@wspc/cli 0.0.14 → 0.0.16

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command62 } from "commander";
+import { Command as Command63 } from "commander";
 
 // src/generated/cli/invite/accept.ts
 import { Command } from "commander";
@@ -970,6 +970,11 @@ var emailDelete = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var emailDomainDelete = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/email/domains/{domain}",
+  ...options
+});
 var emailDomainGet = (options) => (options.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/email/domains/{domain}",
@@ -1175,6 +1180,7 @@ var V1_CRED_KEYS = [
 function migrateEnv(raw) {
   const api_base = typeof raw.api_base === "string" ? raw.api_base : "";
   const env = { api_base, accounts: {} };
+  if (typeof raw.consistency_bookmark === "string") env.consistency_bookmark = raw.consistency_bookmark;
   if (typeof raw.client_id === "string") env.client_id = raw.client_id;
   if (raw.accounts && typeof raw.accounts === "object") {
     env.accounts = raw.accounts;
@@ -1242,6 +1248,49 @@ var ConfigStore = class {
     }
     await fs.writeFile(this.configFile, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
   }
+  /**
+   * Read-modify-write the config under a cross-process file lock. The mutator
+   * runs against a FRESH read taken inside the lock and edits it in place, so
+   * two writers (e.g. token refresh and the consistency-bookmark writeback)
+   * can't clobber each other from stale snapshots — the bug that revoked whole
+   * refresh-token families when several CLI sessions ran concurrently.
+   */
+  async update(mutate) {
+    await this.withLock(async () => {
+      const config = await this.read();
+      mutate(config);
+      await this.write(config);
+    });
+  }
+  async withLock(fn) {
+    await fs.mkdir(this.configDir, { recursive: true, mode: 448 });
+    const lockFile = this.configFile + ".lock";
+    const STALE_MS = 1e4;
+    const RETRY_MS = 25;
+    const MAX_WAIT_MS = 5e3;
+    let waited = 0;
+    for (; ; ) {
+      try {
+        const fh = await fs.open(lockFile, "wx");
+        await fh.close();
+        break;
+      } catch (e) {
+        if (e.code !== "EEXIST") throw e;
+        const age = await fs.stat(lockFile).then((s) => Date.now() - s.mtimeMs).catch(() => Infinity);
+        if (age > STALE_MS || waited >= MAX_WAIT_MS) {
+          await fs.rm(lockFile, { force: true });
+          continue;
+        }
+        await new Promise((r) => setTimeout(r, RETRY_MS));
+        waited += RETRY_MS;
+      }
+    }
+    try {
+      return await fn();
+    } finally {
+      await fs.rm(lockFile, { force: true });
+    }
+  }
   async currentEnv() {
     const c = await this.read();
     const name = c.current_env;
@@ -1252,10 +1301,79 @@ var ConfigStore = class {
   }
 };
 
+// src/handwritten/auth/consistency-fetch.ts
+var HEADER = "x-consistency-bookmark";
+var INVALID_BOOKMARK = "INVALID_CONSISTENCY_BOOKMARK";
+function normalizeBasePath(pathname) {
+  const trimmed = pathname.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+function isUnderApiBase(url, apiBase) {
+  const base = new URL(apiBase);
+  const basePath = normalizeBasePath(base.pathname);
+  return url.origin === base.origin && (basePath === "/" || url.pathname === basePath || url.pathname.startsWith(`${basePath}/`));
+}
+function isJsonContentType(contentType) {
+  const mediaType = contentType.toLowerCase().split(";")[0]?.trim() ?? "";
+  return mediaType === "application/json" || mediaType.endsWith("+json");
+}
+async function responseHasInvalidBookmark(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!isJsonContentType(contentType)) return false;
+  try {
+    const body = await response.clone().json();
+    return body.error?.code === INVALID_BOOKMARK;
+  } catch {
+    return false;
+  }
+}
+function createConsistencyFetch(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  return async (input, init) => {
+    const request = new Request(input, init);
+    const url = new URL(request.url);
+    const applies = isUnderApiBase(url, opts.apiBase);
+    let outgoing = request;
+    let injectedStoredBookmark = false;
+    if (applies && !outgoing.headers.has(HEADER)) {
+      const config = await opts.store.read();
+      const bookmark = config.envs[opts.envName]?.consistency_bookmark;
+      if (bookmark) {
+        const headers = new Headers(outgoing.headers);
+        headers.set(HEADER, bookmark);
+        outgoing = new Request(outgoing, { headers });
+        injectedStoredBookmark = true;
+      }
+    }
+    if (!applies && outgoing.headers.has(HEADER)) {
+      const headers = new Headers(outgoing.headers);
+      headers.delete(HEADER);
+      outgoing = new Request(outgoing, { headers });
+    }
+    const response = await fetchImpl(outgoing);
+    if (!applies) return response;
+    const nextBookmark = response.headers.get(HEADER);
+    const shouldCheckInvalidBookmark = injectedStoredBookmark && !nextBookmark;
+    const invalidBookmark = shouldCheckInvalidBookmark ? await responseHasInvalidBookmark(response) : false;
+    const shouldClearBookmark = invalidBookmark;
+    if (!nextBookmark && !shouldClearBookmark) return response;
+    await opts.store.update((config) => {
+      const env = config.envs[opts.envName];
+      if (!env) return;
+      if (nextBookmark) {
+        env.consistency_bookmark = nextBookmark;
+      } else if (shouldClearBookmark) {
+        delete env.consistency_bookmark;
+      }
+    });
+    return response;
+  };
+}
+
 // src/version.ts
-var VERSION = "0.0.14";
-var SPEC_SHA = "7842b7a9";
-var SPEC_FETCHED_AT = "2026-06-10T05:27:40.161Z";
+var VERSION = "0.0.16";
+var SPEC_SHA = "b505a817";
+var SPEC_FETCHED_AT = "2026-06-16T07:42:43.911Z";
 var API_BASE = "https://api.wspc.ai";
 
 // src/index.ts
@@ -1268,17 +1386,30 @@ var WspcAuthExpiredError = class extends Error {
 };
 
 // src/handwritten/auth/sdk-auth.ts
+var USER_AGENT = `@wspc/cli/${VERSION}`;
+async function expiredMessage(res) {
+  try {
+    const body = await res.clone().json();
+    if (!body.error) return void 0;
+    const detail = body.error_description ? `: ${body.error_description}` : "";
+    return `wspc token refresh failed (${body.error}${detail}); re-authenticate via \`wspc login\``;
+  } catch {
+    return void 0;
+  }
+}
 function createAuthInterceptor(mode) {
   if ("apiKey" in mode) {
     const apiKey = mode.apiKey;
+    const fetchImpl2 = mode.fetchImpl ?? fetch;
     return {
       async onRequest(req) {
         req.headers.set("authorization", `Bearer ${apiKey}`);
+        req.headers.set("user-agent", USER_AGENT);
         return req;
       },
       async execute(req) {
         const out = await this.onRequest(req.clone());
-        return fetch(out);
+        return fetchImpl2(out);
       }
     };
   }
@@ -1289,6 +1420,7 @@ function createAuthInterceptor(mode) {
   return {
     async onRequest(req) {
       req.headers.set("authorization", `Bearer ${accessToken}`);
+      req.headers.set("user-agent", USER_AGENT);
       return req;
     },
     async execute(req) {
@@ -1296,7 +1428,10 @@ function createAuthInterceptor(mode) {
       if (first.status !== 401) return first;
       const refreshRes = await fetchImpl(`${mode.baseUrl}/auth/oauth/token`, {
         method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          "user-agent": USER_AGENT
+        },
         body: new URLSearchParams({
           grant_type: "refresh_token",
           refresh_token: refreshToken,
@@ -1304,7 +1439,7 @@ function createAuthInterceptor(mode) {
         })
       });
       if (!refreshRes.ok) {
-        throw new WspcAuthExpiredError();
+        throw new WspcAuthExpiredError(await expiredMessage(refreshRes));
       }
       const tokens = await refreshRes.json();
       accessToken = tokens.access_token;
@@ -1357,10 +1492,10 @@ function resolveAccount(config, opts = {}) {
 }
 
 // src/handwritten/auth/load-sdk-client.ts
-function buildInterceptor(store, resolved) {
+function buildInterceptor(store, resolved, fetchImpl) {
   const { envName, apiBase, clientId, email, creds } = resolved;
   if (creds.api_key) {
-    return createAuthInterceptor({ apiKey: creds.api_key });
+    return createAuthInterceptor({ apiKey: creds.api_key, fetchImpl });
   }
   if (!clientId) {
     throw new Error(
@@ -1372,14 +1507,15 @@ function buildInterceptor(store, resolved) {
     refreshToken: creds.refresh_token,
     baseUrl: apiBase,
     clientId,
+    fetchImpl,
     onTokenRefresh: async ({ accessToken, refreshToken, expiresAt }) => {
-      const cfg = await store.read();
-      const a = cfg.envs[envName]?.accounts?.[email];
-      if (!a) return;
-      a.access_token = accessToken;
-      a.refresh_token = refreshToken;
-      a.access_token_expires_at = expiresAt;
-      await store.write(cfg);
+      await store.update((cfg) => {
+        const a = cfg.envs[envName]?.accounts?.[email];
+        if (!a) return;
+        a.access_token = accessToken;
+        a.refresh_token = refreshToken;
+        a.access_token_expires_at = expiresAt;
+      });
     }
   });
 }
@@ -1387,7 +1523,13 @@ async function loadSdkClient(opts = {}) {
   const store = opts.store ?? new ConfigStore();
   const config = await store.read();
   const resolved = resolveAccount(config, { accountOverride: process.env.WSPC_ACCOUNT });
-  const interceptor = buildInterceptor(store, resolved);
+  const consistencyFetch = createConsistencyFetch({
+    store,
+    envName: resolved.envName,
+    apiBase: resolved.apiBase,
+    fetchImpl: opts.fetchImpl
+  });
+  const interceptor = buildInterceptor(store, resolved, consistencyFetch);
   const rawClient = createClient(
     createConfig({
       baseUrl: resolved.apiBase,
@@ -1400,7 +1542,13 @@ async function loadAuthedFetch(opts = {}) {
   const store = opts.store ?? new ConfigStore();
   const config = await store.read();
   const resolved = resolveAccount(config, { accountOverride: process.env.WSPC_ACCOUNT });
-  const interceptor = buildInterceptor(store, resolved);
+  const consistencyFetch = createConsistencyFetch({
+    store,
+    envName: resolved.envName,
+    apiBase: resolved.apiBase,
+    fetchImpl: opts.fetchImpl
+  });
+  const interceptor = buildInterceptor(store, resolved, consistencyFetch);
   const authedFetch = (input, init) => interceptor.execute(new Request(input, init));
   return { fetch: authedFetch, baseUrl: resolved.apiBase };
 }
@@ -2416,7 +2564,7 @@ var eventGetCommand = new Command19("show").description("Get a calendar event by
 
 // src/generated/cli/event/set.ts
 import { Command as Command20 } from "commander";
-var eventUpdateCommand = new Command20("set").description("Update a calendar event").argument("<id>", "id").option("--expected-version <value>", "Optional optimistic lock. Omit to let the server use the current version; pass only to fail the call if someone else has mutated the event since you last read. On mismatch the server returns 409 `VERSION_CONFLICT` with `extra.expected_version` and `extra.actual_version`.").option("--title <value>", "New event title. Omit to leave unchanged.").option("--description <value>", "New description. Markdown formatted (CommonMark + GFM tables, strikethrough, task lists). Pass an empty string to clear; omit to leave unchanged.").option("--start <value>", "Accepts ISO 8601 datetime with offset (e.g. `2026-06-01T12:30:00+08:00`) for timed events, or ISO date-only (e.g. `2026-06-01`) for all-day. The `wspc` CLI additionally accepts natural-language phrases (`tomorrow 12:30pm`, `next Monday 9am`) and resolves them to ISO before sending; the server itself only accepts ISO. All-day uses RFC 5545 exclusive end: a one-day event on 6/1 is `start=2026-06-01, end=2026-06-02`; both endpoints must be the same type.").option("--end <value>", "Accepts ISO 8601 datetime with offset (e.g. `2026-06-01T12:30:00+08:00`) for timed events, or ISO date-only (e.g. `2026-06-01`) for all-day. The `wspc` CLI additionally accepts natural-language phrases (`tomorrow 12:30pm`, `next Monday 9am`) and resolves them to ISO before sending; the server itself only accepts ISO. All-day uses RFC 5545 exclusive end: a one-day event on 6/1 is `start=2026-06-01, end=2026-06-02`; both endpoints must be the same type.").option("-l, --location <value>", "New location. Pass an empty string to clear; omit to leave unchanged.").option("-u, --url <value>", "New meeting link. Pass an empty string to clear; omit to leave unchanged.").option("--status <value>", "Lifecycle status. `confirmed`: the event will happen (default). `tentative`: organizer has not finalized; still visible in lists. `cancelled`: the event was called off but the record is kept so attendees can be notified and history audited; distinct from soft-delete (DELETE `/calendar/events/{id}`) which hides the event from default list responses.").option("--attendee <value>", "If provided, REPLACES the attendee list (after case-insensitive email dedupe, up to 50). Added attendees receive a fresh invitation, kept attendees receive an update email, removed attendees receive a cancellation.", (val, memo) => {
+var eventUpdateCommand = new Command20("set").description("Update a calendar event").argument("<id>", "id").option("--expected-version <value>", "Optional optimistic lock. Omit to let the server use the current version; pass only to fail the call if someone else has mutated the event since you last read. On mismatch the server returns 409 `VERSION_CONFLICT` and includes the current and sent versions in the message.").option("--title <value>", "New event title. Omit to leave unchanged.").option("--description <value>", "New description. Markdown formatted (CommonMark + GFM tables, strikethrough, task lists). Pass an empty string to clear; omit to leave unchanged.").option("--start <value>", "Accepts ISO 8601 datetime with offset (e.g. `2026-06-01T12:30:00+08:00`) for timed events, or ISO date-only (e.g. `2026-06-01`) for all-day. The `wspc` CLI additionally accepts natural-language phrases (`tomorrow 12:30pm`, `next Monday 9am`) and resolves them to ISO before sending; the server itself only accepts ISO. All-day uses RFC 5545 exclusive end: a one-day event on 6/1 is `start=2026-06-01, end=2026-06-02`; both endpoints must be the same type.").option("--end <value>", "Accepts ISO 8601 datetime with offset (e.g. `2026-06-01T12:30:00+08:00`) for timed events, or ISO date-only (e.g. `2026-06-01`) for all-day. The `wspc` CLI additionally accepts natural-language phrases (`tomorrow 12:30pm`, `next Monday 9am`) and resolves them to ISO before sending; the server itself only accepts ISO. All-day uses RFC 5545 exclusive end: a one-day event on 6/1 is `start=2026-06-01, end=2026-06-02`; both endpoints must be the same type.").option("-l, --location <value>", "New location. Pass an empty string to clear; omit to leave unchanged.").option("-u, --url <value>", "New meeting link. Pass an empty string to clear; omit to leave unchanged.").option("--status <value>", "Lifecycle status. `confirmed`: the event will happen (default). `tentative`: organizer has not finalized; still visible in lists. `cancelled`: the event was called off but the record is kept so attendees can be notified and history audited; distinct from soft-delete (DELETE `/calendar/events/{id}`) which hides the event from default list responses.").option("--attendee <value>", "If provided, REPLACES the attendee list (after case-insensitive email dedupe, up to 50). Added attendees receive a fresh invitation, kept attendees receive an update email, removed attendees receive a cancellation.", (val, memo) => {
   memo.push(val);
   return memo;
 }, []).option("--all-day", "all_day").option("--tz <zone>", "IANA timezone for relative time parsing").action(async (id, opts) => {
@@ -2614,9 +2762,30 @@ var emailDeleteCommand = new Command27("rm").description("Soft-delete inbound em
   render({ kind: "email_delete", display: { "shape": "object", "format": {} } }, result.data);
 });
 
-// src/generated/cli/domain/show.ts
+// src/generated/cli/domain/rm.ts
 import { Command as Command28 } from "commander";
-var emailDomainGetCommand = new Command28("show").description("Get one cached custom domain").argument("<domain>", "domain").action(async (domain, opts) => {
+var emailDomainDeleteCommand = new Command28("rm").description("Delete a custom email domain").argument("<domain>", "domain").action(async (domain, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await emailDomainDelete({
+    client: client2._rawClient,
+    path: {
+      domain
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "email_domain_delete", display: void 0 }, result.data);
+});
+
+// src/generated/cli/domain/show.ts
+import { Command as Command29 } from "commander";
+var emailDomainGetCommand = new Command29("show").description("Get one cached custom domain").argument("<domain>", "domain").action(async (domain, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailDomainGet({
     client: client2._rawClient,
@@ -2636,8 +2805,8 @@ var emailDomainGetCommand = new Command28("show").description("Get one cached cu
 });
 
 // src/generated/cli/email/show.ts
-import { Command as Command29 } from "commander";
-var emailGetCommand = new Command29("show").description("Get an inbound email by id").argument("<id>", "id").option("--include-html <value>", "When `true`, fetch the HTML body from R2 and include it as `html_body` in the response. Costs an extra R2 read; omit if you only need text.").option("--include-deleted <value>", "When `true`, allow fetching a soft-deleted email. Defaults to `false` (returns 404 for soft-deleted rows).").action(async (id, opts) => {
+import { Command as Command30 } from "commander";
+var emailGetCommand = new Command30("show").description("Get an inbound email by id").argument("<id>", "id").option("--include-html <value>", "When `true`, fetch the HTML body from R2 and include it as `html_body` in the response. Costs an extra R2 read; omit if you only need text.").option("--include-deleted <value>", "When `true`, allow fetching a soft-deleted email. Defaults to `false` (returns 404 for soft-deleted rows).").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailGet({
     client: client2._rawClient,
@@ -2661,8 +2830,8 @@ var emailGetCommand = new Command29("show").description("Get an inbound email by
 });
 
 // src/generated/cli/email/ls.ts
-import { Command as Command30 } from "commander";
-var emailListCommand = new Command30("ls").description("List inbound emails").option("--limit <value>", "Max items to return (clamped to 1-100). Defaults to 20 server-side.").option("--alias-email <value>", "If set, only return emails received on this full alias email address.").option("--unread-only <value>", "When `true`, only return emails with `is_read=false`.").option("--since <value>", "Unix epoch milliseconds \u2014 only return emails with `received_at >= since`. Useful for incremental sync.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").option("--include-deleted <value>", "When `true`, also return soft-deleted emails. Defaults to `false`.").action(async (opts) => {
+import { Command as Command31 } from "commander";
+var emailListCommand = new Command31("ls").description("List inbound emails").option("--limit <value>", "Max items to return (clamped to 1-100). Defaults to 20 server-side.").option("--alias-email <value>", "If set, only return emails received on this full alias email address.").option("--unread-only <value>", "When `true`, only return emails with `is_read=false`.").option("--since <value>", "Unix epoch milliseconds \u2014 only return emails with `received_at >= since`. Useful for incremental sync.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").option("--include-deleted <value>", "When `true`, also return soft-deleted emails. Defaults to `false`.").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await emailList({
     client: client2._rawClient,
@@ -2687,8 +2856,8 @@ var emailListCommand = new Command30("ls").description("List inbound emails").op
 });
 
 // src/generated/cli/email/read.ts
-import { Command as Command31 } from "commander";
-var emailMarkReadCommand = new Command31("read").description("Mark inbound emails as read").argument("<id...>", "id").action(async (id, opts) => {
+import { Command as Command32 } from "commander";
+var emailMarkReadCommand = new Command32("read").description("Mark inbound emails as read").argument("<id...>", "id").action(async (id, opts) => {
   const idRaw = id;
   const ids = idRaw.length > 0 ? idRaw : void 0;
   const client2 = await loadSdkClient();
@@ -2710,8 +2879,8 @@ var emailMarkReadCommand = new Command31("read").description("Mark inbound email
 });
 
 // src/generated/cli/email/unread.ts
-import { Command as Command32 } from "commander";
-var emailMarkUnreadCommand = new Command32("unread").description("Mark inbound emails as unread").argument("<id...>", "id").action(async (id, opts) => {
+import { Command as Command33 } from "commander";
+var emailMarkUnreadCommand = new Command33("unread").description("Mark inbound emails as unread").argument("<id...>", "id").action(async (id, opts) => {
   const idRaw = id;
   const ids = idRaw.length > 0 ? idRaw : void 0;
   const client2 = await loadSdkClient();
@@ -2733,8 +2902,8 @@ var emailMarkUnreadCommand = new Command32("unread").description("Mark inbound e
 });
 
 // src/generated/cli/domain/verify.ts
-import { Command as Command33 } from "commander";
-var emailDomainVerifyCommand = new Command33("verify").description("Verify a custom domain with the provider").argument("<domain>", "domain").action(async (domain, opts) => {
+import { Command as Command34 } from "commander";
+var emailDomainVerifyCommand = new Command34("verify").description("Verify a custom domain with the provider").argument("<domain>", "domain").action(async (domain, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailDomainVerify({
     client: client2._rawClient,
@@ -2754,8 +2923,8 @@ var emailDomainVerifyCommand = new Command33("verify").description("Verify a cus
 });
 
 // src/generated/cli/push/config/rm.ts
-import { Command as Command34 } from "commander";
-var pushConfigDeleteCommand = new Command34("rm").description("Remove a push transport").argument("<transport>", "transport").action(async (transport, opts) => {
+import { Command as Command35 } from "commander";
+var pushConfigDeleteCommand = new Command35("rm").description("Remove a push transport").argument("<transport>", "transport").action(async (transport, opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigDelete({
     client: client2._rawClient,
@@ -2775,8 +2944,8 @@ var pushConfigDeleteCommand = new Command34("rm").description("Remove a push tra
 });
 
 // src/generated/cli/push/config/set.ts
-import { Command as Command35 } from "commander";
-var pushConfigSetCommand = new Command35("set").description("Register or update a push transport").option("--transport <value>", "Transport discriminator. `telegram` is the only supported value today \u2014 push delivers via a Telegram bot DM. Future transports (web push, iOS/Android, generic webhook) will be added as additional discriminator values.").option("--target-bot-username <value>", "Telegram bot username (with leading `@`, 5\u201332 alphanumeric/underscore characters). This is the bot the user has already started a chat with \u2014 wspc DMs notifications to it via the Telegram Bot API.").action(async (opts) => {
+import { Command as Command36 } from "commander";
+var pushConfigSetCommand = new Command36("set").description("Register or update a push transport").option("--transport <value>", "Transport discriminator. `telegram` is the only supported value today \u2014 push delivers via a Telegram bot DM. Future transports (web push, iOS/Android, generic webhook) will be added as additional discriminator values.").option("--target-bot-username <value>", "Telegram bot username (with leading `@`, 5\u201332 alphanumeric/underscore characters). This is the bot the user has already started a chat with \u2014 wspc DMs notifications to it via the Telegram Bot API.").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigSet({
     client: client2._rawClient,
@@ -2799,8 +2968,8 @@ var pushConfigSetCommand = new Command35("set").description("Register or update
 });
 
 // src/generated/cli/push/config/show.ts
-import { Command as Command36 } from "commander";
-var pushConfigGetCommand = new Command36("show").description("List the caller's push transports").action(async (opts) => {
+import { Command as Command37 } from "commander";
+var pushConfigGetCommand = new Command37("show").description("List the caller's push transports").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigGet({
     client: client2._rawClient
@@ -2817,8 +2986,8 @@ var pushConfigGetCommand = new Command36("show").description("List the caller's
 });
 
 // src/generated/cli/push/test.ts
-import { Command as Command37 } from "commander";
-var pushTestCommand = new Command37("test").description("Send a test push notification").option("--transport <value>", "Which transport to send the test message through. Must match a transport the caller has already registered via `POST /push/config`; today only `telegram` is supported.").action(async (opts) => {
+import { Command as Command38 } from "commander";
+var pushTestCommand = new Command38("test").description("Send a test push notification").option("--transport <value>", "Which transport to send the test message through. Must match a transport the caller has already registered via `POST /push/config`; today only `telegram` is supported.").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushTest({
     client: client2._rawClient,
@@ -2841,8 +3010,8 @@ var pushTestCommand = new Command37("test").description("Send a test push notifi
 });
 
 // src/generated/cli/todo/comment/add.ts
-import { Command as Command38 } from "commander";
-var todoCommentCreateCommand = new Command38("add").description("Add a comment to a todo").argument("<id>", "id").argument("<content>", "content").action(async (id, content, opts) => {
+import { Command as Command39 } from "commander";
+var todoCommentCreateCommand = new Command39("add").description("Add a comment to a todo").argument("<id>", "id").argument("<content>", "content").action(async (id, content, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCommentCreate({
     client: client2._rawClient,
@@ -2865,8 +3034,8 @@ var todoCommentCreateCommand = new Command38("add").description("Add a comment t
 });
 
 // src/generated/cli/todo/comment/ls.ts
-import { Command as Command39 } from "commander";
-var todoCommentListCommand = new Command39("ls").description("List comments on a todo").argument("<id>", "id").option("--order <value>", "order").option("--include-deleted <value>", "include_deleted").option("--limit <value>", "Max comments to return. Clamped to [1, 200]. Default 50 server-side.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").action(async (id, opts) => {
+import { Command as Command40 } from "commander";
+var todoCommentListCommand = new Command40("ls").description("List comments on a todo").argument("<id>", "id").option("--order <value>", "order").option("--include-deleted <value>", "include_deleted").option("--limit <value>", "Max comments to return. Clamped to [1, 200]. Default 50 server-side.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCommentList({
     client: client2._rawClient,
@@ -2892,8 +3061,8 @@ var todoCommentListCommand = new Command39("ls").description("List comments on a
 });
 
 // src/generated/cli/todo/project/add.ts
-import { Command as Command40 } from "commander";
-var projectCreateCommand = new Command40("add").description("Create a project").argument("<name>", "name").option("--default-todo-type-id <value>", "default_todo_type_id").action(async (name, opts) => {
+import { Command as Command41 } from "commander";
+var projectCreateCommand = new Command41("add").description("Create a project").argument("<name>", "name").option("--default-todo-type-id <value>", "default_todo_type_id").action(async (name, opts) => {
   const client2 = await loadSdkClient();
   const result = await projectCreate({
     client: client2._rawClient,
@@ -2914,8 +3083,8 @@ var projectCreateCommand = new Command40("add").description("Create a project").
 });
 
 // src/generated/cli/todo/project/ls.ts
-import { Command as Command41 } from "commander";
-var projectListCommand = new Command41("ls").description("List projects").option("--include-deleted <value>", "Set to `true` to include soft-deleted projects in the response.").action(async (opts) => {
+import { Command as Command42 } from "commander";
+var projectListCommand = new Command42("ls").description("List projects").option("--include-deleted <value>", "Set to `true` to include soft-deleted projects in the response.").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await projectList({
     client: client2._rawClient,
@@ -2935,8 +3104,8 @@ var projectListCommand = new Command41("ls").description("List projects").option
 });
 
 // src/generated/cli/todo/rule/add.ts
-import { Command as Command42 } from "commander";
-var recurrenceRuleCreateCommand = new Command42("add").description("Create a recurring todo rule").argument("<title>", "title").option("--rrule <value>", "rrule").option("--dtstart <value>", "dtstart").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("-p, --project <value>", "Project for the recurrence rule, its template todo, and all materialized instances. Must be an active project in the caller's organization.").option("-t, --type <value>", "type_id").action(async (title, opts) => {
+import { Command as Command43 } from "commander";
+var recurrenceRuleCreateCommand = new Command43("add").description("Create a recurring todo rule").argument("<title>", "title").option("--rrule <value>", "rrule").option("--dtstart <value>", "dtstart").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("-p, --project <value>", "Project for the recurrence rule, its template todo, and all materialized instances. Must be an active project in the caller's organization.").option("-t, --type <value>", "type_id").action(async (title, opts) => {
   const client2 = await loadSdkClient();
   const result = await recurrenceRuleCreate({
     client: client2._rawClient,
@@ -2962,8 +3131,8 @@ var recurrenceRuleCreateCommand = new Command42("add").description("Create a rec
 });
 
 // src/generated/cli/todo/rule/ls.ts
-import { Command as Command43 } from "commander";
-var recurrenceRuleListCommand = new Command43("ls").description("List recurring todo rules").option("--project-id <value>", "Project id filter. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").action(async (opts) => {
+import { Command as Command44 } from "commander";
+var recurrenceRuleListCommand = new Command44("ls").description("List recurring todo rules").option("--project-id <value>", "Project id filter. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await recurrenceRuleList({
     client: client2._rawClient,
@@ -2984,7 +3153,7 @@ var recurrenceRuleListCommand = new Command43("ls").description("List recurring
 });
 
 // src/generated/cli/todo/add.ts
-import { Command as Command44 } from "commander";
+import { Command as Command45 } from "commander";
 
 // src/handwritten/utils/parse-json-field.ts
 function parseJsonField(raw, flag) {
@@ -2999,7 +3168,7 @@ function parseJsonField(raw, flag) {
 }
 
 // src/generated/cli/todo/add.ts
-var todoCreateCommand = new Command44("add").description("Create a todo").argument("<title>", "title").option("-p, --project <value>", "Project id to assign this todo to. It must be an active project in the caller's organization.").option("--description <value>", "Free-form details about the todo. Fully supports GFM Markdown (tables, strikethrough, task lists). Stored verbatim; client applications are responsible for rendering. Optional. Passing `null` is strictly rejected.").option("--parent-id <value>", "Parent todo ID (`tod_<ULID>`) to attach this todo as a child under another todo. Omit or pass `null` to create a root-level todo. Nesting is limited to one level; attempting to set a child todo as a parent will trigger `PARENT_IS_CHILD`. To make a subtask appear on every occurrence of a recurring rule, set this to that rule's template todo id (the template id returned when the rule is created); the server re-materializes future occurrences so each carries the subtask.").option("--status <value>", "Initial status of the todo. Omit to default to `open`. Allowed values: `open`, `in_progress`, `done`, `cancelled`.").option("--due-at <value>", 'Optional calendar due date in ISO date-only format (`YYYY-MM-DD`). Stored without timezone offsets to represent the same local calendar day globally. Pass `""` or omit the field to skip setting a due date. Passing `null` is strictly rejected.').option("--type-id <value>", "Type id this todo belongs to. Omit to use the project's default type. When project_id is also supplied, the type must belong to the same project. New server-generated type ids use typ_<ULID>; legacy ids remain accepted.").option("--custom-fields <value>", "Custom field values keyed by the field's immutable `key` (not the human `label`). Each value must match the declared field type: string fields require string values, and string_array fields require string arrays. Providing a key that is not declared on the resolved todo type is strictly rejected with `UNDECLARED_FIELD`. Missing required fields that lack a default value are rejected with `FIELD_REQUIRED`. Defaults declared on the type are auto-applied at create time.").action(async (title, opts) => {
+var todoCreateCommand = new Command45("add").description("Create a todo").argument("<title>", "title").option("-p, --project <value>", "Project id to assign this todo to. It must be an active project in the caller's organization.").option("--description <value>", "Free-form details about the todo. Fully supports GFM Markdown (tables, strikethrough, task lists). Stored verbatim; client applications are responsible for rendering. Optional. Passing `null` is strictly rejected.").option("--parent-id <value>", "Parent todo ID (`tod_<ULID>`) to attach this todo as a child under another todo. Omit or pass `null` to create a root-level todo. Nesting is limited to one level; attempting to set a child todo as a parent will trigger `PARENT_IS_CHILD`. To make a subtask appear on every occurrence of a recurring rule, set this to that rule's template todo id (the template id returned when the rule is created); the server re-materializes future occurrences so each carries the subtask.").option("--status <value>", "Initial status of the todo. Omit to default to `open`. Allowed values: `open`, `in_progress`, `done`, `cancelled`.").option("--due-at <value>", 'Optional calendar due date in ISO date-only format (`YYYY-MM-DD`). Stored without timezone offsets to represent the same local calendar day globally. Pass `""` or omit the field to skip setting a due date. Passing `null` is strictly rejected.').option("--type-id <value>", "Type id this todo belongs to. Omit to use the project's default type. When project_id is also supplied, the type must belong to the same project. New server-generated type ids use typ_<ULID>; legacy ids remain accepted.").option("--custom-fields <value>", "Custom field values keyed by the field's immutable `key` (not the human `label`). Each value must match the declared field type: string fields require string values, and string_array fields require string arrays. Providing a key that is not declared on the resolved todo type is strictly rejected with `UNDECLARED_FIELD`. Missing required fields that lack a default value are rejected with `FIELD_REQUIRED`. Defaults declared on the type are auto-applied at create time.").action(async (title, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCreate({
     client: client2._rawClient,
@@ -3026,8 +3195,8 @@ var todoCreateCommand = new Command44("add").description("Create a todo").argume
 });
 
 // src/generated/cli/todo/ls.ts
-import { Command as Command45 } from "commander";
-var todoListCommand = new Command45("ls").description("List todos with filters").option("-p, --project <value>", "Filter by project. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").option("--parent-id <value>", "parent_id").option("-s, --status <value>", "status").option("--include-deleted <value>", "include_deleted").option("--include-templates <value>", "include_templates").option("--due-after <value>", "due_after").option("--due-before <value>", "due_before").option("--type-id <value>", "type_id").option("--sort-by <value>", "sort_by").option("--order <value>", "order").option("--include-orphan-fields <value>", "include_orphan_fields").option("--limit <value>", "Max todos to return. Clamped to [1, 200]. Default 50 server-side.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").action(async (opts) => {
+import { Command as Command46 } from "commander";
+var todoListCommand = new Command46("ls").description("List todos with filters").option("-p, --project <value>", "Filter by project. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").option("--parent-id <value>", "parent_id").option("-s, --status <value>", "status").option("--include-deleted <value>", "include_deleted").option("--include-templates <value>", "include_templates").option("--due-after <value>", "due_after").option("--due-before <value>", "due_before").option("--type-id <value>", "type_id").option("--sort-by <value>", "sort_by").option("--order <value>", "order").option("--include-orphan-fields <value>", "include_orphan_fields").option("--limit <value>", "Max todos to return. Clamped to [1, 200]. Default 50 server-side.").option("--cursor <value>", "Opaque pagination cursor returned in `next_cursor` of a previous response.").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await todoList({
     client: client2._rawClient,
@@ -3060,8 +3229,8 @@ var todoListCommand = new Command45("ls").description("List todos with filters")
 });
 
 // src/generated/cli/todo/type/ls.ts
-import { Command as Command46 } from "commander";
-var todoTypeListCommand = new Command46("ls").description("List todo types").option("--project-id <value>", "Project id filter. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
+import { Command as Command47 } from "commander";
+var todoTypeListCommand = new Command47("ls").description("List todo types").option("--project-id <value>", "Project id filter. Required. Unknown, cross-organization, or soft-deleted project ids return NOT_FOUND.").option("--user-id <value>", "user_id").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await todoTypeList({
     client: client2._rawClient,
@@ -3083,8 +3252,8 @@ var todoTypeListCommand = new Command46("ls").description("List todo types").opt
 });
 
 // src/generated/cli/todo/comment/rm.ts
-import { Command as Command47 } from "commander";
-var todoCommentDeleteCommand = new Command47("rm").description("Soft-delete a comment").argument("<id>", "id").action(async (id, opts) => {
+import { Command as Command48 } from "commander";
+var todoCommentDeleteCommand = new Command48("rm").description("Soft-delete a comment").argument("<id>", "id").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCommentDelete({
     client: client2._rawClient,
@@ -3104,8 +3273,8 @@ var todoCommentDeleteCommand = new Command47("rm").description("Soft-delete a co
 });
 
 // src/generated/cli/todo/comment/edit.ts
-import { Command as Command48 } from "commander";
-var todoCommentUpdateCommand = new Command48("edit").description("Edit a comment").argument("<id>", "id").argument("<content>", "content").action(async (id, content, opts) => {
+import { Command as Command49 } from "commander";
+var todoCommentUpdateCommand = new Command49("edit").description("Edit a comment").argument("<id>", "id").argument("<content>", "content").action(async (id, content, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCommentUpdate({
     client: client2._rawClient,
@@ -3128,8 +3297,8 @@ var todoCommentUpdateCommand = new Command48("edit").description("Edit a comment
 });
 
 // src/generated/cli/todo/rule/rm.ts
-import { Command as Command49 } from "commander";
-var recurrenceRuleDeleteCommand = new Command49("rm").description("Delete a recurring todo rule").argument("<id>", "id").option("--expected-version <value>", "expected_version").action(async (id, opts) => {
+import { Command as Command50 } from "commander";
+var recurrenceRuleDeleteCommand = new Command50("rm").description("Delete a recurring todo rule").argument("<id>", "id").option("--expected-version <value>", "expected_version").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await recurrenceRuleDelete({
     client: client2._rawClient,
@@ -3152,8 +3321,8 @@ var recurrenceRuleDeleteCommand = new Command49("rm").description("Delete a recu
 });
 
 // src/generated/cli/todo/rule/show.ts
-import { Command as Command50 } from "commander";
-var recurrenceRuleGetCommand = new Command50("show").description("Get a recurring todo rule").argument("<id>", "id").action(async (id, opts) => {
+import { Command as Command51 } from "commander";
+var recurrenceRuleGetCommand = new Command51("show").description("Get a recurring todo rule").argument("<id>", "id").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await recurrenceRuleGet({
     client: client2._rawClient,
@@ -3173,8 +3342,8 @@ var recurrenceRuleGetCommand = new Command50("show").description("Get a recurrin
 });
 
 // src/generated/cli/todo/rm.ts
-import { Command as Command51 } from "commander";
-var todoDeleteCommand = new Command51("rm").description("Soft-delete a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--cascade <value>", "cascade").action(async (id, opts) => {
+import { Command as Command52 } from "commander";
+var todoDeleteCommand = new Command52("rm").description("Soft-delete a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--cascade <value>", "cascade").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoDelete({
     client: client2._rawClient,
@@ -3198,8 +3367,8 @@ var todoDeleteCommand = new Command51("rm").description("Soft-delete a todo").ar
 });
 
 // src/generated/cli/todo/show.ts
-import { Command as Command52 } from "commander";
-var todoGetCommand = new Command52("show").description("Get a todo by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").option("--include-orphan-fields <value>", "include_orphan_fields").action(async (id, opts) => {
+import { Command as Command53 } from "commander";
+var todoGetCommand = new Command53("show").description("Get a todo by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").option("--include-orphan-fields <value>", "include_orphan_fields").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoGet({
     client: client2._rawClient,
@@ -3224,8 +3393,8 @@ var todoGetCommand = new Command52("show").description("Get a todo by id").argum
 });
 
 // src/generated/cli/todo/update.ts
-import { Command as Command53 } from "commander";
-var todoUpdateCommand = new Command53("update").description("Update a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "New title. Omit to leave the existing title unchanged. Must be non-empty when supplied.").option("--description <value>", 'New description. Markdown formatted (CommonMark + GFM tables, strikethrough, task lists). Pass empty string `""` explicitly to clear an existing description, or omit to leave unchanged. Passing `null` is strictly rejected.').option("--parent-id <value>", "Re-parent the todo. Pass a valid parent ID to attach under another todo, pass `null` to move it back to the root level, or omit to leave unchanged. Nesting is limited to one level; attempting to set a child todo as a parent will trigger `PARENT_IS_CHILD`.").option("--status <value>", "New status of the todo. Allowed transitions: `open` \u2794 `in_progress` \u2794 `done`. `cancelled` represents a terminal state. Transitioning to `done` automatically emits a `captureTodoCompleted` analytics event. Omit to leave the existing status unchanged.").option("--due-at <value>", 'Update calendar due date in ISO date-only format (`YYYY-MM-DD`). Pass `""` explicitly to clear an existing due date, or omit to leave it unchanged. Passing `null` is strictly rejected.').option("--type-id <value>", "Re-assign this todo to a different active type. The new type must belong to the todo's same project; otherwise the request fails with TYPE_PROJECT_MISMATCH. New server-generated type ids use typ_<ULID>; legacy ids remain accepted.").option("--custom-fields <value>", "PATCH semantics: only the keys present in this map change. Pass `null` for a key (e.g. `custom_fields: { priority: null }`) to explicitly delete that custom field value. Array values are replaced wholesale with no element-level diff. Providing a key that is not declared on the effective todo type is rejected with `UNDECLARED_FIELD`.").option("--user-id <value>", "Reassign the owner (assignee) user ID of this todo. Target user must belong to the same organization.").action(async (id, opts) => {
+import { Command as Command54 } from "commander";
+var todoUpdateCommand = new Command54("update").description("Update a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "New title. Omit to leave the existing title unchanged. Must be non-empty when supplied.").option("--description <value>", 'New description. Markdown formatted (CommonMark + GFM tables, strikethrough, task lists). Pass empty string `""` explicitly to clear an existing description, or omit to leave unchanged. Passing `null` is strictly rejected.').option("--parent-id <value>", "Re-parent the todo. Pass a valid parent ID to attach under another todo, pass `null` to move it back to the root level, or omit to leave unchanged. Nesting is limited to one level; attempting to set a child todo as a parent will trigger `PARENT_IS_CHILD`.").option("--status <value>", "New status of the todo. Allowed transitions: `open` \u2794 `in_progress` \u2794 `done`. `cancelled` represents a terminal state. Transitioning to `done` automatically emits a `captureTodoCompleted` analytics event. Omit to leave the existing status unchanged.").option("--due-at <value>", 'Update calendar due date in ISO date-only format (`YYYY-MM-DD`). Pass `""` explicitly to clear an existing due date, or omit to leave it unchanged. Passing `null` is strictly rejected.').option("--type-id <value>", "Re-assign this todo to a different active type. The new type must belong to the todo's same project; otherwise the request fails with TYPE_PROJECT_MISMATCH. New server-generated type ids use typ_<ULID>; legacy ids remain accepted.").option("--custom-fields <value>", "PATCH semantics: only the keys present in this map change. Pass `null` for a key (e.g. `custom_fields: { priority: null }`) to explicitly delete that custom field value. Array values are replaced wholesale with no element-level diff. Providing a key that is not declared on the effective todo type is rejected with `UNDECLARED_FIELD`.").option("--user-id <value>", "Reassign the owner (assignee) user ID of this todo. Target user must belong to the same organization.").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoUpdate({
     client: client2._rawClient,
@@ -3291,6 +3460,7 @@ function registerGeneratedCommands(root) {
   const root_domain = root.command("domain").description("domain commands");
   root_domain.addCommand(emailDomainCreateCommand);
   root_domain.addCommand(emailDomainListCommand);
+  root_domain.addCommand(emailDomainDeleteCommand);
   root_domain.addCommand(emailDomainGetCommand);
   root_domain.addCommand(emailDomainVerifyCommand);
   const root_email = root.command("email").description("email commands");
@@ -3329,12 +3499,17 @@ function registerGeneratedCommands(root) {
 }
 
 // src/handwritten/commands/login.ts
-import { Command as Command54 } from "commander";
+import { Command as Command55 } from "commander";
 
 // src/handwritten/auth/device-flow.ts
 var DEFAULT_SLEEP = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runDeviceFlow(opts) {
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.store && opts.envName ? createConsistencyFetch({
+    store: opts.store,
+    envName: opts.envName,
+    apiBase: opts.baseUrl,
+    fetchImpl: opts.fetchImpl
+  }) : opts.fetchImpl ?? fetch;
   const sleep = opts.sleepMs ?? DEFAULT_SLEEP;
   const codeRes = await fetchImpl(`${opts.baseUrl}/auth/oauth/device`, {
     method: "POST",
@@ -3390,10 +3565,19 @@ async function runDeviceFlow(opts) {
 var DEFAULT_CLIENT_NAME = "wspc CLI";
 var DEFAULT_REDIRECT_URI = "http://localhost";
 async function ensureClientId(opts) {
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = createConsistencyFetch({
+    store: opts.store,
+    envName: opts.envName,
+    apiBase: opts.baseUrl,
+    fetchImpl: opts.fetchImpl
+  });
   const c = await opts.store.read();
   const existing = c.envs[opts.envName]?.client_id;
   if (existing) return existing;
+  const targetEnv = c.envs[opts.envName] ??= { api_base: opts.baseUrl, accounts: {} };
+  targetEnv.api_base = opts.baseUrl;
+  targetEnv.accounts ??= {};
+  await opts.store.write(c);
   const res = await fetchImpl(`${opts.baseUrl}/auth/oauth/register`, {
     method: "POST",
     headers: { "content-type": "application/json" },
@@ -3419,7 +3603,12 @@ async function ensureClientId(opts) {
 
 // src/handwritten/auth/fetch-me.ts
 async function fetchMe(opts) {
-  const f = opts.fetchImpl ?? fetch;
+  const f = opts.store && opts.envName ? createConsistencyFetch({
+    store: opts.store,
+    envName: opts.envName,
+    apiBase: opts.baseUrl,
+    fetchImpl: opts.fetchImpl
+  }) : opts.fetchImpl ?? fetch;
   const res = await f(`${opts.baseUrl}/auth/me`, {
     headers: { authorization: `Bearer ${opts.token}` }
   });
@@ -3448,7 +3637,16 @@ async function runLogin(opts) {
   const now = opts.now ?? Date.now;
   const me = opts.fetchMe ?? ((o) => fetchMe(o));
   if (opts.apiKey) {
-    const who2 = await me({ baseUrl: opts.baseUrl, token: opts.apiKey });
+    const initial = await opts.store.read();
+    getOrCreateEnv(initial, envName, opts.baseUrl);
+    initial.current_env = envName;
+    await opts.store.write(initial);
+    const who2 = await me({
+      baseUrl: opts.baseUrl,
+      token: opts.apiKey,
+      store: opts.store,
+      envName
+    });
     const c2 = await opts.store.read();
     const env2 = getOrCreateEnv(c2, envName, opts.baseUrl);
     const prev2 = env2.accounts[who2.email] ?? { email: who2.email };
@@ -3474,6 +3672,8 @@ async function runLogin(opts) {
   const result = await flow({
     baseUrl: opts.baseUrl,
     clientId,
+    store: opts.store,
+    envName,
     onPrompt: (p) => {
       const prompt = p;
       opts.output.writeJson({ event: "device_code_issued", ...prompt });
@@ -3486,7 +3686,12 @@ async function runLogin(opts) {
 `);
     }
   });
-  const who = await me({ baseUrl: opts.baseUrl, token: result.access_token });
+  const who = await me({
+    baseUrl: opts.baseUrl,
+    token: result.access_token,
+    store: opts.store,
+    envName
+  });
   const c = await opts.store.read();
   const env = getOrCreateEnv(c, envName, opts.baseUrl);
   const prev = env.accounts[who.email] ?? { email: who.email };
@@ -3516,7 +3721,7 @@ function resolveLoginTarget(opts, env) {
 function wantsJson(opts, env) {
   return opts.json === true || env.WSPC_OUTPUT === "json";
 }
-var loginCommand = new Command54("login").description("Log in via OAuth device flow (default) or API key").option("--api-key <key>", "Log in with a wspc API key (escape hatch)").option("--api-base <url>", "Target API base URL (default: production)").option("--env <name>", "Config env name to store credentials under").option("--json", "Emit machine-readable events to stdout").action(async (opts) => {
+var loginCommand = new Command55("login").description("Log in via OAuth device flow (default) or API key").option("--api-key <key>", "Log in with a wspc API key (escape hatch)").option("--api-base <url>", "Target API base URL (default: production)").option("--env <name>", "Config env name to store credentials under").option("--json", "Emit machine-readable events to stdout").action(async (opts) => {
   const store = new ConfigStore();
   const { baseUrl, envName } = resolveLoginTarget(opts, process.env);
   const output = wantsJson(opts, process.env) ? { write: () => {
@@ -3535,7 +3740,7 @@ var loginCommand = new Command54("login").description("Log in via OAuth device f
 });
 
 // src/handwritten/commands/logout.ts
-import { Command as Command55 } from "commander";
+import { Command as Command56 } from "commander";
 
 // src/handwritten/auth/logout.ts
 async function runLogout(opts) {
@@ -3563,7 +3768,7 @@ async function runLogout(opts) {
 }
 
 // src/handwritten/commands/logout.ts
-var logoutCommand = new Command55("logout").description("Log out an account (default: the active account in the current env)").argument("[email]", "Email of the account to log out").option("--all", "Log out every account in the current env").action(async (email, opts) => {
+var logoutCommand = new Command56("logout").description("Log out an account (default: the active account in the current env)").argument("[email]", "Email of the account to log out").option("--all", "Log out every account in the current env").action(async (email, opts) => {
   const res = await runLogout({ store: new ConfigStore(), email, all: opts.all });
   if (res.removed.length === 0) {
     process.stdout.write("nothing to log out\n");
@@ -3576,7 +3781,7 @@ var logoutCommand = new Command55("logout").description("Log out an account (def
 });
 
 // src/handwritten/commands/whoami.ts
-import { Command as Command56 } from "commander";
+import { Command as Command57 } from "commander";
 var ENV_DISPLAY = {
   shape: "object",
   fields: ["name", "api_base", "account", "actor", "agent_label"]
@@ -3608,7 +3813,7 @@ async function backfillActiveEmail(store, envName, email, userId) {
     await store.write(cfg);
   }
 }
-var whoamiCommand = new Command56("whoami").description("Show the active env, signed-in account, and organization").action(async () => {
+var whoamiCommand = new Command57("whoami").description("Show the active env, signed-in account, and organization").action(async () => {
   const store = new ConfigStore();
   const config = await store.read();
   let resolved;
@@ -3661,8 +3866,8 @@ function printLoggedOut() {
 }
 
 // src/handwritten/commands/config.ts
-import { Command as Command57 } from "commander";
-var configCommand = new Command57("config").description("Manage wspc local config");
+import { Command as Command58 } from "commander";
+var configCommand = new Command58("config").description("Manage wspc local config");
 registerRenderer("config_show", (data) => {
   const d = data;
   if (d.envs.length === 0) {
@@ -3733,7 +3938,7 @@ configCommand.command("use <env>").description("Switch current_env").action(asyn
 });
 
 // src/handwritten/commands/account.ts
-import { Command as Command58 } from "commander";
+import { Command as Command59 } from "commander";
 async function listAccounts(store) {
   const c = await store.read();
   const envName = c.current_env;
@@ -3774,7 +3979,7 @@ registerRenderer("account_ls", (data) => {
   ]);
   process.stdout.write(table(headers, body));
 });
-var accountCommand = new Command58("account").description("Manage logged-in accounts");
+var accountCommand = new Command59("account").description("Manage logged-in accounts");
 accountCommand.command("ls").description("List accounts in the current env (active marked with \u2713)").action(async () => {
   const accounts = await listAccounts(new ConfigStore());
   render({ kind: "account_ls" }, { accounts });
@@ -3786,7 +3991,7 @@ accountCommand.command("switch <email>").description("Set the active account for
 });
 
 // src/handwritten/commands/todo-done.ts
-import { Command as Command59 } from "commander";
+import { Command as Command60 } from "commander";
 var TODO_UPDATE_DISPLAY = {
   shape: "object",
   format: {
@@ -3804,7 +4009,7 @@ var TODO_UPDATE_DISPLAY = {
     deleted_at: "relative-time"
   }
 };
-var todoDoneCommand = new Command59("done").description("Mark a todo done (sugar for `update <id> --status done`)").argument("<id>", "Todo id").action(async (id) => {
+var todoDoneCommand = new Command60("done").description("Mark a todo done (sugar for `update <id> --status done`)").argument("<id>", "Todo id").action(async (id) => {
   const client2 = await loadSdkClient();
   const result = await todoUpdate({
     client: client2._rawClient,
@@ -3823,7 +4028,7 @@ var todoDoneCommand = new Command59("done").description("Mark a todo done (sugar
 });
 
 // src/handwritten/commands/email/send.ts
-import { Command as Command60 } from "commander";
+import { Command as Command61 } from "commander";
 import { readFile, stat } from "fs/promises";
 import { basename } from "path";
 
@@ -3881,7 +4086,7 @@ async function resolveAttachment(input) {
     `--attach ${input}: neither a readable file nor a valid <prefix>_<ulid>:<idx> reference.`
   );
 }
-var sendCommand = new Command60("send").description("Send an outbound email").requiredOption("--from <alias-email>", "alias email to send from").option("--to <addr...>", "recipient address (repeatable)", []).option("--subject <text>", "subject").option("--text <body>", "plain-text body").option("--text-file <path>", "read text body from file").option("--reply <id>", "inbound email id to reply to").option("--attach <path-or-ref...>", "attachment (file path or eml_xxx:idx)", []).requiredOption("--idempotency-key <key>", "idempotency key").action(async (opts) => {
+var sendCommand = new Command61("send").description("Send an outbound email").requiredOption("--from <alias-email>", "alias email to send from").option("--to <addr...>", "recipient address (repeatable)", []).option("--subject <text>", "subject").option("--text <body>", "plain-text body").option("--text-file <path>", "read text body from file").option("--reply <id>", "inbound email id to reply to").option("--attach <path-or-ref...>", "attachment (file path or eml_xxx:idx)", []).requiredOption("--idempotency-key <key>", "idempotency key").action(async (opts) => {
   const isReply = Boolean(opts.reply);
   const to = opts.to;
   const attachInputs = opts.attach;
@@ -3968,7 +4173,7 @@ var sendCommand = new Command60("send").description("Send an outbound email").re
 });
 
 // src/handwritten/commands/email/attachment.ts
-import { Command as Command61 } from "commander";
+import { Command as Command62 } from "commander";
 import { createWriteStream } from "fs";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -3985,7 +4190,7 @@ function parseContentDispositionFilename(header) {
 }
 
 // src/handwritten/commands/email/attachment.ts
-var attachmentCommand = new Command61("attachment").description("Download an inbound email attachment by index").argument("<email-id>").argument("<idx>").option("--output <path>", "output file path").option("--include-deleted", "allow downloads from soft-deleted parent emails").action(async (emailId, idxArg, opts) => {
+var attachmentCommand = new Command62("attachment").description("Download an inbound email attachment by index").argument("<email-id>").argument("<idx>").option("--output <path>", "output file path").option("--include-deleted", "allow downloads from soft-deleted parent emails").action(async (emailId, idxArg, opts) => {
   const idx = Number(idxArg);
   if (!Number.isInteger(idx) || idx < 0) {
     process.stderr.write(`<idx> must be a non-negative integer (got "${idxArg}")
@@ -4018,7 +4223,7 @@ var attachmentCommand = new Command61("attachment").description("Download an inb
 
 // src/cli.ts
 function buildProgram() {
-  const program = new Command62().name("wspc").description("Official CLI for wspc.ai").version(`wspc ${VERSION} (spec ${SPEC_SHA}, fetched ${SPEC_FETCHED_AT})`).option("--json", "Output raw JSON (machine-readable)").option("--account <email>", "Run as a specific account (overrides the active account)").hook("preAction", (_thisCommand, actionCommand) => {
+  const program = new Command63().name("wspc").description("Official CLI for wspc.ai").version(`wspc ${VERSION} (spec ${SPEC_SHA}, fetched ${SPEC_FETCHED_AT})`).option("--json", "Output raw JSON (machine-readable)").option("--account <email>", "Run as a specific account (overrides the active account)").hook("preAction", (_thisCommand, actionCommand) => {
     const globals = actionCommand.optsWithGlobals();
     if (globals.json) process.env.WSPC_OUTPUT = "json";
     if (globals.account) process.env.WSPC_ACCOUNT = String(globals.account);