/tid claim)")
+        .option("--no-jit-provision", "Disable auto-creation of principals for new IdP users")
+        .option("--default-trust <tier>", "Trust tier for JIT principals", "unverified")
+        .option("--admin-pass <pass>", "Admin password")
+        .option("--admin-user <name>", "Admin username for Basic auth (env: FLAIR_ADMIN_USER; default: admin)")
+        .option("--ops-port <port>", "Harper operations API port")
+        .action(async (opts) => {
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        if (!adminPass) {
+            console.error("Error: --admin-pass or FLAIR_ADMIN_PASS required");
+            process.exit(1);
+        }
+        const id = `idp_${randomUUID().slice(0, 8)}`;
+        const auth = `Basic ${Buffer.from(`${resolveAdminUser(opts.adminUser)}:${adminPass}`).toString("base64")}`;
+        const now = new Date().toISOString();
+        const record = {
+            id,
+            name: opts.name,
+            issuer: opts.issuer,
+            jwksUri: opts.jwksUri,
+            clientId: opts.clientId,
+            requiredDomain: opts.requiredDomain ?? null,
+            jitProvision: opts.jitProvision !== false,
+            defaultTrustTier: opts.defaultTrust ?? "unverified",
+            enabled: true,
+            createdAt: now,
+            updatedAt: now,
+        };
+        const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: auth },
+            body: JSON.stringify({ operation: "upsert", database: "flair", table: "IdpConfig", records: [record] }),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            console.error(`Error: ${res.status} ${text}`);
+            process.exit(1);
+        }
+        console.log(`✅ IdP '${opts.name}' registered (id: ${id})`);
+        console.log(`   Issuer:   ${opts.issuer}`);
+        console.log(`   JWKS:     ${opts.jwksUri}`);
+        console.log(`   Client:   ${opts.clientId}`);
+        if (opts.requiredDomain)
+            console.log(`   Domain:   ${opts.requiredDomain}`);
+        console.log(`   JIT:      ${opts.jitProvision !== false}`);
+    });
+    idp
+        .command("list")
+        .description("List configured IdPs")
+        .option("--admin-pass <pass>", "Admin password")
+        .option("--admin-user <name>", "Admin username for Basic auth (env: FLAIR_ADMIN_USER; default: admin)")
+        .option("--ops-port <port>", "Harper operations API port")
+        .option("--json", "Emit raw JSON array (also: pipe + FLAIR_OUTPUT=json)")
+        .action(async (opts) => {
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        if (!adminPass) {
+            console.error(`${render.icons.error} --admin-pass or FLAIR_ADMIN_PASS required`);
+            process.exit(1);
+        }
+        const auth = `Basic ${Buffer.from(`${resolveAdminUser(opts.adminUser)}:${adminPass}`).toString("base64")}`;
+        const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: auth },
+            body: JSON.stringify({
+                operation: "search_by_value",
+                schema: "flair",
+                table: "IdpConfig",
+                search_attribute: "id",
+                search_type: "starts_with",
+                search_value: "",
+                get_attributes: ["id", "name", "issuer", "requiredDomain", "jitProvision", "enabled", "createdAt"],
+            }),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            console.error(`${render.icons.error} ${res.status} ${text}`);
+            process.exit(1);
+        }
+        const records = await res.json();
+        records.sort((a, b) => (a.createdAt ?? "").localeCompare(b.createdAt ?? ""));
+        const mode = render.resolveOutputMode(opts);
+        if (mode === "json") {
+            console.log(render.asJSON(records));
+            return;
+        }
+        if (records.length === 0) {
+            console.log(`${render.icons.info} ${render.wrap(render.c.dim, "no IdPs configured")}`);
+            return;
+        }
+        console.log(`${render.wrap(render.c.bold, String(records.length))} IdP${records.length === 1 ? "" : "s"}\n`);
+        for (const r of records) {
+            const enabled = r.enabled ? render.wrap(render.c.green, "enabled") : render.wrap(render.c.dim, "disabled");
+            console.log(`${render.wrap(render.c.bold, r.name ?? "?")}  ${render.wrap(render.c.dim, `(${r.id})`)}  ${render.wrap(render.c.dim, "—")}  ${enabled}`);
+            console.log(render.kv("issuer", String(r.issuer ?? "—")));
+            if (r.requiredDomain)
+                console.log(render.kv("domain", String(r.requiredDomain)));
+            console.log(render.kv("JIT", String(r.jitProvision ?? true)));
+            console.log();
+        }
+    });
+    idp
+        .command("remove <id>")
+        .description("Remove an IdP configuration")
+        .option("--admin-pass <pass>", "Admin password")
+        .option("--admin-user <name>", "Admin username for Basic auth (env: FLAIR_ADMIN_USER; default: admin)")
+        .option("--ops-port <port>", "Harper operations API port")
+        .action(async (id, opts) => {
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        if (!adminPass) {
+            console.error("Error: --admin-pass or FLAIR_ADMIN_PASS required");
+            process.exit(1);
+        }
+        const auth = `Basic ${Buffer.from(`${resolveAdminUser(opts.adminUser)}:${adminPass}`).toString("base64")}`;
+        const res = await fetch(`http://127.0.0.1:${opsPort}/`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", Authorization: auth },
+            body: JSON.stringify({ operation: "delete", database: "flair", table: "IdpConfig", hash_values: [id] }),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => "");
+            console.error(`Error: ${res.status} ${text}`);
+            process.exit(1);
+        }
+        console.log(`✅ IdP '${id}' removed`);
+    });
+    idp
+        .command("test <id>")
+        .description("Test IdP connectivity (fetches JWKS)")
+        .option("--admin-pass <pass>", "Admin password")
+        .option("--ops-port <port>", "Harper operations API port")
+        .action(async (id, opts) => {
+        const opsPort = resolveOpsPort(opts);
+        const adminPass = opts.adminPass ?? process.env.FLAIR_ADMIN_PASS ?? "";
+        if (!adminPass) {
+            console.error("Error: --admin-pass or FLAIR_ADMIN_PASS required");
+            process.exit(1);
+        }
+        let cfg;
+        try {
+            cfg = await api("GET", `/IdpConfig/${id}`);
+        }
+        catch {
+            console.error(`IdP '${id}' not found`);
+            process.exit(1);
+        }
+        console.log(`Testing IdP: ${cfg.name} (${cfg.issuer})`);
+        console.log(`  JWKS endpoint: ${cfg.jwksUri}`);
+        try {
+            const jwksRes = await fetch(cfg.jwksUri, { signal: AbortSignal.timeout(10_000) });
+            if (!jwksRes.ok) {
+                console.error(`  ❌ JWKS fetch failed: HTTP ${jwksRes.status}`);
+                process.exit(1);
+            }
+            const jwks = await jwksRes.json();
+            const keyCount = jwks.keys?.length ?? 0;
+            console.log(`  ✅ JWKS reachable — ${keyCount} key(s) found`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`  ❌ JWKS fetch error: ${message}`);
+            process.exit(1);
+        }
+    });
+}