@zanfia/cli 0.9.0 → 0.13.1

package/dist/index.js

@@ -33,9 +33,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// node_modules/commander/lib/error.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/error.js
 var require_error = __commonJS({
-  "node_modules/commander/lib/error.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/error.js"(exports) {
     "use strict";
     var CommanderError2 = class extends Error {
       /**
@@ -69,9 +69,9 @@ var require_error = __commonJS({
   }
 });
 
-// node_modules/commander/lib/argument.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/argument.js
 var require_argument = __commonJS({
-  "node_modules/commander/lib/argument.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/argument.js"(exports) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Argument2 = class {
@@ -197,9 +197,9 @@ var require_argument = __commonJS({
   }
 });
 
-// node_modules/commander/lib/help.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/help.js
 var require_help = __commonJS({
-  "node_modules/commander/lib/help.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/help.js"(exports) {
     "use strict";
     var { humanReadableArgName } = require_argument();
     var Help2 = class {
@@ -612,9 +612,9 @@ var require_help = __commonJS({
   }
 });
 
-// node_modules/commander/lib/option.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/option.js
 var require_option = __commonJS({
-  "node_modules/commander/lib/option.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/option.js"(exports) {
     "use strict";
     var { InvalidArgumentError: InvalidArgumentError2 } = require_error();
     var Option2 = class {
@@ -885,9 +885,9 @@ var require_option = __commonJS({
   }
 });
 
-// node_modules/commander/lib/suggestSimilar.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/suggestSimilar.js
 var require_suggestSimilar = __commonJS({
-  "node_modules/commander/lib/suggestSimilar.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/suggestSimilar.js"(exports) {
     "use strict";
     var maxDistance = 3;
     function editDistance(a, b) {
@@ -966,9 +966,9 @@ var require_suggestSimilar = __commonJS({
   }
 });
 
-// node_modules/commander/lib/command.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/lib/command.js
 var require_command = __commonJS({
-  "node_modules/commander/lib/command.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/lib/command.js"(exports) {
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
@@ -3010,9 +3010,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
   }
 });
 
-// node_modules/commander/index.js
+// ../../../Zanfia2/apps/cli/node_modules/commander/index.js
 var require_commander = __commonJS({
-  "node_modules/commander/index.js"(exports) {
+  "../../../Zanfia2/apps/cli/node_modules/commander/index.js"(exports) {
     "use strict";
     var { Argument: Argument2 } = require_argument();
     var { Command: Command4 } = require_command();
@@ -3033,9 +3033,9 @@ var require_commander = __commonJS({
   }
 });
 
-// ../../node_modules/requires-port/index.js
+// ../../../Zanfia2/node_modules/requires-port/index.js
 var require_requires_port = __commonJS({
-  "../../node_modules/requires-port/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/requires-port/index.js"(exports, module) {
     "use strict";
     module.exports = function required(port, protocol) {
       protocol = protocol.split(":")[0];
@@ -3060,9 +3060,9 @@ var require_requires_port = __commonJS({
   }
 });
 
-// ../../node_modules/querystringify/index.js
+// ../../../Zanfia2/node_modules/querystringify/index.js
 var require_querystringify = __commonJS({
-  "../../node_modules/querystringify/index.js"(exports) {
+  "../../../Zanfia2/node_modules/querystringify/index.js"(exports) {
     "use strict";
     var has = Object.prototype.hasOwnProperty;
     var undef;
@@ -3112,9 +3112,9 @@ var require_querystringify = __commonJS({
   }
 });
 
-// ../../node_modules/url-parse/index.js
+// ../../../Zanfia2/node_modules/url-parse/index.js
 var require_url_parse = __commonJS({
-  "../../node_modules/url-parse/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/url-parse/index.js"(exports, module) {
     "use strict";
     var required = require_requires_port();
     var qs = require_querystringify();
@@ -3420,9 +3420,9 @@ var require_url_parse = __commonJS({
   }
 });
 
-// ../../node_modules/is-stream/index.js
+// ../../../Zanfia2/node_modules/is-stream/index.js
 var require_is_stream = __commonJS({
-  "../../node_modules/is-stream/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/is-stream/index.js"(exports, module) {
     "use strict";
     var isStream2 = (stream) => stream !== null && typeof stream === "object" && typeof stream.pipe === "function";
     isStream2.writable = (stream) => isStream2(stream) && stream.writable !== false && typeof stream._write === "function" && typeof stream._writableState === "object";
@@ -3433,9 +3433,9 @@ var require_is_stream = __commonJS({
   }
 });
 
-// ../../node_modules/lodash.throttle/index.js
+// ../../../Zanfia2/node_modules/lodash.throttle/index.js
 var require_lodash = __commonJS({
-  "../../node_modules/lodash.throttle/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash.throttle/index.js"(exports, module) {
     "use strict";
     var FUNC_ERROR_TEXT = "Expected a function";
     var NAN = 0 / 0;
@@ -3582,9 +3582,9 @@ var require_lodash = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/bin/factories.js
+// ../../../Zanfia2/node_modules/custom-error-instance/bin/factories.js
 var require_factories = __commonJS({
-  "../../node_modules/custom-error-instance/bin/factories.js"(exports) {
+  "../../../Zanfia2/node_modules/custom-error-instance/bin/factories.js"(exports) {
     "use strict";
     exports.expectReceive = function(properties, configuration, factory) {
       var message;
@@ -3655,9 +3655,9 @@ var require_factories = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/bin/error.js
+// ../../../Zanfia2/node_modules/custom-error-instance/bin/error.js
 var require_error2 = __commonJS({
-  "../../node_modules/custom-error-instance/bin/error.js"(exports, module) {
+  "../../../Zanfia2/node_modules/custom-error-instance/bin/error.js"(exports, module) {
     "use strict";
     module.exports = CustomError;
     CustomError.factory = require_factories();
@@ -3766,17 +3766,17 @@ var require_error2 = __commonJS({
   }
 });
 
-// ../../node_modules/custom-error-instance/index.js
+// ../../../Zanfia2/node_modules/custom-error-instance/index.js
 var require_custom_error_instance = __commonJS({
-  "../../node_modules/custom-error-instance/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/custom-error-instance/index.js"(exports, module) {
     "use strict";
     module.exports = require_error2();
   }
 });
 
-// ../../node_modules/lodash._basetostring/index.js
+// ../../../Zanfia2/node_modules/lodash._basetostring/index.js
 var require_lodash2 = __commonJS({
-  "../../node_modules/lodash._basetostring/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._basetostring/index.js"(exports, module) {
     "use strict";
     var INFINITY = 1 / 0;
     var symbolTag = "[object Symbol]";
@@ -3819,9 +3819,9 @@ var require_lodash2 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._stringtopath/index.js
+// ../../../Zanfia2/node_modules/lodash._stringtopath/index.js
 var require_lodash3 = __commonJS({
-  "../../node_modules/lodash._stringtopath/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._stringtopath/index.js"(exports, module) {
     "use strict";
     var baseToString = require_lodash2();
     var FUNC_ERROR_TEXT = "Expected a function";
@@ -4064,9 +4064,9 @@ var require_lodash3 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._baseiteratee/index.js
+// ../../../Zanfia2/node_modules/lodash._baseiteratee/index.js
 var require_lodash4 = __commonJS({
-  "../../node_modules/lodash._baseiteratee/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._baseiteratee/index.js"(exports, module) {
     "use strict";
     var stringToPath = require_lodash3();
     var LARGE_ARRAY_SIZE = 200;
@@ -4835,9 +4835,9 @@ var require_lodash4 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._createset/index.js
+// ../../../Zanfia2/node_modules/lodash._createset/index.js
 var require_lodash5 = __commonJS({
-  "../../node_modules/lodash._createset/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._createset/index.js"(exports, module) {
     "use strict";
     var INFINITY = 1 / 0;
     var funcTag = "[object Function]";
@@ -4924,9 +4924,9 @@ var require_lodash5 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._root/index.js
+// ../../../Zanfia2/node_modules/lodash._root/index.js
 var require_lodash6 = __commonJS({
-  "../../node_modules/lodash._root/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._root/index.js"(exports, module) {
     "use strict";
     var objectTypes = {
       "function": true,
@@ -4946,9 +4946,9 @@ var require_lodash6 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash._baseuniq/index.js
+// ../../../Zanfia2/node_modules/lodash._baseuniq/index.js
 var require_lodash7 = __commonJS({
-  "../../node_modules/lodash._baseuniq/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/lodash._baseuniq/index.js"(exports, module) {
     "use strict";
     var createSet = require_lodash5();
     var root = require_lodash6();
@@ -5249,9 +5249,9 @@ var require_lodash7 = __commonJS({
   }
 });
 
-// ../../node_modules/lodash.uniqby/index.js
+// ../../../Zanfia2/node_modules/combine-errors/node_modules/lodash.uniqby/index.js
 var require_lodash8 = __commonJS({
-  "../../node_modules/lodash.uniqby/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/combine-errors/node_modules/lodash.uniqby/index.js"(exports, module) {
     "use strict";
     var baseIteratee = require_lodash4();
     var baseUniq = require_lodash7();
@@ -5262,9 +5262,9 @@ var require_lodash8 = __commonJS({
   }
 });
 
-// ../../node_modules/combine-errors/index.js
+// ../../../Zanfia2/node_modules/combine-errors/index.js
 var require_combine_errors = __commonJS({
-  "../../node_modules/combine-errors/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/combine-errors/index.js"(exports, module) {
     "use strict";
     var Custom = require_custom_error_instance();
     var uniq = require_lodash8();
@@ -5298,9 +5298,9 @@ var require_combine_errors = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/polyfills.js
+// ../../../Zanfia2/node_modules/graceful-fs/polyfills.js
 var require_polyfills = __commonJS({
-  "../../node_modules/graceful-fs/polyfills.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/polyfills.js"(exports, module) {
     "use strict";
     var constants = __require("constants");
     var origCwd = process.cwd;
@@ -5587,9 +5587,9 @@ var require_polyfills = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/legacy-streams.js
+// ../../../Zanfia2/node_modules/graceful-fs/legacy-streams.js
 var require_legacy_streams = __commonJS({
-  "../../node_modules/graceful-fs/legacy-streams.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     "use strict";
     var Stream = __require("stream").Stream;
     module.exports = legacy;
@@ -5684,9 +5684,9 @@ var require_legacy_streams = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/clone.js
+// ../../../Zanfia2/node_modules/graceful-fs/clone.js
 var require_clone = __commonJS({
-  "../../node_modules/graceful-fs/clone.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/clone.js"(exports, module) {
     "use strict";
     module.exports = clone;
     var getPrototypeOf = Object.getPrototypeOf || function(obj) {
@@ -5707,9 +5707,9 @@ var require_clone = __commonJS({
   }
 });
 
-// ../../node_modules/graceful-fs/graceful-fs.js
+// ../../../Zanfia2/node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
-  "../../node_modules/graceful-fs/graceful-fs.js"(exports, module) {
+  "../../../Zanfia2/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
     "use strict";
     var fs2 = __require("fs");
     var polyfills = require_polyfills();
@@ -6078,9 +6078,9 @@ var require_graceful_fs = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js
 var require_retry_operation = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry_operation.js"(exports, module) {
     "use strict";
     function RetryOperation(timeouts, options) {
       if (typeof options === "boolean") {
@@ -6210,9 +6210,9 @@ var require_retry_operation = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry.js
 var require_retry = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/lib/retry.js"(exports) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/lib/retry.js"(exports) {
     "use strict";
     var RetryOperation = require_retry_operation();
     exports.operation = function(options) {
@@ -6297,17 +6297,17 @@ var require_retry = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/retry/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/index.js
 var require_retry2 = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/retry/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/retry/index.js"(exports, module) {
     "use strict";
     module.exports = require_retry();
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/signal-exit/signals.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/signals.js
 var require_signals = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/signal-exit/signals.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/signals.js"(exports, module) {
     "use strict";
     module.exports = [
       "SIGABRT",
@@ -6343,9 +6343,9 @@ var require_signals = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/node_modules/signal-exit/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/index.js
 var require_signal_exit = __commonJS({
-  "../../node_modules/proper-lockfile/node_modules/signal-exit/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/node_modules/signal-exit/index.js"(exports, module) {
     "use strict";
     var process2 = global.process;
     var processOk = function(process3) {
@@ -6503,9 +6503,9 @@ var require_signal_exit = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/mtime-precision.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/mtime-precision.js
 var require_mtime_precision = __commonJS({
-  "../../node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = /* @__PURE__ */ Symbol();
     function probe(file, fs2, callback) {
@@ -6545,9 +6545,9 @@ var require_mtime_precision = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/lockfile.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/lockfile.js
 var require_lockfile = __commonJS({
-  "../../node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
     var path2 = __require("path");
     var fs2 = require_graceful_fs();
@@ -6782,9 +6782,9 @@ var require_lockfile = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/lib/adapter.js
+// ../../../Zanfia2/node_modules/proper-lockfile/lib/adapter.js
 var require_adapter = __commonJS({
-  "../../node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
     var fs2 = require_graceful_fs();
     function createSyncFs(fs3) {
@@ -6847,9 +6847,9 @@ var require_adapter = __commonJS({
   }
 });
 
-// ../../node_modules/proper-lockfile/index.js
+// ../../../Zanfia2/node_modules/proper-lockfile/index.js
 var require_proper_lockfile = __commonJS({
-  "../../node_modules/proper-lockfile/index.js"(exports, module) {
+  "../../../Zanfia2/node_modules/proper-lockfile/index.js"(exports, module) {
     "use strict";
     var lockfile2 = require_lockfile();
     var { toPromise, toSync, toSyncOptions } = require_adapter();
@@ -6883,7 +6883,7 @@ var require_proper_lockfile = __commonJS({
   }
 });
 
-// node_modules/commander/esm.mjs
+// ../../../Zanfia2/apps/cli/node_modules/commander/esm.mjs
 var import_index = __toESM(require_commander(), 1);
 var {
   program,
@@ -7047,6 +7047,18 @@ function resolveApiKey(explicit) {
   const stored = readCredentials();
   return stored?.apiKey ?? null;
 }
+var MEMBER_WRITE_SCOPE = "communities:write";
+var FULL_MEMBER_SCOPES = ["communities:read", "communities:write"];
+function memberKeyScopes(claims) {
+  return claims.scopes ?? [...FULL_MEMBER_SCOPES];
+}
+function isReadOnlyMemberKey(claims) {
+  return !memberKeyScopes(claims).includes(MEMBER_WRITE_SCOPE);
+}
+function memberScopeLabel(claims) {
+  const scopes = memberKeyScopes(claims).join(", ");
+  return isReadOnlyMemberKey(claims) ? `${scopes} (read-only)` : scopes;
+}
 function decodeTokenClaims(token) {
   if (!token) return { kind: "workspace" };
   const parts = token.split(".");
@@ -7057,7 +7069,8 @@ function decodeTokenClaims(token) {
       kind: p.kind === "member" ? "member" : "workspace",
       workspaceId: typeof p.wsp === "string" ? p.wsp : void 0,
       subject: typeof p.sub === "string" ? p.sub : void 0,
-      expiresAt: typeof p.exp === "number" ? new Date(p.exp * 1e3).toISOString() : void 0
+      expiresAt: typeof p.exp === "number" ? new Date(p.exp * 1e3).toISOString() : void 0,
+      scopes: typeof p.scope === "string" ? p.scope.split(" ").filter(Boolean) : void 0
     };
   } catch {
     return { kind: "workspace" };
@@ -7380,7 +7393,8 @@ var mockBackend = {
       status: "draft",
       isFree: false,
       createdAt: now(),
-      clientCount: 0
+      clientCount: 0,
+      language: input.language ?? null
     };
     products.push(product);
     return toSummary(product);
@@ -7390,6 +7404,7 @@ var mockBackend = {
     if (!product) return null;
     if (input.name !== void 0) product.name = input.name;
     if (input.description !== void 0) product.description = input.description;
+    if (input.language !== void 0) product.language = input.language;
     return { productId: id };
   },
   archiveProduct(id) {
@@ -7897,6 +7912,9 @@ function createMockClient() {
     async listClientTags() {
       return { count: 0, tags: [] };
     },
+    async listClientCustomFields() {
+      return { count: 0, fields: [] };
+    },
     async createClientTag() {
       throw new ApiError(501, "client tag writes are not available in mock mode");
     },
@@ -8119,6 +8137,7 @@ function createMockClient() {
           przelewy24: false,
           paypal: false,
           dodo: false,
+          tubapay: false,
           manual: null
         },
         sms: { defaultProvider: null, twilio: null, smsapi: null }
@@ -9248,6 +9267,7 @@ function createHttpClient(config) {
     ),
     changeClientEmail: (id, newEmail) => request("POST", `/clients/${encodeURIComponent(id)}/change-email`, { newEmail }),
     listClientTags: () => request("GET", "/clients/tags"),
+    listClientCustomFields: (includeArchived) => request("GET", `/clients/custom-fields${includeArchived ? "?includeArchived=true" : ""}`),
     createClientTag: (input) => request("POST", "/clients/tags", input),
     updateClientTag: (tagId, input) => request("PATCH", `/clients/tags/${encodeURIComponent(tagId)}`, input),
     deleteClientTag: (tagId) => request("DELETE", `/clients/tags/${encodeURIComponent(tagId)}`),
@@ -10157,6 +10177,27 @@ function parseStorefrontVisibility(value) {
   }
   return visibility;
 }
+var PRODUCT_LANGUAGES = ["pl", "en"];
+var PRODUCT_LANGUAGE_NONE = "none";
+function parseProductLanguage(value) {
+  const language = PRODUCT_LANGUAGES.find((candidate) => candidate === value.trim().toLowerCase());
+  if (language === void 0) {
+    throw new Error(
+      `Invalid --language: ${value} (expected one of: ${PRODUCT_LANGUAGES.join(", ")})`
+    );
+  }
+  return language;
+}
+function parseProductLanguageOrNone(value) {
+  if (value.trim().toLowerCase() === PRODUCT_LANGUAGE_NONE) return PRODUCT_LANGUAGE_NONE;
+  const language = PRODUCT_LANGUAGES.find((candidate) => candidate === value.trim().toLowerCase());
+  if (language === void 0) {
+    throw new Error(
+      `Invalid --language: ${value} (expected one of: ${PRODUCT_LANGUAGES.join(", ")}, ${PRODUCT_LANGUAGE_NONE})`
+    );
+  }
+  return language;
+}
 function parseCommaList(flag) {
   return (value) => {
     const items = [
@@ -10327,18 +10368,19 @@ function registerCertificatesCommands(program2) {
     "Course-completion and event-participation certificates \u2014 issue for course or event clients, revoke/reinstate, resend the email, and manage designer templates (`certificates templates \u2026`)"
   );
   certificates.command("list").summary("List certificates").description(
-    "Issued certificates of the workspace (course completion and event participation), newest first, optionally filtered to one product (`productId`); `limit` caps the rows (service default applies). Each row is the credential: public `certificateId` (`cert_\u2026`, the id every certificate write takes), `productType` (`course` / `event`), recipient name/email, product (`courseName`) and issuer names, completion/issued dates, `issuedBy` (manual vs automatic), template id/version, PDF and verification URLs, `status` (active/revoked), `expiresAt` and delivery/engagement signals (email status, views, downloads, LinkedIn add). Also the polling endpoint after issue-certificates \u2014 a newly enqueued client shows up here once its PDF has been rendered."
+    "Issued certificates of the workspace (course completion and event participation), newest first, optionally filtered to one product (`productId`); `limit` caps the rows per page (service default applies) and `nextCursor` (pass it back as `cursor`) continues the list. Each row is the credential: public `certificateId` (`cert_\u2026`, the id every certificate write takes), `productType` (`course` / `event`), recipient name/email, product (`courseName`) and issuer names, completion/issued dates, `issuedBy` (manual vs automatic), template id/version, PDF and verification URLs, `status` (active/revoked), `expiresAt` and delivery/engagement signals (email status, views, downloads, LinkedIn add). Also the polling endpoint after issue-certificates \u2014 a newly enqueued client shows up here once its PDF has been rendered."
   ).option("--product <value>", "Course or event product id \u2014 omit for all products.").option(
     "--limit <n>",
-    "Max rows, newest first (max 500; the service default applies when omitted).",
+    "Max rows per page, newest first (max 500; the service default applies when omitted).",
     parseNumberOption("--limit", NumberFormat.Integer)
-  ).action(async (options, command) => {
+  ).option("--cursor <value>", "`nextCursor` of the previous page; omit for the first page.").action(async (options, command) => {
     const flags = getGlobalFlags(command);
     const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
     const params = {};
     const payload = {
       productId: options.product,
-      limit: options.limit
+      limit: options.limit,
+      cursor: options.cursor
     };
     const result = await client.call("GET", "/certificates", params, payload, void 0);
     const rows = tableRowsOf(result, "certificates");
@@ -10566,6 +10608,84 @@ function registerCertificatesCommands(program2) {
     );
     emit(flags, result ?? {}, () => printJson(result ?? {}));
   });
+  const certificatesSettings = certificates.command("settings");
+  certificatesSettings.description(
+    "A course's or event's certificate settings (auto-issue, layout, numbering, date, claim)"
+  );
+  certificatesSettings.command("get").summary("A product's certificate settings").description(
+    'Certificate settings of one course or event product \u2014 the same fields as the dashboard\'s product Settings \u2192 Certificate section: `certificateEnabled` (automatic certificate on course completion; courses only, always false for an event), `certificateTemplateId` (null = the workspace default template), `certificateCustomText` (the extra line printed by templates with the "custom text" element), `certificateValidityMonths` (null = never expires), numbering (`certificateCode`), the printed date (`certificateDateMode` + `certificateTrainingDate`) and claim mode (`certificateClaimEnabled` + `certificateClaimAvailableFrom`). 404 for an unknown product, 400 for a product type without certificates.'
+  ).argument("<productId>", "Course or event product id (other product types answer 400).").action(async (productId, _options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      productId
+    };
+    const result = await client.call(
+      "GET",
+      "/products/:productId/certificate-settings",
+      params,
+      void 0,
+      void 0
+    );
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  certificatesSettings.command("update").summary("Update a product's certificate settings").description(
+    "Partial update of one course or event product's certificate settings \u2014 what the dashboard's product Settings \u2192 Certificate section saves: automatic certificate on course completion (`certificateEnabled`, courses only), layout (`certificateTemplateId`), the extra line (`certificateCustomText`, max 300 characters / 3 lines), validity, numbering (`certificateCode`), the printed date (`certificateDateMode` + `certificateTrainingDate`) and claim mode (`certificateClaimEnabled` + `certificateClaimAvailableFrom`). Absent fields stay unchanged, null clears; an empty body is a 400. The whole patch is checked before anything is saved (409 taken code, 404 unknown product or template, 400 invalid value). Only certificates issued from now on use the new settings. Answers the settings as saved."
+  ).argument("<productId>", "Course or event product id (other product types answer 400).").option(
+    "--auto-issue",
+    "Automatic certificate on course completion. Course products only (400 on an event)."
+  ).option("--no-auto-issue", "Send `certificateEnabled: false` explicitly.").option(
+    "--template <value>",
+    "Certificate template id from list-certificate-templates (404 when not in this workspace); null or blank = back to the workspace default."
+  ).option(
+    "--custom-text <value>",
+    'Extra line printed by templates with the "custom text" element, e.g. training hours. Max 300 characters and 3 lines (line breaks kept); null or blank clears it.'
+  ).option(
+    "--validity-months <n>",
+    "Validity in months from issuance; null = never expires.",
+    parseNumberOption("--validity-months", NumberFormat.Integer)
+  ).option(
+    "--code <value>",
+    "Exactly 3 digits (`017`), unique in the workspace (409 when another product has it); numbers certificates `{seq}/{code}/{schoolYear}`. null or blank = unnumbered."
+  ).addOption(
+    new Option(
+      "--date-mode <completion|training_date|issue_date>",
+      "Printed date: `completion` (course progress, else the issue date), `training_date` (needs certificateTrainingDate) or `issue_date`. null = completion."
+    ).choices(["completion", "training_date", "issue_date"])
+  ).option(
+    "--training-date <value>",
+    "`YYYY-MM-DD`, printed in the `training_date` mode; null or blank clears."
+  ).option("--claim", "Participants claim the certificate themselves in the portal (claim mode).").option("--no-claim", "Send `certificateClaimEnabled: false` explicitly.").option(
+    "--claim-from <value>",
+    "First claim day `YYYY-MM-DD`; null or blank = the day after the training date (else at once)."
+  ).action(
+    async (productId, options, command) => {
+      const flags = getGlobalFlags(command);
+      const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+      const params = {
+        productId
+      };
+      const payload = {
+        certificateEnabled: options.autoIssue,
+        certificateTemplateId: options.template,
+        certificateCustomText: options.customText,
+        certificateValidityMonths: options.validityMonths,
+        certificateCode: options.code,
+        certificateDateMode: options.dateMode,
+        certificateTrainingDate: options.trainingDate,
+        certificateClaimEnabled: options.claim,
+        certificateClaimAvailableFrom: options.claimFrom
+      };
+      const result = await client.call(
+        "PATCH",
+        "/products/:productId/certificate-settings",
+        params,
+        void 0,
+        payload
+      );
+      emit(flags, result ?? {}, () => printJson(result ?? {}));
+    }
+  );
 }
 
 // src/commands/_generated/blog.ts
@@ -10699,10 +10819,270 @@ function registerBlogCommands(program2) {
   });
 }
 
+// src/commands/_generated/site-redirects.ts
+var listSiteRedirectsColumns = ["from", "to", "kind"];
+function registerSiteRedirectsCommands(program2) {
+  const siteRedirects = program2.command("site-redirects");
+  siteRedirects.description(
+    "The site's 301 redirect map (Your site \u2192 Redirects): old addresses and where they go; checked by the same rules as the dashboard"
+  );
+  siteRedirects.command("list").summary("List site redirects").description(
+    "The site's 301 redirect map (dashboard: Your site \u2192 Redirects): old addresses of a site moved to Zanfia and where they go now, in map order, plus `max` (the cap). A line fires only when nothing on the site answers the address. `kind` = `exact` (one address) or `folder` (`/news/*`, every address under it). The `from` of a line is its id for update-site-redirect and delete-site-redirect."
+  ).action(async (_options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const result = await client.call("GET", "/site/redirects", params, void 0, void 0);
+    const rows = tableRowsOf(result, "redirects");
+    emit(flags, result ?? {}, () => printTable(rows, listSiteRedirectsColumns));
+  });
+  siteRedirects.command("create").summary("Add a site redirect").description(
+    "Adds one line at the end of the site's 301 map; live at once. Refused (400 `site-redirects-refused`, `issues[]` = index, from, to, issue) exactly like the dashboard save: a malformed address (`invalid-from` / `invalid-to`), the home page or an address Zanfia owns (`/blog`, `/p/\u2026`, `/app`: `reserved-from`), the member area (`portal-from`), a published page (`page-exists`), a `from` the map already has (`duplicate`), a chain or a loop (`chain`), `/*` in `to` without a folder `from` (`rest-without-folder`), over 500 lines (`too-many-entries`). Returns the line as stored."
+  ).argument(
+    "<from>",
+    "The old address on the site: a path (`/o-nas`), a full address on the site (`https://example.com/o-nas/`, stored as its path) or a folder ending with `/*` (`/news/*`, every address under it). Query string and `#\u2026` are dropped; case is kept."
+  ).argument(
+    "<to>",
+    "Where it goes: a path on the site (`/o-mnie`; a folder line may end with `/*` to keep the rest of the old address: `/news/*` \u2192 `/blog/*`) or an absolute `https://` address."
+  ).action(async (from, to, _options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const payload = {
+      from,
+      to
+    };
+    const result = await client.call("POST", "/site/redirects", params, void 0, payload);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  siteRedirects.command("update").summary("Change a site redirect").description(
+    "Changes one line of the 301 map, picked by its current `from`: `newFrom`, `to` or both; a field not given keeps its value and the line keeps its place. Live at once. 404 `site-redirect-not-found` when no line has that `from`; refused like create-site-redirect (400 `site-redirects-refused` with `issues[]`). Returns the line as stored."
+  ).argument(
+    "<from>",
+    "The line to change, by its current `from` (as list-site-redirects shows it; `/o-nas/` or a full address on the site also match)."
+  ).option(
+    "--new-from <value>",
+    "The old address on the site: a path (`/o-nas`), a full address on the site (`https://example.com/o-nas/`, stored as its path) or a folder ending with `/*` (`/news/*`, every address under it). Query string and `#\u2026` are dropped; case is kept."
+  ).option(
+    "--to <value>",
+    "Where it goes: a path on the site (`/o-mnie`; a folder line may end with `/*` to keep the rest of the old address: `/news/*` \u2192 `/blog/*`) or an absolute `https://` address."
+  ).action(async (from, options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const payload = {
+      from,
+      newFrom: options.newFrom,
+      to: options.to
+    };
+    const result = await client.call("PATCH", "/site/redirects", params, void 0, payload);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  siteRedirects.command("delete").summary("Remove a site redirect").description(
+    "Removes one line of the 301 map, picked by its `from` (sent in the JSON body). The old address answers 404 again at once (links to it in search results and old posts break). 404 `site-redirect-not-found` when no line has that `from`. Returns the removed line."
+  ).argument(
+    "<from>",
+    "The line to change, by its current `from` (as list-site-redirects shows it; `/o-nas/` or a full address on the site also match)."
+  ).option(
+    "--confirm",
+    "required \u2014 acknowledge that you want to the old address answers 404 again"
+  ).action(async (from, options, command) => {
+    const flags = getGlobalFlags(command);
+    requireConfirm(options.confirm, "the old address answers 404 again");
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const payload = {
+      from
+    };
+    const result = await client.call("DELETE", "/site/redirects", params, void 0, payload);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+}
+
+// src/commands/_generated/popups.ts
+var listPopupsColumns = ["id", "name", "status", "priority", "updatedAt"];
+function registerPopupsCommands(program2) {
+  const popups = program2.command("popups");
+  popups.description(
+    "Pop-ups on the workspace site (Your site \u2192 Pop-ups): a signup form shown on entry or after scrolling, after the cookie decision, never again after a signup"
+  );
+  popups.command("list").summary("List pop-ups").description(
+    "Every pop-up of the workspace site (drafts, active, paused) in priority order: copy, form content, triggers per device, targeting, frequency and schedule. The id source for every other pop-up tool."
+  ).action(async (_options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const result = await client.call("GET", "/popups", params, void 0, void 0);
+    const rows = tableRowsOf(result, "popups");
+    emit(flags, result ?? {}, () => printTable(rows, listPopupsColumns));
+  });
+  popups.command("create").summary("Create a pop-up").description(
+    "Creates a pop-up as a DRAFT holding a signup form. Without `content.formId` a new standalone signup form named after the pop-up is created (visible in Forms). Defaults: desktop after 10 s on the page, phones after 40 % scroll as a bottom sheet, again after 7 days, all hosted pages except thank-you / download / member pages, hidden for subscribers. Activate it with set-popup-status once it has a title and a button text. Requires the pop-ups feature on the plan (403 otherwise)."
+  ).requiredOption(
+    "--name <value>",
+    "Internal name (panel only); also the name of a provisioned form."
+  ).option(
+    "--priority <n>",
+    "Lower shows first when several pop-ups match a page; default = after the others.",
+    parseNumberOption("--priority", NumberFormat.Integer)
+  ).addOption(
+    new Option(
+      "--language <pl|en|default>",
+      "Built-in labels (close, errors): `pl`, `en` or `default` (= the page language)."
+    ).choices(["pl", "en", "default"])
+  ).option(
+    "--copy <json|file>",
+    "Headline, text, button and image.",
+    parseJsonObjectFileOrInline("--copy")
+  ).option(
+    "--content <json|file>",
+    "What the pop-up holds: a signup form.",
+    parseJsonObjectFileOrInline("--content")
+  ).option("--design <json|file>", "design", parseJsonObjectFileOrInline("--design")).option(
+    "--trigger <json|file>",
+    "When it opens, per device.",
+    parseJsonObjectFileOrInline("--trigger")
+  ).option(
+    "--targeting <json|file>",
+    "Where and for whom.",
+    parseJsonObjectFileOrInline("--targeting")
+  ).option(
+    "--frequency <json|file>",
+    "How often one visitor sees it; never again after a signup. Default every 7 days.",
+    parseJsonObjectFileOrInline("--frequency")
+  ).option(
+    "--schedule <json|file>",
+    "From / to (applied within a few minutes).",
+    parseJsonObjectFileOrInline("--schedule")
+  ).action(async (options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {};
+    const payload = {
+      name: options.name,
+      priority: options.priority,
+      language: options.language,
+      copy: options.copy,
+      content: options.content,
+      design: options.design,
+      trigger: options.trigger,
+      targeting: options.targeting,
+      frequency: options.frequency,
+      schedule: options.schedule
+    };
+    const result = await client.call("POST", "/popups", params, void 0, payload);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  popups.command("get").summary("Pop-up detail").description(
+    "One pop-up in full: status, copy, form content, triggers, targeting, frequency, schedule."
+  ).argument("<id>", "Pop-up id (`popup_\u2026`) from list-popups.").action(async (id, _options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      popupId: id
+    };
+    const result = await client.call("GET", "/popups/:popupId", params, void 0, void 0);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  popups.command("update").summary("Update a pop-up").description(
+    "Partial update of a pop-up: each section sent merges into the current one (copy, content, design, targeting, schedule field by field; a trigger rule, the page list and the frequency are replaced whole). An active pop-up must keep its title, button and form (400 popup-incomplete). Live sites pick changes up within a few minutes."
+  ).argument("<id>", "Pop-up id (`popup_\u2026`) from list-popups.").option("--name <value>", "Internal name (panel only).").option(
+    "--priority <n>",
+    "Lower shows first when several pop-ups match a page; default = after the others.",
+    parseNumberOption("--priority", NumberFormat.Integer)
+  ).addOption(
+    new Option(
+      "--language <pl|en|default>",
+      "Built-in labels (close, errors): `pl`, `en` or `default` (= the page language)."
+    ).choices(["pl", "en", "default"])
+  ).option(
+    "--copy <json|file>",
+    "Headline, text, button and image.",
+    parseJsonObjectFileOrInline("--copy")
+  ).option(
+    "--content <json|file>",
+    "What the pop-up holds: a signup form.",
+    parseJsonObjectFileOrInline("--content")
+  ).option("--design <json|file>", "design", parseJsonObjectFileOrInline("--design")).option(
+    "--trigger <json|file>",
+    "When it opens, per device.",
+    parseJsonObjectFileOrInline("--trigger")
+  ).option(
+    "--targeting <json|file>",
+    "Where and for whom.",
+    parseJsonObjectFileOrInline("--targeting")
+  ).option(
+    "--frequency <json|file>",
+    "How often one visitor sees it; never again after a signup. Default every 7 days.",
+    parseJsonObjectFileOrInline("--frequency")
+  ).option(
+    "--schedule <json|file>",
+    "From / to (applied within a few minutes).",
+    parseJsonObjectFileOrInline("--schedule")
+  ).action(async (id, options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      popupId: id
+    };
+    const payload = {
+      name: options.name,
+      priority: options.priority,
+      language: options.language,
+      copy: options.copy,
+      content: options.content,
+      design: options.design,
+      trigger: options.trigger,
+      targeting: options.targeting,
+      frequency: options.frequency,
+      schedule: options.schedule
+    };
+    const result = await client.call("PATCH", "/popups/:popupId", params, void 0, payload);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  popups.command("status").summary("Activate or pause a pop-up").description(
+    "Activates or pauses a pop-up. Activation needs a title, a button text and an existing signup form (400 popup-incomplete / 404 form-not-found), the pop-ups feature on the plan (403) and a free slot: at most 20 active pop-ups (409 too-many-active-popups). Visitors see it after their cookie decision, by its trigger, once per page view."
+  ).argument("<id>", "Pop-up id (`popup_\u2026`) from list-popups.").argument(
+    "<status>",
+    "`active` shows it on the site (within a few minutes), `paused` takes it off."
+  ).action(async (id, status, _options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      popupId: id
+    };
+    const payload = {
+      status
+    };
+    const result = await client.call(
+      "POST",
+      "/popups/:popupId/status",
+      params,
+      void 0,
+      payload
+    );
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+  popups.command("delete").summary("Delete a pop-up").description(
+    "Deletes a pop-up for good; an active one leaves the site within a few minutes. Its form and the signups stay. No undo - prefer pausing."
+  ).argument("<id>", "Pop-up id (`popup_\u2026`) from list-popups.").option("--confirm", "required \u2014 acknowledge that you want to deletes the pop-up for good").action(async (id, options, command) => {
+    const flags = getGlobalFlags(command);
+    requireConfirm(options.confirm, "deletes the pop-up for good");
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const params = {
+      popupId: id
+    };
+    const result = await client.call("DELETE", "/popups/:popupId", params, void 0, void 0);
+    emit(flags, result ?? {}, () => printJson(result ?? {}));
+  });
+}
+
 // src/commands/_generated/index.ts
 function registerGeneratedCommands(program2) {
   registerCertificatesCommands(program2);
   registerBlogCommands(program2);
+  registerSiteRedirectsCommands(program2);
+  registerPopupsCommands(program2);
 }
 
 // src/commands/ads/index.ts
@@ -11326,7 +11706,8 @@ async function runWhoami(command) {
       workspaceName: stored?.workspaceName ?? null,
       userEmail: stored?.userEmail ?? null,
       uid: claims.subject ?? null,
-      scopes: ["communities:read", "communities:write"],
+      scopes: memberKeyScopes(claims),
+      readOnly: isReadOnlyMemberKey(claims),
       communityApiUrl: resolveCommunityApiUrl()
     };
     emit(flags, info2, () => {
@@ -11340,7 +11721,7 @@ async function runWhoami(command) {
 `);
       else if (info2.uid) process.stdout.write(`User id: ${info2.uid}
 `);
-      process.stdout.write(`Scopes: ${info2.scopes.join(", ")}
+      process.stdout.write(`Scopes: ${memberScopeLabel(claims)}
 `);
       process.stdout.write(`Community API: ${info2.communityApiUrl ?? "<unresolved>"}
 `);
@@ -11396,10 +11777,15 @@ function registerAuthCommands(program2) {
       process.stdout.write(`  status: no credentials file found
 `);
     } else {
+      const storedClaims = decodeTokenClaims(stored.apiKey);
       process.stdout.write(`  source: ${stored.source ?? "manual"}
 `);
-      process.stdout.write(`  kind  : ${stored.kind ?? decodeTokenKind(stored.apiKey)}
+      process.stdout.write(`  kind  : ${stored.kind ?? storedClaims.kind}
 `);
+      if (storedClaims.kind === "member") {
+        process.stdout.write(`  scope : ${memberScopeLabel(storedClaims)}
+`);
+      }
       process.stdout.write(`  saved : ${stored.savedAt}
 `);
       if (stored.userEmail) {
@@ -11437,6 +11823,8 @@ Resolved by next call:
     process.stdout.write(`  kind  : ${kind}
 `);
     if (kind === "member") {
+      process.stdout.write(`  scope : ${memberScopeLabel(decodeTokenClaims(apiKey))}
+`);
       process.stdout.write(
         `  community API: ${resolveCommunityApiUrl() ?? "<unresolved \u2014 set --api-url>"}
 `
@@ -11452,7 +11840,8 @@ Resolved by next call:
     "--api-url <url>",
     "API URL to associate with this key (for member keys, the api-community URL)"
   ).action((key, options) => {
-    const kind = decodeTokenKind(key);
+    const claims = decodeTokenClaims(key);
+    const { kind } = claims;
     const path2 = writeCredentials({
       apiKey: key,
       apiUrl: options.apiUrl,
@@ -11460,7 +11849,8 @@ Resolved by next call:
       source: "manual",
       kind
     });
-    process.stdout.write(`Saved ${kind === "member" ? "member " : ""}API key to ${path2}
+    const label = kind === "member" ? isReadOnlyMemberKey(claims) ? "read-only member " : "member " : "";
+    process.stdout.write(`Saved ${label}API key to ${path2}
 `);
     if (kind === "member" && !options.apiUrl) {
       process.stdout.write(
@@ -11765,6 +12155,17 @@ async function runBrowserAuth(options, entryUrl) {
     server.close();
   }
 }
+function buildMemberConsentParams(input) {
+  return {
+    redirect_uri: input.redirectUri,
+    state: input.state,
+    code_challenge: input.challenge,
+    code_challenge_method: "S256",
+    hostname: input.hostname,
+    client: "zanfia-cli",
+    ...input.readOnly ? { read_only: "1" } : null
+  };
+}
 function resolveMemberExchangeUrl() {
   const explicit = process.env.ZANFIA_MEMBER_EXCHANGE_URL ?? backendDefaults.memberExchangeUrl;
   if (explicit) return explicit;
@@ -11809,14 +12210,16 @@ async function runMemberLogin(options) {
   const host = safeHostname();
   const server = await startLoopbackServer();
   const redirectUri = `http://127.0.0.1:${server.port}${CALLBACK_PATH}`;
-  const url = buildConsentUrl(consentUrl, {
-    redirect_uri: redirectUri,
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    hostname: host,
-    client: "zanfia-cli"
-  });
+  const url = buildConsentUrl(
+    consentUrl,
+    buildMemberConsentParams({
+      redirectUri,
+      state,
+      challenge,
+      hostname: host,
+      readOnly: options.readOnly
+    })
+  );
   process.stdout.write(`Opening ${url}
 `);
   process.stdout.write("Waiting for browser callback...\n\n");
@@ -11842,6 +12245,8 @@ async function runMemberLogin(options) {
       workspaceName: exchanged.workspaceName
     });
     process.stdout.write(`Logged in as ${exchanged.userEmail} (community member).
+`);
+    process.stdout.write(`Access: ${memberScopeLabel(decodeTokenClaims(exchanged.token))}
 `);
     process.stdout.write(`Workspace: ${exchanged.workspaceName} (${exchanged.workspaceId})
 `);
@@ -11873,6 +12278,9 @@ function registerLoginCommand(auth) {
   ).option(
     "--address <url>",
     "sign in as a community member (Community API) against this creator platform URL"
+  ).option(
+    "--read-only",
+    "member login only: the key can read the communities but never post, comment or chat"
   ).option("-v, --verbose", "show HTTP request details").addHelpText(
     "after",
     `
@@ -11888,24 +12296,33 @@ The two flows use different consent pages:
     command uses another stored login just for that command.
 
   Community member login \u2014 Community API only:
-      login --address https://<creator-platform-url>
+      login --address https://<creator-platform-url> [--read-only]
     Opens the consent page on that creator's platform (where you log in as
     their customer). The CLI gets a member token scoped to that workspace's
     communities; the community URL is passed as the platform address, and
-    which community to act in is chosen per command.
+    which community to act in is chosen per command. --read-only gets a key
+    that can read and summarize but never post, comment or chat (the right
+    choice for an agent that only reads); \`auth status\` shows the scope.
 
     No browser? Generate a key on the creator's platform under
-    Settings -> Developer and paste the shown "auth set-key" command instead.
+    Settings -> AI agents and paste the shown "auth set-key"
+    command instead.
 `
   ).action(async (options) => {
     if (options.address) {
       await runMemberLogin({
         address: options.address,
         apiUrl: options.apiUrl,
-        verbose: options.verbose
+        verbose: options.verbose,
+        readOnly: options.readOnly
       });
       return;
     }
+    if (options.readOnly) {
+      throw new Error(
+        "--read-only applies to community member logins: add --address <creator-platform-url> (or use `zanfia join <handle> --read-only`)."
+      );
+    }
     await runLogin(options);
   });
 }
@@ -12816,10 +13233,10 @@ function registerCampaignsCommands(program2) {
     });
   });
   campaigns.command("test").description(
-    "Send a TEST of the saved campaign to up to 3 addresses (default: your own) \u2014 subject prefixed [Test], sample personalization values; never the audience"
+    "Send a TEST of the saved campaign to your team's addresses only (default: your own) \u2014 subject prefixed [Test], sample personalization values; never the audience"
   ).argument("<id>", "campaign id").option(
     "--to <email>",
-    "test recipient \u2014 repeatable or comma-separated, max 3 (default: your own address)",
+    "test recipient: a team member account e-mail (or a mail-tester.com inbox), repeatable or comma-separated, max 3 (default: your own address)",
     collectRepeatable,
     []
   ).action(async (id, options, command) => {
@@ -13305,7 +13722,8 @@ var CREDENTIAL_PAYMENT_GATEWAYS = [
   "przelewy24",
   "paynow",
   "paypal",
-  "dodo"
+  "dodo",
+  "tubapay"
 ];
 var COMMUNITY_EVENT_LOCATION_TYPES = [
   "online",
@@ -14176,6 +14594,33 @@ Next page: --cursor ${page.nextCursor}
         process.stdout.write(`  Previous emails: ${detail.previousEmails.join(", ")}
 `);
       }
+      const customFields = Object.entries(detail.customFields ?? {});
+      if (customFields.length > 0) {
+        process.stdout.write("  Custom fields:\n");
+        for (const [key, value] of customFields) {
+          process.stdout.write(`    ${key}: ${String(value)}
+`);
+        }
+      }
+    });
+  });
+  clients2.command("fields").description(
+    "List the custom contact fields (key, name, type, options); set values with `clients update --field key=value`"
+  ).option("--include-archived", "also list archived fields (their values are read-only)").action(async (options, command) => {
+    const flags = getGlobalFlags(command);
+    const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
+    const result = await client.listClientCustomFields(options.includeArchived === true);
+    emit(flags, result, () => {
+      printTable(
+        result.fields.map((field) => ({
+          key: field.key,
+          name: field.name,
+          type: field.type,
+          options: field.options.filter((option) => !option.archived).map((option) => `${option.key}=${option.label}`).join(", "),
+          archived: field.archived ? "yes" : ""
+        })),
+        ["key", "name", "type", "options", "archived"]
+      );
     });
   });
   registerClientTagsCommands(clients2);
@@ -14289,12 +14734,27 @@ Next page: --cursor ${page.nextCursor}
 `);
     });
   });
-  clients2.command("update").description("Update a client's profile (name, phone, language)").argument("<id>", "workspace client id (wcid)").option("--first-name <name>", "new first name").option("--last-name <name>", "new last name").option("--phone <number>", "new phone number").option("--language <code>", "new preferred language code (e.g. en, pl)").action(
+  clients2.command("update").description("Update a client's profile (name, phone, language) and custom field values").argument("<id>", "workspace client id (wcid)").option("--first-name <name>", "new first name").option("--last-name <name>", "new last name").option("--phone <number>", "new phone number").option("--language <code>", "new preferred language code (e.g. en, pl)").option(
+    "--field <key=value>",
+    "set a custom field value (repeatable; keys from `clients fields`, e.g. --field plan=premium)",
+    collectRepeatable2,
+    []
+  ).option("--clear-field <key>", "clear a custom field value (repeatable)", collectRepeatable2, []).action(
     async (id, options, command) => {
       const flags = getGlobalFlags(command);
-      if (options.firstName === void 0 && options.lastName === void 0 && options.phone === void 0 && options.language === void 0) {
+      const customFields = {};
+      for (const entry of options.field) {
+        const separator = entry.indexOf("=");
+        if (separator <= 0) {
+          throw new Error(`Invalid --field "${entry}": use key=value.`);
+        }
+        customFields[entry.slice(0, separator).trim()] = entry.slice(separator + 1);
+      }
+      for (const key of options.clearField) customFields[key.trim()] = null;
+      const hasCustomFields = Object.keys(customFields).length > 0;
+      if (options.firstName === void 0 && options.lastName === void 0 && options.phone === void 0 && options.language === void 0 && !hasCustomFields) {
         throw new Error(
-          "Nothing to update \u2014 pass at least one of --first-name, --last-name, --phone, --language."
+          "Nothing to update \u2014 pass at least one of --first-name, --last-name, --phone, --language, --field, --clear-field."
         );
       }
       const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
@@ -14302,7 +14762,8 @@ Next page: --cursor ${page.nextCursor}
         firstName: options.firstName,
         lastName: options.lastName,
         phoneNumber: options.phone,
-        language: options.language
+        language: options.language,
+        ...hasCustomFields ? { customFields } : {}
       });
       emit(flags, result, () => {
         process.stdout.write(`Updated client ${result.clientId}.
@@ -18670,7 +19131,7 @@ function printOverview(overview) {
   const p = overview.payments;
   const on = (value) => value ? "on" : "off";
   process.stdout.write(
-    `Payments: stripe=${on(p.stripe)} payU=${on(p.payU)} tpay=${on(p.tpay)} payNow=${on(p.payNow)} przelewy24=${on(p.przelewy24)} paypal=${on(p.paypal)} dodo=${on(p.dodo)} manual=${p.manual ? `on (${p.manual.name})` : "off"}
+    `Payments: stripe=${on(p.stripe)} payU=${on(p.payU)} tpay=${on(p.tpay)} payNow=${on(p.payNow)} przelewy24=${on(p.przelewy24)} paypal=${on(p.paypal)} dodo=${on(p.dodo)} tubapay=${on(p.tubapay)} manual=${p.manual ? `on (${p.manual.name})` : "off"}
 `
   );
 }
@@ -18945,7 +19406,7 @@ function readSecret2(label, value, fromStdin, fromEnv) {
 function printPayments(payments) {
   const on = (value) => value ? "on" : "off";
   process.stdout.write(
-    `Payments: stripe=${on(payments.stripe)} payu=${on(payments.payU)} tpay=${on(payments.tpay)} paynow=${on(payments.payNow)} przelewy24=${on(payments.przelewy24)} paypal=${on(payments.paypal)} dodo=${on(payments.dodo)} manual=${payments.manual ? "on" : "off"}
+    `Payments: stripe=${on(payments.stripe)} payu=${on(payments.payU)} tpay=${on(payments.tpay)} paynow=${on(payments.payNow)} przelewy24=${on(payments.przelewy24)} paypal=${on(payments.paypal)} dodo=${on(payments.dodo)} tubapay=${on(payments.tubapay)} manual=${payments.manual ? "on" : "off"}
 `
   );
 }
@@ -19024,6 +19485,11 @@ function buildGatewayInput(gateway, o) {
     case "dodo":
       input.apiKey = secret(o.apiKey, "--api-key");
       break;
+    case "tubapay":
+      input.clientId = need(o.clientId, "--client-id");
+      input.clientSecret = secret(o.clientSecret, "--client-secret");
+      input.callbackSecret = secret(o.callbackSecret, "--callback-secret");
+      break;
   }
   return input;
 }
@@ -19064,11 +19530,11 @@ function registerIntegrationProviderCommands(integrations) {
     }
   );
   const payments = integrations.command("payments").description(
-    "Credential payment gateways: payu, tpay, przelewy24 (p24), paynow, paypal, dodo. Stripe connects in the dashboard (OAuth); the transfer method is `integrations manual-payment`."
+    "Credential payment gateways: payu, tpay, przelewy24 (p24), paynow, paypal, dodo, tubapay. Stripe connects in the dashboard (OAuth); the transfer method is `integrations manual-payment`."
   );
   payments.command("connect <gateway>").description(
     "Connect a gateway \u2014 credentials are verified with the gateway first. With --secrets-env every secret flag takes an environment variable NAME instead of the value."
-  ).requiredOption("--name <name>", "creator-facing label").option("--pos-id <id>", "payu / tpay / przelewy24").option("--client-id <id>", "payu / tpay / paypal").option("--client-secret <secret>", "payu / tpay / paypal").option("--second-key <key>", "payu: the second (MD5) key").option("--safety-key <key>", "tpay: the security key").option("--api-key <key>", "przelewy24 / paynow / dodo").option("--signature-key <key>", "paynow").option("--merchant-id <id>", "przelewy24").option("--crc-key <key>", "przelewy24").option("--secrets-env", "treat every secret flag value as an environment variable name").action(async (gatewayArg, options, command) => {
+  ).requiredOption("--name <name>", "creator-facing label").option("--pos-id <id>", "payu / tpay / przelewy24").option("--client-id <id>", "payu / tpay / paypal; tubapay: the Partner ID").option("--client-secret <secret>", "payu / tpay / paypal / tubapay").option("--second-key <key>", "payu: the second (MD5) key").option("--safety-key <key>", "tpay: the security key").option("--api-key <key>", "przelewy24 / paynow / dodo").option("--signature-key <key>", "paynow").option("--merchant-id <id>", "przelewy24").option("--crc-key <key>", "przelewy24").option("--callback-secret <key>", "tubapay: the key TubaPay signs its notifications with").option("--secrets-env", "treat every secret flag value as an environment variable name").action(async (gatewayArg, options, command) => {
     const flags = getGlobalFlags(command);
     const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
     const status = await client.connectPaymentGateway(
@@ -19562,7 +20028,13 @@ async function runJoin(handleInput, options) {
       completed = await postJson2(
         "Join",
         joinUrl(communityApiUrl, handle, "complete"),
-        { email, code, firstName, hostname: hostname3 },
+        {
+          email,
+          code,
+          firstName,
+          hostname: hostname3,
+          ...options.readOnly ? { readOnly: true } : {}
+        },
         { verbose }
       );
     } catch (err) {
@@ -19585,11 +20057,14 @@ async function runJoin(handleInput, options) {
     workspaceName: completed.workspaceName,
     kind: "member"
   });
+  const claims = decodeTokenClaims(completed.token);
+  const readOnly = isReadOnlyMemberKey(claims);
   if (options.json) {
     process.stdout.write(
       `${JSON.stringify(
         {
           joined: true,
+          readOnly,
           alreadyMember: completed.alreadyMember,
           communityId: completed.communityId,
           communityName: completed.communityName,
@@ -19607,12 +20082,13 @@ async function runJoin(handleInput, options) {
     );
     return;
   }
-  const intro = completed.introChannelId ? `  zanfia communities post create ${completed.communityId} ${completed.introChannelId} --content "Hi, I'm <your agent>. I ..."
+  const intro = completed.introChannelId && !readOnly ? `  zanfia communities post create ${completed.communityId} ${completed.introChannelId} --content "Hi, I'm <your agent>. I ..."
 ` : "";
   process.stdout.write(
     `
 ${completed.alreadyMember ? "Welcome back to" : "You are in:"} ${completed.communityName}.
 Member key saved to ${path2} (expires ${completed.expiresAt.slice(0, 10)}).
+Access: ${memberScopeLabel(claims)}
 
 Next:
   zanfia communities list
@@ -19625,17 +20101,20 @@ Plug in your agent: ${AGENT_DOCS_URL}
   );
 }
 function registerJoinCommand(program2) {
-  program2.command("join <handle>").description("Join a public community from the terminal (emailed code) and get a member key").option("--email <email>", "email to join with (prompted when omitted)").option("--name <name>", "your display name (prompted when omitted)").option("--code <code>", "the 6-digit code from the email (prompted when omitted)").addHelpText(
+  program2.command("join <handle>").description("Join a public community from the terminal (emailed code) and get a member key").option("--email <email>", "email to join with (prompted when omitted)").option("--name <name>", "your display name (prompted when omitted)").option("--code <code>", "the 6-digit code from the email (prompted when omitted)").option("--read-only", "get a key that can read and summarize but never post, comment or chat").addHelpText(
     "after",
     `
 Examples:
   zanfia join crew-of-one
   zanfia join crew-of-one --email me@example.com --name "Sam" --code 123456
+  zanfia join crew-of-one --read-only
 
 The key is a MEMBER key: it reaches the Community API for that creator's
-communities only (read/post/comment/chat), never your own workspace. It is
-saved to ~/.config/zanfia/credentials.json and expires in 90 days \u2014 run
-join again to refresh it.
+communities only (read/post/comment/chat), never your own workspace. With
+--read-only it can only read (the right choice for an agent that reads and
+summarizes); \`zanfia auth status\` shows the scope. It is saved to
+~/.config/zanfia/credentials.json and expires in 90 days \u2014 run join again
+to refresh it.
 `
   ).action(async (handle, options, command) => {
     const globals = getGlobalFlags(command);
@@ -19646,15 +20125,28 @@ join again to refresh it.
 // src/commands/liveRooms/index.ts
 var minutes = (seconds) => `${Math.round(seconds / 60)} min`;
 var percent = (part, whole) => whole > 0 ? `${Math.round(part / whole * 100)}%` : "-";
+var countOrDash = (value) => value === null || value === void 0 ? "-" : String(value);
 var WEEKDAYS = ["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"];
+function describeExclusions(schedule) {
+  const parts = [];
+  if (schedule.kind !== "daily" && schedule.nightWindow) {
+    parts.push(`none ${schedule.nightWindow.from}-${schedule.nightWindow.to}`);
+  }
+  if (schedule.blackoutDates && schedule.blackoutDates.length > 0) {
+    const days = schedule.blackoutDates.map((range) => range.from === range.to ? range.from : `${range.from}..${range.to}`).join(", ");
+    parts.push(`none on ${days}`);
+  }
+  return parts.length > 0 ? `; ${parts.join("; ")}` : "";
+}
 function describeSchedule(room) {
   if (!room.schedule) return "fixed";
   const until = room.schedule.until ? ` until ${room.schedule.until}` : "";
+  const exclusions = describeExclusions(room.schedule);
   if (room.schedule.kind === "daily") {
     const days = room.schedule.weekdays ? room.schedule.weekdays.map((day) => WEEKDAYS[day - 1] ?? String(day)).join(", ") : "daily";
-    return `${days} at ${room.schedule.times.join(", ")} (${room.timezone})${until}`;
+    return `${days} at ${room.schedule.times.join(", ")} (${room.timezone})${until}${exclusions}`;
   }
-  return `every ${room.schedule.everyMinutes} min${until}`;
+  return `every ${room.schedule.everyMinutes} min${until}${exclusions}`;
 }
 function registerLiveRoomsCommands(program2) {
   const liveRooms = program2.command("live-rooms").description(
@@ -19687,6 +20179,7 @@ function registerLiveRoomsCommands(program2) {
       printTable(
         result.sessions.map((session) => ({
           session: session.sessionStartAt,
+          registered: countOrDash(session.registered),
           attendees: session.attendees,
           identified: session.identified,
           avgWatched: `${minutes(session.averageWatchedSeconds)} (${percent(
@@ -19695,10 +20188,29 @@ function registerLiveRoomsCommands(program2) {
           )})`,
           toEnd: `${session.watchedToEnd} (${percent(session.watchedToEnd, session.attendees)})`,
           sawOffer: session.sawOffer,
-          clickedOffer: session.clickedOffer
+          clickedOffer: session.clickedOffer,
+          bought: countOrDash(session.purchased)
         })),
-        ["session", "attendees", "identified", "avgWatched", "toEnd", "sawOffer", "clickedOffer"]
+        [
+          "session",
+          "registered",
+          "attendees",
+          "identified",
+          "avgWatched",
+          "toEnd",
+          "sawOffer",
+          "clickedOffer",
+          "bought"
+        ]
       );
+      const totals = result.totals;
+      if (totals) {
+        process.stdout.write(
+          `
+Room total (${totals.sessions} started sessions): registered ${countOrDash(totals.registered)} \u2192 attended ${totals.attendees} \u2192 saw the offer ${totals.sawOffer} \u2192 clicked ${totals.clickedOffer} \u2192 bought ${countOrDash(totals.purchased)}${totals.capped ? " (at least: a read hit its cap)" : ""}
+`
+        );
+      }
       if (options.session !== void 0) {
         process.stdout.write(`
 Viewers of ${options.session}:
@@ -19729,7 +20241,7 @@ import { basename } from "path";
 import { createReadStream as createReadStream2 } from "fs";
 import { stat as stat2 } from "fs/promises";
 
-// ../../node_modules/tus-js-client/lib.esm/error.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/error.js
 function _typeof(o) {
   "@babel/helpers - typeof";
   return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -19883,14 +20395,14 @@ var DetailedError = /* @__PURE__ */ (function(_Error) {
 })(/* @__PURE__ */ _wrapNativeSuper(Error));
 var error_default = DetailedError;
 
-// ../../node_modules/tus-js-client/lib.esm/logger.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/logger.js
 var isEnabled = false;
 function log(msg) {
   if (!isEnabled) return;
   console.log(msg);
 }
 
-// ../../node_modules/tus-js-client/lib.esm/noopUrlStorage.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/noopUrlStorage.js
 function _typeof2(o) {
   "@babel/helpers - typeof";
   return _typeof2 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -19960,7 +20472,7 @@ var NoopUrlStorage = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/js-base64/base64.mjs
+// ../../../Zanfia2/node_modules/tus-js-client/node_modules/js-base64/base64.mjs
 var version = "3.7.8";
 var VERSION = version;
 var _hasBuffer = typeof Buffer === "function";
@@ -20122,10 +20634,10 @@ var gBase64 = {
   extendBuiltins
 };
 
-// ../../node_modules/tus-js-client/lib.esm/upload.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/upload.js
 var import_url_parse = __toESM(require_url_parse());
 
-// ../../node_modules/tus-js-client/lib.esm/uuid.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/uuid.js
 function uuid() {
   return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, function(c) {
     var r = Math.random() * 16 | 0;
@@ -20134,7 +20646,7 @@ function uuid() {
   });
 }
 
-// ../../node_modules/tus-js-client/lib.esm/upload.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/upload.js
 function _regeneratorRuntime() {
   "use strict";
   _regeneratorRuntime = function _regeneratorRuntime4() {
@@ -21369,11 +21881,11 @@ function splitSizeIntoParts(totalSize, partCount) {
 BaseUpload.defaultOptions = defaultOptions;
 var upload_default = BaseUpload;
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileReader.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileReader.js
 var import_is_stream = __toESM(require_is_stream());
 import { ReadStream } from "fs";
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/BufferSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/BufferSource.js
 function _typeof4(o) {
   "@babel/helpers - typeof";
   return _typeof4 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -21440,7 +21952,7 @@ var BufferSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/FileSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/FileSource.js
 import { createReadStream, promises as fsPromises } from "fs";
 function _typeof5(o) {
   "@babel/helpers - typeof";
@@ -21816,7 +22328,7 @@ var FileSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/sources/StreamSource.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/sources/StreamSource.js
 function _typeof6(o) {
   "@babel/helpers - typeof";
   return _typeof6 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -22256,7 +22768,7 @@ var StreamSource = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileReader.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileReader.js
 function _typeof7(o) {
   "@babel/helpers - typeof";
   return _typeof7 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -22324,7 +22836,7 @@ var FileReader = /* @__PURE__ */ (function() {
   }]);
 })();
 
-// ../../node_modules/tus-js-client/lib.esm/node/fileSignature.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/fileSignature.js
 import { createHash as createHash3 } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
@@ -22352,7 +22864,7 @@ function fingerprint(file, options) {
   return Promise.resolve(null);
 }
 
-// ../../node_modules/tus-js-client/lib.esm/node/httpStack.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/httpStack.js
 var import_lodash = __toESM(require_lodash());
 import * as http from "http";
 import * as https from "https";
@@ -22656,11 +23168,11 @@ var writeBufferToStreamWithProgress = function writeBufferToStreamWithProgress2(
   writeNextChunk();
 };
 
-// ../../node_modules/tus-js-client/lib.esm/node/urlStorage.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/urlStorage.js
 var import_combine_errors = __toESM(require_combine_errors());
 var lockfile = __toESM(require_proper_lockfile());
 
-// ../../node_modules/tus-js-client/lib.esm/node/index.js
+// ../../../Zanfia2/node_modules/tus-js-client/lib.esm/node/index.js
 function _typeof9(o) {
   "@babel/helpers - typeof";
   return _typeof9 = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o2) {
@@ -25327,7 +25839,10 @@ function registerPagesCommands(program2) {
   });
   pages.command("generate").description(
     "AI-generate a hosted DRAFT page from a brief. Consumes AI credits and runs in the background (202 + run id, ~1-5 minutes) \u2014 the page appears in `pages list` when the run finishes. Signup intents (lead-magnet / webinar / waitlist) also provision a signup form, a companion thank-you page and a DRAFT delivery automation. Facts in the brief (price, date, links) are used verbatim. Requires --confirm."
-  ).requiredOption("--intent <intent>", `what the page is for (${PAGE_INTENTS.join(" | ")})`).requiredOption("--title <title>", "page title (the slug derives from it unless --slug)").requiredOption("--brief <textOrFile>", "the brief \u2014 inline text or a path to a text file").option("--template <templateId>", "design-template seed from `pages templates`").option("--product <productId>", "grounding product (real name/prices + checkout link)").option("--checkout <checkoutId>", "override the product's default checkout as the offer").option("--form <formId>", "standalone signup form whose embed becomes the signup CTA").option("--source-url <url>", "website to start from (fetched server-side; beats --template)").option(
+  ).requiredOption("--intent <intent>", `what the page is for (${PAGE_INTENTS.join(" | ")})`).requiredOption("--title <title>", "page title (the slug derives from it unless --slug)").requiredOption("--brief <textOrFile>", "the brief \u2014 inline text or a path to a text file").option("--template <templateId>", "design-template seed from `pages templates`").option("--product <productId>", "grounding product (real name/prices + checkout link)").option("--checkout <checkoutId>", "override the product's default checkout as the offer").option(
+    "--form <formId>",
+    "standalone signup form the page renders natively as its signup section (never an iframe)"
+  ).option("--source-url <url>", "website to start from (fetched server-side; beats --template)").option(
     "--source-mode <mode>",
     `how the source site is used, required with --source-url (${SOURCE_SITE_MODES.join(" | ")})`
   ).option("--slug <slug>", "public URL slug; derived from the title when omitted").option(
@@ -25676,6 +26191,10 @@ function registerProductsCommands(program2) {
 `);
       if (product.storefrontVisibility) {
         process.stdout.write(`  Visibility: ${product.storefrontVisibility}
+`);
+      }
+      if (product.language !== void 0) {
+        process.stdout.write(`  Language: ${product.language ?? "none (platform language)"}
 `);
       }
       process.stdout.write(`  Clients: ${product.clientCount}
@@ -25695,6 +26214,10 @@ function registerProductsCommands(program2) {
     "--period <period>",
     "billing period for --amount: one_time, monthly or yearly (default one_time)"
   ).option("--description-file <path>", "read the product description from a file").option(
+    "--language <pl|en>",
+    "the product's language (buyer-facing pages and e-mails; omitted = the platform's language). Also picks the --amount currency when --currency is omitted (pl \u2192 pln, else usd)",
+    parseProductLanguage
+  ).option(
     "--cover <pathOrUrl>",
     "cover image: a local file (uploaded to the media library first) or an https URL"
   ).option(
@@ -25715,7 +26238,8 @@ function registerProductsCommands(program2) {
         name: options.name,
         productType: options.type,
         description,
-        offer
+        offer,
+        language: options.language
       });
       const outcome = {};
       try {
@@ -25764,21 +26288,28 @@ function registerProductsCommands(program2) {
       });
     }
   );
-  products2.command("update").description("Update a product's name, description and/or storefront visibility").argument("<id>", "product id").option("--name <name>", "new product name").option("--description <description>", "new product description").option(
+  products2.command("update").description("Update a product's name, description, storefront visibility and/or language").argument("<id>", "product id").option("--name <name>", "new product name").option("--description <description>", "new product description").option(
     "--visibility <public|unlisted|private>",
     "where buyers find it once published: public (store + product page), unlisted (product page by link only), private (checkout links only)",
     parseStorefrontVisibility
+  ).option(
+    "--language <pl|en|none>",
+    "the product's language (buyer-facing pages and e-mails); none clears it (the platform's language applies)",
+    parseProductLanguageOrNone
   ).action(
     async (id, options, command) => {
-      if (options.name === void 0 && options.description === void 0 && options.visibility === void 0) {
-        throw new Error("Nothing to update: pass --name, --description and/or --visibility.");
+      if (options.name === void 0 && options.description === void 0 && options.visibility === void 0 && options.language === void 0) {
+        throw new Error(
+          "Nothing to update: pass --name, --description, --visibility and/or --language."
+        );
       }
       const flags = getGlobalFlags(command);
       const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
       const result = await client.updateProduct(id, {
         name: options.name,
         description: options.description,
-        storefrontVisibility: options.visibility
+        storefrontVisibility: options.visibility,
+        language: options.language === PRODUCT_LANGUAGE_NONE ? null : options.language
       });
       emit(flags, result, () => {
         process.stdout.write(`Updated product ${result.productId}
@@ -26788,7 +27319,7 @@ function buildUpdateInput2(options) {
 }
 function registerReferralsCommands(program2) {
   const referrals = program2.command("referrals").description(
-    "Referral / affiliate programs \u2014 create reward ladders over your products, enroll clients, approve or reject earned rewards, and retry failed reward deliveries"
+    'Referral programs: "Nagrody za polecenia" (kind referral, reward ladders for your customers) and "Program partnerski" (kind affiliate, partner commission), both from the Growth plan. Create programs over your products, enroll clients, approve or reject earned rewards, and retry failed reward deliveries'
   );
   referrals.command("list").description("List referral programs (kind, status, products, headline stats)").action(async (_, command) => {
     const flags = getGlobalFlags(command);
@@ -26887,7 +27418,7 @@ Failed deliveries (${result.failedDeliveries.length})
     });
   });
   referrals.command("create").description(
-    "Create a program over one or more products. Deep config (milestones, commission, attribution) goes in --json; flat flags win over --json keys."
+    "Create a program over one or more products (both kinds need the Growth plan). Deep config (milestones, commission, attribution) goes in --json; flat flags win over --json keys."
   ).requiredOption("--kind <kind>", `program kind (${PROGRAM_KINDS.join(" | ")})`).requiredOption("--name <name>", "program name").requiredOption("--product <ids>", "comma-separated product ids whose purchases count").option("--enrollment <mode>", `how participants join (${ENROLLMENT_MODES.join(" | ")})`).option("--status <status>", `initial status (${WRITABLE_STATUSES.join(" | ")})`).option(
     "--json <fileOrJson>",
     "inline JSON object or .json path with `milestones`, `commission` and/or `attribution` (write it as --json=<value> \u2014 a bare --json is the global JSON-output flag)"
@@ -26902,7 +27433,7 @@ Failed deliveries (${result.failedDeliveries.length})
     });
   });
   referrals.command("update").description(
-    "Update a program. --product and --json `milestones` are FULL replaces (read the program first); flat flags win over --json keys. Use `referrals archive` to archive."
+    "Update a program. --product and --json `milestones` are FULL replaces (read the program first); flat flags win over --json keys. Activating (--status active) needs the Growth plan. Use `referrals archive` to archive."
   ).argument("<programId>", "program id").option("--name <name>", "program name").option("--status <status>", `status (${WRITABLE_STATUSES.join(" | ")})`).option("--product <ids>", "comma-separated product ids (full replace)").option("--enrollment <mode>", `how participants join (${ENROLLMENT_MODES.join(" | ")})`).option(
     "--json <fileOrJson>",
     "inline JSON object or .json path with `milestones`, `commission` and/or `attribution` (write it as --json=<value> \u2014 a bare --json is the global JSON-output flag)"
@@ -26930,7 +27461,7 @@ Failed deliveries (${result.failedDeliveries.length})
     });
   });
   referrals.command("enroll").description(
-    "Enroll one client as a participant (idempotent \u2014 re-enrolling reports `alreadyEnrolled`). Prints the ref code the client shares."
+    "Enroll one client as a participant (idempotent \u2014 re-enrolling reports `alreadyEnrolled`). Prints the ref code the client shares. Needs the Growth plan."
   ).argument("<programId>", "program id").requiredOption("--client <clientId>", "workspace client id (wcid)").requiredOption("--email <email>", "the client's email").option("--first-name <name>", "first name (optional)").option("--last-name <name>", "last name (optional)").action(async (programId, options, command) => {
     const flags = getGlobalFlags(command);
     const client = createApiClient({ apiKey: flags.apiKey, verbose: flags.verbose });
@@ -26949,7 +27480,7 @@ Failed deliveries (${result.failedDeliveries.length})
     });
   });
   referrals.command("enroll-all").description(
-    "Enroll EVERY client with access to one of the program products. Requires --confirm. Reports enrolled / alreadyEnrolled / skippedWithoutAccount counts."
+    'Enroll EVERY client with access to one of the program products ("Nagrody za polecenia" only: a "Program partnerski" is refused, partners join by invite link). Needs the Growth plan. Requires --confirm. Reports enrolled / alreadyEnrolled / skippedWithoutAccount counts.'
   ).argument("<programId>", "program id").option("--confirm", "required \u2014 acknowledge the bulk enrollment").action(async (programId, options, command) => {
     const flags = getGlobalFlags(command);
     requireConfirm13(options.confirm, `enroll all clients in program ${programId}`);
@@ -30376,8 +30907,8 @@ function applyShortHelp(program2) {
 
 // src/program.ts
 function resolveCliVersion() {
-  if ("0.9.0".length > 0) {
-    return "0.9.0";
+  if ("0.13.1".length > 0) {
+    return "0.13.1";
   }
   try {
     const raw = readFileSync28(new URL("../package.json", import.meta.url), "utf8");
@@ -30404,13 +30935,14 @@ Signing in \u2014 two roles, two consent pages:
   ${programName} login
       Creator (workspace) login. Opens the consent page in the Zanfia dashboard.
       Grants the full Workspace API: products, clients, orders, stats, \u2026
-  ${programName} login --address https://<creator-platform-url>
+  ${programName} login --address https://<creator-platform-url> [--read-only]
       Community member login. Opens the consent page on that creator's platform.
-      Grants the Community API only: communities, posts, comments.
+      Grants the Community API only: communities, posts, comments. --read-only
+      gets a key that reads and summarizes but never posts.
   ${programName} auth set-key --api-url <api-community-url> <key>
       Member alternative without a browser: paste the key generated on the
-      creator's platform under Settings \u2192 Developer.
-  ${programName} join <handle>
+      creator's platform under Settings \u2192 AI agents.
+  ${programName} join <handle> [--read-only]
       Join a public community from the terminal: emailed 6-digit code, then a
       member key is saved \u2014 no account or browser needed. Try: join crew-of-one
 `