@wspc/cli 0.0.5 → 0.0.7

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command41 } from "commander";
+import { Command as Command51 } from "commander";
 
-// src/generated/cli/keys/create.ts
+// src/generated/cli/invite/accept.ts
 import { Command } from "commander";
 
 // src/generated/sdk/core/bodySerializer.gen.ts
@@ -792,9 +792,14 @@ var createClient = (config = {}) => {
 };
 
 // src/generated/sdk/client.gen.ts
-var client = createClient(createConfig());
+var client = createClient(createConfig({ baseUrl: "https://api.wspc.ai" }));
 
 // src/generated/sdk/sdk.gen.ts
+var inviteAccept = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/invites/{id}/accept",
+  ...options
+});
 var keyList = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/auth/keys",
@@ -809,26 +814,78 @@ var keyCreate = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var orgInvitesList = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/me/org/invites",
+  ...options
+});
+var orgInviteCreate = (options) => (options?.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/me/org/invites",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options?.headers
+  }
+});
 var orgGet = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/auth/me/org",
   ...options
 });
+var orgUpdate = (options) => (options?.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/me/org",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options?.headers
+  }
+});
+var inviteGet = (options) => (options.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/invites/{id}",
+  ...options
+});
 var authMe = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/auth/me",
   ...options
 });
+var invitesList = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/invites",
+  ...options
+});
 var orgMembersList = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/auth/me/org/members",
   ...options
 });
+var inviteReject = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/invites/{id}/reject",
+  ...options
+});
 var keyRevoke = (options) => (options.client ?? client).delete({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/auth/keys/{id}",
   ...options
 });
+var keyUpdate = (options) => (options.client ?? client).patch({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/keys/{id}",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var orgInviteRevoke = (options) => (options.client ?? client).delete({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/auth/me/org/invites/{id}",
+  ...options
+});
 var eventList = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/calendar/events",
@@ -1030,7 +1087,62 @@ var todoUpdate = (options) => (options.client ?? client).patch({
 import { promises as fs } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+var LEGACY_ACCOUNT_KEY = "(default)";
 var DEFAULT_DIR = join(homedir(), ".wspc");
+var V1_CRED_KEYS = [
+  "refresh_token",
+  "access_token",
+  "access_token_expires_at",
+  "api_key",
+  "actor",
+  "agent_label"
+];
+function migrateEnv(raw) {
+  const api_base = typeof raw.api_base === "string" ? raw.api_base : "";
+  const env = { api_base, accounts: {} };
+  if (typeof raw.client_id === "string") env.client_id = raw.client_id;
+  if (raw.accounts && typeof raw.accounts === "object") {
+    env.accounts = raw.accounts;
+    if (typeof raw.current_account === "string") env.current_account = raw.current_account;
+    return env;
+  }
+  const hasCreds = V1_CRED_KEYS.some((k) => raw[k] !== void 0);
+  if (hasCreds) {
+    const creds = { email: LEGACY_ACCOUNT_KEY };
+    for (const k of V1_CRED_KEYS) {
+      if (raw[k] !== void 0) creds[k] = raw[k];
+    }
+    env.accounts[LEGACY_ACCOUNT_KEY] = creds;
+    env.current_account = LEGACY_ACCOUNT_KEY;
+  }
+  return env;
+}
+function normalize(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return { envs: {} };
+  const obj = parsed;
+  if (typeof obj.envs !== "object" || obj.envs === null) return { envs: {} };
+  const envs = {};
+  for (const [name, rawEnv] of Object.entries(obj.envs)) {
+    if (typeof rawEnv === "object" && rawEnv !== null) {
+      envs[name] = migrateEnv(rawEnv);
+    }
+  }
+  const out = { schema_version: 2, envs };
+  if (typeof obj.current_env === "string") out.current_env = obj.current_env;
+  return out;
+}
+function rekeyLegacyAccount(config, envName, email, userId) {
+  if (email === LEGACY_ACCOUNT_KEY) return false;
+  const env = config.envs[envName];
+  const legacy = env?.accounts?.[LEGACY_ACCOUNT_KEY];
+  if (!env || !legacy) return false;
+  delete env.accounts[LEGACY_ACCOUNT_KEY];
+  if (!env.accounts[email]) {
+    env.accounts[email] = { ...legacy, email, ...userId ? { user_id: userId } : {} };
+  }
+  if (env.current_account === LEGACY_ACCOUNT_KEY) env.current_account = email;
+  return true;
+}
 var ConfigStore = class {
   configDir;
   configFile;
@@ -1041,11 +1153,7 @@ var ConfigStore = class {
   async read() {
     try {
       const buf = await fs.readFile(this.configFile, "utf8");
-      const parsed = JSON.parse(buf);
-      if (typeof parsed !== "object" || parsed === null || typeof parsed.envs !== "object") {
-        return { envs: {} };
-      }
-      return parsed;
+      return normalize(JSON.parse(buf));
     } catch (e) {
       if (e.code === "ENOENT") return { envs: {} };
       throw e;
@@ -1070,9 +1178,9 @@ var ConfigStore = class {
 };
 
 // src/version.ts
-var VERSION = "0.0.5";
-var SPEC_SHA = "601a9f59";
-var SPEC_FETCHED_AT = "2026-05-27T14:26:43.644Z";
+var VERSION = "0.0.7";
+var SPEC_SHA = "c579a55a";
+var SPEC_FETCHED_AT = "2026-06-03T06:34:38.606Z";
 var API_BASE = "https://api.wspc.ai";
 
 // src/index.ts
@@ -1136,45 +1244,78 @@ function createAuthInterceptor(mode) {
   };
 }
 
-// src/handwritten/auth/load-sdk-client.ts
-async function loadSdkClient(opts = {}) {
-  const store = opts.store ?? new ConfigStore();
-  const current = await store.currentEnv();
-  if (!current) {
-    throw new Error("not logged in: run `wspc login` first");
-  }
-  const env = current.config;
-  if (!env.api_key && !(env.access_token && env.refresh_token)) {
-    throw new Error("not logged in: run `wspc login` first");
-  }
-  let interceptor;
-  if (env.api_key) {
-    interceptor = createAuthInterceptor({ apiKey: env.api_key });
-  } else {
-    if (!env.client_id) {
+// src/handwritten/auth/resolve-account.ts
+var NOT_LOGGED_IN = "not logged in: run `wspc login` first";
+function resolveAccount(config, opts = {}) {
+  const envName = config.current_env;
+  if (!envName || !config.envs[envName]) throw new Error(NOT_LOGGED_IN);
+  const env = config.envs[envName];
+  const accounts = env.accounts ?? {};
+  const emails = Object.keys(accounts);
+  let email;
+  const override = opts.accountOverride;
+  if (override) {
+    if (!accounts[override]) {
       throw new Error(
-        "config has OAuth tokens but no client_id \u2014 run `wspc logout && wspc login` to re-register"
+        `no account '${override}' in env '${envName}'. Run \`wspc account ls\` or \`wspc login\`.`
       );
     }
-    interceptor = createAuthInterceptor({
-      accessToken: env.access_token,
-      refreshToken: env.refresh_token,
-      baseUrl: env.api_base,
-      clientId: env.client_id,
-      onTokenRefresh: async ({ accessToken, refreshToken, expiresAt }) => {
-        const cfg = await store.read();
-        const e = cfg.envs[current.name];
-        if (!e) return;
-        e.access_token = accessToken;
-        e.refresh_token = refreshToken;
-        e.access_token_expires_at = expiresAt;
-        await store.write(cfg);
-      }
-    });
+    email = override;
+  } else if (env.current_account && accounts[env.current_account]) {
+    email = env.current_account;
+  } else if (emails.length === 1) {
+    email = emails[0];
+  } else if (emails.length === 0) {
+    throw new Error(NOT_LOGGED_IN);
+  } else {
+    throw new Error(
+      `multiple accounts in env '${envName}'; specify --account <email> or run \`wspc account switch <email>\`.`
+    );
+  }
+  if (email === void 0) throw new Error(NOT_LOGGED_IN);
+  const creds = accounts[email];
+  if (!creds) throw new Error(NOT_LOGGED_IN);
+  if (!creds.api_key && !(creds.access_token && creds.refresh_token)) {
+    throw new Error(NOT_LOGGED_IN);
   }
+  return { envName, apiBase: env.api_base, clientId: env.client_id, email, creds };
+}
+
+// src/handwritten/auth/load-sdk-client.ts
+function buildInterceptor(store, resolved) {
+  const { envName, apiBase, clientId, email, creds } = resolved;
+  if (creds.api_key) {
+    return createAuthInterceptor({ apiKey: creds.api_key });
+  }
+  if (!clientId) {
+    throw new Error(
+      "config has OAuth tokens but no client_id \u2014 run `wspc logout && wspc login` to re-register"
+    );
+  }
+  return createAuthInterceptor({
+    accessToken: creds.access_token,
+    refreshToken: creds.refresh_token,
+    baseUrl: apiBase,
+    clientId,
+    onTokenRefresh: async ({ accessToken, refreshToken, expiresAt }) => {
+      const cfg = await store.read();
+      const a = cfg.envs[envName]?.accounts?.[email];
+      if (!a) return;
+      a.access_token = accessToken;
+      a.refresh_token = refreshToken;
+      a.access_token_expires_at = expiresAt;
+      await store.write(cfg);
+    }
+  });
+}
+async function loadSdkClient(opts = {}) {
+  const store = opts.store ?? new ConfigStore();
+  const config = await store.read();
+  const resolved = resolveAccount(config, { accountOverride: process.env.WSPC_ACCOUNT });
+  const interceptor = buildInterceptor(store, resolved);
   const rawClient = createClient(
     createConfig({
-      baseUrl: env.api_base,
+      baseUrl: resolved.apiBase,
       fetch: ((input, init) => interceptor.execute(new Request(input, init)))
     })
   );
@@ -1182,39 +1323,11 @@ async function loadSdkClient(opts = {}) {
 }
 async function loadAuthedFetch(opts = {}) {
   const store = opts.store ?? new ConfigStore();
-  const current = await store.currentEnv();
-  if (!current) throw new Error("not logged in: run `wspc login` first");
-  const env = current.config;
-  if (!env.api_key && !(env.access_token && env.refresh_token)) {
-    throw new Error("not logged in: run `wspc login` first");
-  }
-  let interceptor;
-  if (env.api_key) {
-    interceptor = createAuthInterceptor({ apiKey: env.api_key });
-  } else {
-    if (!env.client_id) {
-      throw new Error(
-        "config has OAuth tokens but no client_id \u2014 run `wspc logout && wspc login` to re-register"
-      );
-    }
-    interceptor = createAuthInterceptor({
-      accessToken: env.access_token,
-      refreshToken: env.refresh_token,
-      baseUrl: env.api_base,
-      clientId: env.client_id,
-      onTokenRefresh: async ({ accessToken, refreshToken, expiresAt }) => {
-        const cfg = await store.read();
-        const e = cfg.envs[current.name];
-        if (!e) return;
-        e.access_token = accessToken;
-        e.refresh_token = refreshToken;
-        e.access_token_expires_at = expiresAt;
-        await store.write(cfg);
-      }
-    });
-  }
+  const config = await store.read();
+  const resolved = resolveAccount(config, { accountOverride: process.env.WSPC_ACCOUNT });
+  const interceptor = buildInterceptor(store, resolved);
   const authedFetch = (input, init) => interceptor.execute(new Request(input, init));
-  return { fetch: authedFetch, baseUrl: env.api_base };
+  return { fetch: authedFetch, baseUrl: resolved.apiBase };
 }
 
 // src/handwritten/output/primitives.ts
@@ -1599,8 +1712,29 @@ function formatCell(value, fmt, colorMap) {
   }
 }
 
+// src/generated/cli/invite/accept.ts
+var inviteAcceptCommand = new Command("accept").description("Accept an invite and switch into the inviting organization").argument("<id>", "id").action(async (id, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await inviteAccept({
+    client: client2._rawClient,
+    path: {
+      id
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "invite_accept", display: { "shape": "object", "fields": ["id", "name", "created_at", "updated_at"] } }, result.data);
+});
+
 // src/generated/cli/keys/create.ts
-var keyCreateCommand = new Command("create").description("Create a new API key (full value returned once)").option("--label <value>", "label").action(async (opts) => {
+import { Command as Command2 } from "commander";
+var keyCreateCommand = new Command2("create").description("Create a new API key (full value returned once)").option("--label <value>", "label").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await keyCreate({
     client: client2._rawClient,
@@ -1620,8 +1754,8 @@ var keyCreateCommand = new Command("create").description("Create a new API key (
 });
 
 // src/generated/cli/keys/ls.ts
-import { Command as Command2 } from "commander";
-var keyListCommand = new Command2("ls").description("List active API keys").action(async (opts) => {
+import { Command as Command3 } from "commander";
+var keyListCommand = new Command3("ls").description("List active API keys").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await keyList({
     client: client2._rawClient
@@ -1637,9 +1771,48 @@ var keyListCommand = new Command2("ls").description("List active API keys").acti
   render({ kind: "key_list", display: { "shape": "list", "dataPath": "keys", "columns": ["id", "label", "last_4", "created_at", "last_used_at"], "format": { "id": "id-short", "created_at": "relative-time", "last_used_at": "relative-time" }, "emptyMessage": "(no API keys)" } }, result.data);
 });
 
+// src/generated/cli/org/invite.ts
+import { Command as Command4 } from "commander";
+var orgInviteCreateCommand = new Command4("invite").description("Invite an email to join the caller's organization").option("--email <value>", "email").action(async (opts) => {
+  const client2 = await loadSdkClient();
+  const result = await orgInviteCreate({
+    client: client2._rawClient,
+    body: {
+      email: opts.email
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "org_invite_create", display: { "shape": "object", "fields": ["id", "email", "state", "expires_at", "invite_url"] } }, result.data);
+});
+
+// src/generated/cli/org/invites.ts
+import { Command as Command5 } from "commander";
+var orgInvitesListCommand = new Command5("invites").description("List invites issued by the caller's organization").action(async (opts) => {
+  const client2 = await loadSdkClient();
+  const result = await orgInvitesList({
+    client: client2._rawClient
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "org_invites_list", display: { "shape": "list", "dataPath": "invites", "columns": ["id", "email", "state", "expires_at"], "format": { "id": "id-short", "expires_at": "relative-time" } } }, result.data);
+});
+
 // src/generated/cli/org/show.ts
-import { Command as Command3 } from "commander";
-var orgGetCommand = new Command3("show").description("Get the authenticated user's organization").action(async (opts) => {
+import { Command as Command6 } from "commander";
+var orgGetCommand = new Command6("show").description("Get the authenticated user's organization").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await orgGet({
     client: client2._rawClient
@@ -1655,9 +1828,51 @@ var orgGetCommand = new Command3("show").description("Get the authenticated user
   render({ kind: "org_get", display: { "shape": "object", "fields": ["id", "name", "created_at", "updated_at"], "format": { "id": "id-short", "name": "truncate", "created_at": "relative-time", "updated_at": "relative-time" } } }, result.data);
 });
 
+// src/generated/cli/org/rename.ts
+import { Command as Command7 } from "commander";
+var orgUpdateCommand = new Command7("rename").description("Update the authenticated user's organization").option("--name <value>", "name").action(async (opts) => {
+  const client2 = await loadSdkClient();
+  const result = await orgUpdate({
+    client: client2._rawClient,
+    body: {
+      name: opts.name
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "org_update", display: { "shape": "object", "fields": ["id", "name", "created_at", "updated_at"], "format": { "id": "id-short", "name": "truncate", "created_at": "relative-time", "updated_at": "relative-time" } } }, result.data);
+});
+
+// src/generated/cli/invite/show.ts
+import { Command as Command8 } from "commander";
+var inviteGetCommand = new Command8("show").description("Get a single invite addressed to the caller").argument("<id>", "id").action(async (id, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await inviteGet({
+    client: client2._rawClient,
+    path: {
+      id
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "invite_get", display: void 0 }, result.data);
+});
+
 // src/generated/cli/auth/me.ts
-import { Command as Command4 } from "commander";
-var authMeCommand = new Command4("me").description("Fetch the user identified by the bearer token").action(async (opts) => {
+import { Command as Command9 } from "commander";
+var authMeCommand = new Command9("me").description("Fetch the user identified by the bearer token").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await authMe({
     client: client2._rawClient
@@ -1673,9 +1888,27 @@ var authMeCommand = new Command4("me").description("Fetch the user identified by
   render({ kind: "auth_me", display: { "shape": "object", "fields": ["user_id", "email", "display_name", "api_key_id"], "format": { "user_id": "id-short", "api_key_id": "id-short" } } }, result.data);
 });
 
+// src/generated/cli/invites.ts
+import { Command as Command10 } from "commander";
+var invitesListCommand = new Command10("invites").description("List invites addressed to the authenticated user's email").action(async (opts) => {
+  const client2 = await loadSdkClient();
+  const result = await invitesList({
+    client: client2._rawClient
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "invites_list", display: { "shape": "list", "dataPath": "invites", "columns": ["id", "org_name", "inviter_email", "state", "expires_at"], "format": { "id": "id-short", "expires_at": "relative-time" } } }, result.data);
+});
+
 // src/generated/cli/org/members.ts
-import { Command as Command5 } from "commander";
-var orgMembersListCommand = new Command5("members").description("List members of the authenticated user's organization").option("--cursor <value>", "cursor").option("--limit <value>", "limit").action(async (opts) => {
+import { Command as Command11 } from "commander";
+var orgMembersListCommand = new Command11("members").description("List members of the authenticated user's organization").option("--cursor <value>", "cursor").option("--limit <value>", "limit").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await orgMembersList({
     client: client2._rawClient,
@@ -1695,9 +1928,30 @@ var orgMembersListCommand = new Command5("members").description("List members of
   render({ kind: "org_members_list", display: { "shape": "list", "dataPath": "members", "columns": ["user_id", "email", "display_name", "joined_at"], "format": { "user_id": "id-short", "joined_at": "relative-time" } } }, result.data);
 });
 
+// src/generated/cli/invite/reject.ts
+import { Command as Command12 } from "commander";
+var inviteRejectCommand = new Command12("reject").description("Reject an invite").argument("<id>", "id").action(async (id, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await inviteReject({
+    client: client2._rawClient,
+    path: {
+      id
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "invite_reject", display: void 0 }, result.data);
+});
+
 // src/generated/cli/keys/rm.ts
-import { Command as Command6 } from "commander";
-var keyRevokeCommand = new Command6("rm").description("Soft-revoke an API key").argument("<id>", "id").action(async (id, opts) => {
+import { Command as Command13 } from "commander";
+var keyRevokeCommand = new Command13("rm").description("Soft-revoke an API key").argument("<id>", "id").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await keyRevoke({
     client: client2._rawClient,
@@ -1716,8 +1970,53 @@ var keyRevokeCommand = new Command6("rm").description("Soft-revoke an API key").
   render({ kind: "key_revoke", display: void 0 }, result.data);
 });
 
+// src/generated/cli/keys/edit.ts
+import { Command as Command14 } from "commander";
+var keyUpdateCommand = new Command14("edit").description("Update an active API key's label").argument("<id>", "id").option("--label <value>", "label").action(async (id, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await keyUpdate({
+    client: client2._rawClient,
+    path: {
+      id
+    },
+    body: {
+      label: opts.label
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "key_update", display: void 0 }, result.data);
+});
+
+// src/generated/cli/org/invite/revoke.ts
+import { Command as Command15 } from "commander";
+var orgInviteRevokeCommand = new Command15("revoke").description("Revoke a pending invite").argument("<id>", "id").action(async (id, opts) => {
+  const client2 = await loadSdkClient();
+  const result = await orgInviteRevoke({
+    client: client2._rawClient,
+    path: {
+      id
+    }
+  });
+  if (result.error || !result.response?.ok) {
+    process.stderr.write(
+      `HTTP ${result.response?.status ?? "?"}: ${JSON.stringify(result.error ?? "unknown error", null, 2)}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  render({ kind: "org_invite_revoke", display: void 0 }, result.data);
+});
+
 // src/generated/cli/event/add.ts
-import { Command as Command7 } from "commander";
+import { Command as Command16 } from "commander";
 
 // src/handwritten/utils/parse-time.ts
 import * as chrono from "chrono-node";
@@ -1803,7 +2102,7 @@ function parseAttendee(input) {
 }
 
 // src/generated/cli/event/add.ts
-var eventCreateCommand = new Command7("add").description("Schedule a calendar event").argument("<title>", "title").option("--description <value>", "description").option("--start <value>", "start").option("--end <value>", "end").option("-l, --location <value>", "location").option("-u, --url <value>", "url").option("--status <value>", "status").option("--attendee <value>", "attendee", (val, memo) => {
+var eventCreateCommand = new Command16("add").description("Schedule a calendar event").argument("<title>", "title").option("--description <value>", "description").option("--start <value>", "start").option("--end <value>", "end").option("-l, --location <value>", "location").option("-u, --url <value>", "url").option("--status <value>", "status").option("--attendee <value>", "attendee", (val, memo) => {
   memo.push(val);
   return memo;
 }, []).option("--all-day", "all_day").option("--tz <zone>", "IANA timezone for relative time parsing").action(async (title, opts) => {
@@ -1852,8 +2151,8 @@ var eventCreateCommand = new Command7("add").description("Schedule a calendar ev
 });
 
 // src/generated/cli/event/ls.ts
-import { Command as Command8 } from "commander";
-var eventListCommand = new Command8("ls").description("List calendar events").option("--q <value>", "q").option("--from <value>", "from").option("--to <value>", "to").option("--end-from <value>", "end_from").option("--end-to <value>", "end_to").option("--cursor <value>", "cursor").option("--limit <value>", "limit").option("--include-deleted <value>", "include_deleted").option("--include-past <value>", "include_past").option("--tz <zone>", "IANA timezone for relative time parsing").action(async (opts) => {
+import { Command as Command17 } from "commander";
+var eventListCommand = new Command17("ls").description("List calendar events").option("--q <value>", "q").option("--from <value>", "from").option("--to <value>", "to").option("--end-from <value>", "end_from").option("--end-to <value>", "end_to").option("--cursor <value>", "cursor").option("--limit <value>", "limit").option("--include-deleted <value>", "include_deleted").option("--include-past <value>", "include_past").option("--tz <zone>", "IANA timezone for relative time parsing").action(async (opts) => {
   const zone = resolveTimezone(opts.tz);
   let fromValue;
   if (opts.from !== void 0) {
@@ -1890,8 +2189,8 @@ var eventListCommand = new Command8("ls").description("List calendar events").op
 });
 
 // src/generated/cli/event/rm.ts
-import { Command as Command9 } from "commander";
-var eventDeleteCommand = new Command9("rm").description("Soft-delete a calendar event").argument("<id>", "id").option("--expected-version <value>", "expected_version").action(async (id, opts) => {
+import { Command as Command18 } from "commander";
+var eventDeleteCommand = new Command18("rm").description("Soft-delete a calendar event").argument("<id>", "id").option("--expected-version <value>", "expected_version").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await eventDelete({
     client: client2._rawClient,
@@ -1914,8 +2213,8 @@ var eventDeleteCommand = new Command9("rm").description("Soft-delete a calendar
 });
 
 // src/generated/cli/event/show.ts
-import { Command as Command10 } from "commander";
-var eventGetCommand = new Command10("show").description("Get a calendar event by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").action(async (id, opts) => {
+import { Command as Command19 } from "commander";
+var eventGetCommand = new Command19("show").description("Get a calendar event by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await eventGet({
     client: client2._rawClient,
@@ -1938,8 +2237,8 @@ var eventGetCommand = new Command10("show").description("Get a calendar event by
 });
 
 // src/generated/cli/event/set.ts
-import { Command as Command11 } from "commander";
-var eventUpdateCommand = new Command11("set").description("Update a calendar event").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "title").option("--description <value>", "description").option("--start <value>", "start").option("--end <value>", "end").option("-l, --location <value>", "location").option("-u, --url <value>", "url").option("--status <value>", "status").option("--attendee <value>", "attendee", (val, memo) => {
+import { Command as Command20 } from "commander";
+var eventUpdateCommand = new Command20("set").description("Update a calendar event").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "title").option("--description <value>", "description").option("--start <value>", "start").option("--end <value>", "end").option("-l, --location <value>", "location").option("-u, --url <value>", "url").option("--status <value>", "status").option("--attendee <value>", "attendee", (val, memo) => {
   memo.push(val);
   return memo;
 }, []).option("--all-day", "all_day").option("--tz <zone>", "IANA timezone for relative time parsing").action(async (id, opts) => {
@@ -1992,8 +2291,8 @@ var eventUpdateCommand = new Command11("set").description("Update a calendar eve
 });
 
 // src/generated/cli/event/ics.ts
-import { Command as Command12 } from "commander";
-var eventIcsDownloadCommand = new Command12("ics").description("Download event as `.ics`").argument("<id>", "id").action(async (id, opts) => {
+import { Command as Command21 } from "commander";
+var eventIcsDownloadCommand = new Command21("ics").description("Download event as `.ics`").argument("<id>", "id").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await eventIcsDownload({
     client: client2._rawClient,
@@ -2013,8 +2312,8 @@ var eventIcsDownloadCommand = new Command12("ics").description("Download event a
 });
 
 // src/generated/cli/alias/add.ts
-import { Command as Command13 } from "commander";
-var emailAliasCreateCommand = new Command13("add").description("Create a receiving alias").argument("<email>", "email").action(async (email, opts) => {
+import { Command as Command22 } from "commander";
+var emailAliasCreateCommand = new Command22("add").description("Create a receiving alias").argument("<email>", "email").action(async (email, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailAliasCreate({
     client: client2._rawClient,
@@ -2034,8 +2333,8 @@ var emailAliasCreateCommand = new Command13("add").description("Create a receivi
 });
 
 // src/generated/cli/alias/ls.ts
-import { Command as Command14 } from "commander";
-var emailAliasListCommand = new Command14("ls").description("List the caller's aliases").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
+import { Command as Command23 } from "commander";
+var emailAliasListCommand = new Command23("ls").description("List the caller's aliases").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await emailAliasList({
     client: client2._rawClient,
@@ -2055,8 +2354,8 @@ var emailAliasListCommand = new Command14("ls").description("List the caller's a
 });
 
 // src/generated/cli/alias/rm.ts
-import { Command as Command15 } from "commander";
-var emailAliasDeleteCommand = new Command15("rm").description("Soft-delete an alias").argument("<email>", "email").action(async (email, opts) => {
+import { Command as Command24 } from "commander";
+var emailAliasDeleteCommand = new Command24("rm").description("Soft-delete an alias").argument("<email>", "email").action(async (email, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailAliasDelete({
     client: client2._rawClient,
@@ -2076,8 +2375,8 @@ var emailAliasDeleteCommand = new Command15("rm").description("Soft-delete an al
 });
 
 // src/generated/cli/email/rm.ts
-import { Command as Command16 } from "commander";
-var emailDeleteCommand = new Command16("rm").description("Soft-delete inbound emails").argument("<id...>", "id").action(async (id, opts) => {
+import { Command as Command25 } from "commander";
+var emailDeleteCommand = new Command25("rm").description("Soft-delete inbound emails").argument("<id...>", "id").action(async (id, opts) => {
   const idRaw = id;
   const ids = idRaw.length > 0 ? idRaw : void 0;
   const client2 = await loadSdkClient();
@@ -2099,8 +2398,8 @@ var emailDeleteCommand = new Command16("rm").description("Soft-delete inbound em
 });
 
 // src/generated/cli/email/show.ts
-import { Command as Command17 } from "commander";
-var emailGetCommand = new Command17("show").description("Get an inbound email by id").argument("<id>", "id").option("--include-html <value>", "include_html").option("--include-deleted <value>", "include_deleted").action(async (id, opts) => {
+import { Command as Command26 } from "commander";
+var emailGetCommand = new Command26("show").description("Get an inbound email by id").argument("<id>", "id").option("--include-html <value>", "include_html").option("--include-deleted <value>", "include_deleted").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await emailGet({
     client: client2._rawClient,
@@ -2124,8 +2423,8 @@ var emailGetCommand = new Command17("show").description("Get an inbound email by
 });
 
 // src/generated/cli/email/ls.ts
-import { Command as Command18 } from "commander";
-var emailListCommand = new Command18("ls").description("List inbound emails").option("--limit <value>", "limit").option("--alias-email <value>", "alias_email").option("--unread-only <value>", "unread_only").option("--since <value>", "since").option("--cursor <value>", "cursor").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
+import { Command as Command27 } from "commander";
+var emailListCommand = new Command27("ls").description("List inbound emails").option("--limit <value>", "limit").option("--alias-email <value>", "alias_email").option("--unread-only <value>", "unread_only").option("--since <value>", "since").option("--cursor <value>", "cursor").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await emailList({
     client: client2._rawClient,
@@ -2150,8 +2449,8 @@ var emailListCommand = new Command18("ls").description("List inbound emails").op
 });
 
 // src/generated/cli/email/read.ts
-import { Command as Command19 } from "commander";
-var emailMarkReadCommand = new Command19("read").description("Mark inbound emails as read").argument("<id...>", "id").action(async (id, opts) => {
+import { Command as Command28 } from "commander";
+var emailMarkReadCommand = new Command28("read").description("Mark inbound emails as read").argument("<id...>", "id").action(async (id, opts) => {
   const idRaw = id;
   const ids = idRaw.length > 0 ? idRaw : void 0;
   const client2 = await loadSdkClient();
@@ -2173,8 +2472,8 @@ var emailMarkReadCommand = new Command19("read").description("Mark inbound email
 });
 
 // src/generated/cli/email/unread.ts
-import { Command as Command20 } from "commander";
-var emailMarkUnreadCommand = new Command20("unread").description("Mark inbound emails as unread").argument("<id...>", "id").action(async (id, opts) => {
+import { Command as Command29 } from "commander";
+var emailMarkUnreadCommand = new Command29("unread").description("Mark inbound emails as unread").argument("<id...>", "id").action(async (id, opts) => {
   const idRaw = id;
   const ids = idRaw.length > 0 ? idRaw : void 0;
   const client2 = await loadSdkClient();
@@ -2196,8 +2495,8 @@ var emailMarkUnreadCommand = new Command20("unread").description("Mark inbound e
 });
 
 // src/generated/cli/push/config/rm.ts
-import { Command as Command21 } from "commander";
-var pushConfigDeleteCommand = new Command21("rm").description("Remove a push transport").argument("<transport>", "transport").action(async (transport, opts) => {
+import { Command as Command30 } from "commander";
+var pushConfigDeleteCommand = new Command30("rm").description("Remove a push transport").argument("<transport>", "transport").action(async (transport, opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigDelete({
     client: client2._rawClient,
@@ -2217,8 +2516,8 @@ var pushConfigDeleteCommand = new Command21("rm").description("Remove a push tra
 });
 
 // src/generated/cli/push/config/set.ts
-import { Command as Command22 } from "commander";
-var pushConfigSetCommand = new Command22("set").description("Register or update a push transport").option("--transport <value>", "transport").option("--target-bot-username <value>", "target_bot_username").action(async (opts) => {
+import { Command as Command31 } from "commander";
+var pushConfigSetCommand = new Command31("set").description("Register or update a push transport").option("--transport <value>", "transport").option("--target-bot-username <value>", "target_bot_username").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigSet({
     client: client2._rawClient,
@@ -2241,8 +2540,8 @@ var pushConfigSetCommand = new Command22("set").description("Register or update
 });
 
 // src/generated/cli/push/config/show.ts
-import { Command as Command23 } from "commander";
-var pushConfigGetCommand = new Command23("show").description("List the caller's push transports").action(async (opts) => {
+import { Command as Command32 } from "commander";
+var pushConfigGetCommand = new Command32("show").description("List the caller's push transports").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushConfigGet({
     client: client2._rawClient
@@ -2259,8 +2558,8 @@ var pushConfigGetCommand = new Command23("show").description("List the caller's
 });
 
 // src/generated/cli/push/test.ts
-import { Command as Command24 } from "commander";
-var pushTestCommand = new Command24("test").description("Send a test push notification").option("--transport <value>", "transport").action(async (opts) => {
+import { Command as Command33 } from "commander";
+var pushTestCommand = new Command33("test").description("Send a test push notification").option("--transport <value>", "transport").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await pushTest({
     client: client2._rawClient,
@@ -2283,8 +2582,8 @@ var pushTestCommand = new Command24("test").description("Send a test push notifi
 });
 
 // src/generated/cli/todo/project/add.ts
-import { Command as Command25 } from "commander";
-var projectCreateCommand = new Command25("add").description("Create a project").argument("<name>", "name").option("--default-todo-type-id <value>", "default_todo_type_id").action(async (name, opts) => {
+import { Command as Command34 } from "commander";
+var projectCreateCommand = new Command34("add").description("Create a project").argument("<name>", "name").option("--default-todo-type-id <value>", "default_todo_type_id").action(async (name, opts) => {
   const client2 = await loadSdkClient();
   const result = await projectCreate({
     client: client2._rawClient,
@@ -2305,8 +2604,8 @@ var projectCreateCommand = new Command25("add").description("Create a project").
 });
 
 // src/generated/cli/todo/project/ls.ts
-import { Command as Command26 } from "commander";
-var projectListCommand = new Command26("ls").description("List projects").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
+import { Command as Command35 } from "commander";
+var projectListCommand = new Command35("ls").description("List projects").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await projectList({
     client: client2._rawClient,
@@ -2326,8 +2625,8 @@ var projectListCommand = new Command26("ls").description("List projects").option
 });
 
 // src/generated/cli/todo/rule/ls.ts
-import { Command as Command27 } from "commander";
-var recurrenceRuleListCommand = new Command27("ls").description("List recurring todo rules").option("--project-id <value>", "project_id").option("--user-id <value>", "user_id").action(async (opts) => {
+import { Command as Command36 } from "commander";
+var recurrenceRuleListCommand = new Command36("ls").description("List recurring todo rules").option("--project-id <value>", "project_id").option("--user-id <value>", "user_id").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await recurrenceRuleList({
     client: client2._rawClient,
@@ -2348,8 +2647,8 @@ var recurrenceRuleListCommand = new Command27("ls").description("List recurring
 });
 
 // src/generated/cli/todo/add.ts
-import { Command as Command28 } from "commander";
-var todoCreateCommand = new Command28("add").description("Create a todo").argument("<title>", "title").option("-p, --project <value>", "project_id").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("--status <value>", "status").option("--due-at <value>", "due_at").option("--type-id <value>", "type_id").option("--custom-fields <value>", "custom_fields").action(async (title, opts) => {
+import { Command as Command37 } from "commander";
+var todoCreateCommand = new Command37("add").description("Create a todo").argument("<title>", "title").option("-p, --project <value>", "project_id").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("--status <value>", "status").option("--due-at <value>", "due_at").option("--type-id <value>", "type_id").option("--custom-fields <value>", "custom_fields").action(async (title, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoCreate({
     client: client2._rawClient,
@@ -2376,8 +2675,8 @@ var todoCreateCommand = new Command28("add").description("Create a todo").argume
 });
 
 // src/generated/cli/todo/ls.ts
-import { Command as Command29 } from "commander";
-var todoListCommand = new Command29("ls").description("List todos with filters").option("-p, --project <value>", "project_id").option("--user-id <value>", "user_id").option("--parent-id <value>", "parent_id").option("-s, --status <value>", "status").option("--include-deleted <value>", "include_deleted").option("--include-templates <value>", "include_templates").option("--due-after <value>", "due_after").option("--due-before <value>", "due_before").option("--type-id <value>", "type_id").option("--sort-by <value>", "sort_by").option("--order <value>", "order").option("--include-orphan-fields <value>", "include_orphan_fields").action(async (opts) => {
+import { Command as Command38 } from "commander";
+var todoListCommand = new Command38("ls").description("List todos with filters").option("-p, --project <value>", "project_id").option("--user-id <value>", "user_id").option("--parent-id <value>", "parent_id").option("-s, --status <value>", "status").option("--include-deleted <value>", "include_deleted").option("--include-templates <value>", "include_templates").option("--due-after <value>", "due_after").option("--due-before <value>", "due_before").option("--type-id <value>", "type_id").option("--sort-by <value>", "sort_by").option("--order <value>", "order").option("--include-orphan-fields <value>", "include_orphan_fields").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await todoList({
     client: client2._rawClient,
@@ -2408,8 +2707,8 @@ var todoListCommand = new Command29("ls").description("List todos with filters")
 });
 
 // src/generated/cli/todo/type/ls.ts
-import { Command as Command30 } from "commander";
-var todoTypeListCommand = new Command30("ls").description("List todo types").option("--project-id <value>", "project_id").option("--user-id <value>", "user_id").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
+import { Command as Command39 } from "commander";
+var todoTypeListCommand = new Command39("ls").description("List todo types").option("--project-id <value>", "project_id").option("--user-id <value>", "user_id").option("--include-deleted <value>", "include_deleted").action(async (opts) => {
   const client2 = await loadSdkClient();
   const result = await todoTypeList({
     client: client2._rawClient,
@@ -2431,8 +2730,8 @@ var todoTypeListCommand = new Command30("ls").description("List todo types").opt
 });
 
 // src/generated/cli/todo/rm.ts
-import { Command as Command31 } from "commander";
-var todoDeleteCommand = new Command31("rm").description("Soft-delete a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--cascade <value>", "cascade").action(async (id, opts) => {
+import { Command as Command40 } from "commander";
+var todoDeleteCommand = new Command40("rm").description("Soft-delete a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--cascade <value>", "cascade").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoDelete({
     client: client2._rawClient,
@@ -2456,8 +2755,8 @@ var todoDeleteCommand = new Command31("rm").description("Soft-delete a todo").ar
 });
 
 // src/generated/cli/todo/show.ts
-import { Command as Command32 } from "commander";
-var todoGetCommand = new Command32("show").description("Get a todo by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").action(async (id, opts) => {
+import { Command as Command41 } from "commander";
+var todoGetCommand = new Command41("show").description("Get a todo by id").argument("<id>", "id").option("--include-deleted <value>", "include_deleted").option("--include-orphan-fields <value>", "include_orphan_fields").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoGet({
     client: client2._rawClient,
@@ -2465,7 +2764,8 @@ var todoGetCommand = new Command32("show").description("Get a todo by id").argum
       id
     },
     query: {
-      include_deleted: opts.includeDeleted
+      include_deleted: opts.includeDeleted,
+      include_orphan_fields: opts.includeOrphanFields
     }
   });
   if (result.error || !result.response?.ok) {
@@ -2480,8 +2780,8 @@ var todoGetCommand = new Command32("show").description("Get a todo by id").argum
 });
 
 // src/generated/cli/todo/update.ts
-import { Command as Command33 } from "commander";
-var todoUpdateCommand = new Command33("update").description("Update a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "title").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("--status <value>", "status").option("--due-at <value>", "due_at").option("--type-id <value>", "type_id").option("--custom-fields <value>", "custom_fields").option("--user-id <value>", "user_id").action(async (id, opts) => {
+import { Command as Command42 } from "commander";
+var todoUpdateCommand = new Command42("update").description("Update a todo").argument("<id>", "id").option("--expected-version <value>", "expected_version").option("--title <value>", "title").option("--description <value>", "description").option("--parent-id <value>", "parent_id").option("--status <value>", "status").option("--due-at <value>", "due_at").option("--type-id <value>", "type_id").option("--custom-fields <value>", "custom_fields").option("--user-id <value>", "user_id").action(async (id, opts) => {
   const client2 = await loadSdkClient();
   const result = await todoUpdate({
     client: client2._rawClient,
@@ -2513,15 +2813,26 @@ var todoUpdateCommand = new Command33("update").description("Update a todo").arg
 
 // src/generated/cli/index.ts
 function registerGeneratedCommands(root) {
+  const root_invite = root.command("invite").description("invite commands");
+  root_invite.addCommand(inviteAcceptCommand);
+  root_invite.addCommand(inviteGetCommand);
+  root_invite.addCommand(inviteRejectCommand);
   const root_keys = root.command("keys").description("keys commands");
   root_keys.addCommand(keyCreateCommand);
   root_keys.addCommand(keyListCommand);
   root_keys.addCommand(keyRevokeCommand);
+  root_keys.addCommand(keyUpdateCommand);
   const root_org = root.command("org").description("org commands");
+  const root_org_invite = root_org.command("invite").description("invite commands");
+  root_org_invite.addCommand(orgInviteCreateCommand);
+  root_org_invite.addCommand(orgInviteRevokeCommand);
+  root_org.addCommand(orgInvitesListCommand);
   root_org.addCommand(orgGetCommand);
+  root_org.addCommand(orgUpdateCommand);
   root_org.addCommand(orgMembersListCommand);
   const root_auth = root.command("auth").description("auth commands");
   root_auth.addCommand(authMeCommand);
+  root.addCommand(invitesListCommand);
   const root_event = root.command("event").description("event commands");
   root_event.addCommand(eventCreateCommand);
   root_event.addCommand(eventListCommand);
@@ -2561,7 +2872,7 @@ function registerGeneratedCommands(root) {
 }
 
 // src/handwritten/commands/login.ts
-import { Command as Command34 } from "commander";
+import { Command as Command43 } from "commander";
 
 // src/handwritten/auth/device-flow.ts
 var DEFAULT_SLEEP = (ms) => new Promise((r) => setTimeout(r, ms));
@@ -2642,23 +2953,62 @@ async function ensureClientId(opts) {
   const body = await res.json();
   if (!body.client_id) throw new Error("client_registration_failed: missing client_id in response");
   const fresh = await opts.store.read();
-  const env = fresh.envs[opts.envName] ?? { api_base: opts.baseUrl };
+  const env = fresh.envs[opts.envName] ?? { api_base: opts.baseUrl, accounts: {} };
   env.client_id = body.client_id;
   fresh.envs[opts.envName] = env;
   await opts.store.write(fresh);
   return body.client_id;
 }
 
+// src/handwritten/auth/fetch-me.ts
+async function fetchMe(opts) {
+  const f = opts.fetchImpl ?? fetch;
+  const res = await f(`${opts.baseUrl}/auth/me`, {
+    headers: { authorization: `Bearer ${opts.token}` }
+  });
+  if (!res.ok) throw new Error(`auth_me_failed: HTTP ${res.status}`);
+  const body = await res.json().catch(() => ({}));
+  if (!body.user_id || !body.email) {
+    throw new Error("auth_me_failed: missing user_id/email in response");
+  }
+  return { user_id: body.user_id, email: body.email };
+}
+
 // src/handwritten/auth/login.ts
+function getOrCreateEnv(c, envName, apiBase) {
+  const existing = c.envs[envName];
+  if (existing) {
+    existing.api_base = apiBase;
+    existing.accounts ??= {};
+    return existing;
+  }
+  const fresh = { api_base: apiBase, accounts: {} };
+  c.envs[envName] = fresh;
+  return fresh;
+}
 async function runLogin(opts) {
   const envName = opts.envName ?? "prod";
   const now = opts.now ?? Date.now;
-  const c = await opts.store.read();
+  const me = opts.fetchMe ?? ((o) => fetchMe(o));
   if (opts.apiKey) {
-    c.current_env = envName;
-    c.envs[envName] = { ...c.envs[envName] ?? {}, api_base: opts.baseUrl, api_key: opts.apiKey };
-    await opts.store.write(c);
-    opts.output.write(`\u2713 logged in (api key) \u2192 env "${envName}"`);
+    const who2 = await me({ baseUrl: opts.baseUrl, token: opts.apiKey });
+    const c2 = await opts.store.read();
+    const env2 = getOrCreateEnv(c2, envName, opts.baseUrl);
+    const prev2 = env2.accounts[who2.email] ?? { email: who2.email };
+    const acct2 = env2.accounts[who2.email] = {
+      ...prev2,
+      email: who2.email,
+      user_id: who2.user_id,
+      api_key: opts.apiKey
+    };
+    delete acct2.refresh_token;
+    delete acct2.access_token;
+    delete acct2.access_token_expires_at;
+    env2.current_account = who2.email;
+    if (who2.email !== LEGACY_ACCOUNT_KEY) delete env2.accounts[LEGACY_ACCOUNT_KEY];
+    c2.current_env = envName;
+    await opts.store.write(c2);
+    opts.output.write(`\u2713 logged in (api key) as ${who2.email} \u2192 env "${envName}"`);
     return;
   }
   const ensureClient = opts.ensureClient ?? ((env2) => ensureClientId({ store: opts.store, envName: env2, baseUrl: opts.baseUrl }));
@@ -2679,24 +3029,29 @@ async function runLogin(opts) {
 `);
     }
   });
-  const cFinal = await opts.store.read();
-  cFinal.current_env = envName;
-  cFinal.envs[envName] = {
-    ...cFinal.envs[envName] ?? {},
-    api_base: opts.baseUrl,
+  const who = await me({ baseUrl: opts.baseUrl, token: result.access_token });
+  const c = await opts.store.read();
+  const env = getOrCreateEnv(c, envName, opts.baseUrl);
+  const prev = env.accounts[who.email] ?? { email: who.email };
+  const acct = env.accounts[who.email] = {
+    ...prev,
+    email: who.email,
+    user_id: who.user_id,
     refresh_token: result.refresh_token,
     access_token: result.access_token,
     access_token_expires_at: now() + result.expires_in * 1e3
   };
-  const env = cFinal.envs[envName];
-  if (env && "api_key" in env) delete env.api_key;
-  await opts.store.write(cFinal);
-  opts.output.writeJson({ event: "login_success" });
-  opts.output.write(`\u2713 logged in \u2192 env "${envName}"`);
+  delete acct.api_key;
+  env.current_account = who.email;
+  if (who.email !== LEGACY_ACCOUNT_KEY) delete env.accounts[LEGACY_ACCOUNT_KEY];
+  c.current_env = envName;
+  await opts.store.write(c);
+  opts.output.writeJson({ event: "login_success", email: who.email });
+  opts.output.write(`\u2713 logged in as ${who.email} \u2192 env "${envName}"`);
 }
 
 // src/handwritten/commands/login.ts
-var loginCommand = new Command34("login").description("Log in via OAuth device flow (default) or API key").option("--api-key <key>", "Log in with a wspc API key (escape hatch)").option("--json", "Emit machine-readable events to stdout").action(async (opts) => {
+var loginCommand = new Command43("login").description("Log in via OAuth device flow (default) or API key").option("--api-key <key>", "Log in with a wspc API key (escape hatch)").option("--json", "Emit machine-readable events to stdout").action(async (opts) => {
   const store = new ConfigStore();
   const output = opts.json ? { write: () => {
   }, writeJson: (e) => process.stdout.write(JSON.stringify(e) + "\n") } : {
@@ -2713,51 +3068,61 @@ var loginCommand = new Command34("login").description("Log in via OAuth device f
 });
 
 // src/handwritten/commands/logout.ts
-import { Command as Command35 } from "commander";
+import { Command as Command44 } from "commander";
 
 // src/handwritten/auth/logout.ts
 async function runLogout(opts) {
-  const envName = opts.envName;
   const c = await opts.store.read();
-  const targetEnv = envName ?? c.current_env;
-  if (!targetEnv || !c.envs[targetEnv]) return;
-  const env = c.envs[targetEnv];
-  delete env.refresh_token;
-  delete env.access_token;
-  delete env.access_token_expires_at;
-  delete env.api_key;
+  const envName = opts.envName ?? c.current_env;
+  if (!envName || !c.envs[envName]) return { removed: [] };
+  const env = c.envs[envName];
+  env.accounts ??= {};
+  if (opts.all) {
+    const removed = Object.keys(env.accounts);
+    env.accounts = {};
+    env.current_account = void 0;
+    await opts.store.write(c);
+    return { removed };
+  }
+  const target = opts.email ?? env.current_account ?? (Object.keys(env.accounts).length === 1 ? Object.keys(env.accounts)[0] : void 0);
+  if (!target || !env.accounts[target]) return { removed: [] };
+  delete env.accounts[target];
+  if (env.current_account === target) {
+    const remaining = Object.keys(env.accounts);
+    env.current_account = remaining.length === 1 ? remaining[0] : void 0;
+  }
   await opts.store.write(c);
+  return { removed: [target], newActive: env.current_account };
 }
 
 // src/handwritten/commands/logout.ts
-var logoutCommand = new Command35("logout").description("Clear stored credentials for the current environment").action(async () => {
-  await runLogout({ store: new ConfigStore() });
-  process.stdout.write("\u2713 logged out\n");
+var logoutCommand = new Command44("logout").description("Log out an account (default: the active account in the current env)").argument("[email]", "Email of the account to log out").option("--all", "Log out every account in the current env").action(async (email, opts) => {
+  const res = await runLogout({ store: new ConfigStore(), email, all: opts.all });
+  if (res.removed.length === 0) {
+    process.stdout.write("nothing to log out\n");
+    return;
+  }
+  process.stdout.write(`\u2713 logged out: ${res.removed.join(", ")}
+`);
+  if (res.newActive) process.stdout.write(`active account is now ${res.newActive}
+`);
 });
 
 // src/handwritten/commands/whoami.ts
-import { Command as Command36 } from "commander";
+import { Command as Command45 } from "commander";
 var ENV_DISPLAY = {
   shape: "object",
-  fields: ["name", "api_base", "actor", "agent_label"]
+  fields: ["name", "api_base", "account", "actor", "agent_label"]
 };
 var USER_DISPLAY = {
   shape: "object",
   fields: ["user_id", "email", "display_name", "api_key_id"],
-  format: {
-    user_id: "id-short",
-    api_key_id: "id-short"
-  }
+  format: { user_id: "id-short", api_key_id: "id-short" }
 };
 var ORG_DISPLAY = {
   shape: "object",
   fields: ["id", "name", "created_at", "updated_at"],
-  format: {
-    id: "id-short",
-    name: "truncate",
-    created_at: "relative-time",
-    updated_at: "relative-time"
-  }
+  format: { id: "id-short", name: "truncate", created_at: "relative-time", updated_at: "relative-time" }
 };
 registerRenderer("whoami", (data) => {
   const d = data;
@@ -2770,15 +3135,19 @@ registerRenderer("whoami", (data) => {
     renderObject(d.org, ORG_DISPLAY);
   }
 });
-var whoamiCommand = new Command36("whoami").description("Show the active env, signed-in user, and organization").action(async () => {
-  const store = new ConfigStore();
-  const current = await store.currentEnv();
-  if (!current) {
-    printLoggedOut();
-    return;
+async function backfillActiveEmail(store, envName, email, userId) {
+  const cfg = await store.read();
+  if (rekeyLegacyAccount(cfg, envName, email, userId)) {
+    await store.write(cfg);
   }
+}
+var whoamiCommand = new Command45("whoami").description("Show the active env, signed-in account, and organization").action(async () => {
+  const store = new ConfigStore();
+  const config = await store.read();
+  let resolved;
   let sdkClient;
   try {
+    resolved = resolveAccount(config, { accountOverride: process.env.WSPC_ACCOUNT });
     sdkClient = await loadSdkClient({ store });
   } catch {
     printLoggedOut();
@@ -2807,16 +3176,17 @@ var whoamiCommand = new Command36("whoami").description("Show the active env, si
     }
     throw e;
   }
+  if (typeof user.email === "string") {
+    await backfillActiveEmail(store, resolved.envName, user.email, user.user_id);
+  }
   const env = {
-    name: current.name,
-    api_base: current.config.api_base
+    name: resolved.envName,
+    api_base: resolved.apiBase,
+    account: typeof user.email === "string" ? user.email : resolved.email
   };
-  if (current.config.actor) env.actor = current.config.actor;
-  if (current.config.agent_label) env.agent_label = current.config.agent_label;
-  render(
-    { kind: "whoami" },
-    { env, user, ...org ? { org } : {} }
-  );
+  if (resolved.creds.actor) env.actor = resolved.creds.actor;
+  if (resolved.creds.agent_label) env.agent_label = resolved.creds.agent_label;
+  render({ kind: "whoami" }, { env, user, ...org ? { org } : {} });
 });
 function printLoggedOut() {
   process.stderr.write(dim('not logged in. run "wspc login".') + "\n");
@@ -2824,58 +3194,64 @@ function printLoggedOut() {
 }
 
 // src/handwritten/commands/config.ts
-import { Command as Command37 } from "commander";
-var configCommand = new Command37("config").description("Manage wspc local config");
+import { Command as Command46 } from "commander";
+var configCommand = new Command46("config").description("Manage wspc local config");
 registerRenderer("config_show", (data) => {
   const d = data;
   if (d.envs.length === 0) {
     process.stdout.write(dim('  no envs configured. run "wspc login".') + "\n");
     return;
   }
-  const headers = ["", "ENV", "API BASE", "ACTOR", "AUTH"];
+  const headers = ["", "ENV", "API BASE", "ACTIVE ACCOUNT", "ACCOUNTS", "AUTH"];
   const rows = d.envs.map((e) => [
     e.name === d.current_env ? green("\u2713") : " ",
     e.name,
     e.api_base,
-    e.actor ?? dim("\u2014"),
+    e.active_account ?? dim("\u2014"),
+    String(e.accounts),
     e.auth === "none" ? dim("none") : e.auth
   ]);
   process.stdout.write(table(headers, rows));
 });
-configCommand.command("show").description("List configured envs (tokens redacted, current marked with \u2713)").action(async () => {
-  const c = await new ConfigStore().read();
-  const envs = Object.entries(c.envs ?? {}).map(([name, env]) => ({
-    name,
-    api_base: env.api_base,
-    ...env.actor !== void 0 ? { actor: env.actor } : {},
-    auth: env.api_key ? "api_key" : env.access_token ? "oauth" : "none"
-  }));
-  render(
-    { kind: "config_show" },
-    {
-      ...c.current_env !== void 0 ? { current_env: c.current_env } : {},
-      envs
-    }
-  );
-});
-configCommand.command("set <key> <value>").description("Set a config field on current env (actor, agent-label, ...)").action(async (key, value) => {
-  const store = new ConfigStore();
+async function setConfigKey(store, key, value) {
   const c = await store.read();
-  if (!c.current_env) throw new Error("no current env; run `wspc login` first");
-  const env = c.envs[c.current_env];
-  if (!env) throw new Error(`env ${c.current_env} missing`);
+  const resolved = resolveAccount(c, { accountOverride: process.env.WSPC_ACCOUNT });
+  const env = c.envs[resolved.envName];
+  if (!env) throw new Error(`env "${resolved.envName}" not found`);
+  const acct = env.accounts[resolved.email];
+  if (!acct) throw new Error(`account "${resolved.email}" not found`);
   switch (key) {
     case "actor":
       if (value !== "user" && value !== "agent") throw new Error("actor must be 'user' or 'agent'");
-      env.actor = value;
+      acct.actor = value;
       break;
     case "agent-label":
-      env.agent_label = value;
+      acct.agent_label = value;
       break;
     default:
       throw new Error(`unknown config key: ${key}`);
   }
   await store.write(c);
+}
+configCommand.command("show").description("List configured envs (tokens redacted, current marked with \u2713)").action(async () => {
+  const c = await new ConfigStore().read();
+  const envs = Object.entries(c.envs ?? {}).map(([name, env]) => {
+    const active = env.current_account ? env.accounts?.[env.current_account] : void 0;
+    return {
+      name,
+      api_base: env.api_base,
+      ...env.current_account !== void 0 ? { active_account: env.current_account } : {},
+      accounts: Object.keys(env.accounts ?? {}).length,
+      auth: active?.api_key ? "api_key" : active?.access_token ? "oauth" : "none"
+    };
+  });
+  render(
+    { kind: "config_show" },
+    { ...c.current_env !== void 0 ? { current_env: c.current_env } : {}, envs }
+  );
+});
+configCommand.command("set <key> <value>").description("Set a field on the active account (actor, agent-label, ...)").action(async (key, value) => {
+  await setConfigKey(new ConfigStore(), key, value);
   process.stdout.write(`\u2713 set ${key}=${value}
 `);
 });
@@ -2889,8 +3265,61 @@ configCommand.command("use <env>").description("Switch current_env").action(asyn
 `);
 });
 
+// src/handwritten/commands/account.ts
+import { Command as Command47 } from "commander";
+async function listAccounts(store) {
+  const c = await store.read();
+  const envName = c.current_env;
+  if (!envName || !c.envs[envName]) return [];
+  const env = c.envs[envName];
+  return Object.values(env.accounts ?? {}).map((a) => ({
+    email: a.email,
+    user_id: a.user_id,
+    actor: a.actor,
+    auth: a.api_key ? "api_key" : a.access_token ? "oauth" : "none",
+    active: env.current_account === a.email
+  }));
+}
+async function switchAccount(store, email) {
+  const c = await store.read();
+  const envName = c.current_env;
+  if (!envName || !c.envs[envName]) throw new Error("no current env; run `wspc login` first");
+  const env = c.envs[envName];
+  if (!env.accounts?.[email]) {
+    throw new Error(`no account '${email}' in env '${envName}'. Run \`wspc account ls\` or \`wspc login\`.`);
+  }
+  env.current_account = email;
+  await store.write(c);
+}
+registerRenderer("account_ls", (data) => {
+  const rows = data.accounts;
+  if (rows.length === 0) {
+    process.stdout.write(dim('  no accounts. run "wspc login".') + "\n");
+    return;
+  }
+  const headers = ["", "EMAIL", "USER", "ACTOR", "AUTH"];
+  const body = rows.map((r) => [
+    r.active ? green("\u2713") : " ",
+    r.email,
+    r.user_id ?? dim("\u2014"),
+    r.actor ?? dim("\u2014"),
+    r.auth === "none" ? dim("none") : r.auth
+  ]);
+  process.stdout.write(table(headers, body));
+});
+var accountCommand = new Command47("account").description("Manage logged-in accounts");
+accountCommand.command("ls").description("List accounts in the current env (active marked with \u2713)").action(async () => {
+  const accounts = await listAccounts(new ConfigStore());
+  render({ kind: "account_ls" }, { accounts });
+});
+accountCommand.command("switch <email>").description("Set the active account for the current env").action(async (email) => {
+  await switchAccount(new ConfigStore(), email);
+  process.stdout.write(`\u2713 active account is now ${email}
+`);
+});
+
 // src/handwritten/commands/todo-done.ts
-import { Command as Command38 } from "commander";
+import { Command as Command48 } from "commander";
 var TODO_UPDATE_DISPLAY = {
   shape: "object",
   format: {
@@ -2908,7 +3337,7 @@ var TODO_UPDATE_DISPLAY = {
     deleted_at: "relative-time"
   }
 };
-var todoDoneCommand = new Command38("done").description("Mark a todo done (sugar for `update <id> --status done`)").argument("<id>", "Todo id").action(async (id) => {
+var todoDoneCommand = new Command48("done").description("Mark a todo done (sugar for `update <id> --status done`)").argument("<id>", "Todo id").action(async (id) => {
   const client2 = await loadSdkClient();
   const result = await todoUpdate({
     client: client2._rawClient,
@@ -2927,7 +3356,7 @@ var todoDoneCommand = new Command38("done").description("Mark a todo done (sugar
 });
 
 // src/handwritten/commands/email/send.ts
-import { Command as Command39 } from "commander";
+import { Command as Command49 } from "commander";
 import { readFile, stat } from "fs/promises";
 import { basename } from "path";
 
@@ -2985,7 +3414,7 @@ async function resolveAttachment(input) {
     `--attach ${input}: neither a readable file nor a valid <prefix>_<ulid>:<idx> reference.`
   );
 }
-var sendCommand = new Command39("send").description("Send an outbound email").requiredOption("--from <alias-email>", "alias email to send from").option("--to <addr...>", "recipient address (repeatable)", []).option("--subject <text>", "subject").option("--text <body>", "plain-text body").option("--text-file <path>", "read text body from file").option("--reply <id>", "inbound email id to reply to").option("--attach <path-or-ref...>", "attachment (file path or eml_xxx:idx)", []).requiredOption("--idempotency-key <key>", "idempotency key").action(async (opts) => {
+var sendCommand = new Command49("send").description("Send an outbound email").requiredOption("--from <alias-email>", "alias email to send from").option("--to <addr...>", "recipient address (repeatable)", []).option("--subject <text>", "subject").option("--text <body>", "plain-text body").option("--text-file <path>", "read text body from file").option("--reply <id>", "inbound email id to reply to").option("--attach <path-or-ref...>", "attachment (file path or eml_xxx:idx)", []).requiredOption("--idempotency-key <key>", "idempotency key").action(async (opts) => {
   const isReply = Boolean(opts.reply);
   const to = opts.to;
   const attachInputs = opts.attach;
@@ -3072,7 +3501,7 @@ var sendCommand = new Command39("send").description("Send an outbound email").re
 });
 
 // src/handwritten/commands/email/attachment.ts
-import { Command as Command40 } from "commander";
+import { Command as Command50 } from "commander";
 import { createWriteStream } from "fs";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
@@ -3089,7 +3518,7 @@ function parseContentDispositionFilename(header) {
 }
 
 // src/handwritten/commands/email/attachment.ts
-var attachmentCommand = new Command40("attachment").description("Download an inbound email attachment by index").argument("<email-id>").argument("<idx>").option("--output <path>", "output file path").option("--include-deleted", "allow downloads from soft-deleted parent emails").action(async (emailId, idxArg, opts) => {
+var attachmentCommand = new Command50("attachment").description("Download an inbound email attachment by index").argument("<email-id>").argument("<idx>").option("--output <path>", "output file path").option("--include-deleted", "allow downloads from soft-deleted parent emails").action(async (emailId, idxArg, opts) => {
   const idx = Number(idxArg);
   if (!Number.isInteger(idx) || idx < 0) {
     process.stderr.write(`<idx> must be a non-negative integer (got "${idxArg}")
@@ -3122,13 +3551,16 @@ var attachmentCommand = new Command40("attachment").description("Download an inb
 
 // src/cli.ts
 function buildProgram() {
-  const program = new Command41().name("wspc").description("Official CLI for wspc.ai").version(`wspc ${VERSION} (spec ${SPEC_SHA}, fetched ${SPEC_FETCHED_AT})`).option("--json", "Output raw JSON (machine-readable)").hook("preAction", (thisCommand) => {
-    if (thisCommand.opts().json) process.env.WSPC_OUTPUT = "json";
+  const program = new Command51().name("wspc").description("Official CLI for wspc.ai").version(`wspc ${VERSION} (spec ${SPEC_SHA}, fetched ${SPEC_FETCHED_AT})`).option("--json", "Output raw JSON (machine-readable)").option("--account <email>", "Run as a specific account (overrides the active account)").hook("preAction", (_thisCommand, actionCommand) => {
+    const globals = actionCommand.optsWithGlobals();
+    if (globals.json) process.env.WSPC_OUTPUT = "json";
+    if (globals.account) process.env.WSPC_ACCOUNT = String(globals.account);
   });
   program.addCommand(loginCommand);
   program.addCommand(logoutCommand);
   program.addCommand(whoamiCommand);
   program.addCommand(configCommand);
+  program.addCommand(accountCommand);
   registerGeneratedCommands(program);
   const todo = program.commands.find((c) => c.name() === "todo");
   if (todo) todo.addCommand(todoDoneCommand);