@ycadence/cli 0.1.0 → 0.2.1

package/dist/bin.js

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
 
 // src/bin.ts
-import { readFile } from "node:fs/promises";
+import { spawn as spawn2 } from "node:child_process";
+import { readFile as readFile3 } from "node:fs/promises";
+import { createInterface } from "node:readline";
+
+// src/runner.ts
+import { randomUUID } from "node:crypto";
 
 // ../core/src/env.ts
 var ENV_PREFIX = "YCADENCE_";
@@ -20,129 +25,370 @@ function readEnv(name, env = processEnv()) {
   return;
 }
 
-// ../sdk/src/client.ts
+// ../sdk/src/errors.ts
 class YCadenceError extends Error {
   status;
   code;
   issues;
-  constructor(status, code, message, issues) {
+  requestId;
+  details;
+  retryAfter;
+  method;
+  path;
+  constructor(status, code, message, issues, extras = {}) {
     super(message);
     this.status = status;
     this.code = code;
     this.issues = issues;
     this.name = "YCadenceError";
+    this.requestId = extras.requestId;
+    this.details = extras.details;
+    this.retryAfter = extras.retryAfter;
+    this.method = extras.method;
+    this.path = extras.path;
   }
   get retryable() {
-    return this.status === 429 || this.status >= 500;
+    return this.status === 0 || this.status === 408 || this.status === 429 || this.status >= 500;
   }
 }
 
+class YCadenceValidationError extends YCadenceError {
+  name = "YCadenceValidationError";
+}
+
+class YCadencePermissionError extends YCadenceError {
+  name = "YCadencePermissionError";
+}
+
+class YCadenceNotFoundError extends YCadenceError {
+  name = "YCadenceNotFoundError";
+}
+
+class YCadenceConflictError extends YCadenceError {
+  name = "YCadenceConflictError";
+}
+
+class YCadencePreconditionError extends YCadenceError {
+  name = "YCadencePreconditionError";
+}
+
+class YCadenceRateLimitError extends YCadenceError {
+  name = "YCadenceRateLimitError";
+}
+
+class YCadenceNetworkError extends YCadenceError {
+  name = "YCadenceNetworkError";
+}
+function errorClassFor(status) {
+  if (status === 0 || status === 408)
+    return YCadenceNetworkError;
+  if (status === 400 || status === 422)
+    return YCadenceValidationError;
+  if (status === 401 || status === 403)
+    return YCadencePermissionError;
+  if (status === 404)
+    return YCadenceNotFoundError;
+  if (status === 409)
+    return YCadenceConflictError;
+  if (status === 412)
+    return YCadencePreconditionError;
+  if (status === 429)
+    return YCadenceRateLimitError;
+  return YCadenceError;
+}
+function createError(status, code, message, issues, extras = {}) {
+  const ErrorClass = errorClassFor(status);
+  return new ErrorClass(status, code, message, issues, extras);
+}
+
+class RequestIntercepted extends Error {
+  request;
+  name = "RequestIntercepted";
+  constructor(request) {
+    super(`${request.method} ${request.url} was not sent.`);
+    this.request = request;
+  }
+}
+
+// ../sdk/src/operations.ts
+var OPERATIONS = {
+  health: { method: "GET", path: "/api/health" },
+  me: { method: "GET", path: "/api/v1/me" },
+  listProjects: { method: "GET", path: "/api/v1/projects" },
+  listWorkItems: { method: "GET", path: "/api/v1/projects/{projectId}/work-items" },
+  createWorkItem: { method: "POST", path: "/api/v1/projects/{projectId}/work-items" },
+  getWorkItem: { method: "GET", path: "/api/v1/work-items/{workItemId}" },
+  updateWorkItem: { method: "PATCH", path: "/api/v1/work-items/{workItemId}" },
+  deleteWorkItem: { method: "DELETE", path: "/api/v1/work-items/{workItemId}" },
+  listStates: { method: "GET", path: "/api/v1/projects/{projectId}/states" },
+  listLabels: { method: "GET", path: "/api/v1/projects/{projectId}/labels" },
+  createLabel: { method: "POST", path: "/api/v1/projects/{projectId}/labels" },
+  listTypes: { method: "GET", path: "/api/v1/projects/{projectId}/types" },
+  listCycles: { method: "GET", path: "/api/v1/projects/{projectId}/cycles" },
+  createCycle: { method: "POST", path: "/api/v1/projects/{projectId}/cycles" },
+  getCycleProgress: { method: "GET", path: "/api/v1/cycles/{cycleId}/progress" },
+  addWorkItemsToCycle: { method: "POST", path: "/api/v1/cycles/{cycleId}/work-items" },
+  listViews: { method: "GET", path: "/api/v1/projects/{projectId}/views" },
+  createView: { method: "POST", path: "/api/v1/projects/{projectId}/views" },
+  listIntake: { method: "GET", path: "/api/v1/projects/{projectId}/intake" },
+  submitIntake: { method: "POST", path: "/api/v1/projects/{projectId}/intake" },
+  triageIntake: { method: "POST", path: "/api/v1/intake-items/{intakeItemId}/triage" },
+  previewImport: { method: "POST", path: "/api/v1/projects/{projectId}/imports/preview" },
+  startImport: { method: "POST", path: "/api/v1/projects/{projectId}/imports" },
+  listImports: { method: "GET", path: "/api/v1/projects/{projectId}/imports" },
+  getImport: { method: "GET", path: "/api/v1/imports/{runId}" }
+};
+function isIdempotentMethod(method) {
+  return method === "GET" || method === "HEAD";
+}
+function buildPath(template, params = {}) {
+  return template.replace(/\{(\w+)\}/g, (_match, name) => {
+    const value = params[name];
+    if (value === undefined || value === "") {
+      throw new TypeError(`Missing path parameter "${name}" for ${template}.`);
+    }
+    return encodeURIComponent(value);
+  });
+}
+
+// ../sdk/src/pagination.ts
+async function* paginate(fetchPage, options = {}) {
+  let cursor = options.cursor;
+  let yielded = 0;
+  do {
+    const page = await fetchPage(cursor);
+    for (const item of page.items) {
+      if (options.maxItems !== undefined && yielded >= options.maxItems)
+        return;
+      yielded += 1;
+      yield item;
+    }
+    cursor = page.nextCursor ?? undefined;
+  } while (cursor !== undefined);
+}
+
+// ../sdk/src/version.ts
+var SDK_VERSION = "0.2.0";
+
+// ../sdk/src/client.ts
+var DEFAULT_RETRY = { retries: 2, baseDelayMs: 250, maxDelayMs: 8000 };
+
 class YCadenceClient {
+  options;
   baseUrl;
   apiKey;
   identityToken;
   timeoutMs;
   doFetch;
+  retry;
+  userAgent;
+  onResponse;
+  sleep;
   constructor(options) {
+    this.options = options;
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
     this.apiKey = options.apiKey;
     this.identityToken = options.identityToken;
     this.timeoutMs = options.timeoutMs ?? 30000;
-    this.doFetch = options.fetch ?? globalThis.fetch;
+    this.doFetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    this.retry = { ...DEFAULT_RETRY, ...options.retry };
+    this.userAgent = [options.userAgent, `ycadence-sdk/${SDK_VERSION}`].filter((part) => part !== undefined && part !== "").join(" ");
+    this.onResponse = options.onResponse;
+    this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  }
+  withOptions(overrides) {
+    return new YCadenceClient({ ...this.options, ...overrides });
+  }
+  get fetchImplementation() {
+    return this.doFetch;
   }
   async health() {
-    return this.request("GET", "/api/health");
-  }
-  async listWorkItems(projectId, options = {}) {
-    const query = new URLSearchParams;
-    if (options.filter !== undefined)
-      query.set("filter", JSON.stringify(options.filter));
-    if (options.limit !== undefined)
-      query.set("limit", String(options.limit));
-    if (options.cursor !== undefined)
-      query.set("cursor", options.cursor);
-    return this.request("GET", `/api/v1/projects/${projectId}/work-items?${query}`);
-  }
-  async* iterateWorkItems(projectId, options = {}) {
-    let cursor;
-    do {
-      const page = await this.listWorkItems(projectId, {
-        filter: options.filter,
-        limit: options.pageSize ?? 100,
-        cursor
-      });
-      for (const item of page.items)
-        yield item;
-      cursor = page.nextCursor ?? undefined;
-    } while (cursor !== undefined);
+    return this.call("health");
+  }
+  async me(options) {
+    return this.call("me", {}, undefined, undefined, options);
+  }
+  async listProjects(query = {}, options) {
+    return this.call("listProjects", {}, query, undefined, options);
+  }
+  async listWorkItems(projectId, query = {}, options) {
+    return this.call("listWorkItems", { projectId }, {
+      filter: query.filter === undefined ? undefined : JSON.stringify(query.filter),
+      limit: query.limit,
+      cursor: query.cursor,
+      state: query.state,
+      priority: query.priority
+    }, undefined, options);
+  }
+  iterateWorkItems(projectId, options = {}) {
+    return paginate((cursor) => this.listWorkItems(projectId, {
+      filter: options.filter,
+      limit: options.pageSize ?? 100,
+      cursor
+    }));
+  }
+  async createWorkItem(projectId, body, options) {
+    return this.call("createWorkItem", { projectId }, undefined, body, options);
+  }
+  async getWorkItem(workItemId, options) {
+    return this.call("getWorkItem", { workItemId }, undefined, undefined, options);
+  }
+  async updateWorkItem(workItemId, body, options) {
+    return this.call("updateWorkItem", { workItemId }, undefined, body, options);
+  }
+  async deleteWorkItem(workItemId, options) {
+    await this.call("deleteWorkItem", { workItemId }, undefined, undefined, options);
+  }
+  async listStates(projectId, options) {
+    return this.call("listStates", { projectId }, undefined, undefined, options);
+  }
+  async listLabels(projectId, options) {
+    return this.call("listLabels", { projectId }, undefined, undefined, options);
+  }
+  async createLabel(projectId, body, options) {
+    return this.call("createLabel", { projectId }, undefined, body, options);
+  }
+  async listTypes(projectId, options) {
+    return this.call("listTypes", { projectId }, undefined, undefined, options);
+  }
+  async listCycles(projectId, options) {
+    return this.call("listCycles", { projectId }, undefined, undefined, options);
   }
-  async createWorkItem(projectId, body) {
-    return this.request("POST", `/api/v1/projects/${projectId}/work-items`, body);
+  async createCycle(projectId, body, options) {
+    return this.call("createCycle", { projectId }, undefined, body, options);
   }
-  async getWorkItem(workItemId) {
-    return this.request("GET", `/api/v1/work-items/${workItemId}`);
+  async getCycleProgress(cycleId, options) {
+    return this.call("getCycleProgress", { cycleId }, undefined, undefined, options);
   }
-  async updateWorkItem(workItemId, body) {
-    return this.request("PATCH", `/api/v1/work-items/${workItemId}`, body);
+  async addWorkItemsToCycle(cycleId, workItemIds, options) {
+    return this.call("addWorkItemsToCycle", { cycleId }, undefined, { workItemIds }, options);
   }
-  async deleteWorkItem(workItemId) {
-    await this.request("DELETE", `/api/v1/work-items/${workItemId}`);
+  async listViews(projectId, options) {
+    return this.call("listViews", { projectId }, undefined, undefined, options);
   }
-  async listStates(projectId) {
-    return this.request("GET", `/api/v1/projects/${projectId}/states`);
+  async createView(projectId, body, options) {
+    return this.call("createView", { projectId }, undefined, body, options);
   }
-  async listLabels(projectId) {
-    return this.request("GET", `/api/v1/projects/${projectId}/labels`);
+  async listIntake(projectId, query = {}, options) {
+    return this.call("listIntake", { projectId }, query, undefined, options);
   }
-  async listCycles(projectId) {
-    return this.request("GET", `/api/v1/projects/${projectId}/cycles`);
+  async submitIntake(projectId, body, options) {
+    return this.call("submitIntake", { projectId }, undefined, body, options);
   }
-  async previewImport(projectId, body) {
-    return this.request("POST", `/api/v1/projects/${projectId}/imports/preview`, body);
+  async triageIntake(intakeItemId, body, options) {
+    return this.call("triageIntake", { intakeItemId }, undefined, body, options);
   }
-  async startImport(projectId, body) {
-    return this.request("POST", `/api/v1/projects/${projectId}/imports`, body);
+  async previewImport(projectId, body, options) {
+    return this.call("previewImport", { projectId }, undefined, body, options);
   }
-  async getImport(runId) {
-    return this.request("GET", `/api/v1/imports/${runId}`);
+  async startImport(projectId, body, options) {
+    return this.call("startImport", { projectId }, undefined, body, options);
   }
-  async listImports(projectId) {
-    return this.request("GET", `/api/v1/projects/${projectId}/imports`);
+  async getImport(runId, options) {
+    return this.call("getImport", { runId }, undefined, undefined, options);
   }
-  async listViews(projectId) {
-    return this.request("GET", `/api/v1/projects/${projectId}/views`);
+  async listImports(projectId, options) {
+    return this.call("listImports", { projectId }, undefined, undefined, options);
   }
-  async request(method, path, body) {
+  async call(operation, params = {}, query, body, options = {}) {
+    const { method, path } = OPERATIONS[operation];
+    let url = buildPath(path, params);
+    if (query !== undefined) {
+      const search = new URLSearchParams;
+      for (const [name, value] of Object.entries(query)) {
+        if (value !== undefined)
+          search.set(name, String(value));
+      }
+      const encoded = search.toString();
+      if (encoded.length > 0)
+        url += `?${encoded}`;
+    }
+    return this.request(method, url, body, options);
+  }
+  async request(method, path, body, options) {
+    const retryable = isIdempotentMethod(method) || options.idempotencyKey !== undefined;
+    const retries = retryable ? options.retries ?? this.retry.retries : 0;
+    for (let attempt = 0;; attempt += 1) {
+      try {
+        return await this.send(method, path, body, options, attempt);
+      } catch (error) {
+        const failure = error;
+        const again = attempt < retries && typeof failure.retryable === "boolean" && (failure.retryable || failure.code === "request_in_progress");
+        if (!again)
+          throw error;
+        await this.sleep(this.backoff(attempt, failure.retryAfter));
+      }
+    }
+  }
+  backoff(attempt, retryAfter) {
+    if (retryAfter !== undefined)
+      return Math.min(retryAfter * 1000, this.retry.maxDelayMs);
+    const exponential = this.retry.baseDelayMs * 2 ** attempt;
+    const jittered = exponential / 2 + Math.random() * (exponential / 2);
+    return Math.min(jittered, this.retry.maxDelayMs);
+  }
+  async send(method, path, body, options, attempt) {
     const controller = new AbortController;
     const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    const abort = () => controller.abort();
+    options.signal?.addEventListener("abort", abort);
+    const started = Date.now();
     let response;
     try {
       const identityToken = typeof this.identityToken === "function" ? await this.identityToken() : this.identityToken;
+      const headers = {
+        "x-api-key": this.apiKey,
+        ...identityToken === undefined || identityToken.length === 0 ? {} : { Authorization: `Bearer ${identityToken}` },
+        ...body === undefined ? {} : { "Content-Type": "application/json" },
+        Accept: "application/json",
+        "User-Agent": this.userAgent
+      };
+      if (options.idempotencyKey !== undefined && !isIdempotentMethod(method)) {
+        headers["Idempotency-Key"] = options.idempotencyKey;
+      }
+      if (options.expectedVersion !== undefined && !isIdempotentMethod(method)) {
+        headers["If-Match"] = `"${String(options.expectedVersion).replace(/"/g, "")}"`;
+      }
       response = await this.doFetch(`${this.baseUrl}${path}`, {
         method,
-        headers: {
-          "x-api-key": this.apiKey,
-          ...identityToken === undefined || identityToken.length === 0 ? {} : { Authorization: `Bearer ${identityToken}` },
-          ...body === undefined ? {} : { "Content-Type": "application/json" }
-        },
+        headers,
         body: body === undefined ? undefined : JSON.stringify(body),
         signal: controller.signal
       });
     } catch (error) {
+      if (error instanceof RequestIntercepted)
+        throw error;
       if (error instanceof Error && error.name === "AbortError") {
-        throw new YCadenceError(408, "timeout", `${method} ${path} timed out after ${this.timeoutMs}ms.`);
+        throw createError(408, "timeout", `${method} ${path} timed out after ${this.timeoutMs}ms.`, undefined, { method, path });
       }
-      throw new YCadenceError(0, "network_error", `Could not reach ${this.baseUrl}: ${error instanceof Error ? error.message : "unknown error"}`);
+      throw createError(0, "network_error", `Could not reach ${this.baseUrl}: ${error instanceof Error ? error.message : "unknown error"}`, undefined, { method, path });
     } finally {
       clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
     }
+    const headerRequestId = response.headers?.get?.("x-request-id") ?? undefined;
+    this.onResponse?.({
+      method,
+      path,
+      status: response.status,
+      requestId: headerRequestId,
+      durationMs: Date.now() - started,
+      attempt,
+      replayed: response.headers?.get?.("idempotent-replayed") === "true"
+    });
     if (response.status === 204)
       return;
     const text = await response.text();
     const parsed = text.length === 0 ? undefined : safeJson(text);
     if (!response.ok) {
-      const failure = parsed ?? {};
-      throw new YCadenceError(response.status, failure.code ?? "unknown", failure.error ?? `${method} ${path} failed with ${response.status}.`, failure.issues);
+      const failure = isRecord(parsed) ? parsed : {};
+      throw createError(response.status, typeof failure.code === "string" ? failure.code : codeForStatus(response.status), typeof failure.error === "string" ? failure.error : `${method} ${path} failed with ${response.status}.`, failure.issues, {
+        requestId: failure.requestId ?? headerRequestId,
+        details: failure.details,
+        retryAfter: parseRetryAfter(response.headers?.get?.("retry-after") ?? null),
+        method,
+        path
+      });
     }
     return parsed;
   }
@@ -154,316 +400,3385 @@ function safeJson(text) {
     return;
   }
 }
-// src/commands.ts
-var ok = (output) => ({ output, exitCode: 0 });
-var fail = (output, exitCode = 1) => ({ output, exitCode });
-var USAGE = `ycadence — project and work management from the command line
-
-  ycadence doctor                       check configuration and connectivity
-  ycadence work-item list <projectId>   list work items
-  ycadence work-item create <projectId> --title "..." [--priority high]
-  ycadence work-item show <workItemId>
-  ycadence work-item close <workItemId>
-  ycadence states <projectId>
-  ycadence cycles <projectId>
-  ycadence import preview <projectId> --source csv --file issues.csv
-  ycadence import run <projectId> --source csv --file issues.csv [--map "Done=<stateId>"]
-  ycadence import status <runId>
-  ycadence import list <projectId>
-
-Configuration:
-  YCADENCE_URL       the instance, e.g. https://devpulse.yarlis.com
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function codeForStatus(status) {
+  const codes = {
+    400: "bad_request",
+    401: "unauthorized",
+    403: "forbidden",
+    404: "not_found",
+    409: "conflict",
+    412: "precondition_failed",
+    422: "validation_failed",
+    429: "rate_limited"
+  };
+  return codes[status] ?? (status >= 500 ? "server_error" : "unknown");
+}
+function parseRetryAfter(value, now = Date.now()) {
+  if (value === null || value.trim() === "")
+    return;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds))
+    return Math.max(0, seconds);
+  const date = Date.parse(value);
+  if (Number.isNaN(date))
+    return;
+  return Math.max(0, Math.ceil((date - now) / 1000));
+}
+// ../sdk/src/types.ts
+var PRIORITIES = ["urgent", "high", "medium", "low", "none"];
+var WORK_ITEM_FIELDS = {
+  id: true,
+  key: true,
+  sequenceId: true,
+  name: true,
+  priority: true,
+  stateId: true,
+  assigneeIds: true,
+  labelIds: true,
+  parentId: true,
+  sortOrder: true,
+  createdAt: true,
+  projectId: true,
+  version: true
+};
+var WORK_ITEM_DETAIL_FIELDS = {
+  ...WORK_ITEM_FIELDS,
+  description: true,
+  startDate: true,
+  targetDate: true,
+  archivedAt: true,
+  updatedAt: true
+};
+// src/config.ts
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+
+// src/exit.ts
+var EXIT = {
+  ok: 0,
+  failure: 1,
+  usage: 2,
+  notFound: 3,
+  permission: 4,
+  conflict: 5,
+  validation: 6,
+  pending: 7,
+  tempfail: 75,
+  config: 78
+};
+var EXIT_CODE_TABLE = [
+  [EXIT.ok, "Success, confirmed by the server"],
+  [EXIT.failure, "Generic failure"],
+  [EXIT.usage, "Usage error: unknown command, bad flag, missing argument"],
+  [EXIT.notFound, "Not found (404)"],
+  [EXIT.permission, "Permission denied (401, 403)"],
+  [EXIT.conflict, "Conflict or failed precondition (409, 412)"],
+  [EXIT.validation, "Validation failed (400, 422)"],
+  [EXIT.pending, "Pending: approval or confirmation required (202)"],
+  [EXIT.tempfail, "Temporary failure; a retry may succeed (429, 5xx, network, timeout)"],
+  [EXIT.config, "Configuration error: no URL or key, or sign-in needed"]
+];
+
+class UsageError extends Error {
+  name = "UsageError";
+  code = "usage";
+  exitCode = EXIT.usage;
+}
+
+class ConfigError extends Error {
+  name = "ConfigError";
+  code = "config";
+  exitCode = EXIT.config;
+}
+
+class CliError extends Error {
+  code;
+  exitCode;
+  name = "CliError";
+  constructor(message, code, exitCode = EXIT.failure) {
+    super(message);
+    this.code = code;
+    this.exitCode = exitCode;
+  }
+}
+function exitCodeForStatus(status) {
+  if (status === 0 || status === 408 || status === 429 || status >= 500)
+    return EXIT.tempfail;
+  if (status === 404)
+    return EXIT.notFound;
+  if (status === 401 || status === 403)
+    return EXIT.permission;
+  if (status === 409 || status === 412)
+    return EXIT.conflict;
+  if (status === 400 || status === 422)
+    return EXIT.validation;
+  if (status === 202)
+    return EXIT.pending;
+  return EXIT.failure;
+}
+function exitCodeFor(error) {
+  if (error instanceof YCadenceError)
+    return exitCodeForStatus(error.status);
+  if (error instanceof UsageError || error instanceof ConfigError || error instanceof CliError) {
+    return error.exitCode;
+  }
+  return EXIT.failure;
+}
+
+// src/config.ts
+var PROFILE_KEYS = [
+  "url",
+  "org",
+  "project",
+  "format",
+  "oauthClientId",
+  "iapAudience"
+];
+var PROFILE_KEY_HELP = {
+  url: "The instance, e.g. https://ycadence.example.com",
+  org: "Organization slug",
+  project: "Default project id (or identifier, once the server lists projects)",
+  format: "Default output format: table, json or ndjson",
+  oauthClientId: "Desktop OAuth client id used by `ycadence login` for IAP",
+  iapAudience: "The IAP OAuth client id; the audience of the identity token"
+};
+function configDirectory(env) {
+  if (env.YCADENCE_CONFIG_DIR)
+    return env.YCADENCE_CONFIG_DIR;
+  if (env.XDG_CONFIG_HOME)
+    return join(env.XDG_CONFIG_HOME, "ycadence");
+  const home = env.HOME ?? env.USERPROFILE;
+  return home ? join(home, ".config", "ycadence") : undefined;
+}
+function fileConfigStore(directory) {
+  const path = join(directory, "config.json");
+  return {
+    path,
+    directory,
+    async load() {
+      let text;
+      try {
+        text = await readFile(path, "utf8");
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return { profiles: {} };
+        throw error;
+      }
+      try {
+        const parsed = JSON.parse(text);
+        return { currentProfile: parsed.currentProfile, profiles: parsed.profiles ?? {} };
+      } catch {
+        throw new ConfigError(`${path} is not valid JSON. Fix or delete it.`);
+      }
+    },
+    async save(config) {
+      await mkdir(directory, { recursive: true, mode: 448 });
+      const temporary = `${path}.${process.pid}.tmp`;
+      await writeFile(temporary, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+      await chmod(temporary, 384);
+      await rename(temporary, path);
+    }
+  };
+}
+function memoryConfigStore(initial = { profiles: {} }) {
+  let current = structuredClone(initial);
+  return {
+    path: undefined,
+    directory: undefined,
+    async load() {
+      return structuredClone(current);
+    },
+    async save(config) {
+      current = structuredClone(config);
+    }
+  };
+}
+function assertProfileKey(key) {
+  if (key === "apiKey" || key === "api-key" || key === "token") {
+    throw new UsageError("Keys are not stored in the config file. Use `ycadence login --api-key-stdin`, which keeps it in the OS keychain.");
+  }
+  if (!PROFILE_KEYS.includes(key)) {
+    throw new UsageError(`Unknown setting "${key}". One of: ${PROFILE_KEYS.join(", ")}.`);
+  }
+}
+function assertProfileName(name) {
+  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(name)) {
+    throw new UsageError(`Profile names are letters, digits, ".", "_" and "-"; got "${name}".`);
+  }
+}
+function envSource(name, env) {
+  const current = env[`YCADENCE_${name}`];
+  return current !== undefined && current !== "" ? "env" : "legacy-env";
+}
+function resolveConfig(file, env, flags) {
+  const profileFromEnv = readEnv("PROFILE", env);
+  const profile = flags.profile ?? profileFromEnv ?? file.currentProfile ?? "default";
+  const stored = file.profiles[profile] ?? {};
+  const sources = {
+    profile: flags.profile !== undefined ? "flag" : profileFromEnv !== undefined ? envSource("PROFILE", env) : file.currentProfile !== undefined ? "profile" : "default"
+  };
+  const pick = (key, envName, flag) => {
+    if (flag !== undefined) {
+      sources[key] = "flag";
+      return flag;
+    }
+    const fromEnv = readEnv(envName, env);
+    if (fromEnv !== undefined) {
+      sources[key] = envSource(envName, env);
+      return fromEnv;
+    }
+    const fromProfile = stored[key];
+    sources[key] = fromProfile === undefined ? "none" : "profile";
+    return fromProfile;
+  };
+  return {
+    profile,
+    url: pick("url", "URL"),
+    org: pick("org", "ORG", flags.org),
+    project: pick("project", "PROJECT", flags.project),
+    format: pick("format", "FORMAT"),
+    oauthClientId: readEnv("OAUTH_CLIENT_ID", env) ?? stored.oauthClientId,
+    iapAudience: readEnv("IAP_AUDIENCE", env) ?? stored.iapAudience,
+    sources,
+    stored
+  };
+}
+
+// src/credentials.ts
+import { execFile, spawn } from "node:child_process";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+var SERVICE = "ycadence";
+var secretAccount = {
+  apiKey: (profile) => `${profile}:api_key`,
+  refreshToken: (profile) => `${profile}:refresh_token`,
+  identityToken: (profile) => `${profile}:identity_token`,
+  oauthClientSecret: (profile) => `${profile}:oauth_client_secret`
+};
+var nodeExec = (command, args, stdin) => new Promise((resolve) => {
+  if (stdin === undefined) {
+    execFile(command, args, { encoding: "utf8" }, (error, stdout2, stderr2) => {
+      const code = error === null ? 0 : typeof error.code === "number" ? error.code : error ? 127 : 0;
+      resolve({ code, stdout: stdout2, stderr: stderr2 });
+    });
+    return;
+  }
+  const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString("utf8");
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString("utf8");
+  });
+  child.on("error", () => resolve({ code: 127, stdout, stderr }));
+  child.on("close", (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(stdin);
+});
+function assertAccount(account) {
+  if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(account)) {
+    throw new Error(`Invalid credential account name "${account}".`);
+  }
+}
+function hex(value) {
+  return Buffer.from(value, "utf8").toString("hex");
+}
+function macKeychainStore(exec = nodeExec) {
+  return {
+    kind: "keychain",
+    description: "macOS Keychain",
+    async get(account) {
+      assertAccount(account);
+      const result = await exec("security", [
+        "find-generic-password",
+        "-s",
+        SERVICE,
+        "-a",
+        account,
+        "-w"
+      ]);
+      if (result.code !== 0)
+        return;
+      const value = result.stdout.replace(/\n$/, "");
+      return value === "" ? undefined : value;
+    },
+    async set(account, value) {
+      assertAccount(account);
+      const result = await exec("security", ["-i"], `add-generic-password -U -s ${SERVICE} -a ${account} -l ${SERVICE} -X ${hex(value)}
+`);
+      if (result.code !== 0) {
+        throw new Error(`Could not save to the macOS Keychain (security exited ${result.code}).`);
+      }
+    },
+    async delete(account) {
+      assertAccount(account);
+      await exec("security", ["delete-generic-password", "-s", SERVICE, "-a", account]);
+    }
+  };
+}
+function libsecretStore(exec = nodeExec) {
+  return {
+    kind: "libsecret",
+    description: "Secret Service (libsecret)",
+    async get(account) {
+      assertAccount(account);
+      const result = await exec("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+      if (result.code !== 0)
+        return;
+      const value = result.stdout.replace(/\n$/, "");
+      return value === "" ? undefined : value;
+    },
+    async set(account, value) {
+      assertAccount(account);
+      const result = await exec("secret-tool", ["store", `--label=${SERVICE} ${account}`, "service", SERVICE, "account", account], value);
+      if (result.code !== 0) {
+        throw new Error(`Could not save to the Secret Service (secret-tool exited ${result.code}).`);
+      }
+    },
+    async delete(account) {
+      assertAccount(account);
+      await exec("secret-tool", ["clear", "service", SERVICE, "account", account]);
+    }
+  };
+}
+function fileSecretStore(directory) {
+  const path = join2(directory, "credentials.json");
+  const load = async () => {
+    try {
+      return JSON.parse(await readFile2(path, "utf8"));
+    } catch {
+      return {};
+    }
+  };
+  const save = async (values) => {
+    await mkdir2(directory, { recursive: true, mode: 448 });
+    const temporary = `${path}.${process.pid}.tmp`;
+    await writeFile2(temporary, `${JSON.stringify(values, null, 2)}
+`, { mode: 384 });
+    await chmod2(temporary, 384);
+    await rename2(temporary, path);
+  };
+  return {
+    kind: "file",
+    description: `${path} (mode 0600; no OS keychain found)`,
+    async get(account) {
+      return (await load())[account];
+    },
+    async set(account, value) {
+      const values = await load();
+      values[account] = value;
+      await save(values);
+    },
+    async delete(account) {
+      const values = await load();
+      if (!(account in values))
+        return;
+      delete values[account];
+      await save(values);
+    }
+  };
+}
+function memorySecretStore(initial = {}) {
+  const values = new Map(Object.entries(initial));
+  return {
+    kind: "memory",
+    description: "in memory (nothing is saved)",
+    async get(account) {
+      return values.get(account);
+    },
+    async set(account, value) {
+      values.set(account, value);
+    },
+    async delete(account) {
+      values.delete(account);
+    }
+  };
+}
+async function detectSecretStore(options) {
+  const exec = options.exec ?? nodeExec;
+  const platform = options.platform ?? process.platform;
+  const fallback = () => options.directory === undefined ? memorySecretStore() : fileSecretStore(options.directory);
+  if (options.env.YCADENCE_CREDENTIAL_STORE === "file")
+    return fallback();
+  if (platform === "darwin") {
+    const probe = await exec("security", ["list-keychains"]);
+    if (probe.code === 0)
+      return macKeychainStore(exec);
+  }
+  if (platform === "linux" && options.env.DBUS_SESSION_BUS_ADDRESS) {
+    const probe = await exec("secret-tool", []);
+    if (probe.code !== 127)
+      return libsecretStore(exec);
+  }
+  return fallback();
+}
+
+// src/parser.ts
+var GLOBAL_FLAGS = [
+  { name: "help", short: "h", type: "boolean", description: "Help for the command" },
+  {
+    name: "format",
+    type: "string",
+    values: ["table", "json", "ndjson"],
+    placeholder: "<format>",
+    description: "Output format: table (default), json or ndjson"
+  },
+  { name: "json", type: "boolean", description: "Shorthand for --format json" },
+  {
+    name: "fields",
+    type: "string",
+    placeholder: "<a,b,c>",
+    description: "Columns for table output; the projection for json"
+  },
+  {
+    name: "quiet",
+    short: "q",
+    type: "boolean",
+    description: "Print only ids or keys, one per line"
+  },
+  {
+    name: "verbose",
+    short: "v",
+    type: "boolean",
+    description: "Request ids and timings on stderr; never credentials"
+  },
+  { name: "profile", type: "string", placeholder: "<name>", description: "Use a stored profile" },
+  { name: "org", type: "string", placeholder: "<slug>", description: "Organization slug" },
+  {
+    name: "project",
+    short: "p",
+    type: "string",
+    placeholder: "<id|identifier>",
+    description: "Project for commands that need one"
+  },
+  { name: "limit", type: "number", placeholder: "<n>", description: "Page size for lists" },
+  { name: "cursor", type: "string", placeholder: "<cursor>", description: "Continue a list" },
+  { name: "all", type: "boolean", description: "Follow the cursor to the end of a list" },
+  {
+    name: "dry-run",
+    type: "boolean",
+    description: "Show the write a command would send, and send nothing"
+  },
+  {
+    name: "yes",
+    short: "y",
+    type: "boolean",
+    description: "Skip confirmation (required outside a terminal for destructive commands)"
+  },
+  {
+    name: "idempotency-key",
+    type: "string",
+    placeholder: "<key>",
+    description: "Sent as Idempotency-Key on a write, so retrying it is safe"
+  },
+  {
+    name: "retry",
+    type: "number",
+    placeholder: "<n>",
+    description: "Retry temporary failures n times (a write gets an idempotency key)"
+  }
+];
+var GLOBAL_BY_NAME = new Map(GLOBAL_FLAGS.map((flag) => [flag.name, flag]));
+var GLOBAL_BY_SHORT = new Map(GLOBAL_FLAGS.filter((flag) => flag.short !== undefined).map((flag) => [flag.short, flag]));
+function findChild(node, word) {
+  return node.children?.find((child) => child.name === word || (child.aliases?.includes(word) ?? false));
+}
+function globalTakesValue(token) {
+  if (token.includes("="))
+    return false;
+  const flag = token.startsWith("--") ? GLOBAL_BY_NAME.get(token.slice(2)) : GLOBAL_BY_SHORT.get(token.slice(1));
+  return flag !== undefined && flag.type !== "boolean";
+}
+function isGlobalToken(token) {
+  if (token.startsWith("--")) {
+    const name = token.slice(2).split("=")[0];
+    return GLOBAL_BY_NAME.has(name) || name.startsWith("no-") && GLOBAL_BY_NAME.has(name.slice(3));
+  }
+  return token.length === 2 && GLOBAL_BY_SHORT.has(token.slice(1));
+}
+function resolveCommand(root, argv) {
+  let node = root;
+  const path = [];
+  const consumed = new Set;
+  for (let index = 0;index < argv.length; index += 1) {
+    const token = argv[index];
+    if (token === "--")
+      break;
+    if (token.startsWith("-") && token !== "-") {
+      if (!isGlobalToken(token))
+        break;
+      if (globalTakesValue(token))
+        index += 1;
+      continue;
+    }
+    const child = findChild(node, token);
+    if (child === undefined)
+      break;
+    node = child;
+    path.push(child.name);
+    consumed.add(index);
+  }
+  return { path, command: node, consumed };
+}
+function closest(word, candidates) {
+  let best;
+  for (const candidate of candidates) {
+    const distance = levenshtein(word, candidate);
+    if (distance <= 2 && (best === undefined || distance < best.distance)) {
+      best = { name: candidate, distance };
+    }
+  }
+  return best?.name;
+}
+function levenshtein(a, b) {
+  const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+  for (let i = 1;i <= a.length; i += 1) {
+    let previous = row[0];
+    row[0] = i;
+    for (let j = 1;j <= b.length; j += 1) {
+      const current = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+      previous = current;
+    }
+  }
+  return row[b.length];
+}
+function convert(flag, raw, display) {
+  if (flag.type === "number") {
+    const value = Number(raw);
+    if (raw.trim() === "" || !Number.isFinite(value)) {
+      throw new UsageError(`${display} takes a number, got "${raw}".`);
+    }
+    return value;
+  }
+  if (flag.type === "boolean") {
+    if (raw === "true" || raw === "1" || raw === "")
+      return true;
+    if (raw === "false" || raw === "0")
+      return false;
+    throw new UsageError(`${display} is true or false, got "${raw}".`);
+  }
+  if (flag.values !== undefined && !flag.values.includes(raw)) {
+    throw new UsageError(`${display} is one of ${flag.values.join(", ")}; got "${raw}".`);
+  }
+  return raw;
+}
+function commandName(path) {
+  return ["ycadence", ...path].join(" ");
+}
+function parse(root, argv) {
+  const { path, command, consumed } = resolveCommand(root, argv);
+  const flags = [...GLOBAL_FLAGS, ...command.flags ?? []];
+  const byName = new Map(flags.map((flag) => [flag.name, flag]));
+  const byShort = new Map(flags.filter((flag) => flag.short !== undefined).map((flag) => [flag.short, flag]));
+  const values = {};
+  const positionals = [];
+  const rest = [];
+  const assign = (flag, value) => {
+    if (flag.multiple === true) {
+      const list = values[flag.name] ?? [];
+      values[flag.name] = [...list, value];
+    } else {
+      values[flag.name] = value;
+    }
+  };
+  for (let index = 0;index < argv.length; index += 1) {
+    if (consumed.has(index))
+      continue;
+    const token = argv[index];
+    if (token === "--") {
+      rest.push(...argv.slice(index + 1));
+      break;
+    }
+    if (token.startsWith("--")) {
+      const equals = token.indexOf("=");
+      const name = equals === -1 ? token.slice(2) : token.slice(2, equals);
+      let flag = byName.get(name);
+      let negated = false;
+      if (flag === undefined && name.startsWith("no-")) {
+        const positive = byName.get(name.slice(3));
+        if (positive?.type === "boolean") {
+          flag = positive;
+          negated = true;
+        }
+      }
+      if (flag === undefined) {
+        const suggestion = closest(name, flags.filter((candidate) => candidate.hidden !== true).map((candidate) => candidate.name));
+        throw new UsageError(`Unknown flag --${name} for "${commandName(path)}".${suggestion === undefined ? "" : ` Did you mean --${suggestion}?`}`);
+      }
+      const display = `--${flag.name}`;
+      if (negated) {
+        values[flag.name] = false;
+        continue;
+      }
+      if (equals !== -1) {
+        assign(flag, convert(flag, token.slice(equals + 1), display));
+        continue;
+      }
+      if (flag.type === "boolean") {
+        assign(flag, true);
+        continue;
+      }
+      const next = argv[index + 1];
+      if (next === undefined || next.startsWith("--") && next.length > 2) {
+        throw new UsageError(`${display} needs a value.`);
+      }
+      assign(flag, convert(flag, next, display));
+      index += 1;
+      continue;
+    }
+    if (token.startsWith("-") && token.length > 1 && !/^-\d/.test(token)) {
+      const short = token.slice(1);
+      const flag = short.length === 1 ? byShort.get(short) : undefined;
+      if (flag === undefined) {
+        throw new UsageError(`Unknown flag ${token} for "${commandName(path)}".`);
+      }
+      if (flag.type === "boolean") {
+        assign(flag, true);
+        continue;
+      }
+      const next = argv[index + 1];
+      if (next === undefined)
+        throw new UsageError(`${token} needs a value.`);
+      assign(flag, convert(flag, next, `-${short}`));
+      index += 1;
+      continue;
+    }
+    positionals.push(token);
+  }
+  const help = values.help === true;
+  const args = {};
+  const specs = command.args ?? [];
+  if (!help && command.run !== undefined) {
+    let position = 0;
+    for (const arg of specs) {
+      if (arg.variadic === true) {
+        args[arg.name] = positionals.slice(position);
+        position = positionals.length;
+        if (arg.required === true && args[arg.name].length === 0) {
+          throw new UsageError(`Missing <${arg.name}>. Usage: ${usageLine(path, command)}`);
+        }
+        continue;
+      }
+      args[arg.name] = positionals[position];
+      if (positionals[position] !== undefined)
+        position += 1;
+      else if (arg.required === true) {
+        throw new UsageError(`Missing <${arg.name}>. Usage: ${usageLine(path, command)}`);
+      }
+    }
+    if (position < positionals.length) {
+      const extra = positionals[position];
+      const hint = command.children === undefined ? "" : (() => {
+        const suggestion = closest(extra, command.children.filter((child) => child.hidden !== true).map((child) => child.name));
+        return suggestion === undefined ? "" : ` Did you mean "${suggestion}"?`;
+      })();
+      throw new UsageError(`Unexpected argument "${extra}" for "${commandName(path)}".${hint} Usage: ${usageLine(path, command)}`);
+    }
+    for (const flag of command.flags ?? []) {
+      if (flag.required === true && values[flag.name] === undefined) {
+        throw new UsageError(`--${flag.name} is required. Usage: ${usageLine(path, command)}`);
+      }
+    }
+  } else if (!help && positionals.length > 0) {
+    const word = positionals[0];
+    const candidates = (command.children ?? []).filter((child) => child.hidden !== true).map((child) => child.name);
+    const suggestion = closest(word, candidates);
+    throw new UsageError(path.length === 0 ? `Unknown command: ${word}.${suggestion === undefined ? "" : ` Did you mean "${suggestion}"?`}` : `Unknown command "${word}" for "${commandName(path)}".${suggestion === undefined ? "" : ` Did you mean "${suggestion}"?`}`);
+  }
+  return { path, command, args, flags: values, rest, help };
+}
+function usageLine(path, command) {
+  const parts = [commandName(path)];
+  if (command.children !== undefined && command.run === undefined)
+    parts.push("<command>");
+  for (const arg of command.args ?? []) {
+    const name = arg.variadic === true ? `${arg.name}...` : arg.name;
+    parts.push(arg.required === true ? `<${name}>` : `[${name}]`);
+  }
+  for (const flag of command.flags ?? []) {
+    if (flag.required === true)
+      parts.push(`--${flag.name} ${flag.placeholder ?? "<value>"}`);
+  }
+  if ((command.flags ?? []).some((flag) => flag.required !== true && flag.hidden !== true)) {
+    parts.push("[flags]");
+  }
+  return parts.join(" ");
+}
+function globalOptions(flags, defaults = {}) {
+  const requested = flags.json === true ? "json" : flags.format ?? defaults.format;
+  const format = requested === "json" || requested === "ndjson" ? requested : "table";
+  const fields = typeof flags.fields === "string" ? flags.fields.split(",").map((field) => field.trim()).filter((field) => field !== "") : undefined;
+  const limit = flags.limit;
+  if (limit !== undefined && (!Number.isInteger(limit) || limit < 1 || limit > 200)) {
+    throw new UsageError("--limit is a whole number from 1 to 200.");
+  }
+  const retry = flags.retry;
+  if (retry !== undefined && (!Number.isInteger(retry) || retry < 0 || retry > 10)) {
+    throw new UsageError("--retry is a whole number from 0 to 10.");
+  }
+  const key = flags["idempotency-key"];
+  if (key !== undefined && !/^[\x21-\x7e]{1,255}$/.test(key)) {
+    throw new UsageError("--idempotency-key is 1 to 255 printable ASCII characters.");
+  }
+  return {
+    format,
+    fields,
+    quiet: flags.quiet === true,
+    verbose: flags.verbose === true,
+    dryRun: flags["dry-run"] === true,
+    yes: flags.yes === true,
+    limit,
+    cursor: flags.cursor,
+    all: flags.all === true,
+    idempotencyKey: key,
+    retry,
+    profile: flags.profile,
+    org: flags.org,
+    project: flags.project
+  };
+}
+
+// src/help.ts
+function visibleChildren(command) {
+  return (command.children ?? []).filter((child) => child.hidden !== true);
+}
+function flagLabel(flag) {
+  const names = [flag.short === undefined ? undefined : `-${flag.short}`, `--${flag.name}`].filter((name) => name !== undefined).join(", ");
+  return flag.type === "boolean" ? names : `${names} ${flag.placeholder ?? "<value>"}`;
+}
+function flagLines(flags) {
+  const visible = flags.filter((flag) => flag.hidden !== true);
+  const labels = visible.map(flagLabel);
+  const width = Math.max(0, ...labels.map((label) => label.length));
+  return visible.map((flag, index) => {
+    const notes = [
+      flag.required === true ? "required" : undefined,
+      flag.multiple === true ? "repeatable" : undefined
+    ].filter((note) => note !== undefined);
+    return `  ${labels[index].padEnd(width)}  ${flag.description}${notes.length === 0 ? "" : ` (${notes.join(", ")})`}`;
+  });
+}
+function commandLines(path, children) {
+  const names = children.map((child) => [child.name, ...child.aliases ?? []].join(", "));
+  const width = Math.max(0, ...names.map((name) => name.length));
+  return children.map((child, index) => `  ${names[index].padEnd(width)}  ${child.summary}`);
+}
+var CONFIGURATION_HELP = `Configuration:
+  Profiles live in ~/.config/ycadence/config.json ($XDG_CONFIG_HOME aware);
+  keys in the OS keychain. Environment variables override both:
+  YCADENCE_URL       the instance, e.g. https://ycadence.example.com
   YCADENCE_API_KEY   a project, organization or personal key
   YCADENCE_IDENTITY_TOKEN
                      optional: a Google identity token, for an instance behind
-                     IAP. Its audience must be the IAP OAuth client id, and it
-                     lasts about an hour
+                     IAP (or use \`ycadence login\`)
+  YCADENCE_PROFILE, YCADENCE_PROJECT, YCADENCE_ORG, YCADENCE_FORMAT
 
 The DEVPULSE_* names are still read when the YCADENCE_* one is unset.
-\`devpulse\` is kept as an alias of this command.`;
-async function run(argv, context) {
-  const [command, ...rest] = argv;
+\`devpulse\` is kept as an alias of this command. For a short name, add
+\`alias yc=ycadence\` to your shell.`;
+function renderHelp(root, path, command) {
+  const isRoot = path.length === 0;
+  const lines = [];
+  lines.push(isRoot ? "ycadence — project and work management from the command line" : `${commandName(path)} — ${command.summary}`);
+  if (command.deprecatedFor !== undefined) {
+    lines.push("", `Deprecated: use \`${command.deprecatedFor}\`.`);
+  }
+  if (command.description !== undefined)
+    lines.push("", command.description);
+  lines.push("", "Usage:", `  ${isRoot ? "ycadence <command> [flags]" : usageLine(path, command)}`);
+  const children = visibleChildren(command);
+  if (children.length > 0) {
+    lines.push("", "Commands:", ...commandLines(path, children));
+  }
+  if ((command.args ?? []).length > 0) {
+    const width = Math.max(...(command.args ?? []).map((arg) => arg.name.length + 2));
+    lines.push("", "Arguments:", ...(command.args ?? []).map((arg) => `  ${`<${arg.name}>`.padEnd(width)}  ${arg.description}`));
+  }
+  if ((command.flags ?? []).some((flag) => flag.hidden !== true)) {
+    lines.push("", "Flags:", ...flagLines(command.flags ?? []));
+  }
+  if ((command.examples ?? []).length > 0) {
+    lines.push("", "Examples:", ...(command.examples ?? []).map((example) => `  ${example}`));
+  }
+  if (isRoot) {
+    lines.push("", "Global flags:", ...flagLines(GLOBAL_FLAGS));
+    lines.push("", CONFIGURATION_HELP);
+    lines.push("", "Exit codes:", ...EXIT_CODE_TABLE.map(([code, meaning]) => `  ${String(code).padStart(2)}  ${meaning}`));
+    lines.push("", "Run `ycadence <command> --help` for a command, or `ycadence help <command>`.");
+  } else {
+    lines.push("", "Global flags: see `ycadence --help`.");
+  }
+  return lines.join(`
+`);
+}
+function walk(command, path = [], includeHidden = false) {
+  const entries = [];
+  for (const child of command.children ?? []) {
+    if (child.hidden === true && !includeHidden)
+      continue;
+    const childPath = [...path, child.name];
+    entries.push({ path: childPath, command: child });
+    entries.push(...walk(child, childPath, includeHidden));
+  }
+  return entries;
+}
+
+// src/oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+var GOOGLE_ENDPOINTS = {
+  authorization: "https://accounts.google.com/o/oauth2/v2/auth",
+  token: "https://oauth2.googleapis.com/token",
+  device: "https://oauth2.googleapis.com/device/code"
+};
+function endpointsFrom(env) {
+  return {
+    authorization: env.YCADENCE_OAUTH_AUTH_URL || GOOGLE_ENDPOINTS.authorization,
+    token: env.YCADENCE_OAUTH_TOKEN_URL || GOOGLE_ENDPOINTS.token,
+    device: env.YCADENCE_OAUTH_DEVICE_URL || GOOGLE_ENDPOINTS.device
+  };
+}
+var SCOPE = "openid email";
+function base64url(buffer) {
+  return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createPkce(random = randomBytes) {
+  const verifier = base64url(random(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function authorizationUrl(options) {
+  const url = new URL(options.client.endpoints.authorization);
+  url.searchParams.set("client_id", options.client.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("scope", SCOPE);
+  url.searchParams.set("code_challenge", options.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("state", options.state);
+  url.searchParams.set("access_type", "offline");
+  url.searchParams.set("prompt", "consent");
+  return url.toString();
+}
+function tokenExpiry(token) {
+  const payload = token.split(".")[1];
+  if (payload === undefined)
+    return;
   try {
-    switch (command) {
-      case undefined:
-      case "help":
-      case "--help":
-      case "-h":
-        return ok(USAGE);
-      case "doctor":
-        return await doctor(context);
-      case "states": {
-        const projectId = rest[0];
-        if (projectId === undefined)
-          return fail("Usage: ycadence states <projectId>");
-        const { states } = await context.client.listStates(projectId);
-        return ok(states.map((state) => `${state.id}  ${state.name}  (${state.group})`).join(`
-`));
-      }
-      case "cycles": {
-        const projectId = rest[0];
-        if (projectId === undefined)
-          return fail("Usage: ycadence cycles <projectId>");
-        const { cycles } = await context.client.listCycles(projectId);
-        return ok(cycles.length === 0 ? "No cycles." : cycles.map((cycle) => `${cycle.id}  ${cycle.name}  [${cycle.status}]`).join(`
-`));
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof claims.exp === "number" ? claims.exp * 1000 : undefined;
+  } catch {
+    return;
+  }
+}
+async function postForm(fetchImpl, url, form) {
+  const body = new URLSearchParams;
+  for (const [name, value] of Object.entries(form)) {
+    if (value !== undefined && value !== "")
+      body.set(name, value);
+  }
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+      body: body.toString()
+    });
+  } catch (error) {
+    throw new CliError(`Could not reach ${new URL(url).host}: ${error instanceof Error ? error.message : "error"}`, "network_error", EXIT.tempfail);
+  }
+  const text = await response.text();
+  let parsed = {};
+  try {
+    parsed = JSON.parse(text);
+  } catch {}
+  return { status: response.status, body: parsed };
+}
+function tokenError(body, status) {
+  const reason = body.error_description ?? body.error ?? `HTTP ${status}`;
+  return new CliError(`Sign-in failed: ${reason}`, body.error ?? "oauth_error", body.error === "invalid_grant" ? EXIT.config : EXIT.failure);
+}
+function toTokenSet(body, now) {
+  const idToken = body.id_token;
+  return {
+    refreshToken: body.refresh_token,
+    idToken,
+    expiresAt: (idToken === undefined ? undefined : tokenExpiry(idToken)) ?? (body.expires_in === undefined ? undefined : now + body.expires_in * 1000)
+  };
+}
+async function exchangeCode(options) {
+  const { status, body } = await postForm(options.fetch, options.client.endpoints.token, {
+    grant_type: "authorization_code",
+    code: options.code,
+    code_verifier: options.verifier,
+    redirect_uri: options.redirectUri,
+    client_id: options.client.clientId,
+    client_secret: options.client.clientSecret
+  });
+  if (status !== 200 || body.error !== undefined)
+    throw tokenError(body, status);
+  return toTokenSet(body, (options.now ?? Date.now)());
+}
+async function refreshIdToken(options) {
+  const { status, body } = await postForm(options.fetch, options.client.endpoints.token, {
+    grant_type: "refresh_token",
+    refresh_token: options.refreshToken,
+    client_id: options.client.clientId,
+    client_secret: options.client.clientSecret,
+    audience: options.audience
+  });
+  if (status !== 200 || body.error !== undefined)
+    throw tokenError(body, status);
+  const tokens = toTokenSet(body, (options.now ?? Date.now)());
+  if (tokens.idToken === undefined) {
+    throw new CliError("The token endpoint returned no id_token.", "oauth_error");
+  }
+  return { idToken: tokens.idToken, expiresAt: tokens.expiresAt };
+}
+var nodeListen = (handler) => new Promise((resolve, reject) => {
+  const server = createServer((request, response) => {
+    const result = handler({ url: request.url ?? "/" });
+    response.writeHead(result.status, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(result.body);
+  });
+  server.on("error", reject);
+  server.listen(0, "127.0.0.1", () => {
+    const { port } = server.address();
+    resolve({
+      port,
+      close: () => new Promise((done) => server.close(() => done()))
+    });
+  });
+});
+var PAGE = (message) => `<!doctype html><meta charset="utf-8"><title>ycadence</title><p style="font:16px system-ui;margin:3rem">${message}</p>`;
+async function loopbackLogin(options) {
+  const random = options.random ?? randomBytes;
+  const { verifier, challenge } = createPkce(random);
+  const state = base64url(random(16));
+  const listen = options.listen ?? nodeListen;
+  let settle = () => {};
+  const redirected = new Promise((resolve) => {
+    settle = resolve;
+  });
+  const server = await listen((request) => {
+    const url2 = new URL(request.url, "http://127.0.0.1");
+    if (url2.pathname !== "/")
+      return { status: 404, body: PAGE("Not found.") };
+    if (url2.searchParams.get("state") !== state) {
+      return { status: 400, body: PAGE("This sign-in link is stale. Run the command again.") };
+    }
+    const error = url2.searchParams.get("error");
+    const code = url2.searchParams.get("code");
+    settle(error !== null ? { error } : { code: code ?? undefined });
+    return {
+      status: 200,
+      body: PAGE(error === null ? "Signed in. You can close this tab and return to the terminal." : "Sign-in was cancelled.")
+    };
+  });
+  const redirectUri = `http://127.0.0.1:${server.port}`;
+  const url = authorizationUrl({ client: options.client, redirectUri, challenge, state });
+  options.print(`Opening your browser to sign in. If it does not open, visit:
+
+  ${url}
+`);
+  await options.openUrl(url);
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve({ error: "timed out" }), options.timeoutMs ?? 300000);
+  });
+  try {
+    const result = await Promise.race([redirected, timeout]);
+    if (result.error !== undefined || result.code === undefined) {
+      throw new CliError(`Sign-in did not complete: ${result.error ?? "no code"}.`, "oauth_error");
+    }
+    return await exchangeCode({
+      client: options.client,
+      code: result.code,
+      verifier,
+      redirectUri,
+      fetch: options.fetch,
+      now: options.now
+    });
+  } finally {
+    clearTimeout(timer);
+    await server.close();
+  }
+}
+async function deviceLogin(options) {
+  const now = options.now ?? Date.now;
+  const start = await postForm(options.fetch, options.client.endpoints.device, {
+    client_id: options.client.clientId,
+    scope: SCOPE
+  });
+  if (start.status !== 200 || start.body.error !== undefined) {
+    throw tokenError(start.body, start.status);
+  }
+  const deviceCode = start.body.device_code;
+  const userCode = start.body.user_code;
+  const verificationUrl = start.body.verification_url ?? start.body.verification_uri;
+  if (deviceCode === undefined || userCode === undefined || verificationUrl === undefined) {
+    throw new CliError("The device endpoint returned an incomplete answer.", "oauth_error");
+  }
+  let interval = (start.body.interval ?? 5) * 1000;
+  const deadline = now() + (start.body.expires_in ?? 1800) * 1000;
+  options.print(`To sign in, visit ${verificationUrl} and enter the code ${userCode}`);
+  while (now() < deadline) {
+    await options.sleep(interval);
+    const { status, body } = await postForm(options.fetch, options.client.endpoints.token, {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: options.client.clientId,
+      client_secret: options.client.clientSecret
+    });
+    if (body.error === "authorization_pending")
+      continue;
+    if (body.error === "slow_down") {
+      interval += 5000;
+      continue;
+    }
+    if (status !== 200 || body.error !== undefined)
+      throw tokenError(body, status);
+    return toTokenSet(body, now());
+  }
+  throw new CliError("The sign-in code expired before it was approved.", "oauth_error");
+}
+function oauthClientFrom(options) {
+  if (options.clientId === undefined || options.clientId === "") {
+    throw new ConfigError("No OAuth client is configured. Set it with `ycadence config set oauthClientId <id>` (or YCADENCE_OAUTH_CLIENT_ID).");
+  }
+  return {
+    clientId: options.clientId,
+    clientSecret: options.clientSecret,
+    endpoints: endpointsFrom(options.env)
+  };
+}
+
+// src/identity.ts
+function storedIdentityToken(options) {
+  const { config, secrets } = options;
+  let memory;
+  const fresh = (entry) => entry !== undefined && (entry.expiresAt === undefined || entry.expiresAt - 60000 > options.now());
+  return async () => {
+    if (memory !== undefined && fresh(memory))
+      return memory.token;
+    const cached = await secrets.get(secretAccount.identityToken(config.profile));
+    if (cached !== undefined) {
+      try {
+        const parsed = JSON.parse(cached);
+        const entry = { token: parsed.token, expiresAt: parsed.expiresAt };
+        if (fresh(entry)) {
+          memory = entry;
+          return entry.token;
+        }
+      } catch {}
+    }
+    const refreshToken = await secrets.get(secretAccount.refreshToken(config.profile));
+    if (refreshToken === undefined || config.oauthClientId === undefined)
+      return;
+    const clientSecret = options.env.YCADENCE_OAUTH_CLIENT_SECRET || await secrets.get(secretAccount.oauthClientSecret(config.profile));
+    const minted = await refreshIdToken({
+      client: oauthClientFrom({ clientId: config.oauthClientId, clientSecret, env: options.env }),
+      refreshToken,
+      audience: config.iapAudience,
+      fetch: options.fetch,
+      now: options.now
+    });
+    memory = { token: minted.idToken, expiresAt: minted.expiresAt };
+    await secrets.set(secretAccount.identityToken(config.profile), JSON.stringify({ token: minted.idToken, expiresAt: minted.expiresAt }));
+    return minted.idToken;
+  };
+}
+
+// src/output.ts
+function pick(record, fields) {
+  if (typeof record !== "object" || record === null)
+    return record;
+  const picked = {};
+  for (const field of fields)
+    picked[field] = record[field];
+  return picked;
+}
+function project(data, fields) {
+  if (fields === undefined || fields.length === 0)
+    return data;
+  return Array.isArray(data) ? data.map((item) => pick(item, fields)) : pick(data, fields);
+}
+function cell(value) {
+  if (value === null || value === undefined)
+    return "—";
+  if (Array.isArray(value))
+    return value.length === 0 ? "—" : value.map(cell).join(",");
+  if (typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
+}
+function renderTable(rows, columns) {
+  const cells = rows.map((row) => columns.map((column) => cell(row[column])));
+  const widths = columns.map((column, index) => Math.max(column.length, ...cells.map((line2) => line2[index].length)));
+  const line = (values) => values.map((value, index) => index === values.length - 1 ? value : value.padEnd(widths[index])).join("  ").trimEnd();
+  return [line(columns.map((column) => column.toUpperCase())), ...cells.map(line)].join(`
+`);
+}
+function renderRecord(record, fields) {
+  const keys = fields ?? Object.keys(record);
+  const width = Math.max(0, ...keys.map((key) => key.length));
+  return keys.map((key) => `${key.padEnd(width)}  ${cell(record[key])}`).join(`
+`);
+}
+function idOf(row) {
+  if (typeof row !== "object" || row === null)
+    return typeof row === "string" ? row : undefined;
+  const record = row;
+  const value = record.key ?? record.id ?? record.runId ?? record.intakeItemId ?? record.name;
+  return value === undefined ? undefined : String(value);
+}
+function formatSuccess(output, globals, requestId) {
+  const data = output.data;
+  const nextCursor = output.nextCursor ?? null;
+  if (globals.quiet) {
+    const ids = output.ids ?? (Array.isArray(data) ? data.map(idOf) : [idOf(data)]);
+    return ids.filter((id) => id !== undefined).join(`
+`);
+  }
+  if (globals.format === "json") {
+    const envelope = {
+      ok: output.exitCode === undefined || output.exitCode === 0,
+      data: project(data, globals.fields),
+      nextCursor,
+      requestId: requestId ?? null
+    };
+    return JSON.stringify(envelope, null, 2);
+  }
+  if (globals.format === "ndjson") {
+    const projected = project(data, globals.fields);
+    const lines = Array.isArray(projected) ? projected.map((item) => JSON.stringify(item)) : [JSON.stringify(projected)];
+    return lines.join(`
+`);
+  }
+  if (output.text !== undefined && globals.fields === undefined)
+    return output.text;
+  if (Array.isArray(data)) {
+    if (data.length === 0)
+      return output.empty ?? "Nothing found.";
+    const columns = globals.fields ?? output.columns ?? Object.keys(data[0] ?? {});
+    const table = renderTable(data, columns);
+    return nextCursor === null ? table : `${table}
+… more (use --cursor ${nextCursor})`;
+  }
+  if (typeof data === "object" && data !== null) {
+    return renderRecord(data, globals.fields);
+  }
+  return data === undefined ? "" : String(data);
+}
+function formatDryRun(request, globals) {
+  const path = (() => {
+    try {
+      const url = new URL(request.url);
+      return `${url.pathname}${url.search}`;
+    } catch {
+      return request.url;
+    }
+  })();
+  const data = { method: request.method, path, headers: request.headers, body: request.body };
+  if (globals.format === "json" || globals.format === "ndjson") {
+    const envelope = {
+      ok: true,
+      dryRun: true,
+      data,
+      nextCursor: null,
+      requestId: null
+    };
+    return JSON.stringify(envelope, null, globals.format === "json" ? 2 : undefined);
+  }
+  const lines = [`Dry run: would send ${request.method} ${path}`];
+  for (const [name, value] of Object.entries(request.headers))
+    lines.push(`  ${name}: ${value}`);
+  if (request.body !== undefined)
+    lines.push("", JSON.stringify(request.body, null, 2));
+  lines.push("", "Nothing was sent.");
+  return lines.join(`
+`);
+}
+function errorEnvelope(error, code, requestId) {
+  if (error instanceof YCadenceError) {
+    return {
+      ok: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        status: error.status,
+        ...error.issues === undefined ? {} : { issues: error.issues },
+        ...error.details === undefined ? {} : { details: error.details },
+        requestId: error.requestId ?? requestId ?? null
       }
-      case "import":
-        return await importCommand(rest, context);
-      case "work-item":
-        return await workItem(rest, context);
-      default:
-        return fail(`Unknown command: ${command}
+    };
+  }
+  return {
+    ok: false,
+    error: {
+      code,
+      message: error instanceof Error ? error.message : "Unknown error.",
+      status: null,
+      requestId: requestId ?? null
+    }
+  };
+}
+function formatError(error, code, globals, requestId) {
+  const envelope = errorEnvelope(error, code, requestId);
+  if (globals.format === "json")
+    return JSON.stringify(envelope, null, 2);
+  if (globals.format === "ndjson")
+    return JSON.stringify(envelope);
+  const lines = [envelope.error.message];
+  for (const issue of envelope.error.issues ?? [])
+    lines.push(`  ${issue.path}: ${issue.message}`);
+  if (envelope.error.requestId !== null)
+    lines.push(`(request id ${envelope.error.requestId})`);
+  return lines.join(`
+`);
+}
 
-${USAGE}`);
+// src/resolve.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var WORK_ITEM_KEY = /^[A-Za-z][A-Za-z0-9]*-\d+$/;
+var isUuid = (value) => UUID.test(value);
+async function resolveProjectId(client, value) {
+  if (isUuid(value))
+    return value;
+  try {
+    const page = await client.listProjects({ q: value, limit: 50 });
+    const match = page.items.find((project2) => project2.identifier.toLowerCase() === value.toLowerCase());
+    if (match === undefined) {
+      throw new CliError(`No project with identifier "${value}".`, "not_found", EXIT.notFound);
     }
+    return match.id;
   } catch (error) {
-    if (error instanceof YCadenceError) {
-      const detail = error.issues === undefined ? error.message : `${error.message}
-${error.issues.map((issue) => `  ${issue.path}: ${issue.message}`).join(`
-`)}`;
-      return fail(detail, error.retryable ? 75 : 1);
-    }
-    return fail(error instanceof Error ? error.message : "Unknown error.");
-  }
-}
-async function workItem(argv, context) {
-  const [action, ...rest] = argv;
-  switch (action) {
-    case "list": {
-      const projectId = rest[0];
-      if (projectId === undefined)
-        return fail("Usage: ycadence work-item list <projectId>");
-      const page = await context.client.listWorkItems(projectId, { limit: 50 });
-      if (page.items.length === 0)
-        return ok("No work items.");
-      const lines = page.items.map((item) => `${item.key.padEnd(10)} ${item.priority.padEnd(7)} ${item.name}`);
-      if (page.nextCursor !== null)
-        lines.push(`… more (use --cursor ${page.nextCursor})`);
-      return ok(lines.join(`
-`));
-    }
-    case "create": {
-      const projectId = rest[0];
-      const flags = parseFlags(rest.slice(1));
-      const title = flags.title;
-      if (projectId === undefined || title === undefined) {
-        return fail('Usage: ycadence work-item create <projectId> --title "..."');
-      }
-      const created = await context.client.createWorkItem(projectId, {
-        name: title,
-        priority: flags.priority,
-        description: flags.description
-      });
-      return ok(`${created.key}  ${created.name}`);
-    }
-    case "show": {
-      const workItemId = rest[0];
-      if (workItemId === undefined)
-        return fail("Usage: ycadence work-item show <workItemId>");
-      const item = await context.client.getWorkItem(workItemId);
-      return ok([
-        `${item.key}  ${item.name}`,
-        `priority  ${item.priority}`,
-        `state     ${item.stateId ?? "—"}`,
-        "",
-        item.description ?? "(no description)"
-      ].join(`
-`));
-    }
-    case "close": {
-      const workItemId = rest[0];
-      if (workItemId === undefined)
-        return fail("Usage: ycadence work-item close <workItemId>");
-      const item = await context.client.getWorkItem(workItemId);
-      const { states } = await context.client.listStates(item.projectId ?? "");
-      const done = states.find((state) => state.group === "completed");
-      if (done === undefined) {
-        return fail("This project has no completed state, so nothing can be closed.");
-      }
-      await context.client.updateWorkItem(workItemId, { stateId: done.id });
-      return ok(`Closed ${item.key}.`);
+    if (error instanceof YCadenceNotFoundError || error instanceof YCadenceError && error.status === 405) {
+      throw new UsageError(`"${value}" is not a project id, and this server cannot look projects up by identifier yet. Pass the project's id.`);
     }
-    default:
-      return fail(`Unknown work-item action: ${action ?? "(none)"}
+    throw error;
+  }
+}
+async function listStates(client, projectId) {
+  const { states } = await client.listStates(projectId);
+  return [...states].sort((a, b) => a.sequence < b.sequence ? -1 : a.sequence > b.sequence ? 1 : 0);
+}
+function findState(states, value) {
+  const match = states.find((state) => state.id === value) ?? states.find((state) => state.name.toLowerCase() === value.toLowerCase());
+  if (match === undefined) {
+    throw new CliError(`No state "${value}" in this project. States: ${states.map((state) => state.name).join(", ")}.`, "validation_failed", EXIT.validation);
+  }
+  return match;
+}
+function closingState(states) {
+  const done = states.find((state) => state.group === "completed");
+  if (done === undefined) {
+    throw new CliError("This project has no completed state, so nothing can be closed.", "validation_failed", EXIT.validation);
+  }
+  return done;
+}
+var KEY_SCAN_LIMIT = 2000;
+async function resolveWorkItemId(client, value, projectId) {
+  if (isUuid(value))
+    return value;
+  if (!WORK_ITEM_KEY.test(value)) {
+    throw new UsageError(`"${value}" is neither a work item id nor a key like DP-42.`);
+  }
+  const project2 = await projectId();
+  const wanted = value.toUpperCase();
+  let seen = 0;
+  for await (const item of client.iterateWorkItems(project2, { pageSize: 200 })) {
+    if (item.key.toUpperCase() === wanted)
+      return item.id;
+    seen += 1;
+    if (seen >= KEY_SCAN_LIMIT)
+      break;
+  }
+  throw new CliError(seen >= KEY_SCAN_LIMIT ? `${value} was not among the first ${KEY_SCAN_LIMIT} items; pass its id instead.` : `No work item ${value} in this project.`, "not_found", EXIT.notFound);
+}
+function projectOf(item) {
+  return typeof item.projectId === "string" && item.projectId !== "" ? item.projectId : undefined;
+}
 
-${USAGE}`);
+// src/completion.ts
+var SHELLS = ["bash", "zsh", "fish"];
+function entries(root) {
+  const globalFlags = GLOBAL_FLAGS.map((flag) => `--${flag.name}`);
+  const all = [
+    {
+      key: "",
+      words: visibleChildren(root).flatMap((child) => [child.name, ...child.aliases ?? []]),
+      flags: globalFlags
+    }
+  ];
+  for (const { path, command } of walk(root)) {
+    all.push({
+      key: path.join(" "),
+      words: visibleChildren(command).flatMap((child) => [child.name, ...child.aliases ?? []]),
+      flags: [
+        ...globalFlags,
+        ...(command.flags ?? []).filter((flag) => flag.hidden !== true).map((flag) => `--${flag.name}`)
+      ]
+    });
+    for (const alias of command.aliases ?? []) {
+      const last = all[all.length - 1];
+      all.push({ ...last, key: [...path.slice(0, -1), alias].join(" ") });
+    }
+  }
+  return all;
+}
+function enumValues(root) {
+  const values = new Map;
+  for (const flag of GLOBAL_FLAGS)
+    if (flag.values)
+      values.set(`--${flag.name}`, flag.values);
+  for (const { command } of walk(root)) {
+    for (const flag of command.flags ?? [])
+      if (flag.values)
+        values.set(`--${flag.name}`, flag.values);
   }
+  return values;
+}
+function bash(root) {
+  const table = entries(root).map((entry) => `    "${entry.key}") words="${[...entry.words, ...entry.flags].join(" ")}" ;;`).join(`
+`);
+  const values = [...enumValues(root)].map(([flag, list]) => `    ${flag}) COMPREPLY=($(compgen -W "${list.join(" ")}" -- "$cur")); return ;;`).join(`
+`);
+  return `# bash completion for ycadence (generated; do not edit)
+# Add to ~/.bashrc:  source <(ycadence completion bash)
+_ycadence() {
+  local cur prev cmdpath words i
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  case "$prev" in
+${values}
+  esac
+  cmdpath=""
+  for ((i = 1; i < COMP_CWORD; i++)); do
+    case "\${COMP_WORDS[i]}" in
+      -*) ;;
+      *) if _ycadence_known "\${cmdpath:+$cmdpath }\${COMP_WORDS[i]}"; then cmdpath="\${cmdpath:+$cmdpath }\${COMP_WORDS[i]}"; fi ;;
+    esac
+  done
+  _ycadence_words "$cmdpath"
+  COMPREPLY=($(compgen -W "$words" -- "$cur"))
+}
+_ycadence_words() {
+  case "$1" in
+${table}
+    *) words="" ;;
+  esac
 }
+_ycadence_known() {
+  local words
+  _ycadence_words "$1"
+  [ -n "$words" ]
+}
+complete -F _ycadence ycadence devpulse
+`;
+}
+function zsh(root) {
+  const table = entries(root).map((entry) => `    "${entry.key}") reply=(${[...entry.words, ...entry.flags].join(" ")}) ;;`).join(`
+`);
+  const values = [...enumValues(root)].map(([flag, list]) => `    ${flag}) compadd -- ${list.join(" ")}; return ;;`).join(`
+`);
+  return `#compdef ycadence devpulse
+# zsh completion for ycadence (generated; do not edit)
+# Add to ~/.zshrc (after compinit):  source <(ycadence completion zsh)
+_ycadence_words() {
+  case "$1" in
+${table}
+    *) reply=() ;;
+  esac
+}
+_ycadence() {
+  local -a reply
+  local cmdpath="" word i
+  case "\${words[CURRENT-1]}" in
+${values}
+  esac
+  for (( i = 2; i < CURRENT; i++ )); do
+    word="\${words[i]}"
+    [[ "$word" == -* ]] && continue
+    _ycadence_words "\${cmdpath:+$cmdpath }$word"
+    (( \${#reply} )) && cmdpath="\${cmdpath:+$cmdpath }$word"
+  done
+  _ycadence_words "$cmdpath"
+  compadd -- $reply
+}
+compdef _ycadence ycadence devpulse
+`;
+}
+function fish(root) {
+  const lines = [
+    "# fish completion for ycadence (generated; do not edit)",
+    "# Save as ~/.config/fish/completions/ycadence.fish:  ycadence completion fish > ~/.config/fish/completions/ycadence.fish",
+    "function __ycadence_path",
+    "    set -l tokens (commandline -opc)",
+    "    set -e tokens[1]",
+    "    set -l words",
+    "    for token in $tokens",
+    "        string match -q -- '-*' $token; or set words $words $token",
+    "    end",
+    '    string join " " $words',
+    "end"
+  ];
+  for (const entry of entries(root)) {
+    const condition = `test (__ycadence_path) = '${entry.key}'`;
+    if (entry.words.length > 0) {
+      lines.push(`complete -c ycadence -f -n "${condition}" -a '${entry.words.join(" ")}'`);
+    }
+  }
+  for (const flag of GLOBAL_FLAGS) {
+    const values = flag.values ? ` -a '${flag.values.join(" ")}'` : "";
+    lines.push(`complete -c ycadence -l ${flag.name}${flag.short ? ` -s ${flag.short}` : ""}${flag.type === "boolean" ? "" : " -r"}${values} -d '${flag.description.replace(/'/g, "\\'")}'`);
+  }
+  for (const { path, command } of walk(root)) {
+    for (const flag of command.flags ?? []) {
+      if (flag.hidden === true)
+        continue;
+      const values = flag.values ? ` -a '${flag.values.join(" ")}'` : "";
+      lines.push(`complete -c ycadence -n "test (__ycadence_path) = '${path.join(" ")}'" -l ${flag.name}${flag.type === "boolean" ? "" : " -r"}${values} -d '${flag.description.replace(/'/g, "\\'")}'`);
+    }
+  }
+  lines.push("complete -c devpulse -w ycadence", "");
+  return lines.join(`
+`);
+}
+function completionScript(root, shell) {
+  if (shell === "bash")
+    return bash(root);
+  if (shell === "zsh")
+    return zsh(root);
+  return fish(root);
+}
+
+// src/handlers/auth.ts
+function str(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function keyHint(key) {
+  return `${key.slice(0, 12)}… (${key.length} chars)`;
+}
+async function storedKey(context) {
+  return readEnv("API_KEY", context.env) ?? await context.secrets.get(secretAccount.apiKey(context.config.profile));
+}
+var loginHandler = async (context) => {
+  const profile = context.config.profile;
+  assertProfileName(profile);
+  const file = await context.configStore.load();
+  const stored = { ...file.profiles[profile] ?? {} };
+  const url = str(context.flags.url);
+  if (url !== undefined) {
+    try {
+      new URL(url);
+    } catch {
+      throw new UsageError(`--url takes a URL, got "${url}".`);
+    }
+    stored.url = url.replace(/\/+$/, "");
+  }
+  const clientIdFlag = str(context.flags["oauth-client-id"]);
+  if (clientIdFlag !== undefined)
+    stored.oauthClientId = clientIdFlag;
+  const audienceFlag = str(context.flags["iap-audience"]);
+  if (audienceFlag !== undefined)
+    stored.iapAudience = audienceFlag;
+  file.profiles[profile] = stored;
+  if (file.currentProfile === undefined)
+    file.currentProfile = profile;
+  await context.configStore.save(file);
+  let apiKey;
+  if (context.flags["api-key-stdin"] === true) {
+    apiKey = (await context.readStdin()).trim();
+    if (apiKey === "")
+      throw new UsageError("--api-key-stdin read nothing from stdin.");
+  }
+  const clientId = readEnv("OAUTH_CLIENT_ID", context.env) ?? stored.oauthClientId;
+  const audience = readEnv("IAP_AUDIENCE", context.env) ?? stored.iapAudience;
+  let signedIn = false;
+  if (context.flags["skip-oauth"] === true) {
+    context.debug("Skipping the IAP sign-in (--skip-oauth).");
+  } else if (clientId === undefined) {
+    context.notice("No OAuth client is configured, so the IAP sign-in is skipped. That is right for an instance that is not behind IAP. For one that is, a person must first create the Desktop OAuth client (see docs/cli/work-management.md), then run `ycadence login --oauth-client-id <id> --iap-audience <IAP client id>`.");
+  } else {
+    const clientSecret = context.env.YCADENCE_OAUTH_CLIENT_SECRET || await context.secrets.get(secretAccount.oauthClientSecret(profile));
+    if (clientSecret === undefined || clientSecret === "") {
+      throw new ConfigError("The OAuth client secret is missing. Set YCADENCE_OAUTH_CLIENT_SECRET for this login; it is then kept in the credential store.");
+    }
+    const client = oauthClientFrom({ clientId, clientSecret, env: context.env });
+    const tokens = context.flags.device === true ? await deviceLogin({
+      client,
+      fetch: context.fetch,
+      print: (message) => context.notice(message),
+      sleep: (ms) => context.sleep(ms),
+      now: () => context.now()
+    }) : await loopbackLogin({
+      client,
+      fetch: context.fetch,
+      openUrl: context.flags["no-browser"] === true ? async () => false : (target) => context.openUrl(target),
+      print: (message) => context.notice(message),
+      now: () => context.now()
+    });
+    if (tokens.refreshToken === undefined) {
+      throw new CliError("Google returned no refresh token. Revoke the app at myaccount.google.com/permissions and sign in again.", "oauth_error");
+    }
+    await context.secrets.set(secretAccount.refreshToken(profile), tokens.refreshToken);
+    await context.secrets.set(secretAccount.oauthClientSecret(profile), clientSecret);
+    const identity = audience === undefined ? tokens.idToken === undefined ? undefined : { idToken: tokens.idToken, expiresAt: tokens.expiresAt } : await refreshIdToken({
+      client,
+      refreshToken: tokens.refreshToken,
+      audience,
+      fetch: context.fetch,
+      now: () => context.now()
+    });
+    if (identity === undefined) {
+      await context.secrets.delete(secretAccount.identityToken(profile));
+    } else {
+      await context.secrets.set(secretAccount.identityToken(profile), JSON.stringify({ token: identity.idToken, expiresAt: identity.expiresAt }));
+    }
+    signedIn = true;
+  }
+  if (apiKey !== undefined)
+    await context.secrets.set(secretAccount.apiKey(profile), apiKey);
+  await context.reloadConfig();
+  const key = await storedKey(context);
+  const result = {
+    profile,
+    url: context.config.url ?? null,
+    identity: signedIn,
+    apiKey: key === undefined ? null : keyHint(key),
+    credentialStore: context.secrets.kind,
+    organization: null
+  };
+  if (context.config.url !== undefined && key !== undefined) {
+    const client = await context.client();
+    try {
+      const me = await client.me();
+      result.organization = me.organization.slug;
+    } catch (error) {
+      if (!(error instanceof YCadenceNotFoundError))
+        throw error;
+      await client.health();
+    }
+  }
+  const lines = [`Profile "${profile}" saved.`];
+  if (signedIn)
+    lines.push("Signed in for IAP; the identity token refreshes itself.");
+  if (key !== undefined)
+    lines.push(`API key ${keyHint(key)} in the ${context.secrets.description}.`);
+  else
+    lines.push("No API key yet: run `ycadence login --api-key-stdin < key.txt`.");
+  if (result.organization !== null)
+    lines.push(`Connected to organization ${result.organization}.`);
+  return { data: result, text: lines.join(`
+`) };
+};
+var statusHandler = async (context) => {
+  const key = await storedKey(context);
+  if (context.config.url === undefined || key === undefined) {
+    throw new ConfigError("Not signed in: no URL or API key for this profile. Run `ycadence login`.");
+  }
+  const refresh = await context.secrets.get(secretAccount.refreshToken(context.config.profile));
+  const data = {
+    profile: context.config.profile,
+    url: context.config.url,
+    apiKey: keyHint(key),
+    identity: refresh !== undefined,
+    me: null
+  };
+  try {
+    data.me = await (await context.client()).me();
+  } catch (error) {
+    if (!(error instanceof YCadenceNotFoundError))
+      throw error;
+    data.note = "This server does not have GET /api/v1/me yet.";
+  }
+  const me = data.me;
+  const lines = [
+    `profile   ${data.profile}`,
+    `url       ${data.url}`,
+    `api key   ${data.apiKey}`,
+    `identity  ${data.identity === true ? "signed in (IAP)" : "not signed in"}`
+  ];
+  if (me !== null) {
+    lines.push(`org       ${me.organization?.slug ?? "—"}`);
+    lines.push(`as        ${me.principal?.email ?? me.principal?.kind ?? "—"}`);
+    lines.push(`scopes    ${(me.scopes ?? []).join(", ") || "—"}`);
+    if (context.globals.org !== undefined && me.organization?.slug !== context.globals.org) {
+      context.notice(`This key belongs to ${me.organization?.slug}, not ${context.globals.org}.`);
+    }
+  } else {
+    lines.push(`          ${data.note}`);
+  }
+  return { data, text: lines.join(`
+`) };
+};
+var logoutHandler = async (context) => {
+  const profile = context.config.profile;
+  for (const account of [
+    secretAccount.apiKey(profile),
+    secretAccount.refreshToken(profile),
+    secretAccount.identityToken(profile),
+    secretAccount.oauthClientSecret(profile)
+  ]) {
+    await context.secrets.delete(account);
+  }
+  return {
+    data: { profile, loggedOut: true },
+    text: `Removed the stored credentials for profile "${profile}". Its settings are kept; \`ycadence config list\` shows them.`
+  };
+};
+var tokenHandler = async (context) => {
+  const fromEnv = readEnv("IDENTITY_TOKEN", context.env);
+  const token = fromEnv ?? await storedIdentityToken({
+    config: context.config,
+    secrets: context.secrets,
+    env: context.env,
+    fetch: context.fetch,
+    now: () => context.now()
+  })();
+  if (token === undefined) {
+    throw new ConfigError("No identity token: run `ycadence login` against an IAP instance first.");
+  }
+  return { data: { token }, text: token, ids: [token] };
+};
+
+// src/handlers/config.ts
+function str2(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function validate(key, value) {
+  if (key === "url") {
+    try {
+      new URL(value);
+    } catch {
+      throw new UsageError(`url takes a URL, got "${value}".`);
+    }
+    return value.replace(/\/+$/, "");
+  }
+  if (key === "format" && !["table", "json", "ndjson"].includes(value)) {
+    throw new UsageError("format is one of table, json, ndjson.");
+  }
+  return value;
+}
+var configGetHandler = async (context) => {
+  const key = str2(context.args.key);
+  assertProfileKey(key);
+  const value = (await context.configStore.load()).profiles[context.config.profile]?.[key];
+  return { data: { profile: context.config.profile, key, value: value ?? null }, text: value ?? "" };
+};
+var configSetHandler = async (context) => {
+  const key = str2(context.args.key);
+  assertProfileKey(key);
+  const value = validate(key, str2(context.args.value));
+  const file = await context.configStore.load();
+  const profile = context.config.profile;
+  file.profiles[profile] = { ...file.profiles[profile] ?? {}, [key]: value };
+  if (file.currentProfile === undefined)
+    file.currentProfile = profile;
+  await context.configStore.save(file);
+  return { data: { profile, key, value }, text: `Set ${key} for profile "${profile}".` };
+};
+var configUnsetHandler = async (context) => {
+  const key = str2(context.args.key);
+  assertProfileKey(key);
+  const file = await context.configStore.load();
+  const profile = context.config.profile;
+  const stored = { ...file.profiles[profile] ?? {} };
+  delete stored[key];
+  file.profiles[profile] = stored;
+  await context.configStore.save(file);
+  return { data: { profile, key, value: null }, text: `Unset ${key} for profile "${profile}".` };
+};
+var configListHandler = async (context) => {
+  const config = context.config;
+  const rows = PROFILE_KEYS.map((key) => {
+    const value = config[key];
+    const source = config.sources[key] ?? (value === undefined ? "none" : "profile");
+    return { key, value: value ?? null, source, description: PROFILE_KEY_HELP[key] };
+  });
+  return {
+    data: { profile: config.profile, path: context.configStore.path ?? null, settings: rows },
+    text: [
+      `profile "${config.profile}"  (${context.configStore.path ?? "not saved"})`,
+      ...rows.map((row) => `  ${row.key.padEnd(14)} ${String(row.value ?? "—").padEnd(40)} ${row.source}`)
+    ].join(`
+`)
+  };
+};
+var configProfilesHandler = async (context) => {
+  const file = await context.configStore.load();
+  const current = context.config.profile;
+  const names = Object.keys(file.profiles).sort();
+  const rows = names.map((name) => ({
+    name,
+    current: name === current,
+    url: file.profiles[name]?.url ?? null
+  }));
+  return {
+    data: rows,
+    columns: ["name", "current", "url"],
+    empty: "No profiles yet. `ycadence login` creates one.",
+    text: rows.length === 0 ? "No profiles yet. `ycadence login` creates one." : rows.map((row) => `${row.current ? "*" : " "} ${row.name.padEnd(16)} ${row.url ?? "—"}`).join(`
+`)
+  };
+};
+var configUseHandler = async (context) => {
+  const name = str2(context.args.profile);
+  assertProfileName(name);
+  const file = await context.configStore.load();
+  file.currentProfile = name;
+  file.profiles[name] = file.profiles[name] ?? {};
+  await context.configStore.save(file);
+  return { data: { currentProfile: name }, text: `Now using profile "${name}".` };
+};
+var configPathHandler = async (context) => {
+  const path = context.configStore.path ?? null;
+  return { data: { path }, text: path ?? "No config directory (no HOME or XDG_CONFIG_HOME)." };
+};
+
+// src/version.ts
+var CLI_VERSION = "0.2.1";
+
+// src/handlers/doctor.ts
 function legacyNote(name, env) {
   const current = env[`YCADENCE_${name}`];
   if (current !== undefined && current !== "")
     return "";
   return ` (read from ${LEGACY_ENV_PREFIX}${name}; rename it to YCADENCE_${name})`;
 }
-async function doctor(context) {
+var doctorHandler = async (context) => {
   const lines = [];
+  const checks = [];
   let healthy = true;
-  const url = readEnv("URL", context.env);
-  const key = readEnv("API_KEY", context.env);
-  lines.push(url === undefined ? "✗ YCADENCE_URL is not set" : `✓ YCADENCE_URL  ${url}${legacyNote("URL", context.env)}`);
-  lines.push(key === undefined ? "✗ YCADENCE_API_KEY is not set" : `✓ YCADENCE_API_KEY  ${key.slice(0, 12)}… (${key.length} chars)${legacyNote("API_KEY", context.env)}`);
-  if (url === undefined || key === undefined)
-    healthy = false;
-  const identityToken = readEnv("IDENTITY_TOKEN", context.env);
-  lines.push(identityToken === undefined || identityToken.length === 0 ? "· YCADENCE_IDENTITY_TOKEN not set (only needed behind IAP)" : `✓ YCADENCE_IDENTITY_TOKEN  set (${identityToken.length} chars)${legacyNote("IDENTITY_TOKEN", context.env)}`);
-  if (healthy) {
+  const add = (name, ok, line, detail = line) => {
+    lines.push(line);
+    checks.push({ name, ok, detail });
+    if (ok === false)
+      healthy = false;
+  };
+  const env = context.env;
+  const profile = context.config.profile;
+  lines.push(`ycadence ${CLI_VERSION}, profile "${profile}"`);
+  const envUrl = readEnv("URL", env);
+  const url = context.config.url;
+  if (url === undefined)
+    add("url", false, "✗ YCADENCE_URL is not set");
+  else if (envUrl !== undefined)
+    add("url", true, `✓ YCADENCE_URL  ${url}${legacyNote("URL", env)}`);
+  else
+    add("url", true, `✓ url  ${url}  (profile "${profile}")`);
+  const envKey = readEnv("API_KEY", env);
+  const storedKey2 = envKey === undefined ? await context.secrets.get(secretAccount.apiKey(profile)) : undefined;
+  const key = envKey ?? storedKey2;
+  if (key === undefined)
+    add("apiKey", false, "✗ YCADENCE_API_KEY is not set");
+  else if (envKey !== undefined) {
+    add("apiKey", true, `✓ YCADENCE_API_KEY  ${keyHint(key)}${legacyNote("API_KEY", env)}`);
+  } else
+    add("apiKey", true, `✓ API key  ${keyHint(key)}  (${context.secrets.description})`);
+  add("credentialStore", context.secrets.kind === "file" ? null : true, context.secrets.kind === "file" ? `! credentials in ${context.secrets.description}` : `✓ credentials in ${context.secrets.description}`);
+  const identityToken = readEnv("IDENTITY_TOKEN", env);
+  const refresh = await context.secrets.get(secretAccount.refreshToken(profile));
+  if (identityToken !== undefined && identityToken.length > 0) {
+    add("identity", true, `✓ YCADENCE_IDENTITY_TOKEN  set (${identityToken.length} chars)${legacyNote("IDENTITY_TOKEN", env)}`);
+  } else if (refresh !== undefined) {
+    add("identity", true, "✓ signed in for IAP (`ycadence login`)");
+  } else {
+    add("identity", null, "· YCADENCE_IDENTITY_TOKEN not set (only needed behind IAP)");
+  }
+  if (url !== undefined && key !== undefined) {
+    const client = await context.client();
     try {
-      const health = await context.client.health();
-      lines.push(`✓ reachable — status ${health.status}`);
-      for (const [name, state] of Object.entries(health.checks)) {
-        lines.push(`  ${state === "ok" ? "✓" : "✗"} ${name}: ${state}`);
-        if (state !== "ok")
-          healthy = false;
+      const health = await client.health();
+      add("reachable", true, `✓ reachable — status ${health.status}`);
+      for (const [name, state] of Object.entries(health.checks ?? {})) {
+        add(`health.${name}`, state === "ok", `  ${state === "ok" ? "✓" : "✗"} ${name}: ${state}`);
       }
     } catch (error) {
-      healthy = false;
-      lines.push(`✗ unreachable — ${error instanceof Error ? error.message : "unknown error"}`);
-    }
-  }
-  return healthy ? ok(lines.join(`
-`)) : fail(lines.join(`
-`));
-}
-function parseFlags(argv) {
-  const flags = {};
-  for (let index = 0;index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--"))
-      continue;
-    const equals = token.indexOf("=");
-    if (equals > -1) {
-      flags[token.slice(2, equals)] = token.slice(equals + 1);
-      continue;
+      const message = error instanceof Error ? error.message : "unknown error";
+      add("reachable", false, `✗ unreachable — ${message}`);
+      if (/audience/i.test(message)) {
+        lines.push("  The identity token was minted for the wrong client. Set iapAudience to the IAP OAuth client id and run `ycadence login` again.");
+      } else if (error instanceof YCadenceError && error.status === 401 && refresh === undefined && identityToken === undefined) {
+        lines.push("  If this instance is behind IAP, sign in with `ycadence login` first.");
+      }
     }
-    const next = argv[index + 1];
-    if (next === undefined || next.startsWith("--")) {
-      flags[token.slice(2)] = "";
-      continue;
+    if (healthy) {
+      try {
+        const me = await client.me();
+        if (typeof me === "object" && me !== null && "organization" in me) {
+          add("key", true, `✓ key accepted — organization ${me.organization.slug}`);
+        }
+      } catch (error) {
+        if (error instanceof YCadenceNotFoundError) {
+          add("key", null, "· key not checked (this server has no /api/v1/me yet)");
+        } else {
+          add("key", false, `✗ key refused — ${error instanceof Error ? error.message : "error"}`);
+        }
+      }
     }
-    flags[token.slice(2)] = next;
-    index += 1;
   }
-  return flags;
-}
+  return {
+    data: { healthy, profile, checks },
+    text: lines.join(`
+`),
+    exitCode: healthy ? EXIT.ok : EXIT.failure
+  };
+};
+
+// src/handlers/imports.ts
 var IMPORT_SOURCES = ["csv", "github", "jira", "linear"];
-async function importCommand(argv, context) {
-  const [action, target] = argv;
-  const flags = parseFlags(argv.slice(2));
-  if (action === "status") {
-    if (target === undefined)
-      return fail("Usage: ycadence import status <runId>");
-    const run2 = await context.client.getImport(target);
-    return ok(formatRun(run2));
-  }
-  if (action === "list") {
-    if (target === undefined)
-      return fail("Usage: ycadence import list <projectId>");
-    const { runs } = await context.client.listImports(target);
-    return ok(runs.length === 0 ? "No imports." : runs.map((run2) => formatRun(run2)).join(`
-
-`));
-  }
-  if (action !== "preview" && action !== "run") {
-    return fail(`Usage: ycadence import preview|run|status|list …`);
-  }
-  if (target === undefined)
-    return fail(`Usage: ycadence import ${action} <projectId> --file …`);
-  const source = flags.source ?? "csv";
+function str3(value) {
+  return typeof value === "string" ? value : undefined;
+}
+async function importBody(context) {
+  const source = str3(context.flags.source) ?? "csv";
   if (!IMPORT_SOURCES.includes(source)) {
-    return fail(`Unknown source "${source}". One of: ${IMPORT_SOURCES.join(", ")}.`);
+    throw new UsageError(`Unknown source "${source}". One of: ${IMPORT_SOURCES.join(", ")}.`);
+  }
+  const file = str3(context.flags.file);
+  if (file === undefined)
+    throw new UsageError("Pass --file with the export to import.");
+  const text = await context.readFile(file);
+  let data = text;
+  if (source !== "csv") {
+    try {
+      data = JSON.parse(text);
+    } catch {
+      throw new UsageError(`${file} is not valid JSON; a ${source} export should be.`);
+    }
   }
-  if (flags.file === undefined)
-    return fail("Pass --file with the export to import.");
-  const text = await context.readFile(flags.file);
-  const data = source === "csv" ? text : JSON.parse(text);
   const body = { source, data };
-  if (flags.repository !== undefined)
-    body.repository = flags.repository;
-  if (flags["base-url"] !== undefined)
-    body.baseUrl = flags["base-url"];
-  if (action === "preview") {
-    const preview = await context.client.previewImport(target, body);
-    const lines = [
-      `${preview.total} items from ${preview.source}.`,
-      preview.idempotent ? "" : "This source has no stable ids, so re-importing an edited row creates a second item.",
-      "",
-      "States:",
-      ...preview.states.map((state) => `  ${state.name} → ${state.suggestedStateId ?? "no match; will use the default state"}`),
-      "",
-      "Labels:",
-      ...preview.labels.map((label) => `  ${label.name}${label.exists ? "" : "  (will create)"}`),
-      "",
-      "Assignees:",
-      ...preview.assignees.map((assignee) => `  ${assignee.value}${assignee.matched ? "" : "  (no matching member)"}`)
-    ];
-    if (preview.unmappedPriorities.length > 0) {
-      lines.push("", `Unrecognised priorities: ${preview.unmappedPriorities.join(", ")}`);
-    }
-    if (preview.skipped.length > 0) {
-      lines.push("", "Skipped:");
-      for (const skip of preview.skipped)
-        lines.push(`  row ${skip.row}: ${skip.reason}`);
-    }
-    return ok(lines.filter((line, index) => line !== "" || index > 0).join(`
-`));
+  const repository = str3(context.flags.repository);
+  if (repository !== undefined)
+    body.repository = repository;
+  const baseUrl = str3(context.flags["base-url"]);
+  if (baseUrl !== undefined)
+    body.baseUrl = baseUrl;
+  return body;
+}
+function formatRun(run) {
+  const lines = [
+    `${run.id}  [${run.status}]  ${run.source}`,
+    `  ${run.cursor}/${run.totalItems} committed — ${run.createdCount} created, ${run.updatedCount} updated`
+  ];
+  if (run.error !== null)
+    lines.push(`  error: ${run.error}`);
+  for (const miss of run.unmatched.slice(0, 20)) {
+    lines.push(`  unmatched ${miss.kind} "${miss.value}" on ${miss.item}`);
   }
+  if (run.unmatched.length > 20) {
+    lines.push(`  …and ${run.unmatched.length - 20} more`);
+  }
+  return lines.join(`
+`);
+}
+var previewImportHandler = async (context) => {
+  const projectId = await context.projectId(str3(context.args.projectId));
+  const body = await importBody(context);
+  const preview = await (await context.client()).previewImport(projectId, body);
+  const lines = [
+    `${preview.total} items from ${preview.source}.`,
+    preview.idempotent ? "" : "This source has no stable ids, so re-importing an edited row creates a second item.",
+    "",
+    "States:",
+    ...preview.states.map((state) => `  ${state.name} → ${state.suggestedStateId ?? "no match; will use the default state"}`),
+    "",
+    "Labels:",
+    ...preview.labels.map((label) => `  ${label.name}${label.exists ? "" : "  (will create)"}`),
+    "",
+    "Assignees:",
+    ...preview.assignees.map((assignee) => `  ${assignee.value}${assignee.matched ? "" : "  (no matching member)"}`)
+  ];
+  if (preview.unmappedPriorities.length > 0) {
+    lines.push("", `Unrecognised priorities: ${preview.unmappedPriorities.join(", ")}`);
+  }
+  if (preview.skipped.length > 0) {
+    lines.push("", "Skipped:");
+    for (const skip of preview.skipped)
+      lines.push(`  row ${skip.row}: ${skip.reason}`);
+  }
+  return { data: preview, text: lines.filter((line, index) => line !== "" || index > 0).join(`
+`) };
+};
+var runImportHandler = async (context) => {
+  const projectId = await context.projectId(str3(context.args.projectId));
+  const body = await importBody(context);
   const stateMap = {};
-  for (const pair of toList(flags.map)) {
-    const at = pair.indexOf("=");
+  const pairs = context.flags.map ?? [];
+  for (const pair of pairs.flatMap((value) => value.split(","))) {
+    const trimmed = pair.trim();
+    if (trimmed === "")
+      continue;
+    const at = trimmed.indexOf("=");
     if (at < 0)
-      return fail(`--map takes "SourceState=<stateId>", got "${pair}".`);
-    stateMap[pair.slice(0, at)] = pair.slice(at + 1);
+      throw new UsageError(`--map takes "SourceState=<stateId>", got "${trimmed}".`);
+    stateMap[trimmed.slice(0, at)] = trimmed.slice(at + 1);
   }
   if (Object.keys(stateMap).length > 0)
     body.stateMap = stateMap;
-  const { runId } = await context.client.startImport(target, body);
-  return ok(`Queued as ${runId}. Follow it with: ycadence import status ${runId}`);
+  const { runId } = await (await context.client()).startImport(projectId, body, context.mutationOptions());
+  return {
+    data: { runId },
+    text: `Queued as ${runId}. Follow it with: ycadence import status ${runId}`,
+    ids: [runId]
+  };
+};
+var importStatusHandler = async (context) => {
+  const run = await (await context.client()).getImport(str3(context.args.runId));
+  return { data: run, text: formatRun(run) };
+};
+var listImportsHandler = async (context) => {
+  const projectId = await context.projectId(str3(context.args.projectId));
+  const { runs } = await (await context.client()).listImports(projectId);
+  return {
+    data: runs,
+    text: runs.length === 0 ? "No imports." : runs.map((run) => formatRun(run)).join(`
+
+`),
+    empty: "No imports."
+  };
+};
+
+// src/handlers/intake.ts
+function str4(value) {
+  return typeof value === "string" ? value : undefined;
 }
-function formatRun(run2) {
-  const lines = [
-    `${run2.id}  [${run2.status}]  ${run2.source}`,
-    `  ${run2.cursor}/${run2.totalItems} committed — ${run2.createdCount} created, ${run2.updatedCount} updated`
-  ];
-  if (run2.error !== null)
-    lines.push(`  error: ${run2.error}`);
-  for (const miss of run2.unmatched.slice(0, 20)) {
-    lines.push(`  unmatched ${miss.kind} "${miss.value}" on ${miss.item}`);
+var TRIAGE_DECISIONS = ["accepted", "declined", "snoozed", "duplicate"];
+var listIntakeHandler = async (context) => {
+  const projectId = await context.projectId();
+  const { items } = await (await context.client()).listIntake(projectId, {
+    ...context.flags["include-decided"] === true ? { includeDecided: true } : {}
+  });
+  return {
+    data: items,
+    columns: ["id", "status", "source", "submittedAt"],
+    empty: "The triage queue is empty."
+  };
+};
+var submitIntakeHandler = async (context) => {
+  const projectId = await context.projectId();
+  const title = str4(context.flags.title);
+  const file = str4(context.flags["description-file"]);
+  const description = file === undefined ? str4(context.flags.description) : file === "-" ? await context.readStdin() : await context.readFile(file);
+  const email = str4(context.flags.email);
+  const result = await (await context.client()).submitIntake(projectId, {
+    title,
+    source: "api",
+    ...description === undefined ? {} : { description },
+    ...email === undefined ? {} : { sourceEmail: email }
+  }, context.mutationOptions());
+  return {
+    data: result,
+    text: `Submitted for triage as ${result.intakeItemId}.`,
+    ids: [result.intakeItemId]
+  };
+};
+var triageIntakeHandler = async (context) => {
+  const client = await context.client();
+  const intakeItemId = str4(context.args.intakeItem);
+  if (!isUuid(intakeItemId))
+    throw new UsageError(`"${intakeItemId}" is not an intake item id.`);
+  const decision = str4(context.flags.decision);
+  const body = { status: decision };
+  if (decision === "snoozed") {
+    const until = str4(context.flags.until);
+    if (until === undefined || Number.isNaN(Date.parse(until))) {
+      throw new UsageError("Snoozing needs --until <date>.");
+    }
+    body.snoozedUntil = until;
   }
-  if (run2.unmatched.length > 20) {
-    lines.push(`  …and ${run2.unmatched.length - 20} more`);
+  if (decision === "duplicate") {
+    const of = str4(context.flags["duplicate-of"]);
+    if (of === undefined)
+      throw new UsageError("Marking a duplicate needs --duplicate-of <work item>.");
+    body.duplicateOfId = await resolveWorkItemId(client, of, () => context.projectId());
   }
-  return lines.join(`
+  const result = await client.triageIntake(intakeItemId, body, context.mutationOptions());
+  return { data: { intakeItemId, ...result }, text: `Triage recorded: ${result.status}.` };
+};
+
+// src/handlers/project.ts
+function str5(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function legacyProject(context, command) {
+  const positional = str5(context.args.projectId);
+  if (positional !== undefined) {
+    context.notice(`"ycadence ${command} <projectId>" is deprecated; use "ycadence ${command} list --project <projectId>".`);
+  }
+  return positional;
+}
+var listStatesHandler = async (context) => {
+  const projectId = await context.projectId(legacyProject(context, "states"));
+  const states = await listStates(await context.client(), projectId);
+  return {
+    data: states,
+    columns: ["id", "name", "group"],
+    empty: "No states.",
+    text: states.length === 0 ? "No states." : states.map((state) => `${state.id}  ${state.name}  (${state.group})`).join(`
+`)
+  };
+};
+var listLabelsHandler = async (context) => {
+  const projectId = await context.projectId();
+  const { labels } = await (await context.client()).listLabels(projectId);
+  return { data: labels, columns: ["id", "name", "color"], empty: "No labels." };
+};
+var createLabelHandler = async (context) => {
+  const projectId = await context.projectId();
+  const name = str5(context.flags.name);
+  const label = await (await context.client()).createLabel(projectId, {
+    name,
+    color: str5(context.flags.color),
+    ...str5(context.flags.description) === undefined ? {} : { description: str5(context.flags.description) }
+  }, context.mutationOptions());
+  return { data: label, text: `Created label ${label.name} (${label.id}).`, ids: [label.id] };
+};
+var listTypesHandler = async (context) => {
+  const projectId = await context.projectId();
+  const { types: types2 } = await (await context.client()).listTypes(projectId);
+  return { data: types2, columns: ["id", "name", "level"], empty: "No work item types." };
+};
+var listCyclesHandler = async (context) => {
+  const projectId = await context.projectId(legacyProject(context, "cycles"));
+  const { cycles } = await (await context.client()).listCycles(projectId);
+  return {
+    data: cycles,
+    columns: ["id", "name", "status", "startDate", "endDate"],
+    empty: "No cycles.",
+    text: cycles.length === 0 ? "No cycles." : cycles.map((cycle) => `${cycle.id}  ${cycle.name}  [${cycle.status}]`).join(`
+`)
+  };
+};
+var showCycleHandler = async (context) => {
+  const cycleId = str5(context.args.cycle);
+  const progress = await (await context.client()).getCycleProgress(cycleId);
+  return { data: { id: cycleId, ...progress } };
+};
+var createCycleHandler = async (context) => {
+  const projectId = await context.projectId();
+  const cycle = await (await context.client()).createCycle(projectId, {
+    name: str5(context.flags.name),
+    ...str5(context.flags.description) === undefined ? {} : { description: str5(context.flags.description) },
+    ...str5(context.flags["start-date"]) === undefined ? {} : { startDate: str5(context.flags["start-date"]) },
+    ...str5(context.flags["end-date"]) === undefined ? {} : { endDate: str5(context.flags["end-date"]) }
+  }, context.mutationOptions());
+  return { data: cycle, text: `Created cycle ${cycle.name} (${cycle.id}).`, ids: [cycle.id] };
+};
+var addToCycleHandler = async (context) => {
+  const client = await context.client();
+  const cycleId = str5(context.args.cycle);
+  const values = context.args.workItems ?? [];
+  if (values.length > 200)
+    throw new UsageError("Add at most 200 work items at a time.");
+  const ids = [];
+  for (const value of values) {
+    ids.push(await resolveWorkItemId(client, value, () => context.projectId()));
+  }
+  const result = await client.addWorkItemsToCycle(cycleId, ids, context.mutationOptions());
+  return {
+    data: { cycleId, ...result },
+    text: `Added ${result.added} work item${result.added === 1 ? "" : "s"} to the cycle.`
+  };
+};
+var listViewsHandler = async (context) => {
+  const projectId = await context.projectId();
+  const { views } = await (await context.client()).listViews(projectId);
+  return { data: views, columns: ["id", "name", "access"], empty: "No views." };
+};
+var createViewHandler = async (context) => {
+  const projectId = await context.projectId();
+  const rawFilter = str5(context.flags.filter);
+  let where;
+  if (rawFilter !== undefined) {
+    try {
+      where = JSON.parse(rawFilter);
+    } catch {
+      throw new UsageError("--filter takes a JSON filter expression.");
+    }
+  }
+  const access = str5(context.flags.access);
+  const view = await (await context.client()).createView(projectId, {
+    name: str5(context.flags.name),
+    ...str5(context.flags.description) === undefined ? {} : { description: str5(context.flags.description) },
+    ...where === undefined ? {} : { where },
+    ...access === undefined ? {} : { access }
+  }, context.mutationOptions());
+  return { data: view, text: `Saved view ${view.name} (${view.id}).`, ids: [view.id] };
+};
+
+// src/handlers/work.ts
+var WORK_COLUMNS = ["key", "priority", "name"];
+var priorityFlag = {
+  name: "priority",
+  type: "string",
+  values: PRIORITIES,
+  placeholder: "<priority>",
+  description: `One of ${PRIORITIES.join(", ")}`
+};
+var WORK_FIELD_FLAGS = {
+  title: { name: "title", type: "string", placeholder: "<text>", description: "Title" },
+  description: {
+    name: "description",
+    type: "string",
+    placeholder: "<markdown>",
+    description: "Description"
+  },
+  descriptionFile: {
+    name: "description-file",
+    type: "string",
+    placeholder: "<path|->",
+    description: "Read the description from a file, or - for stdin"
+  },
+  priority: priorityFlag,
+  state: {
+    name: "state",
+    type: "string",
+    placeholder: "<name|id>",
+    description: "State, by name or id"
+  },
+  parent: {
+    name: "parent",
+    type: "string",
+    placeholder: "<id>",
+    description: "Parent work item id"
+  },
+  startDate: {
+    name: "start-date",
+    type: "string",
+    placeholder: "<YYYY-MM-DD>",
+    description: "Start date"
+  },
+  targetDate: {
+    name: "target-date",
+    type: "string",
+    placeholder: "<YYYY-MM-DD>",
+    description: "Target date"
+  }
+};
+function str6(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function list(value) {
+  return Array.isArray(value) ? value.map(String) : typeof value === "string" ? [value] : [];
+}
+function date(value, flag) {
+  const text = str6(value);
+  if (text === undefined)
+    return;
+  if (Number.isNaN(Date.parse(text)))
+    throw new UsageError(`--${flag} takes a date, got "${text}".`);
+  return text;
+}
+async function description(context) {
+  const inline = str6(context.flags.description);
+  const file = str6(context.flags["description-file"]);
+  if (inline !== undefined && file !== undefined) {
+    throw new UsageError("Pass --description or --description-file, not both.");
+  }
+  if (file === undefined)
+    return inline;
+  return file === "-" ? context.readStdin() : context.readFile(file);
+}
+function detailText(item) {
+  return [
+    `${item.key}  ${item.name}`,
+    `priority  ${item.priority}`,
+    `state     ${item.stateId ?? "—"}`,
+    "",
+    item.description ?? "(no description)"
+  ].join(`
 `);
 }
-function toList(value) {
-  if (value === undefined)
-    return [];
-  return value.split(",").map((part) => part.trim()).filter((part) => part !== "");
+async function workItemId(context, value) {
+  return resolveWorkItemId(await context.client(), value, () => context.projectId());
+}
+var listWork = async (context) => {
+  const client = await context.client();
+  const projectId = await context.projectId(str6(context.args.projectId));
+  const conditions = [];
+  const assignees = list(context.flags.assignee);
+  if (assignees.length > 0)
+    conditions.push({ field: "assignee", operator: "in", value: assignees });
+  const labels = list(context.flags.label);
+  if (labels.length > 0) {
+    const known = (await client.listLabels(projectId)).labels;
+    const ids = labels.map((value) => {
+      const label = known.find((candidate) => candidate.id === value) ?? known.find((candidate) => candidate.name.toLowerCase() === value.toLowerCase());
+      if (label === undefined) {
+        throw new CliError(`No label "${value}" in this project.`, "validation_failed", EXIT.validation);
+      }
+      return label.id;
+    });
+    conditions.push({ field: "label", operator: "in", value: ids });
+  }
+  const rawFilter = str6(context.flags.filter);
+  if (rawFilter !== undefined) {
+    try {
+      conditions.push(JSON.parse(rawFilter));
+    } catch {
+      throw new UsageError("--filter takes a JSON filter expression.");
+    }
+  }
+  const stateValue = str6(context.flags.state);
+  const state = stateValue === undefined ? undefined : isUuid(stateValue) ? stateValue : findState(await listStates(client, projectId), stateValue).id;
+  const query = {
+    filter: conditions.length === 0 ? undefined : conditions.length === 1 ? conditions[0] : { all: conditions },
+    state,
+    priority: str6(context.flags.priority)
+  };
+  if (context.globals.all) {
+    const items = [];
+    for await (const item of paginate((cursor) => client.listWorkItems(projectId, { ...query, limit: context.globals.limit ?? 200, cursor }), { cursor: context.globals.cursor })) {
+      items.push(item);
+    }
+    return { data: items, nextCursor: null, columns: WORK_COLUMNS, empty: "No work items." };
+  }
+  const page = await client.listWorkItems(projectId, {
+    ...query,
+    limit: context.globals.limit ?? 50,
+    cursor: context.globals.cursor
+  });
+  return {
+    data: page.items,
+    nextCursor: page.nextCursor,
+    columns: WORK_COLUMNS,
+    empty: "No work items."
+  };
+};
+var getWork = async (context) => {
+  const id = await workItemId(context, str6(context.args.workItem));
+  const item = await (await context.client()).getWorkItem(id);
+  return { data: item, text: detailText(item) };
+};
+var createWork = async (context) => {
+  const title = str6(context.flags.title);
+  if (title === undefined || title.trim() === "") {
+    throw new UsageError("Pass --title with the work item title.");
+  }
+  const projectId = await context.projectId(str6(context.args.projectId));
+  const client = await context.client();
+  const body = { name: title };
+  const text = await description(context);
+  if (text !== undefined)
+    body.description = text;
+  const priority = str6(context.flags.priority);
+  if (priority !== undefined)
+    body.priority = priority;
+  const stateValue = str6(context.flags.state);
+  if (stateValue !== undefined) {
+    body.stateId = isUuid(stateValue) ? stateValue : findState(await listStates(client, projectId), stateValue).id;
+  }
+  const assignees = list(context.flags.assignee);
+  for (const assignee of assignees) {
+    if (!isUuid(assignee)) {
+      throw new UsageError(`--assignee takes a user id; "${assignee}" is not one.`);
+    }
+  }
+  if (assignees.length > 0)
+    body.assigneeIds = assignees;
+  const labels = list(context.flags.label);
+  if (labels.length > 0) {
+    const known = (await client.listLabels(projectId)).labels;
+    body.labelIds = labels.map((value) => {
+      const label = known.find((candidate) => candidate.id === value) ?? known.find((candidate) => candidate.name.toLowerCase() === value.toLowerCase());
+      if (label === undefined) {
+        throw new CliError(`No label "${value}" in this project.`, "validation_failed", EXIT.validation);
+      }
+      return label.id;
+    });
+  }
+  const parent = str6(context.flags.parent);
+  if (parent !== undefined)
+    body.parentId = await workItemId(context, parent);
+  const startDate = date(context.flags["start-date"], "start-date");
+  if (startDate !== undefined)
+    body.startDate = startDate;
+  const targetDate = date(context.flags["target-date"], "target-date");
+  if (targetDate !== undefined)
+    body.targetDate = targetDate;
+  const created = await client.createWorkItem(projectId, body, context.mutationOptions());
+  return { data: created, text: `${created.key}  ${created.name}`, ids: [created.key] };
+};
+var updateWork = async (context) => {
+  const client = await context.client();
+  const id = await workItemId(context, str6(context.args.workItem));
+  const body = {};
+  const title = str6(context.flags.title);
+  if (title !== undefined)
+    body.name = title;
+  const text = await description(context);
+  if (text !== undefined)
+    body.description = text;
+  const priority = str6(context.flags.priority);
+  if (priority !== undefined)
+    body.priority = priority;
+  const stateValue = str6(context.flags.state);
+  if (stateValue !== undefined) {
+    body.stateId = isUuid(stateValue) ? stateValue : findState(await listStates(client, await context.projectId()), stateValue).id;
+  }
+  if (context.flags["no-parent"] === true)
+    body.parentId = null;
+  const parent = str6(context.flags.parent);
+  if (parent !== undefined)
+    body.parentId = await workItemId(context, parent);
+  const startDate = date(context.flags["start-date"], "start-date");
+  if (startDate !== undefined)
+    body.startDate = startDate;
+  const targetDate = date(context.flags["target-date"], "target-date");
+  if (targetDate !== undefined)
+    body.targetDate = targetDate;
+  if (Object.keys(body).length === 0) {
+    throw new UsageError("Nothing to update. Pass at least one of --title, --description, --priority, --state, --parent, --start-date, --target-date.");
+  }
+  const version = context.flags["expect-version"];
+  const updated = await client.updateWorkItem(id, body, context.mutationOptions(version === undefined ? {} : { expectedVersion: version }));
+  return { data: updated, text: `Updated ${updated.key}.`, ids: [updated.key] };
+};
+async function moveTo(context, value, choose, verb) {
+  const client = await context.client();
+  const id = await workItemId(context, value);
+  const item = await client.getWorkItem(id);
+  const projectId = projectOf(item) ?? await context.projectId();
+  const target = choose(await listStates(client, projectId));
+  if (item.stateId === target.id) {
+    return {
+      data: { ...item, changed: false },
+      text: `${item.key} is already in ${target.name}.`,
+      ids: [item.key]
+    };
+  }
+  const updated = await client.updateWorkItem(id, { stateId: target.id }, context.mutationOptions(item.version === undefined ? {} : { expectedVersion: item.version }));
+  return {
+    data: { ...updated, changed: true },
+    text: verb === "close" ? `Closed ${updated.key}.` : `Moved ${updated.key} to ${target.name}.`,
+    ids: [updated.key]
+  };
 }
+var closeWork = (context) => moveTo(context, str6(context.args.workItem), closingState, "close");
+var transitionWork = (context) => {
+  const to = str6(context.flags.to);
+  if (to === undefined)
+    throw new UsageError("Pass --to with the state name or id.");
+  return moveTo(context, str6(context.args.workItem), (states) => findState(states, to), "transition");
+};
+var deleteWork = async (context) => {
+  const value = str6(context.args.workItem);
+  const id = await workItemId(context, value);
+  if (!await context.confirm(`Delete work item ${value}? This cannot be undone.`)) {
+    throw new CliError("Cancelled.", "cancelled", EXIT.failure);
+  }
+  await (await context.client()).deleteWorkItem(id, context.mutationOptions());
+  return { data: { id, deleted: true }, text: `Deleted ${value}.`, ids: [id] };
+};
 
-// src/bin.ts
-var url = readEnv("URL");
-var key = readEnv("API_KEY");
-var argv = process.argv.slice(2);
-var needsConfig = argv[0] !== undefined && argv[0] !== "help" && argv[0] !== "doctor";
-if (needsConfig && (url === undefined || key === undefined)) {
-  process.stderr.write(`Set YCADENCE_URL and YCADENCE_API_KEY first.
-
-${USAGE}
+// src/tree.ts
+var workItemArg = {
+  name: "workItem",
+  required: true,
+  description: "Work item id, or key such as DP-42 (a key needs --project)"
+};
+var importFlags = [
+  {
+    name: "source",
+    type: "string",
+    placeholder: "<csv|github|jira|linear>",
+    description: "What the file was exported from (default csv)"
+  },
+  { name: "file", type: "string", placeholder: "<path>", description: "The export to import" },
+  {
+    name: "repository",
+    type: "string",
+    placeholder: "<org/repo>",
+    description: "GitHub repository the export came from"
+  },
+  {
+    name: "base-url",
+    type: "string",
+    placeholder: "<url>",
+    description: "Jira site the export came from"
+  }
+];
+var legacyProjectArg = {
+  name: "projectId",
+  description: "Project id (the older positional form of --project)"
+};
+var LOGIN_FLAGS = [
+  { name: "url", type: "string", placeholder: "<url>", description: "The instance URL" },
+  { name: "api-key-stdin", type: "boolean", description: "Read the API key from stdin" },
+  { name: "device", type: "boolean", description: "Use the device flow (no local browser)" },
+  {
+    name: "no-browser",
+    type: "boolean",
+    description: "Print the sign-in URL instead of opening it"
+  },
+  {
+    name: "oauth-client-id",
+    type: "string",
+    placeholder: "<id>",
+    description: "Desktop OAuth client id (saved to the profile)"
+  },
+  {
+    name: "iap-audience",
+    type: "string",
+    placeholder: "<id>",
+    description: "IAP OAuth client id (saved to the profile)"
+  },
+  { name: "skip-oauth", type: "boolean", description: "Do not sign in for IAP" }
+];
+var help = async (context) => {
+  const words = context.args.command ?? [];
+  let node = context.root;
+  const path = [];
+  for (const word of words) {
+    const child = findChild(node, word);
+    if (child === undefined)
+      throw new UsageError(`Unknown command: ${words.join(" ")}.`);
+    node = child;
+    path.push(child.name);
+  }
+  return {
+    data: { help: renderHelp(context.root, path, node) },
+    text: renderHelp(context.root, path, node)
+  };
+};
+var completion = async (context) => {
+  const shell = context.args.shell;
+  const script = completionScript(context.root, shell);
+  return { data: { shell, script }, text: script.trimEnd() };
+};
+var version = async () => ({
+  data: { version: CLI_VERSION },
+  text: `ycadence ${CLI_VERSION}`
+});
+var TREE = {
+  name: "ycadence",
+  summary: "Project and work management from the command line",
+  children: [
+    {
+      name: "work",
+      summary: "Work items: list, read, create, update, close, move",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "List work items in a project",
+          flags: [
+            {
+              name: "state",
+              type: "string",
+              placeholder: "<name|id>",
+              description: "Only items in this state"
+            },
+            WORK_FIELD_FLAGS.priority,
+            {
+              name: "assignee",
+              type: "string",
+              multiple: true,
+              placeholder: "<user id>",
+              description: "Only items assigned to this user"
+            },
+            {
+              name: "label",
+              type: "string",
+              multiple: true,
+              placeholder: "<name|id>",
+              description: "Only items with this label"
+            },
+            {
+              name: "filter",
+              type: "string",
+              placeholder: "<json>",
+              description: "A filter expression in the query language, passed through"
+            }
+          ],
+          examples: [
+            "ycadence work list --project <projectId>",
+            'ycadence work list --state "In Progress" --priority high --format json',
+            "ycadence work list --all --quiet"
+          ],
+          run: listWork
+        },
+        {
+          name: "get",
+          aliases: ["show"],
+          summary: "Read one work item",
+          args: [workItemArg],
+          run: getWork
+        },
+        {
+          name: "create",
+          summary: "Create a work item",
+          mutates: true,
+          flags: [
+            { ...WORK_FIELD_FLAGS.title, required: true },
+            WORK_FIELD_FLAGS.description,
+            WORK_FIELD_FLAGS.descriptionFile,
+            WORK_FIELD_FLAGS.priority,
+            WORK_FIELD_FLAGS.state,
+            {
+              name: "assignee",
+              type: "string",
+              multiple: true,
+              placeholder: "<user id>",
+              description: "Assign a user, by id"
+            },
+            {
+              name: "label",
+              type: "string",
+              multiple: true,
+              placeholder: "<name|id>",
+              description: "Add a label, by name or id"
+            },
+            WORK_FIELD_FLAGS.parent,
+            WORK_FIELD_FLAGS.startDate,
+            WORK_FIELD_FLAGS.targetDate
+          ],
+          examples: [
+            'ycadence work create --project <projectId> --title "Fix login redirect" --priority high',
+            'ycadence work create --title "Spike" --description-file notes.md --idempotency-key spike-1'
+          ],
+          run: createWork
+        },
+        {
+          name: "update",
+          summary: "Change a work item",
+          mutates: true,
+          args: [workItemArg],
+          flags: [
+            WORK_FIELD_FLAGS.title,
+            WORK_FIELD_FLAGS.description,
+            WORK_FIELD_FLAGS.descriptionFile,
+            WORK_FIELD_FLAGS.priority,
+            WORK_FIELD_FLAGS.state,
+            WORK_FIELD_FLAGS.parent,
+            { name: "no-parent", type: "boolean", description: "Remove the parent" },
+            WORK_FIELD_FLAGS.startDate,
+            WORK_FIELD_FLAGS.targetDate,
+            {
+              name: "expect-version",
+              type: "number",
+              placeholder: "<n>",
+              description: "Fail if the item changed since this version (sent as If-Match)"
+            }
+          ],
+          run: updateWork
+        },
+        {
+          name: "close",
+          summary: "Move a work item to the project's first completed state",
+          description: "The project comes from the work item; --project is only needed against a server older than Slice 2A.",
+          mutates: true,
+          args: [workItemArg],
+          run: closeWork
+        },
+        {
+          name: "transition",
+          aliases: ["move"],
+          summary: "Move a work item to a state",
+          mutates: true,
+          args: [workItemArg],
+          flags: [
+            {
+              name: "to",
+              type: "string",
+              required: true,
+              placeholder: "<state name|id>",
+              description: "The state to move to"
+            }
+          ],
+          examples: ['ycadence work transition DP-42 --to "In Review" --project <projectId>'],
+          run: transitionWork
+        },
+        {
+          name: "delete",
+          summary: "Delete a work item",
+          mutates: true,
+          destructive: true,
+          args: [workItemArg],
+          run: deleteWork
+        }
+      ]
+    },
+    {
+      name: "states",
+      aliases: ["state"],
+      summary: "A project's workflow states",
+      args: [legacyProjectArg],
+      run: listStatesHandler,
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "List a project's states, in order",
+          run: listStatesHandler
+        }
+      ]
+    },
+    {
+      name: "labels",
+      aliases: ["label"],
+      summary: "A project's labels",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "List a project's labels",
+          run: listLabelsHandler
+        },
+        {
+          name: "create",
+          summary: "Create a label",
+          mutates: true,
+          flags: [
+            {
+              name: "name",
+              type: "string",
+              required: true,
+              placeholder: "<name>",
+              description: "Label name"
+            },
+            {
+              name: "color",
+              type: "string",
+              required: true,
+              placeholder: "<token|css colour>",
+              description: "A theme token or CSS colour"
+            },
+            {
+              name: "description",
+              type: "string",
+              placeholder: "<text>",
+              description: "Description"
+            }
+          ],
+          run: createLabelHandler
+        }
+      ]
+    },
+    {
+      name: "cycles",
+      aliases: ["cycle", "sprint"],
+      summary: "A project's cycles (sprints)",
+      args: [legacyProjectArg],
+      run: listCyclesHandler,
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "List a project's cycles",
+          run: listCyclesHandler
+        },
+        {
+          name: "show",
+          summary: "Progress and burndown for a cycle",
+          args: [{ name: "cycle", required: true, description: "Cycle id" }],
+          run: showCycleHandler
+        },
+        {
+          name: "create",
+          summary: "Create a cycle",
+          mutates: true,
+          flags: [
+            {
+              name: "name",
+              type: "string",
+              required: true,
+              placeholder: "<name>",
+              description: "Cycle name"
+            },
+            {
+              name: "description",
+              type: "string",
+              placeholder: "<text>",
+              description: "Description"
+            },
+            WORK_FIELD_FLAGS.startDate,
+            {
+              name: "end-date",
+              type: "string",
+              placeholder: "<YYYY-MM-DD>",
+              description: "End date"
+            }
+          ],
+          run: createCycleHandler
+        },
+        {
+          name: "add",
+          summary: "Add work items to a cycle, moving them out of any other",
+          mutates: true,
+          args: [
+            { name: "cycle", required: true, description: "Cycle id" },
+            {
+              name: "workItems",
+              required: true,
+              variadic: true,
+              description: "Work item ids or keys"
+            }
+          ],
+          run: addToCycleHandler
+        }
+      ]
+    },
+    {
+      name: "views",
+      aliases: ["view"],
+      summary: "Saved views",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "List the views you can see",
+          run: listViewsHandler
+        },
+        {
+          name: "create",
+          summary: "Save a view",
+          mutates: true,
+          flags: [
+            {
+              name: "name",
+              type: "string",
+              required: true,
+              placeholder: "<name>",
+              description: "View name"
+            },
+            {
+              name: "description",
+              type: "string",
+              placeholder: "<text>",
+              description: "Description"
+            },
+            {
+              name: "filter",
+              type: "string",
+              placeholder: "<json>",
+              description: "Filter expression"
+            },
+            {
+              name: "access",
+              type: "string",
+              values: ["private", "public"],
+              placeholder: "<private|public>",
+              description: "Who can see it (default private)"
+            }
+          ],
+          run: createViewHandler
+        }
+      ]
+    },
+    {
+      name: "types",
+      aliases: ["type"],
+      summary: "Work item types",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "Work item types and their properties",
+          run: listTypesHandler
+        }
+      ]
+    },
+    {
+      name: "intake",
+      summary: "The triage queue",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "Pending submissions, and snoozed ones that are due",
+          flags: [
+            {
+              name: "include-decided",
+              type: "boolean",
+              description: "Include decided submissions"
+            }
+          ],
+          run: listIntakeHandler
+        },
+        {
+          name: "submit",
+          summary: "Submit a request for triage",
+          mutates: true,
+          flags: [
+            { ...WORK_FIELD_FLAGS.title, required: true },
+            WORK_FIELD_FLAGS.description,
+            WORK_FIELD_FLAGS.descriptionFile,
+            {
+              name: "email",
+              type: "string",
+              placeholder: "<email>",
+              description: "Requester email"
+            }
+          ],
+          run: submitIntakeHandler
+        },
+        {
+          name: "triage",
+          summary: "Accept, decline, snooze or mark a submission as a duplicate",
+          mutates: true,
+          args: [{ name: "intakeItem", required: true, description: "Intake item id" }],
+          flags: [
+            {
+              name: "decision",
+              type: "string",
+              required: true,
+              values: TRIAGE_DECISIONS,
+              placeholder: "<decision>",
+              description: `One of ${TRIAGE_DECISIONS.join(", ")}`
+            },
+            {
+              name: "until",
+              type: "string",
+              placeholder: "<date>",
+              description: "Snooze until (with snoozed)"
+            },
+            {
+              name: "duplicate-of",
+              type: "string",
+              placeholder: "<work item>",
+              description: "The item it duplicates (with duplicate)"
+            }
+          ],
+          run: triageIntakeHandler
+        }
+      ]
+    },
+    {
+      name: "import",
+      summary: "Import from CSV, GitHub, Jira or Linear exports",
+      description: "`preview` and `run` are separate commands, so the safe one is the one you can type by accident.",
+      children: [
+        {
+          name: "preview",
+          summary: "Show what an import would do, without importing",
+          args: [legacyProjectArg],
+          flags: importFlags,
+          examples: ["ycadence import preview --project <projectId> --file issues.csv"],
+          run: previewImportHandler
+        },
+        {
+          name: "run",
+          summary: "Start an import",
+          mutates: true,
+          args: [legacyProjectArg],
+          flags: [
+            ...importFlags,
+            {
+              name: "map",
+              type: "string",
+              multiple: true,
+              placeholder: "<State=stateId>",
+              description: "Map a source state to a state id"
+            }
+          ],
+          run: runImportHandler
+        },
+        {
+          name: "status",
+          summary: "Where an import got to",
+          args: [{ name: "runId", required: true, description: "The run id `import run` printed" }],
+          run: importStatusHandler
+        },
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "A project's imports",
+          args: [legacyProjectArg],
+          run: listImportsHandler
+        }
+      ]
+    },
+    {
+      name: "login",
+      summary: "Save a profile, sign in for IAP, and store an API key",
+      description: "Signs in with Google (loopback, or --device) against the configured Desktop OAuth client for an IAP identity token, when one is configured. The API key is read from stdin and kept in the OS keychain.",
+      needsClient: false,
+      flags: LOGIN_FLAGS,
+      examples: [
+        "ycadence login --url https://ycadence.example.com --api-key-stdin < key.txt",
+        "ycadence login --profile yarlis --oauth-client-id <desktop client id> --iap-audience <iap client id>"
+      ],
+      run: loginHandler
+    },
+    {
+      name: "auth",
+      summary: "Credentials for the current profile",
+      children: [
+        {
+          name: "login",
+          summary: "Same as `ycadence login`",
+          needsClient: false,
+          flags: LOGIN_FLAGS,
+          run: loginHandler
+        },
+        {
+          name: "status",
+          summary: "Who the stored credential is",
+          run: statusHandler,
+          needsClient: false
+        },
+        {
+          name: "logout",
+          summary: "Remove the profile's stored credentials",
+          run: logoutHandler,
+          needsClient: false
+        },
+        {
+          name: "token",
+          summary: "Print a fresh IAP identity token, for other tools",
+          needsClient: false,
+          flags: [
+            {
+              name: "identity",
+              type: "boolean",
+              description: "The IAP identity token (the default)"
+            }
+          ],
+          run: tokenHandler
+        }
+      ]
+    },
+    {
+      name: "config",
+      summary: "Profiles and settings",
+      children: [
+        {
+          name: "list",
+          aliases: ["ls"],
+          summary: "Settings for the current profile, and where each comes from",
+          run: configListHandler,
+          needsClient: false
+        },
+        {
+          name: "get",
+          summary: "Read a setting",
+          args: [{ name: "key", required: true, description: "Setting name" }],
+          run: configGetHandler,
+          needsClient: false
+        },
+        {
+          name: "set",
+          summary: "Change a setting",
+          args: [
+            {
+              name: "key",
+              required: true,
+              description: "url, org, project, format, oauthClientId or iapAudience"
+            },
+            { name: "value", required: true, description: "The value" }
+          ],
+          run: configSetHandler,
+          needsClient: false
+        },
+        {
+          name: "unset",
+          summary: "Remove a setting",
+          args: [{ name: "key", required: true, description: "Setting name" }],
+          run: configUnsetHandler,
+          needsClient: false
+        },
+        {
+          name: "profiles",
+          summary: "List profiles",
+          run: configProfilesHandler,
+          needsClient: false
+        },
+        {
+          name: "use",
+          summary: "Switch the default profile",
+          args: [{ name: "profile", required: true, description: "Profile name" }],
+          run: configUseHandler,
+          needsClient: false
+        },
+        {
+          name: "path",
+          summary: "Where the config file is",
+          run: configPathHandler,
+          needsClient: false
+        }
+      ]
+    },
+    {
+      name: "doctor",
+      summary: "Check configuration, credentials and connectivity",
+      needsClient: false,
+      run: doctorHandler
+    },
+    {
+      name: "completion",
+      summary: "Print a shell completion script",
+      description: "For a short name, also add `alias yc=ycadence` to your shell.",
+      needsClient: false,
+      args: [{ name: "shell", required: true, description: `One of ${SHELLS.join(", ")}` }],
+      examples: [
+        "source <(ycadence completion bash)",
+        "source <(ycadence completion zsh)",
+        "ycadence completion fish > ~/.config/fish/completions/ycadence.fish"
+      ],
+      run: async (context) => {
+        if (!SHELLS.includes(context.args.shell)) {
+          throw new UsageError(`Shell is one of ${SHELLS.join(", ")}.`);
+        }
+        return completion(context);
+      }
+    },
+    {
+      name: "help",
+      summary: "Help for a command",
+      needsClient: false,
+      args: [{ name: "command", variadic: true, description: "The command, e.g. `work create`" }],
+      run: help
+    },
+    { name: "version", summary: "Print the version", needsClient: false, run: version },
+    {
+      name: "work-item",
+      summary: "Old spelling of `work`",
+      hidden: true,
+      deprecatedFor: "ycadence work",
+      children: [
+        {
+          name: "list",
+          summary: "Old spelling of `work list`",
+          deprecatedFor: "ycadence work list --project <projectId>",
+          args: [legacyProjectArg],
+          run: listWork
+        },
+        {
+          name: "create",
+          summary: "Old spelling of `work create`",
+          deprecatedFor: "ycadence work create --project <projectId> --title …",
+          mutates: true,
+          args: [legacyProjectArg],
+          flags: [WORK_FIELD_FLAGS.title, WORK_FIELD_FLAGS.description, WORK_FIELD_FLAGS.priority],
+          run: createWork
+        },
+        {
+          name: "show",
+          summary: "Old spelling of `work get`",
+          deprecatedFor: "ycadence work get <workItem>",
+          args: [workItemArg],
+          run: getWork
+        },
+        {
+          name: "close",
+          summary: "Old spelling of `work close`",
+          deprecatedFor: "ycadence work close <workItem>",
+          mutates: true,
+          args: [workItemArg],
+          run: closeWork
+        }
+      ]
+    }
+  ]
+};
+
+// src/runner.ts
+var IDENTIFIER = /^[A-Z][A-Z0-9_]{0,15}$/;
+function lazySecretStore(create) {
+  let store;
+  let pending;
+  const ready = async () => {
+    if (store !== undefined)
+      return store;
+    pending ??= create();
+    store = await pending;
+    return store;
+  };
+  return {
+    get kind() {
+      return store?.kind ?? "memory";
+    },
+    get description() {
+      return store?.description ?? "not yet opened";
+    },
+    get: async (account) => (await ready()).get(account),
+    set: async (account, value) => (await ready()).set(account, value),
+    delete: async (account) => (await ready()).delete(account)
+  };
+}
+function redactHeaders(headers) {
+  const result = {};
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    const lower = name.toLowerCase();
+    result[name] = lower === "x-api-key" || lower === "authorization" || lower === "cookie" ? "[redacted]" : value;
+  }
+  return result;
+}
+function dryRunFetch(inner) {
+  return async (input, init) => {
+    const method = (init?.method ?? "GET").toUpperCase();
+    if (method === "GET" || method === "HEAD")
+      return inner(input, init);
+    let body;
+    if (typeof init?.body === "string") {
+      try {
+        body = JSON.parse(init.body);
+      } catch {
+        body = init.body;
+      }
+    }
+    throw new RequestIntercepted({
+      method,
+      url: String(input),
+      headers: redactHeaders(init?.headers),
+      body
+    });
+  };
+}
+function errorCode(error) {
+  if (error instanceof YCadenceError)
+    return error.code;
+  if (error instanceof UsageError || error instanceof ConfigError || error instanceof CliError) {
+    return error.code;
+  }
+  return "error";
+}
+async function run(argv, context) {
+  const tree = context.tree ?? TREE;
+  const stdout = [];
+  const stderr = [];
+  let globals = {
+    format: "table",
+    quiet: false,
+    verbose: false
+  };
+  let requestId;
+  let path = [];
+  const finish = (exitCode) => {
+    const out = stdout.join(`
 `);
-  process.exit(1);
-}
-var result = await run(argv, {
-  client: new YCadenceClient({
-    baseUrl: url ?? "http://localhost:3000",
-    apiKey: key ?? "",
-    identityToken: readEnv("IDENTITY_TOKEN")
-  }),
+    const err = stderr.join(`
+`);
+    return { stdout: out, stderr: err, exitCode, output: exitCode === 0 ? out : err || out };
+  };
+  try {
+    if (argv.includes("--json") || argv.includes("--format=json"))
+      globals.format = "json";
+    const formatAt = argv.indexOf("--format");
+    if (formatAt !== -1 && argv[formatAt + 1] === "json")
+      globals.format = "json";
+    const parsed = parse(tree, argv);
+    path = parsed.path;
+    if (parsed.help || parsed.command.run === undefined) {
+      const text = renderHelp(tree, parsed.path, parsed.command);
+      if (parsed.help || parsed.path.length === 0) {
+        stdout.push(text);
+        return finish(EXIT.ok);
+      }
+      throw new UsageError(`"${commandName(parsed.path)}" needs a command.
+
+${text}`);
+    }
+    const directory = configDirectory(context.env);
+    const configStore = context.configStore ?? (directory === undefined ? memoryConfigStore() : fileConfigStore(directory));
+    const flagsForConfig = {
+      profile: parsed.flags.profile,
+      org: parsed.flags.org,
+      project: parsed.flags.project
+    };
+    let config = resolveConfig(await configStore.load(), context.env, flagsForConfig);
+    const options = globalOptions(parsed.flags, { format: config.format });
+    globals = options;
+    const secrets = context.secrets ?? (directory === undefined ? lazySecretStore(async () => detectSecretStore({ directory: undefined, env: { YCADENCE_CREDENTIAL_STORE: "file" } })) : lazySecretStore(() => detectSecretStore({ directory, env: context.env })));
+    const notice = (message) => {
+      if (options.quiet)
+        return;
+      if (context.notice === undefined)
+        stderr.push(message);
+      else
+        context.notice(message);
+    };
+    const debug = (message) => {
+      if (options.verbose)
+        stderr.push(message);
+    };
+    if (parsed.command.deprecatedFor !== undefined) {
+      notice(`"${commandName(parsed.path)}" is deprecated; use "${parsed.command.deprecatedFor}".`);
+    }
+    const isTTY = context.isTTY ?? false;
+    const fetchImpl = context.fetch ?? ((input, init) => globalThis.fetch(input, init));
+    const now = context.now ?? Date.now;
+    const sleep = context.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const onResponse = (info) => {
+      if (info.requestId !== undefined)
+        requestId = info.requestId;
+      debug(`→ ${info.method} ${info.path} ${info.status} ${info.durationMs}ms` + `${info.requestId === undefined ? "" : ` request-id=${info.requestId}`}` + `${info.attempt > 0 ? ` (retry ${info.attempt})` : ""}${info.replayed ? " (replayed)" : ""}`);
+    };
+    let client;
+    const getClient = async () => {
+      if (client !== undefined)
+        return client;
+      let base = context.client;
+      if (base === undefined) {
+        const apiKey = readEnv("API_KEY", context.env) ?? await secrets.get(secretAccount.apiKey(config.profile));
+        if (config.url === undefined || apiKey === undefined) {
+          throw new ConfigError("Set YCADENCE_URL and YCADENCE_API_KEY first, or run `ycadence login`.");
+        }
+        debug(`profile "${config.profile}", ${config.url}, key ${apiKey.slice(0, 12)}…`);
+        const envToken = readEnv("IDENTITY_TOKEN", context.env);
+        base = new YCadenceClient({
+          baseUrl: config.url,
+          apiKey,
+          identityToken: envToken ?? storedIdentityToken({ config, secrets, env: context.env, fetch: fetchImpl, now }),
+          fetch: fetchImpl,
+          sleep
+        });
+      }
+      const inner = base.fetchImplementation;
+      client = base.withOptions({
+        userAgent: `ycadence-cli/${CLI_VERSION}`,
+        onResponse,
+        fetch: options.dryRun ? dryRunFetch(inner) : inner,
+        ...options.retry === undefined ? {} : { retry: { retries: options.retry } }
+      });
+      return client;
+    };
+    const generatedKey = options.idempotencyKey === undefined && (options.retry ?? 0) > 0 && parsed.command.mutates === true ? randomUUID() : undefined;
+    if (generatedKey !== undefined)
+      debug(`Idempotency-Key ${generatedKey} (generated for --retry)`);
+    const handlerContext = {
+      root: tree,
+      path: parsed.path,
+      args: parsed.args,
+      flags: parsed.flags,
+      rest: parsed.rest,
+      globals: options,
+      env: context.env,
+      get config() {
+        return config;
+      },
+      configStore,
+      secrets,
+      isTTY,
+      async reloadConfig() {
+        config = resolveConfig(await configStore.load(), context.env, flagsForConfig);
+        client = undefined;
+      },
+      client: getClient,
+      async projectId(positional) {
+        const value = positional ?? options.project ?? config.project;
+        if (value === undefined || value === "") {
+          throw new ConfigError("This command needs a project: pass --project <id>, or set a default with `ycadence config set project <id>`.");
+        }
+        if (isUuid(value) || !IDENTIFIER.test(value))
+          return value;
+        return resolveProjectId(await getClient(), value);
+      },
+      mutationOptions(extra = {}) {
+        const key = options.idempotencyKey ?? generatedKey;
+        return {
+          ...extra,
+          ...key === undefined ? {} : { idempotencyKey: key },
+          ...options.retry === undefined ? {} : { retries: options.retry }
+        };
+      },
+      readFile: context.readFile,
+      readStdin: context.readStdin ?? (async () => {
+        throw new UsageError("Nothing to read on stdin.");
+      }),
+      async confirm(question) {
+        if (options.yes || options.dryRun)
+          return true;
+        if (!isTTY || context.confirm === undefined) {
+          throw new UsageError(`"${commandName(parsed.path)}" needs --yes when not run in a terminal.`);
+        }
+        return context.confirm(question);
+      },
+      notice,
+      debug,
+      fetch: fetchImpl,
+      openUrl: context.openUrl ?? (async () => false),
+      now,
+      sleep
+    };
+    try {
+      const output = await parsed.command.run(handlerContext);
+      const text = formatSuccess(output, options, requestId);
+      if (text !== "")
+        stdout.push(text);
+      return finish(output.exitCode ?? EXIT.ok);
+    } catch (error) {
+      if (error instanceof RequestIntercepted) {
+        stdout.push(formatDryRun(error.request, options));
+        return finish(EXIT.ok);
+      }
+      throw error;
+    }
+  } catch (error) {
+    const code = errorCode(error);
+    let message = formatError(error, code, globals, requestId);
+    if (error instanceof UsageError && globals.format === "table" && !message.includes("Usage:") && !message.includes(`
+
+`)) {
+      message += `
+Run \`${commandName(path)} --help\` for usage.`;
+    }
+    if (!(error instanceof YCadenceError || error instanceof UsageError || error instanceof ConfigError || error instanceof CliError)) {
+      if (globals.verbose && error instanceof Error && error.stack)
+        stderr.push(error.stack);
+    }
+    stderr.push(message);
+    return finish(exitCodeFor(error));
+  }
+}
+
+// src/bin.ts
+async function readStdin() {
+  if (process.stdin.isTTY)
+    return "";
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function confirm(question) {
+  const prompt = createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => {
+    prompt.question(`${question} [y/N] `, (answer) => {
+      prompt.close();
+      resolve(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+function openUrl(url) {
+  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  return new Promise((resolve) => {
+    try {
+      const child = spawn2(command, args, { stdio: "ignore", detached: true });
+      child.on("error", () => resolve(false));
+      child.on("spawn", () => {
+        child.unref();
+        resolve(true);
+      });
+    } catch {
+      resolve(false);
+    }
+  });
+}
+var result = await run(process.argv.slice(2), {
   env: process.env,
-  readFile: (path) => readFile(path, "utf8")
+  readFile: (path) => readFile3(path, "utf8"),
+  readStdin,
+  isTTY: process.stdin.isTTY === true && process.stderr.isTTY === true,
+  confirm,
+  openUrl,
+  notice: (message) => process.stderr.write(`${message}
+`)
 });
-var stream = result.exitCode === 0 ? process.stdout : process.stderr;
-stream.write(`${result.output}
+if (result.stdout !== "")
+  process.stdout.write(`${result.stdout}
+`);
+if (result.stderr !== "")
+  process.stderr.write(`${result.stderr}
 `);
-process.exit(result.exitCode);
+process.exitCode = result.exitCode;