@worldlabsai/cli 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,68 @@
+# World Labs CLI
+
+Use the World Labs Developer API from a terminal or coding agent with a manually issued API key. The published package has zero npm runtime dependencies; the public SDK is bundled.
+
+With Node 24 or newer, install the CLI and configure your key:
+
+```sh
+npm install -g @worldlabsai/cli && worldlabs setup
+```
+
+On Windows, run these commands in Command Prompt.
+
+`setup` opens the API keys page, prompts you to paste a new key without echoing it, validates it with `assets.list`, and saves it in a plaintext file in your user configuration directory. It can also install the general skill for Codex or Claude Code; you can skip skill installation. Use `worldlabs setup --help` for options.
+
+## Onboarding
+
+```mermaid
+flowchart TD
+    A[Install CLI] --> B[worldlabs setup]
+    B --> C[Create API key on website]
+    C --> D[Paste key into hidden prompt]
+    D --> E[Validate with assets.list]
+    E --> F[Save credentials file]
+    F --> G[Optionally install Codex or Claude Code skill]
+    F --> H[Upload assets and run tasks]
+```
+
+On the API keys page, choose only the scopes required for your work: task submission, asset upload, operation polling, and asset download. The available choices and descriptions appear in the key creation form. The key belongs to the selected project. Store it as a secret; revoke it from the website if it is exposed or no longer needed.
+
+## Commands
+
+| Command                                                                                     | Purpose                                                                                                                          |
+| ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `setup [--client codex\|claude-code]`                                                       | Configure the API key and optionally install the agent skill. Without `--client`, noninteractive setup skips skill installation. |
+| `auth login [--no-browser]`                                                                 | Open the API keys page, or print its URL for manual opening.                                                                     |
+| `auth status`                                                                               | Check the key through `assets.list` without printing it. This does not validate every generation scope.                          |
+| `auth logout`                                                                               | Remove the locally stored key. Revoke the key on the website to invalidate it.                                                   |
+| `tasks list`                                                                                | List tasks available through the public SDK.                                                                                     |
+| `tasks run <name> --request file.json [--idempotency-key key] [--wait] [--timeout seconds]` | Submit a task request; optionally wait for its operation. Some SDK tasks require beta entitlement.                               |
+| `assets upload file [--mime type]`                                                          | Upload a local file.                                                                                                             |
+| `assets download id --out file`                                                             | Download an asset to a local path.                                                                                               |
+| `assets list [--page-token token]`                                                          | List accessible assets.                                                                                                          |
+| `operations get id`                                                                         | Read an operation.                                                                                                               |
+| `operations wait id [--timeout seconds]`                                                    | Poll an operation until it finishes or the timeout expires. The default timeout is 600 seconds.                                  |
+| `skills install\|uninstall --client codex\|claude-code`                                     | Install or remove the general agent skill.                                                                                       |
+
+Use `--request -` to read task JSON from standard input. Results go to stdout; diagnostics go to stderr, so a result can be saved without mixing in progress messages:
+
+```sh
+worldlabs tasks run atlasGenerate --request - --wait --json < request.json > result.json
+```
+
+Use `--json` for machine-readable output. Task submission generates an idempotency key and prints it to stderr before sending the request. Save that value and pass it back with `--idempotency-key` to retry an uncertain submission. The bundled `@worldlabsai/client-next` SDK handles API retries and operation polling.
+
+Skill updates and removal refuse to change a directory with local edits or unrelated files. Move a customized `worldlabs` skill aside before reinstalling.
+
+The installed skill includes task descriptions and an upload/submit/result example. It points to
+[How To Use Atlas](https://marble5.worldlabs.ai/docs/how-to-use-atlas) for maintained guidance on model inputs, cameras, and task combinations.
+
+## Configuration
+
+The CLI uses `https://api.atlas-beta.worldlabs.ai` by default. Saved keys live in separate files per API origin under `~/.config/worldlabs/credentials/`. On macOS/Linux, new directories use mode `700` and new files use mode `600`. On Windows, files inherit the directory permissions. Keys are plaintext, so programs running as your user can read them. `auth status` shows the saved file location.
+
+Set `WORLDLABS_CONFIG_DIR` to use another configuration directory, such as a temporary directory for tests. Keep it outside repositories. `WLT_API_KEY` takes precedence over saved keys for automation. Generated Windows skill commands use PowerShell.
+
+For development or a nonproduction deployment, set `WORLDLABS_API_ORIGIN` and, when needed, `WORLDLABS_API_KEYS_URL`. The key page defaults to `https://atlas-beta.worldlabs.ai/api-keys`. Do not commit credentials, client IDs, or nonproduction hostnames.
+
+See the [World Labs CLI skill](skills/worldlabs/SKILL.md).

package/dist/index.js

@@ -0,0 +1,963 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync } from "node:fs";
+import { parseArgs as parseArgs2 } from "node:util";
+
+// ../client/dist/core/sleep.js
+var sleep = async (ms, signal) => {
+  if (signal?.aborted) {
+    return;
+  }
+  await new Promise((resolve) => {
+    const finish = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", finish);
+      resolve();
+    };
+    const timer = setTimeout(finish, ms);
+    signal?.addEventListener("abort", finish, { once: true });
+  });
+};
+
+// ../client/dist/core/transport.js
+var errorDetail = (body) => {
+  if (typeof body !== "object" || body === null) {
+    return void 0;
+  }
+  for (const key of ["detail", "message"]) {
+    const value = Reflect.get(body, key);
+    if (typeof value === "string" && value !== "") {
+      return value;
+    }
+  }
+  return void 0;
+};
+var ApiError = class extends Error {
+  name = "ApiError";
+  /** HTTP status and headers. The response body has already been consumed. */
+  response;
+  /**
+   * Parsed JSON or text for API failures; raw text for upload failures.
+   * Empty API response bodies are `undefined`.
+   */
+  body;
+  constructor(response, body) {
+    const where = response.url === "" ? "" : ` for ${response.url}`;
+    super(`${response.status} ${errorDetail(body) ?? response.statusText}${where}`);
+    this.response = response;
+    this.body = body;
+  }
+};
+var fillPath = (path, params) => path.replaceAll(/\{(?<name>\w+)\}/gu, (_, name) => {
+  const value = params[name];
+  if (value === void 0) {
+    throw new Error(`Missing path parameter "${name}" for ${path}`);
+  }
+  return encodeURIComponent(value);
+});
+var compose = (middleware, fetch2) => {
+  let next = fetch2;
+  for (const layer of middleware.toReversed()) {
+    const inner = next;
+    next = async (request) => await layer(request, inner);
+  }
+  return next;
+};
+var parseBody = async (response) => {
+  const text2 = await response.text();
+  if (text2 === "") {
+    return void 0;
+  }
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+};
+var RETRYABLE_STATUS_CODES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+var retryDelay = (error, attempt) => {
+  const backoff = 1e3 * 2 ** attempt * (0.5 + Math.random() / 2);
+  const value = error instanceof ApiError ? error.response.headers.get("retry-after")?.trim() : void 0;
+  if (!value) {
+    return backoff;
+  }
+  const delay = /^\d+$/u.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+  return Math.max(backoff, Number.isFinite(delay) ? delay : 0);
+};
+var createTransport = (options) => {
+  const fetch2 = options.fetch ?? (async (request) => await globalThis.fetch(request));
+  const send = compose(options.middleware ?? [], fetch2);
+  const baseUrl = String(options.baseUrl).replace(/\/+$/u, "");
+  const boundParams = options.pathParams ?? {};
+  return {
+    fetch: fetch2,
+    send,
+    request: async (path, { body, params, query, retry = false, ...init } = {}) => {
+      const url = new URL(baseUrl + fillPath(path, { ...boundParams, ...params }));
+      for (const [key, value] of Object.entries(query ?? {})) {
+        if (value !== void 0 && value !== null) {
+          url.searchParams.set(key, String(value));
+        }
+      }
+      const headers = new Headers(init.headers);
+      if (body !== void 0) {
+        headers.set("content-type", "application/json");
+      }
+      const request = new Request(url, {
+        ...init,
+        headers,
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+      let networkError;
+      const sendRequest = retry ? compose(options.middleware ?? [], async (attempt) => {
+        try {
+          return await fetch2(attempt);
+        } catch (error) {
+          networkError = error;
+          throw error;
+        }
+      }) : send;
+      for (let attempt = 0; ; attempt += 1) {
+        request.signal.throwIfAborted();
+        networkError = void 0;
+        try {
+          const response = await sendRequest(retry ? request.clone() : request);
+          let parsed;
+          try {
+            parsed = await parseBody(response);
+          } catch (error) {
+            if (!response.ok) {
+              throw new ApiError(response, void 0);
+            }
+            networkError = error;
+            throw error;
+          }
+          if (!response.ok) {
+            throw new ApiError(response, parsed);
+          }
+          return parsed;
+        } catch (error) {
+          request.signal.throwIfAborted();
+          const transient = error instanceof ApiError ? RETRYABLE_STATUS_CODES.has(error.response.status) : error instanceof TypeError && error === networkError;
+          if (!retry || attempt >= 3 || !transient) {
+            throw error;
+          }
+          await sleep(retryDelay(error, attempt), request.signal);
+        }
+      }
+    }
+  };
+};
+var withHeader = (request, name, value) => {
+  const headers = new Headers(request.headers);
+  headers.set(name, value);
+  return new Request(request, { headers });
+};
+var apiKeyAuth = (apiKey) => async (request, next) => {
+  const key = typeof apiKey === "function" ? await apiKey() : apiKey;
+  if (!key)
+    throw new Error("No API key is available for the Developer API request");
+  return await next(withHeader(request, "WLT-Api-Key", key));
+};
+
+// ../client/dist/core/assets.js
+var assetId = (asset) => asset.id;
+var toBlob = (data, mimeType) => {
+  if (data instanceof Blob) {
+    return mimeType === void 0 || mimeType === data.type ? data : new Blob([data], { type: mimeType });
+  }
+  return new Blob([data], { type: mimeType ?? "" });
+};
+var createAssets = (transport, assetsPath2) => {
+  const itemPath = `${assetsPath2}/{asset}`;
+  const create = async (asset, signal) => await transport.request(assetsPath2, {
+    body: { asset },
+    method: "POST",
+    ...signal ? { signal } : {}
+  });
+  const completeUpload = async (id, body = {}, options = {}) => await transport.request(`${itemPath}:completeUpload`, {
+    body,
+    method: "POST",
+    params: { asset: id },
+    ...options
+  });
+  return {
+    /**
+     * Finalize an asset after its bytes have been uploaded.
+     * @param id - Asset ID from {@link assetId}.
+     * @returns The updated asset resource.
+     */
+    completeUpload,
+    /** Create an asset record. Use `upload` to create and upload a single file in one call. */
+    create: async (asset, options = {}) => await create(asset, options.signal),
+    /**
+     * Create a temporary signed URL for reading an asset's stored bytes.
+     * @param id - Asset ID from {@link assetId}.
+     */
+    createReadUrl: async (id, options = {}) => await transport.request(`${itemPath}:createReadUrl`, {
+      method: "POST",
+      params: { asset: id },
+      ...options
+    }),
+    /**
+     * Soft-delete an asset.
+     * @param id - Asset ID from {@link assetId}.
+     */
+    delete: async (id, options = {}) => {
+      await transport.request(itemPath, { method: "DELETE", params: { asset: id }, ...options });
+    },
+    /**
+     * Fetch asset metadata.
+     * @param id - Asset ID from {@link assetId}.
+     */
+    get: async (id, options = {}) => await transport.request(itemPath, { params: { asset: id }, ...options }),
+    /** Return one page of assets. Pass the response's `nextPageToken` to retrieve the next page. */
+    list: async ({ pageSize, pageToken, state, ...options } = {}) => await transport.request(assetsPath2, {
+      query: { pageSize, pageToken, state },
+      ...options
+    }),
+    /**
+     * Create an asset, upload the bytes, and mark the upload complete.
+     *
+     * @param data - Bytes to upload. A `Blob` supplies its own MIME type when present.
+     * @param options - Display name, MIME type, and cancellation settings.
+     * @returns The completed asset. Pass it to {@link assetRef} to use it in a task.
+     * @throws {Error} If neither `mimeType` nor the input `Blob` supplies a MIME type.
+     * @throws {ApiError} If an API request or storage upload fails with a non-2xx status.
+     */
+    upload: async (data, { displayName, mimeType, signal }) => {
+      const blob = toBlob(data, mimeType);
+      if (blob.type === "") {
+        throw new Error("upload needs a mimeType when the data does not carry one");
+      }
+      const init = signal ? { signal } : {};
+      const created = await create({ displayName }, signal);
+      const id = assetId(created);
+      const ticket = await transport.request(`${itemPath}:createUploadUrl`, {
+        body: { contentLength: blob.size, contentType: blob.type },
+        method: "POST",
+        params: { asset: id },
+        ...init
+      });
+      const stored = await transport.fetch(new Request(ticket.uploadUrl, {
+        body: blob,
+        headers: ticket.headers ?? {},
+        method: ticket.method,
+        ...init
+      }));
+      if (!stored.ok) {
+        throw new ApiError(stored, await stored.text());
+      }
+      return await completeUpload(id, { sizeBytes: blob.size }, init);
+    }
+  };
+};
+
+// ../client/dist/core/operations.js
+var DEFAULT_POLL_INTERVAL_MS = 1e3;
+var waitForOperation = async (fetchOperation, { pollIntervalMs = DEFAULT_POLL_INTERVAL_MS, signal } = {}) => {
+  for (; ; ) {
+    signal?.throwIfAborted();
+    const operation = await fetchOperation(signal);
+    if (operation.done) {
+      return { ...operation, done: true };
+    }
+    await sleep(pollIntervalMs, signal);
+  }
+};
+var createOperations = (transport, operationPath2) => {
+  const get = async (operationId, { signal, wait } = {}) => await transport.request(operationPath2, {
+    params: { operation: operationId },
+    query: { wait },
+    ...signal ? { signal } : {}
+  });
+  return {
+    /** Fetch the current state of an operation by its id. */
+    get: async (operationId, options = {}) => await get(operationId, options),
+    /**
+     * Poll until an operation is done. The returned operation keeps the response type
+     * associated with the task that created it.
+     *
+     * An operation can finish with an API-reported task error; inspect `error` before
+     * reading `response`. Aborting stops local waiting without canceling the task.
+     * HTTP 502, 503, and 504 polling failures are retried up to three times in a row;
+     * a successful poll resets the retry count.
+     *
+     * @param operation - Operation returned by task submission. Completed operations return immediately.
+     * @param options - Polling interval and abort signal; no overall timeout by default.
+     * @throws {ApiError} If polling fails with an unretried status or exhausts gateway retries.
+     */
+    wait: async (operation, options) => {
+      options?.signal?.throwIfAborted();
+      if (operation.done) {
+        return { ...operation, done: true };
+      }
+      let gatewayErrors = 0;
+      return await waitForOperation(async (signal) => {
+        try {
+          const current = await get(operation.id, {
+            ...signal ? { signal } : {},
+            wait: true
+          });
+          gatewayErrors = 0;
+          return current;
+        } catch (error) {
+          gatewayErrors += 1;
+          if (!(error instanceof ApiError) || ![502, 503, 504].includes(error.response.status) || gatewayErrors > 3) {
+            throw error;
+          }
+          return operation;
+        }
+      }, options);
+    }
+  };
+};
+
+// ../client/dist/core/tasks.js
+var submitTask = async (transport, path, body, { idempotencyKey = crypto.randomUUID(), signal, wait } = {}) => {
+  if (idempotencyKey.trim() === "") {
+    throw new Error("Idempotency key must not be empty");
+  }
+  return await transport.request(path, {
+    body,
+    headers: { "Idempotency-Key": idempotencyKey },
+    method: "POST",
+    query: { wait },
+    retry: true,
+    ...signal ? { signal } : {}
+  });
+};
+
+// ../client/dist/generated/tasks.gen.js
+var operationPath = "/api/v2/operations/{operation}";
+var assetsPath = "/api/v2/assets";
+var createTasks = (transport) => ({
+  /**
+   * Submit the atlasChisel task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  atlasChisel: async (body, options) => await submitTask(transport, "/api/v2/tasks:atlasChisel", body, options),
+  /**
+   * Submit the atlasGenerate task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  atlasGenerate: async (body, options) => await submitTask(transport, "/api/v2/tasks:atlasGenerate", body, options),
+  /**
+   * Submit the atlasMasked task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  atlasMasked: async (body, options) => await submitTask(transport, "/api/v2/tasks:atlasMasked", body, options),
+  /**
+   * Submit the atlasTextToImage task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  atlasTextToImage: async (body, options) => await submitTask(transport, "/api/v2/tasks:atlasTextToImage", body, options),
+  /**
+   * Submit the images2PosedRGBD task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  images2PosedRGBD: async (body, options) => await submitTask(transport, "/api/v2/tasks:images2PosedRGBD", body, options),
+  /**
+   * Submit the splats2Mesh task
+   * Retries network failures and HTTP 429/502/503/504 up to three times with the same key and body.
+   *
+   * @param body - Task inputs and settings.
+   * @param options - Abort signal, idempotency key, and server-wait preference.
+   * @returns An operation to pass to `client.operations.wait` for the typed result.
+   * Check the completed operation's `error` before reading its `response`.
+   * @throws {ApiError} If the API rejects the submission or retries are exhausted.
+   * @beta Requires beta access for your account.
+   */
+  splats2Mesh: async (body, options) => await submitTask(transport, "/api/v2/tasks:splats2Mesh", body, options)
+});
+
+// ../client/dist/client.js
+var DEFAULT_BASE_URL = "https://api.atlas-beta.worldlabs.ai";
+var createClient = (options) => {
+  const middleware = [
+    ...options.apiKey === void 0 ? [] : [apiKeyAuth(options.apiKey)],
+    ...options.middleware ?? []
+  ];
+  if (middleware.length === 0) {
+    throw new Error("createClient needs an apiKey or middleware that authenticates requests");
+  }
+  const transport = createTransport({
+    baseUrl: options.baseUrl ?? DEFAULT_BASE_URL,
+    ...options.fetch ? { fetch: options.fetch } : {},
+    middleware
+  });
+  return {
+    assets: createAssets(transport, assetsPath),
+    operations: createOperations(transport, operationPath),
+    tasks: createTasks(transport)
+  };
+};
+
+// src/config.ts
+var CliError = class extends Error {
+  name = "CliError";
+};
+function configuration(env = process.env) {
+  const api = checkedUrl(env.WORLDLABS_API_ORIGIN ?? DEFAULT_BASE_URL);
+  if (api.pathname !== "/" || api.search || api.hash) {
+    throw new CliError(
+      "WORLDLABS_API_ORIGIN must be an origin without a path, query, or fragment."
+    );
+  }
+  return {
+    apiOrigin: api.origin,
+    apiKeysUrl: checkedUrl(env.WORLDLABS_API_KEYS_URL ?? "https://atlas-beta.worldlabs.ai/api-keys").href
+  };
+}
+function checkedUrl(value) {
+  const url = new URL(value);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.username || url.password || url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+    throw new CliError(
+      "Use HTTPS, or HTTP on a loopback address for local testing. URL credentials are not allowed."
+    );
+  }
+  return url;
+}
+
+// src/credentials.ts
+import { createHash, randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import nodePath from "node:path";
+function credentialPath(apiOrigin) {
+  const config = process.env.WORLDLABS_CONFIG_DIR ?? nodePath.join(homedir(), ".config", "worldlabs");
+  const name = createHash("sha256").update(apiOrigin).digest("hex");
+  return nodePath.join(config, "credentials", `${name}.key`);
+}
+async function readApiKey(apiOrigin) {
+  let file;
+  try {
+    file = await open(
+      credentialPath(apiOrigin),
+      process.platform === "win32" ? constants.O_RDONLY : constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new CliError("Cannot open saved credentials. Check the file location and permissions.");
+  }
+  try {
+    const stat = await file.stat();
+    if (!stat.isFile()) {
+      throw new CliError("Saved credentials must be a regular file.");
+    }
+    const contents = await file.readFile("utf8");
+    return contents.trim() || void 0;
+  } finally {
+    await file.close();
+  }
+}
+async function saveApiKey(apiOrigin, apiKey) {
+  const path = credentialPath(apiOrigin);
+  const directory = nodePath.dirname(path);
+  await mkdir(directory, { recursive: true, mode: 448 });
+  const stat = await lstat(directory);
+  if (!stat.isDirectory()) {
+    throw new CliError("The credentials path must be a directory and must not be a symlink.");
+  }
+  const temporary = nodePath.join(directory, `.${randomUUID()}.tmp`);
+  try {
+    await writeFile(temporary, `${apiKey}
+`, { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function removeApiKey(apiOrigin) {
+  await rm(credentialPath(apiOrigin), { force: true });
+}
+
+// src/terminal.ts
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { Writable } from "node:stream";
+async function prompt(message, hidden = false) {
+  if (!process.stdin.isTTY || !process.stderr.isTTY) {
+    throw new CliError("Run this command in your terminal. For automation, set WLT_API_KEY.");
+  }
+  const muted = new Writable({
+    write(_chunk, _encoding, callback) {
+      callback();
+    }
+  });
+  const reader = createInterface({
+    input: process.stdin,
+    output: hidden ? muted : process.stderr,
+    terminal: true
+  });
+  const controller = new AbortController();
+  reader.once("SIGINT", () => controller.abort());
+  process.stderr.write(message);
+  try {
+    const answer = await reader.question("", { signal: controller.signal });
+    return answer.trim();
+  } catch {
+    throw new CliError("Cancelled.");
+  } finally {
+    reader.close();
+    if (hidden) process.stderr.write("\n");
+  }
+}
+async function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer.exe" : "xdg-open";
+  await new Promise((resolve) => {
+    const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+    child.once("error", () => resolve());
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+
+// src/auth.ts
+async function authenticatedClient() {
+  const { apiOrigin } = configuration();
+  let apiKey = process.env.WLT_API_KEY?.trim();
+  if (!apiKey) {
+    apiKey = await readApiKey(apiOrigin);
+  }
+  if (!apiKey) throw new CliError("Run worldlabs auth login or set WLT_API_KEY.");
+  return createClient({ apiKey, baseUrl: apiOrigin });
+}
+async function authStatus() {
+  const client = await authenticatedClient();
+  await client.assets.list({ pageSize: 1, signal: AbortSignal.timeout(3e4) });
+  return {
+    authenticated: true,
+    apiOrigin: configuration().apiOrigin,
+    source: process.env.WLT_API_KEY?.trim() ? "environment" : "file",
+    ...process.env.WLT_API_KEY?.trim() ? {} : { credentialFile: credentialPath(configuration().apiOrigin) }
+  };
+}
+async function login(noBrowser) {
+  if (process.env.WLT_API_KEY?.trim()) return await authStatus();
+  const { apiOrigin, apiKeysUrl } = configuration();
+  if (!process.stdin.isTTY || !process.stderr.isTTY) {
+    throw new CliError(
+      "Run worldlabs auth login in your own terminal to paste a key privately. Agents should never ask for keys in chat."
+    );
+  }
+  process.stderr.write(
+    `API: ${apiOrigin}
+Create a key for your project at ${apiKeysUrl}
+Select task submission, operation reads, and asset upload/read permissions. Usage is billed to that API project.
+The key will be saved in plaintext at ${credentialPath(apiOrigin)}.
+`
+  );
+  if (!noBrowser) await openBrowser(apiKeysUrl);
+  const apiKey = await prompt("Paste API key (hidden): ", true);
+  if (!apiKey) throw new CliError("No key entered.");
+  await createClient({ apiKey, baseUrl: apiOrigin }).assets.list({
+    pageSize: 1,
+    signal: AbortSignal.timeout(3e4)
+  });
+  await saveApiKey(apiOrigin, apiKey);
+  return {
+    authenticated: true,
+    apiOrigin,
+    source: "file",
+    credentialFile: credentialPath(apiOrigin)
+  };
+}
+async function logout() {
+  const { apiOrigin } = configuration();
+  await removeApiKey(apiOrigin);
+  return {
+    apiOrigin,
+    message: "Saved key removed from this computer. Revoke it on the API keys page to disable it everywhere.",
+    environmentKeyActive: Boolean(process.env.WLT_API_KEY?.trim())
+  };
+}
+
+// src/commands.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { openAsBlob } from "node:fs";
+import { open as open2, readFile, rm as rm2 } from "node:fs/promises";
+import nodePath2 from "node:path";
+import { text } from "node:stream/consumers";
+import { pipeline } from "node:stream/promises";
+import { parseArgs } from "node:util";
+var mimeTypes = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".webp": "image/webp",
+  ".mp4": "video/mp4",
+  ".ply": "application/octet-stream",
+  ".spz": "application/octet-stream"
+};
+function timeout(value) {
+  const seconds = value === void 0 ? 600 : Number(value);
+  if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 86400) {
+    throw new CliError("--timeout must be between 0 and 86400 seconds (exclusive of 0).");
+  }
+  return AbortSignal.timeout(Math.ceil(seconds * 1e3));
+}
+async function runApiCommand(args2) {
+  const [command, action, ...rest] = args2;
+  if (command === "tasks" && action === "list" && !rest.length) {
+    return Object.keys(createClient({ apiKey: "unused" }).tasks);
+  }
+  if (command === "tasks" && action === "run") {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: {
+        request: { type: "string" },
+        "idempotency-key": { type: "string" },
+        wait: { type: "boolean" },
+        timeout: { type: "string" }
+      }
+    });
+    const [name] = positionals;
+    if (!name || positionals.length !== 1 || !values.request) {
+      throw new CliError(
+        "Usage: tasks run <name> --request <file|-> [--wait] [--idempotency-key <key>] [--timeout <seconds>]"
+      );
+    }
+    const signal = timeout(values.timeout);
+    const client = await authenticatedClient();
+    if (!Object.hasOwn(client.tasks, name)) {
+      throw new CliError("Unknown task. Run worldlabs tasks list.");
+    }
+    const body = JSON.parse(
+      values.request === "-" ? await text(process.stdin) : await readFile(values.request, "utf8")
+    );
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      throw new CliError("Task request must be a JSON object.");
+    }
+    const idempotencyKey = values["idempotency-key"] ?? randomUUID2();
+    if (!idempotencyKey.trim() || /[\r\n]/u.test(idempotencyKey)) {
+      throw new CliError("Invalid idempotency key.");
+    }
+    process.stderr.write(
+      `Idempotency key: ${idempotencyKey}
+Reuse this key and request if submission is interrupted.
+`
+    );
+    const submit = client.tasks[name];
+    const operation = await submit(body, { idempotencyKey, signal });
+    if (!values.wait) return operation;
+    process.stderr.write(`Operation: ${operation.id}
+`);
+    return await client.operations.wait(operation, { signal });
+  }
+  if (command === "operations" && (action === "get" || action === "wait")) {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: { timeout: { type: "string" } }
+    });
+    const [id] = positionals;
+    if (!id || positionals.length !== 1) {
+      throw new CliError("Usage: operations get|wait <id> [--timeout <seconds>]");
+    }
+    const signal = timeout(values.timeout);
+    const client = await authenticatedClient();
+    const operation = await client.operations.get(id, { signal });
+    return action === "wait" ? await client.operations.wait(operation, { signal }) : operation;
+  }
+  if (command === "assets" && action === "upload") {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: { mime: { type: "string" } }
+    });
+    const [file] = positionals;
+    if (!file || positionals.length !== 1) {
+      throw new CliError("Usage: assets upload <file> [--mime <type>]");
+    }
+    const type = values.mime ?? mimeTypes[nodePath2.extname(file).toLowerCase()];
+    if (!type) throw new CliError("Unknown file type. Pass --mime <type>.");
+    const blob = await openAsBlob(file, { type });
+    const client = await authenticatedClient();
+    return await client.assets.upload(blob, {
+      displayName: nodePath2.basename(file),
+      signal: timeout()
+    });
+  }
+  if (command === "assets" && action === "download") {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      allowPositionals: true,
+      options: { out: { type: "string" } }
+    });
+    const [id] = positionals;
+    if (!id || positionals.length !== 1 || !values.out) {
+      throw new CliError("Usage: assets download <id> --out <file>");
+    }
+    const client = await authenticatedClient();
+    const signal = timeout();
+    const { readUrl } = await client.assets.createReadUrl(id, { signal });
+    const response = await fetch(readUrl, { signal });
+    if (!response.ok || !response.body) {
+      throw new CliError(`Asset download failed (HTTP ${response.status}).`);
+    }
+    const file = await open2(values.out, "wx", 384);
+    try {
+      await pipeline(response.body, file.createWriteStream());
+    } catch (error) {
+      await rm2(values.out, { force: true });
+      throw error;
+    } finally {
+      await file.close();
+    }
+    return { assetId: id, path: values.out };
+  }
+  if (command === "assets" && action === "list") {
+    const { values } = parseArgs({ args: rest, options: { "page-token": { type: "string" } } });
+    const client = await authenticatedClient();
+    return await client.assets.list({
+      ...values["page-token"] ? { pageToken: values["page-token"] } : {},
+      signal: timeout()
+    });
+  }
+  throw new CliError("Unknown command or arguments. Run worldlabs --help.");
+}
+
+// src/skills.ts
+import { createHash as createHash2, randomUUID as randomUUID3 } from "node:crypto";
+import { cp, lstat as lstat2, mkdir as mkdir2, readFile as readFile2, readdir, rename as rename2, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import nodePath3 from "node:path";
+import { fileURLToPath } from "node:url";
+var marker = ".worldlabs-install.json";
+var source = fileURLToPath(new URL("../skills/worldlabs/", import.meta.url));
+function skillTarget(client) {
+  if (client === "codex") {
+    return nodePath3.join(
+      process.env.CODEX_HOME ?? nodePath3.join(homedir2(), ".codex"),
+      "skills",
+      "worldlabs"
+    );
+  }
+  if (client === "claude-code") return nodePath3.join(homedir2(), ".claude", "skills", "worldlabs");
+  throw new CliError("Choose --client codex or --client claude-code.");
+}
+async function fingerprint(root) {
+  const hash = createHash2("sha256");
+  async function visit(relative) {
+    if (relative === marker) return;
+    const path = nodePath3.join(root, relative);
+    const stat = await lstat2(path);
+    hash.update(`${relative}\0`);
+    if (stat.isDirectory()) {
+      const names = await readdir(path);
+      for (const name of names.toSorted()) await visit(nodePath3.join(relative, name));
+    } else if (stat.isFile()) {
+      hash.update(await readFile2(path));
+    } else {
+      throw new CliError(`Refusing a skill containing symlinks or special files: ${path}`);
+    }
+  }
+  await visit("");
+  return hash.digest("hex");
+}
+async function manageSkills(action, target) {
+  const parent = nodePath3.dirname(target);
+  const lock = `${target}.lock`;
+  await mkdir2(parent, { recursive: true });
+  try {
+    await mkdir2(lock);
+  } catch {
+    throw new CliError(
+      `Skill installation is locked at ${lock}. Remove the lock only if no installer is running.`
+    );
+  }
+  const staging = nodePath3.join(parent, `.worldlabs-${randomUUID3()}`);
+  const backup = `${staging}-backup`;
+  try {
+    let exists = false;
+    try {
+      await lstat2(target);
+      exists = true;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    if (exists) {
+      const actual = await fingerprint(target);
+      let expected;
+      try {
+        expected = JSON.parse(await readFile2(nodePath3.join(target, marker), "utf8"));
+      } catch {
+        throw new CliError(`Refusing to replace an unowned skill: ${target}`);
+      }
+      if (actual !== expected) {
+        throw new CliError(`Skill has local changes. Move it aside before continuing: ${target}`);
+      }
+    }
+    if (action === "uninstall") {
+      if (exists) await rm3(target, { recursive: true });
+      return { path: target, removed: exists };
+    }
+    await cp(source, staging, { recursive: true });
+    const entry = fileURLToPath(
+      new URL(import.meta.url.endsWith(".ts") ? "index.ts" : "index.js", import.meta.url)
+    );
+    const windows = process.platform === "win32";
+    const shell = windows ? "powershell" : "sh";
+    const quote = (value) => `'${value.replaceAll("'", windows ? "''" : String.raw`'\''`)}'`;
+    const command = `${windows ? "& " : ""}${quote(process.execPath)} ${quote(entry)}`;
+    for (const name of await readdir(staging, { recursive: true })) {
+      const path = nodePath3.join(staging, name);
+      const stat = await lstat2(path);
+      if (stat.isFile()) {
+        const content = await readFile2(path, "utf8");
+        await writeFile2(
+          path,
+          content.replaceAll("{{CLI}}", () => command).replaceAll("{{SHELL}}", shell)
+        );
+      }
+    }
+    await writeFile2(nodePath3.join(staging, marker), JSON.stringify(await fingerprint(staging)));
+    if (exists) await rename2(target, backup);
+    try {
+      await rename2(staging, target);
+    } catch (error) {
+      if (exists) await rename2(backup, target);
+      throw error;
+    }
+    await rm3(backup, { recursive: true, force: true });
+    return { path: target, next: "Start a new agent session to load the worldlabs skill." };
+  } finally {
+    await rm3(staging, { recursive: true, force: true });
+    await rm3(lock, { recursive: true, force: true });
+  }
+}
+
+// src/setup.ts
+async function setup(client, noBrowser) {
+  let target;
+  if (client !== void 0) {
+    target = skillTarget(client);
+  } else if (process.stdin.isTTY && process.stderr.isTTY) {
+    const choice = await prompt("Install agent skill: 1) Codex  2) Claude Code  3) Skip [3]: ");
+    if (choice === "1" || choice === "2") {
+      target = skillTarget(choice === "1" ? "codex" : "claude-code");
+    } else if (choice && choice !== "3") {
+      throw new CliError("Choose 1, 2, or 3.");
+    }
+  }
+  const auth = await login(noBrowser);
+  const skill = target ? await manageSkills("install", target) : void 0;
+  return {
+    ...auth,
+    ...skill ? { skill } : {},
+    next: "Run worldlabs tasks list to see the available tasks."
+  };
+}
+
+// src/index.ts
+var { version } = JSON.parse(
+  readFileSync(new URL("../package.json", import.meta.url), "utf8")
+);
+var help = `worldlabs - World Labs Developer API CLI
+
+Usage: worldlabs [--json] <command>
+  setup [--client codex|claude-code] [--no-browser]
+  skills install|uninstall --client codex|claude-code
+  auth login [--no-browser]
+  auth status
+  auth logout
+  config show
+  tasks list
+  tasks run <name> --request <file|-> [--wait] [--idempotency-key <key>] [--timeout <seconds>]
+  assets upload <file> [--mime <type>]
+  assets download <id> --out <file>
+  assets list [--page-token <token>]
+  operations get|wait <id> [--timeout <seconds>]
+  --version
+  --help
+
+Use --request - to read task JSON from standard input.
+
+Saved login uses a plaintext file in your user configuration directory. Automation can set WLT_API_KEY.
+`;
+async function main(args2) {
+  if (args2.length === 0 || args2.includes("--help")) return help;
+  if (args2.length === 1 && args2[0] === "--version") return version;
+  const [command, action, ...rest] = args2;
+  if (command === "setup") {
+    const { values } = parseArgs2({
+      args: args2.slice(1),
+      options: { client: { type: "string" }, "no-browser": { type: "boolean" } }
+    });
+    return await setup(values.client, Boolean(values["no-browser"]));
+  }
+  if (command === "skills" && (action === "install" || action === "uninstall")) {
+    const { values } = parseArgs2({ args: rest, options: { client: { type: "string" } } });
+    return await manageSkills(action, skillTarget(values.client));
+  }
+  if (command === "config" && action === "show" && !rest.length) return configuration();
+  if (command === "auth") {
+    if (action === "login") {
+      const { values } = parseArgs2({ args: rest, options: { "no-browser": { type: "boolean" } } });
+      return await login(Boolean(values["no-browser"]));
+    }
+    if (action === "status" && !rest.length) return await authStatus();
+    if (action === "logout" && !rest.length) return await logout();
+  }
+  if (["tasks", "assets", "operations"].includes(command ?? "")) return await runApiCommand(args2);
+  throw new CliError("Unknown command or arguments. Run worldlabs --help.");
+}
+var args = process.argv.slice(2);
+var json = args.includes("--json");
+try {
+  const result = await main(args.filter((arg) => arg !== "--json"));
+  if (result && typeof result === "object" && "done" in result && result.done && "error" in result && result.error) {
+    process.exitCode = 1;
+  }
+  process.stdout.write(
+    `${typeof result === "string" && !json ? result : JSON.stringify(result, null, json ? void 0 : 2)}
+`
+  );
+} catch (error) {
+  const message = error instanceof ApiError ? `API request failed (HTTP ${error.response.status}). Check the API key, its permissions, and project access.` : error instanceof Error ? error.message : "Command failed.";
+  process.stderr.write(`${json ? JSON.stringify({ error: message }) : message}
+`);
+  process.exitCode = 1;
+}

package/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@worldlabsai/cli",
+  "version": "0.1.0",
+  "description": "World Labs command line interface",
+  "license": "Apache-2.0",
+  "bin": {
+    "worldlabs": "./dist/index.js"
+  },
+  "files": [
+    "dist/index.js",
+    "skills",
+    "LICENSE"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "restricted",
+    "registry": "https://registry.npmjs.org/",
+    "tag": "next"
+  }
+}

package/skills/worldlabs/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: worldlabs
+description: Generate and edit scene images, estimate cameras and depth, or extract meshes with the World Labs CLI.
+---
+
+# World Labs
+
+Use `{{CLI}}` for the Developer API. Run commands in `{{SHELL}}`. Run `{{CLI}} --help` for command syntax.
+
+## Choose a task
+
+| Task | Purpose |
+| --- | --- |
+| `atlasTextToImage` | Generate starting images from a description of an environment. |
+| `images2PosedRGBD` | Estimate cameras and depth from images of a scene. |
+| `atlasGenerate` | Generate new viewpoints using posed RGBD context. |
+| `atlasChisel` | Generate posed images from a prompt and optional depth layouts. |
+| `atlasMasked` | Fill masked regions across posed images. |
+| `splats2Mesh` | Extract a mesh from a Gaussian splat scene. |
+
+Read [How To Use Atlas](https://marble5.worldlabs.ai/docs/how-to-use-atlas) before choosing model inputs, calculating cameras, or chaining tasks. It explains scene data, model behavior, and the requirements that affect results. Follow its task or camera links when you need exact fields or geometry calculations. `{{CLI}} tasks list` reports SDK task names; account access can differ.
+
+## Submit and inspect
+
+Upload a local image:
+
+```{{SHELL}}
+{{CLI}} assets upload photo.jpg --json > asset.json
+```
+
+Write `request.json` as `{"frames":[{"imageAsset":{"assetId":"<id>"}}]}`, replacing `<id>` with the uploaded asset's `id` from `asset.json`.
+
+```{{SHELL}}
+{{CLI}} tasks run images2PosedRGBD --request request.json --wait --json > result.json
+```
+
+Use `--request -` to read JSON from stdin. Results go to stdout; diagnostics and the submission's idempotency key go to stderr. Preserve the key and reuse it with `--idempotency-key <key>` and the same request if submission is interrupted.
+
+A timeout stops local waiting, not server work. Resume with `{{CLI}} operations wait <operation-id> --json`. Check a completed operation's `error` before reading `response`. Download returned assets with `{{CLI}} assets download <asset-id> --out result.png`. Inspect the outputs before using them in another task; keep each image, camera, depth, and confidence together.
+
+## Authentication
+
+Check `{{CLI}} auth status`. If login is needed, have the user run `{{CLI}} auth login` in their own terminal and enter the key privately. Never request keys in chat or put them in command arguments. Automation can supply `WLT_API_KEY`. The key selects the API project and billing; a successful status check verifies asset access, not every task permission.