donebear 0.4.2 → 0.4.4

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-BBEVWudm.mjs";
-import { n as readStdin, t as promptForValue } from "./prompt-GfcWO85b.mjs";
+import { a as toCliError, d as DEFAULT_APP_URL, f as DEFAULT_OAUTH_CALLBACK_PATH, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, p as DEFAULT_OAUTH_CALLBACK_PORT, r as CliError, s as CLI_NAME, t as ensureLocalContext, x as DONEBEAR_TOKEN_ENV } from "./context-store-BbZMKY0F.mjs";
+import { n as readStdin, t as promptForValue } from "./prompt-B66eG-Zm.mjs";
 import { createRequire } from "node:module";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
@@ -18,7 +18,27 @@ import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
 import Database from "better-sqlite3";
 //#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
 //#endregion
 //#region src/output.ts
 const writeLine = (stream, message) => {
@@ -1291,7 +1311,7 @@ const WORKSPACE_INVITATION_CREATE_MUTATION = `
   mutation WorkspaceInvitationCreate($input: WorkspaceInvitationCreateInput!) {
     workspaceInvitationCreate(input: $input) {
       success lastSyncId
-      invitation { id email code role expiresAt createdAt usedAt usedByUserId workspaceId }
+      invitation { id email code role expiresAt createdAt usedAt usedByUserId workspaceId kind projectId }
     }
   }
 `;
@@ -1766,6 +1786,8 @@ const listWorkspaceInvitations = async (context, options) => await paginateGraph
 const createWorkspaceInvitation = async (context, options) => {
 	const input = omitUndefined({
 		email: options.email,
+		kind: options.kind,
+		projectId: options.projectId,
 		role: options.role,
 		workspaceId: options.workspaceId
 	});
@@ -2143,9 +2165,21 @@ const parsePositiveInteger = (value, label) => {
 };
 //#endregion
 //#region src/oauth-callback.ts
+const CALLBACK_HTML_HEADERS = {
+	connection: "close",
+	"content-type": "text/html; charset=utf-8"
+};
 const successHtml = () => `<!doctype html><html><head><meta charset="utf-8"/><title>Done Bear CLI</title></head><body><h1>Authentication complete</h1><p>You can return to your terminal.</p></body></html>`;
 const escapeHtml = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
 const errorHtml = (message) => `<!doctype html><html><head><meta charset="utf-8"/><title>Done Bear CLI</title></head><body><h1>Authentication failed</h1><p>${escapeHtml(message)}</p></body></html>`;
+const writeCallbackHtml = (request, response, statusCode, html, onFlushed) => {
+	response.shouldKeepAlive = false;
+	response.writeHead(statusCode, CALLBACK_HTML_HEADERS);
+	response.end(html, () => {
+		request.socket.destroy();
+		onFlushed?.();
+	});
+};
 const waitForOAuthCode = async (options) => await new Promise((resolve, reject) => {
 	const host = options.redirectUrl.hostname;
 	const port = Number(options.redirectUrl.port);
@@ -2159,6 +2193,7 @@ const waitForOAuthCode = async (options) => await new Promise((resolve, reject)
 		if (settled) return;
 		settled = true;
 		clearTimeout(timeout);
+		server.closeAllConnections();
 		server.close(() => {
 			if (result.error) {
 				reject(result.error);
@@ -2169,41 +2204,40 @@ const waitForOAuthCode = async (options) => await new Promise((resolve, reject)
 	};
 	const server = createServer((request, response) => {
 		if (!request.url) {
-			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-			response.end(errorHtml("Missing request URL"));
-			finish({ error: new CliError("OAuth callback is missing a request URL", EXIT_CODES.ERROR) });
+			writeCallbackHtml(request, response, 400, errorHtml("Missing request URL"), () => {
+				finish({ error: new CliError("OAuth callback is missing a request URL", EXIT_CODES.ERROR) });
+			});
 			return;
 		}
 		const url = new URL(request.url, options.redirectUrl.origin);
 		if (url.pathname !== pathname) {
-			response.writeHead(404, { "content-type": "text/html; charset=utf-8" });
-			response.end(errorHtml("Invalid callback path"));
+			writeCallbackHtml(request, response, 404, errorHtml("Invalid callback path"));
 			return;
 		}
 		const providerError = url.searchParams.get("error");
 		if (providerError) {
 			const description = url.searchParams.get("error_description") ?? providerError;
-			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-			response.end(errorHtml(description));
-			finish({ error: new CliError(`OAuth provider returned an error: ${description}`, EXIT_CODES.ERROR) });
+			writeCallbackHtml(request, response, 400, errorHtml(description), () => {
+				finish({ error: new CliError(`OAuth provider returned an error: ${description}`, EXIT_CODES.ERROR) });
+			});
 			return;
 		}
 		if (url.searchParams.get("state") !== options.expectedState) {
-			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-			response.end(errorHtml("State verification failed"));
-			finish({ error: new CliError("OAuth state verification failed", EXIT_CODES.ERROR) });
+			writeCallbackHtml(request, response, 400, errorHtml("State verification failed"), () => {
+				finish({ error: new CliError("OAuth state verification failed", EXIT_CODES.ERROR) });
+			});
 			return;
 		}
 		const code = url.searchParams.get("code");
 		if (!code) {
-			response.writeHead(400, { "content-type": "text/html; charset=utf-8" });
-			response.end(errorHtml("Authorization code was missing"));
-			finish({ error: new CliError("OAuth callback is missing an authorization code", EXIT_CODES.ERROR) });
+			writeCallbackHtml(request, response, 400, errorHtml("Authorization code was missing"), () => {
+				finish({ error: new CliError("OAuth callback is missing an authorization code", EXIT_CODES.ERROR) });
+			});
 			return;
 		}
-		response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-		response.end(successHtml());
-		finish({ code });
+		writeCallbackHtml(request, response, 200, successHtml(), () => {
+			finish({ code });
+		});
 	});
 	server.on("error", (error) => {
 		finish({ error: new CliError(`Failed to start callback server on ${host}:${port}: ${error.message}`, EXIT_CODES.ERROR) });
@@ -2219,6 +2253,183 @@ const createOAuthState = () => randomBytes(24).toString("hex");
 const createCodeVerifier = () => randomBytes(64).toString("base64url");
 const createCodeChallenge = (verifier) => createHash("sha256").update(verifier).digest().toString("base64url");
 //#endregion
+//#region src/api/agent-signup.ts
+const parseJson = async (response) => {
+	const raw = await response.text();
+	if (raw.length === 0) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return raw;
+	}
+};
+const throwForFailure = (status, payload) => {
+	const message = typeof payload === "string" && payload.length > 0 ? payload : extractErrorMessage(payload);
+	const record = typeof payload === "object" && payload !== null ? payload : {};
+	const code = typeof record.code === "string" ? record.code : null;
+	if (status === 409 || code === "DUPLICATE_EMAIL") throw new CliError(message, EXIT_CODES.AUTH_REQUIRED, "Run `donebear auth login` with this email. Do not start another signup.");
+	if (status === 429 || code === "RATE_LIMIT_EXCEEDED") throw new CliError(message, EXIT_CODES.ERROR, "Wait, then retry.");
+	if (status === 400 || code === "INVALID_REQUEST") throw new CliError(message, EXIT_CODES.VALIDATION);
+	throw new CliError(message, EXIT_CODES.ERROR);
+};
+const request = async (endpoint, options) => {
+	const headers = new Headers({ Accept: "application/json" });
+	if (options.token) headers.set("Authorization", `Bearer ${options.token}`);
+	if (options.body !== void 0) headers.set("Content-Type", "application/json");
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+			headers,
+			method: options.method ?? "GET"
+		});
+	} catch (error) {
+		throw new CliError("Cannot connect to Done Bear API.", EXIT_CODES.NETWORK, error instanceof Error ? error.message : void 0);
+	}
+	const payload = await parseJson(response);
+	if (!response.ok) throwForFailure(response.status, payload);
+	return payload;
+};
+const startAgentSignup = async (_context, apiBaseUrl, input) => {
+	return await request(`${apiBaseUrl}/api/agent-signup`, {
+		body: {
+			email: input.email,
+			...input.name ? { name: input.name } : {}
+		},
+		method: "POST"
+	});
+};
+const pollAgentSignup = async (_context, apiBaseUrl, pollToken) => {
+	return await request(`${apiBaseUrl}/api/agent-signup/poll`, {
+		method: "GET",
+		token: pollToken
+	});
+};
+const verifyAgentSignupCode = async (_context, apiBaseUrl, input) => {
+	return await request(`${apiBaseUrl}/api/agent-signup/verify`, {
+		body: input,
+		method: "POST"
+	});
+};
+//#endregion
+//#region src/commands/auth-signup.ts
+const MISSING_EMAIL_MESSAGE = "Pass --email with the human's address. Do not invent one.";
+const POLL_INTERVAL_MS = 2e3;
+const defaultClock = {
+	now: () => Date.now(),
+	sleep: (ms, signal) => new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			resolve();
+			return;
+		}
+		const timer = setTimeout(resolve, ms);
+		signal.addEventListener("abort", () => {
+			clearTimeout(timer);
+			reject(/* @__PURE__ */ new Error("aborted"));
+		}, { once: true });
+	})
+};
+const isComplete = (value) => value.status === "complete";
+const printWaiting = (context, verifyUrl, instructions) => {
+	writeWarning(context, instructions.agent);
+	writeWarning(context, instructions.human);
+	writeWarning(context, `Verify link: ${verifyUrl}`);
+	writeWarning(context, "Waiting for the human to verify. The CLI will continue once that happens.");
+};
+const sessionFromComplete = (complete) => ({
+	accessToken: complete.apiKey.key,
+	createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+	expiresAt: null,
+	provider: "oauth2",
+	refreshToken: null,
+	tokenType: "bearer",
+	user: {
+		email: complete.user.email,
+		id: complete.user.id
+	}
+});
+const printComplete = (context, complete, verifyUrl) => {
+	if (context.json) {
+		writeJson({
+			apiKey: complete.apiKey,
+			email: complete.email,
+			instructions: {
+				agent: "Store the API key as DONEBEAR_TOKEN. Paste mcp.cursor into the MCP config. Do not log the full key.",
+				human: "Verification is done."
+			},
+			mcp: complete.mcp,
+			ok: true,
+			sessionStored: true,
+			status: "complete",
+			user: complete.user,
+			verifyUrl,
+			workspace: complete.workspace
+		});
+		return;
+	}
+	writeSuccess(context, "Signup complete. API key stored in the CLI session.");
+	writeInfo(context, `Signed in as ${complete.user.email}`);
+	writeInfo(context, `Workspace: ${complete.workspace.name} (${complete.workspace.urlKey ?? complete.workspace.id})`);
+	writeInfo(context, "API key (shown once):");
+	writeInfo(context, complete.apiKey.key);
+	writeInfo(context, "Paste-ready MCP config for Cursor:");
+	writeInfo(context, JSON.stringify(complete.mcp.cursor, null, 2));
+	writeInfo(context, complete.mcp.claude);
+};
+const runAgentSignup = async (context, options, clock = defaultClock) => {
+	const email = options.email?.trim() ?? "";
+	if (email.length === 0) throw new CliError(MISSING_EMAIL_MESSAGE, EXIT_CODES.VALIDATION, "Example: donebear auth signup --email person@example.com");
+	const apiBaseUrl = resolveApiBaseUrl(context);
+	const started = await startAgentSignup(context, apiBaseUrl, {
+		email,
+		name: options.name?.trim() || void 0
+	});
+	printWaiting(context, started.verifyUrl, started.instructions);
+	const abort = new AbortController();
+	const canPrompt = options.interactive && process.stdin.isTTY && !context.json && !context.quiet;
+	let submittedCode = null;
+	const promptTask = canPrompt ? promptForValue(context, "6-digit email code", abort.signal).then((value) => {
+		submittedCode = value;
+	}) : Promise.resolve();
+	const deadline = clock.now() + options.timeout * 1e3;
+	try {
+		while (clock.now() < deadline) {
+			if (submittedCode) {
+				const verified = await verifyAgentSignupCode(context, apiBaseUrl, {
+					code: submittedCode,
+					pollToken: started.pollToken
+				});
+				if (isComplete(verified)) {
+					abort.abort();
+					await writeStoredAuthSession(sessionFromComplete(verified));
+					printComplete(context, verified, started.verifyUrl);
+					return;
+				}
+				if (verified.status === "consumed") throw new CliError(verified.message, EXIT_CODES.ERROR);
+				submittedCode = null;
+			}
+			const polled = await pollAgentSignup(context, apiBaseUrl, started.pollToken);
+			if (isComplete(polled)) {
+				abort.abort();
+				await writeStoredAuthSession(sessionFromComplete(polled));
+				printComplete(context, polled, started.verifyUrl);
+				return;
+			}
+			if (polled.status === "consumed") throw new CliError(polled.message, EXIT_CODES.ERROR);
+			try {
+				await clock.sleep(POLL_INTERVAL_MS, abort.signal);
+			} catch {
+				break;
+			}
+		}
+	} finally {
+		abort.abort();
+		await promptTask.catch(() => void 0);
+	}
+	throw new CliError("Signup timed out before the email was verified.", EXIT_CODES.ERROR, "Ask the human to open the verify link, then run this command again if the code expired.");
+};
+const parseSignupTimeout = (value) => parsePositiveInteger(value, "Timeout");
+//#endregion
 //#region src/commands/auth.ts
 const runLogin = async (context, options) => {
 	const { authorizeUrl, tokenUrl } = buildOAuthUrls(resolveSupabaseConfig());
@@ -2321,6 +2532,7 @@ const getOptionalSupabaseConfig = () => {
 const registerAuthCommands = (program) => {
 	const auth = program.command("auth").description("Authenticate donebear CLI").addHelpText("after", `
 Examples:
+  donebear auth signup --email person@example.com --json
   donebear auth login
   donebear auth login --no-open     (print URL, don't open browser)
   donebear auth status --json
@@ -2349,6 +2561,25 @@ Non-interactive / CI use:
 			await runLogin(context, options);
 		});
 	});
+	auth.command("signup").description("Create a Done Bear account from a human email (agent signup)").option("--email <email>", "Human email to verify. Do not invent one.").option("--name <name>", "Optional display name").option("--timeout <seconds>", "Seconds to wait for email verification", parseSignupTimeout, 600).option("--no-interactive", "Never prompt for the email code; poll the verify link instead").addHelpText("after", `
+Creates a real human account. One person must verify the email (code or link).
+Do not invent an email address. If the address is already registered, run
+\`donebear auth login\` instead.
+
+Examples:
+  donebear auth signup --email person@example.com
+  donebear auth signup --email person@example.com --json --no-interactive
+`).action(async (options, command) => {
+		const context = contextFromCommand(command);
+		await runWithErrorHandling(context, async () => {
+			await runAgentSignup(context, {
+				email: options.email,
+				interactive: options.interactive !== false,
+				name: options.name,
+				timeout: options.timeout
+			});
+		});
+	});
 	auth.command("status").description("Check authentication status").action(async (_options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
@@ -2428,23 +2659,32 @@ const toTaskMarker = (task) => {
 	if (state === "archived") return "[-]";
 	return "[ ]";
 };
+const completedOn = (task) => {
+	if (task.completedAt === null) return null;
+	const date = new Date(task.completedAt);
+	return Number.isNaN(date.getTime()) ? null : formatDateOnlyEpoch(dateOnlyEpochFromLocalDate(date));
+};
+const deadlineDetail = (deadline) => deadline ? `due ${deadline}` : "";
 const taskListHeaders = () => [
 	"number",
 	"title",
 	"state",
-	"deadline"
+	"deadline",
+	"completed"
 ];
 const taskListRows = (tasks) => tasks.map((task) => [
 	String(task.number),
 	task.title,
 	getTaskState(task),
-	formatDateOnlyEpoch(task.deadlineAt) ?? ""
+	formatDateOnlyEpoch(task.deadlineAt) ?? "",
+	completedOn(task) ?? ""
 ]);
 const taskListLines = (tasks) => tasks.map((task) => {
 	const marker = toTaskMarker(task);
 	const deadline = formatDateOnlyEpoch(task.deadlineAt);
-	const suffix = deadline ? `  due ${deadline}` : "";
-	return `${marker} ${task.number}  ${task.title}${suffix}`;
+	const completed = completedOn(task);
+	const detail = completed ? `done ${completed}` : deadlineDetail(deadline);
+	return `${marker} ${task.number}  ${task.title}${detail ? `  ${detail}` : ""}`;
 });
 //#endregion
 //#region src/confirm.ts
@@ -2466,29 +2706,29 @@ const confirmAction = (context, message) => {
 	});
 };
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/regex.js
+//#region ../../node_modules/uuid/dist-node/regex.js
 var regex_default = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/i;
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/validate.js
+//#region ../../node_modules/uuid/dist-node/validate.js
 function validate(uuid) {
 	return typeof uuid === "string" && regex_default.test(uuid);
 }
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/parse.js
+//#region ../../node_modules/uuid/dist-node/parse.js
 function parse(uuid) {
 	if (!validate(uuid)) throw TypeError("Invalid UUID");
 	let v;
 	return Uint8Array.of((v = parseInt(uuid.slice(0, 8), 16)) >>> 24, v >>> 16 & 255, v >>> 8 & 255, v & 255, (v = parseInt(uuid.slice(9, 13), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(14, 18), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(19, 23), 16)) >>> 8, v & 255, (v = parseInt(uuid.slice(24, 36), 16)) / 1099511627776 & 255, v / 4294967296 & 255, v >>> 24 & 255, v >>> 16 & 255, v >>> 8 & 255, v & 255);
 }
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/stringify.js
+//#region ../../node_modules/uuid/dist-node/stringify.js
 const byteToHex = [];
 for (let i = 0; i < 256; ++i) byteToHex.push((i + 256).toString(16).slice(1));
 function unsafeStringify(arr, offset = 0) {
 	return (byteToHex[arr[offset + 0]] + byteToHex[arr[offset + 1]] + byteToHex[arr[offset + 2]] + byteToHex[arr[offset + 3]] + "-" + byteToHex[arr[offset + 4]] + byteToHex[arr[offset + 5]] + "-" + byteToHex[arr[offset + 6]] + byteToHex[arr[offset + 7]] + "-" + byteToHex[arr[offset + 8]] + byteToHex[arr[offset + 9]] + "-" + byteToHex[arr[offset + 10]] + byteToHex[arr[offset + 11]] + byteToHex[arr[offset + 12]] + byteToHex[arr[offset + 13]] + byteToHex[arr[offset + 14]] + byteToHex[arr[offset + 15]]).toLowerCase();
 }
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/v35.js
+//#region ../../node_modules/uuid/dist-node/v35.js
 function stringToBytes(str) {
 	str = unescape(encodeURIComponent(str));
 	const bytes = new Uint8Array(str.length);
@@ -2517,14 +2757,14 @@ function v35(version, hash, value, namespace, buf, offset) {
 	return unsafeStringify(bytes);
 }
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/sha1.js
+//#region ../../node_modules/uuid/dist-node/sha1.js
 function sha1(bytes) {
 	if (Array.isArray(bytes)) bytes = Buffer.from(bytes);
 	else if (typeof bytes === "string") bytes = Buffer.from(bytes, "utf8");
 	return createHash("sha1").update(bytes).digest();
 }
 //#endregion
-//#region ../../packages/sync-ids/node_modules/uuid/dist-node/v5.js
+//#region ../../node_modules/uuid/dist-node/v5.js
 function v5(value, namespace, buf, offset) {
 	return v35(80, sha1, value, namespace, buf, offset);
 }
@@ -2545,6 +2785,11 @@ const createTeamProjectId = (params) => createCompositeSyncId("TeamProject", [
 	params.teamId,
 	params.projectId
 ]);
+const createTeamMembershipId = (params) => createCompositeSyncId("TeamMembership", [
+	params.workspaceId,
+	params.teamId,
+	params.userId
+]);
 const createProjectMembershipId = (params) => createCompositeSyncId("ProjectMembership", [
 	params.workspaceId,
 	params.projectId,
@@ -2552,9 +2797,7 @@ const createProjectMembershipId = (params) => createCompositeSyncId("ProjectMemb
 ]);
 //#endregion
 //#region src/import/model-id.ts
-const IMPORT_ID_NAMESPACE = "b1f9f0ac-9f76-54ed-8eb0-7d6d3a0a0a31";
 const IDEMPOTENCY_ID_NAMESPACE = "4c8af5e2-1d36-5a0b-9c47-2f81b3d6e955";
-const createDeterministicImportId = (params) => createDeterministicId(IMPORT_ID_NAMESPACE, `things:${params.workspaceId}:${params.modelName}:${params.sourceId}`);
 const createIdempotentMutationId = (params) => createDeterministicId(IDEMPOTENCY_ID_NAMESPACE, `idem:${params.workspaceId}:${params.modelName}:${params.part}:${params.key}`);
 //#endregion
 //#region src/workspace-context.ts
@@ -2631,19 +2874,35 @@ const resolveWorkspace = async (context, options) => {
 //#endregion
 //#region src/commands/task.ts
 const DEFAULT_TASK_LIST_LIMIT = 20;
-const VALID_TASK_VIEWS = new Set([
+/** The views `--when` can place a task in: the ones with start fields. */
+const ACTIVE_TASK_VIEWS = new Set([
 	"inbox",
 	"anytime",
 	"today",
 	"upcoming",
-	"someday",
+	"someday"
+]);
+/** The views `--view` can filter a list by, which adds the two read-only ones. */
+const VALID_TASK_VIEWS = new Set([
+	...ACTIVE_TASK_VIEWS,
 	"logbook",
 	"trash"
 ]);
 const parseTaskView = (value) => {
 	const normalized = value.trim().toLowerCase();
 	if (VALID_TASK_VIEWS.has(normalized)) return normalized;
-	throw new Error(`Invalid view "${value}". Expected one of: inbox, anytime, today, upcoming, someday.`);
+	throw new Error(`Invalid view "${value}". Expected one of: ${[...VALID_TASK_VIEWS].join(", ")}.`);
+};
+/**
+* The view a `--when` may name. Logbook and Trash are derived from state, not
+* from a start field, so there are no start fields to build for them: passing
+* either used to fall through `buildTaskStartFields` and quietly land the task
+* in Inbox. Completing and archiving have their own commands.
+*/
+const parseTaskWhenView = (value) => {
+	const view = parseTaskView(value);
+	if (view === "logbook" || view === "trash") throw new Error(`Invalid --when "${value}". Expected one of: ${[...ACTIVE_TASK_VIEWS].join(", ")}. Use "task done" to complete a task and "task archive" to archive one.`);
+	return view;
 };
 const parseDeadline = (value) => parseCliDateOnlyToEpoch(value, "deadline date");
 /**
@@ -2667,7 +2926,7 @@ const parseDeadline = (value) => parseCliDateOnlyToEpoch(value, "deadline date")
 * there would make "typed nothing" indistinguishable from "typed --when today".
 */
 const resolveAddView = (when, deadlineEpoch, hasContainer = false) => {
-	if (when) return parseTaskView(when);
+	if (when) return parseTaskWhenView(when);
 	if (deadlineEpoch !== null) return "anytime";
 	return hasContainer ? "inbox" : "today";
 };
@@ -2990,7 +3249,7 @@ const applyScalarEdits = (updates, options) => {
 		const description = options.description.trim();
 		updates.description = description.length > 0 ? description : null;
 	}
-	if (typeof options.when === "string") Object.assign(updates, buildTaskStartFields(parseTaskView(options.when)));
+	if (typeof options.when === "string") Object.assign(updates, buildTaskStartFields(parseTaskWhenView(options.when)));
 	if (options.clearDeadline) updates.deadlineAt = null;
 	else if (typeof options.deadline === "string") updates.deadlineAt = parseDeadline(options.deadline);
 };
@@ -3155,33 +3414,7 @@ const runChecklistList = async (context, taskId, workspaceOption) => {
 	writeInfo(context, `Checklist for: ${task.title}`);
 	for (const item of sorted) writeInfo(context, `${item.completedAt === null ? "[ ]" : "[x]"} ${item.id.slice(0, 8)}  ${item.title}`);
 };
-const registerTaskCommands = (program, workspaceOverride) => {
-	const task = program.command("task").alias("tasks").description("Manage tasks").addHelpText("after", `
-Examples:
-  donebear task list --json
-  donebear task add "Fix login bug" --when today --json
-  donebear task add "Write tests" --deadline 2026-03-15 --project PROJ --json
-  donebear task edit 12 --deadline 2026-03-05 --json
-  donebear task done 12 --json
-  donebear task list --state done --limit 50 --json
-
-Date format: YYYY-MM-DD (e.g. 2026-03-15)
-Task number: workspace-scoped positive integer (e.g. 12)
-View buckets: inbox | anytime | today | upcoming | someday
-New tasks default to today; to anytime with --deadline and no --when; to
-inbox with --project or --team and no --when. Pass --when inbox to capture
-without scheduling.
-
-Agent tip: run "donebear spec task add" for full option reference
-`).action(async (_options, command) => {
-		const context = contextFromCommand(command);
-		await runWithErrorHandling(context, async () => {
-			await runTaskList(context, {
-				limit: DEFAULT_TASK_LIST_LIMIT,
-				state: "open"
-			}, workspaceOverride);
-		});
-	});
+const registerTaskSubcommands = (task, workspaceOverride) => {
 	task.command("list").alias("ls").description("List tasks").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").option("-s, --state <state>", "open|done|archived|all", "open").option("-n, --limit <count>", "Maximum number of tasks", (value) => parsePositiveInteger(value, "Limit"), DEFAULT_TASK_LIST_LIMIT).option("-q, --search <query>", "Filter by title or description").option("-v, --view <view>", "Filter by view (inbox|anytime|today|upcoming|someday|logbook|trash)").addHelpText("after", `
 Examples:
   donebear task list --json
@@ -3308,12 +3541,8 @@ without scheduling.
 			});
 		});
 	});
-	const checklist = task.command("checklist").alias("cl").description("Manage task checklist items").argument("<task-number>", "Workspace-scoped task number").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").action(async (taskId, options, command) => {
-		const context = contextFromCommand(command);
-		await runWithErrorHandling(context, async () => {
-			await runChecklistList(context, taskId, options.workspace);
-		});
-	});
+};
+const registerChecklistSubcommands = (checklist) => {
 	checklist.command("add").description("Add a checklist item").argument("<task-number>", "Workspace-scoped task number").argument("<title>", "Item title").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").action(async (taskId, title, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
@@ -3516,6 +3745,41 @@ without scheduling.
 		});
 	});
 };
+const registerTaskCommands = (program, workspaceOverride) => {
+	const task = program.command("task").alias("tasks").description("Manage tasks").addHelpText("after", `
+Examples:
+  donebear task list --json
+  donebear task add "Fix login bug" --when today --json
+  donebear task add "Write tests" --deadline 2026-03-15 --project PROJ --json
+  donebear task edit 12 --deadline 2026-03-05 --json
+  donebear task done 12 --json
+  donebear task list --state done --limit 50 --json
+
+Date format: YYYY-MM-DD (e.g. 2026-03-15)
+Task number: workspace-scoped positive integer (e.g. 12)
+View buckets: inbox | anytime | today | upcoming | someday
+New tasks default to today; to anytime with --deadline and no --when; to
+inbox with --project or --team and no --when. Pass --when inbox to capture
+without scheduling.
+
+Agent tip: run "donebear spec task add" for full option reference
+`).action(async (_options, command) => {
+		const context = contextFromCommand(command);
+		await runWithErrorHandling(context, async () => {
+			await runTaskList(context, {
+				limit: DEFAULT_TASK_LIST_LIMIT,
+				state: "open"
+			}, workspaceOverride);
+		});
+	});
+	registerTaskSubcommands(task, workspaceOverride);
+	registerChecklistSubcommands(task.command("checklist").alias("cl").description("Manage task checklist items").argument("<task-number>", "Workspace-scoped task number").option("-w, --workspace <workspace>", "Workspace id, slug, or exact name").action(async (taskId, options, command) => {
+		const context = contextFromCommand(command);
+		await runWithErrorHandling(context, async () => {
+			await runChecklistList(context, taskId, options.workspace);
+		});
+	}));
+};
 //#endregion
 //#region src/commands/comment.ts
 /**
@@ -3947,7 +4211,7 @@ const checkAuth = async (context) => {
 };
 const checkWorkspace = async () => {
 	try {
-		const { ensureLocalContext } = await import("./context-store-ClAx1T2N.mjs");
+		const { ensureLocalContext } = await import("./context-store-D8zfa5LS.mjs");
 		const localContext = await ensureLocalContext();
 		if (!localContext.workspaceId) return {
 			message: "No workspace selected (run `donebear workspace use`)",
@@ -4269,17 +4533,31 @@ state and start date rather than stored as a column:
 
 - inbox     captured, not yet placed
 - today     start date today or earlier
+
+A private email address (Settings on the web) can also drop a message into
+today as a task: subject is the title, body is the notes. Slack capture is
+unchanged.
 - upcoming  start date in the future
 - anytime   actionable now, no date pressure
 - someday   parked, off every working list
 - logbook   completed
 - trash     archived
 
-\`--when\` sets the bucket on create and edit; \`--state open|done|archived|all\`
-reaches the Logbook and Trash on list.
+\`--when\` sets the bucket on create and edit, and takes the first five only:
+logbook and trash come from a task's state, so \`task done\` and \`task archive\`
+put a task there, not \`--when\`. On list, \`--state open|done|archived|all\`
+reaches the Logbook and Trash, and so does \`--view logbook\` or \`--view trash\`,
+which widen the state for you. Do not pair \`--state done\` with a bucket view: a
+completed task's view is logbook, so \`--state done --view today\` matches
+nothing. What was finished today or this week comes off the completion date,
+not the ordering: the list prints it in the \`completed\` column, \`task show
+--json\` reports it as \`completedAtIso\`, and each row from \`task list --json\`
+carries \`completedAt\`. The iOS and web apps can keep completed to-dos on Today
+until a day roll or Log Completed (Settings → Preferences → Logging). The CLI
+still treats every completed task as logbook.
 
     donebear task add "Renew passport" --when upcoming --deadline 2030-03-01 --json
-    donebear task list --state done --json
+    donebear task list --view logbook --json
 
 \`donebear task add\` defaults to today, so a task created without \`--when\`
 starts today and shows up on the user's working list straight away. That is the
@@ -4334,8 +4612,16 @@ Clear a date with the explicit flag rather than passing an empty value:
     donebear task edit 12 --clear-deadline --json
     donebear project edit launch --clear-target-date --json
 
-Repeating tasks exist in Done Bear but are not editable from the CLI. If a user
-asks to make something repeat, say so rather than creating a run of copies.`,
+Repeat rules are configured in the app and cannot be edited from the CLI. If a user
+asks to make something repeat, say so rather than creating a run of copies.
+
+Upcoming copies can be edited or completed early. Fixed repeats keep their
+calendar schedule; after-completion repeats count from actual completion.
+CLI date edits affect the copy only. Use When in the app to choose Make
+Exception or Update Rule for a fixed series. Custom and count-limited
+patterns need the Repeat editor.
+In the app, search for Repeating to see rules and upcoming copies. Select multiple
+repeating tasks and use More to pause, resume, or stop their series.`,
 		title: "Dates and deadlines",
 		whenToUse: "Setting or clearing a due date, or choosing between a deadline and a start date."
 	},
@@ -4352,6 +4638,10 @@ never have to read a task first just to preserve its other fields.
 - cleared   use the paired flag: \`--clear-deadline\`, \`--clear-project\`,
             \`--clear-team\`, \`--clear-description\`.
 
+The description is markdown. Write a link as a bare URL (\`https://…\`), which
+every client shows as a link; \`<https://…>\` shows its angle brackets on iOS
+and here.
+
 Not on \`task edit\`:
 
 - labels      \`donebear label add|remove\`
@@ -4496,10 +4786,16 @@ a slightly wrong fit. Check \`donebear label list --json\` first and prefer an
 existing label when it is a reasonable match. Teams are set up in the app;
 there is no team create command.
 
-Every workspace member sees every project; \`donebear project join\` and
-\`donebear project leave\` only change which ones sit in your sidebar's Your
-projects list. Neither grants nor removes access, both are idempotent, and
-creating a project already joins you to it.`,
+A project is either visible to the whole workspace (the default) or private
+to its members. A private project and its tasks are invisible to everyone
+else — absent from \`project list\`, \`task list\` and \`search\`, not merely
+hidden. Visibility is set in the app.
+
+On a workspace-visible project, \`donebear project join\` and \`donebear
+project leave\` only change which ones sit in your sidebar's Your projects
+list: neither grants nor removes access. On a private project those same rows
+are the access, so leaving one gives up your ability to see it. Both are
+idempotent, and creating a project already joins you to it.`,
 		title: "Projects, teams, and labels",
 		whenToUse: "Deciding where a task belongs, creating a project or label, or joining/leaving a project."
 	},
@@ -4539,9 +4835,21 @@ off unless the user named a second one:
 Ids and names never cross workspaces. A missing task, project, or label is
 missing from *this* workspace before it is deleted.
 
+A workspace owner can turn on domain join from Settings → Members. People who
+later sign in with a verified address on that work domain join as members,
+without an invite code. Personal email hosts cannot be used. The CLI has no
+domain-join command; joining by code remains \`donebear workspace join\`.
+
 Auth precedence: \`DONEBEAR_TOKEN\` in the environment, then the stored session
-from \`donebear auth login\`. Set the env var for anything non-interactive; the
-browser login flow will hang in CI.
+from \`donebear auth login\` or \`donebear auth signup\`. Set the env var for
+anything non-interactive; the browser login flow will hang in CI.
+
+New accounts from a coding agent: \`donebear auth signup --email <human-email>
+--json --no-interactive\`. Do not invent an email. One human step verifies it
+(link or 6-digit code). The CLI then stores a \`db_\` key with read+write and
+prints paste-ready MCP config for \`https://mcp.donebear.com/mcp\`. If that
+email is already registered, run \`donebear auth login\` instead. WorkOS
+\`agent_auth\` and RFC 8628 device code are not offered.
 
     export DONEBEAR_TOKEN=<token>
     donebear whoami --json
@@ -4551,6 +4859,15 @@ write fails with an explicit message rather than silently doing nothing — tell
 the user they need a write-scoped key rather than trying to work around it.
 \`donebear doctor --json\` reports which of these is actually in effect.
 
+## Invites and share links
+
+\`donebear workspace invite --email user@example.com\` sends a single-use
+email invite. \`donebear workspace invite --share --copy\` mints a reusable
+join link at \`https://donebear.com/join?code=\`. \`--project <id>\` on
+\`--share\` scopes the link: whoever opens it joins the whole workspace as a
+member, gets that project, and uses a seat. Join with
+\`donebear workspace join <code>\` or by opening the link while signed in.
+
 ## Task attachments (read-only)
 
 Tasks can carry file/image attachments, capped at 10 MB per file and roughly
@@ -4571,6 +4888,9 @@ Three commands orient you, in order of cost:
     donebear guide <topic>     concepts and conventions, no auth
     donebear context --json    the live workspace: counts, recent tasks, projects
 
+No account yet: \`donebear auth signup --email <human-email> --json --no-interactive\`.
+Do not invent the email. A human verifies it, then the CLI stores a \`db_\` key.
+
 \`donebear spec <command> <subcommand>\` narrows to one command's flags, output
 shape, and examples. Read that before guessing at a flag.
 
@@ -4599,22 +4919,25 @@ workspace from the token.`,
 
 Two importers exist, and they are not the same thing.
 
+**In the apps**, Settings → Integrations & Import (web) and Settings → Import
+(iOS: Reminders, Todoist, Things) cover Todoist, TickTick, Microsoft To Do, Any.do, Apple
+Reminders, Things 3, Trello, Asana, Notion, Google Tasks, and plain CSV, JSON or
+iCal files. Things 3 is no longer CLI-only: on iPhone, Things → Settings →
+General → Diagnostics → Enter Code → \`491348\` → Send Things Database, then
+upload the \`.aar\` under Settings → Import → Things, or \`main.sqlite\` on the web.
+
 **In the terminal**, \`donebear import things\` reads a copy of a Things 3
 SQLite database and writes it into a workspace. It is the only import this CLI
-performs. \`donebear spec import things\` lists its flags.
+performs. \`donebear spec import things\` lists its flags. It is the power-user
+path; send people to the apps first.
 
 On macOS it finds that database itself — \`donebear import things --dry-run\`
-with no other flags is the whole command. This is worth volunteering, because
-Things keeps its database inside a folder Finder hides, under a dated directory
-whose name nobody can guess, and people hunting for it in Finder is the single
-most common way this import stalls. \`--database-url\` is for a database
-somewhere unusual: a backup, an external disk, another machine's copy.
+with no other flags is the whole command. \`--database-url\` is for a database
+somewhere unusual: an iPhone export, a backup, an external disk, another
+machine's copy.
 
-**In the web app**, Settings → Integrations & Import covers Todoist, TickTick,
-Microsoft To Do, Any.do, Apple Reminders, Things 3, Trello, Asana, Notion,
-Google Tasks, and plain CSV, JSON or iCal files. If a user asks how to move a
-backlog in from anything other than Things, that is where to send them; there
-is no CLI equivalent to offer.
+If a user asks how to move a backlog in from anything other than Things, that is
+the web import screen; there is no CLI equivalent to offer.
 
 Each of those is a file the user exports and uploads — Todoist from Settings →
 Backups, Google Tasks from Google Takeout, Microsoft To Do from a read-only
@@ -4623,6 +4946,13 @@ that may change: a read-only connect flow is being built so Done Bear can make
 that call instead, so treat the Graph export as the current route and check the
 import screen before promising a connection.
 
+Every importer, here and in the apps, only reads the source; none of them
+writes, edits or deletes anything in the app being left. The one path that
+does is Reminders Inbox on iPhone (Settings → Import → Reminders Inbox), which
+is a capture bridge rather than an import: a chosen Reminders list shows at the
+top of Inbox, and importing a to-do from there creates the task and removes it
+from Reminders after a confirmation. It has no CLI equivalent.
+
 The other direction is here though: \`donebear export\` writes a portable JSON
 archive of a workspace, and the web importer restores one.
 
@@ -4655,9 +4985,8 @@ only what is new.
 
 There is no undo for \`donebear import things\`; a run has to be unpicked by
 hand. The web importer does offer one on its completion screen, but the receipt
-lives in the browser that ran the import, so it cannot be reached from the CLI,
-another device or the iOS app. Say that plainly rather than sending someone
-looking for a flag.`,
+lives in the browser that ran the import. An iOS import is undone with the
+usual undo for that change, not from the web receipt.`,
 		title: "Importing from another app",
 		whenToUse: "Moving a backlog in from Things 3 or another task manager, or restoring an export."
 	}
@@ -4892,60 +5221,16 @@ const getUtcCalendarDayEndEpoch = (date) => {
 	return Date.UTC(parts.year, parts.month - 1, parts.day, 23, 59, 59, 999);
 };
 //#endregion
-//#region ../../packages/sync-ids/src/meet-done-bear.ts
-/**
-* Ids for the "Meet Done Bear" sample project every new workspace is seeded
-* with.
-*
-* `manage-api` seeds the rows; `manage-frontend` and the CLI have to recognise
-* and trash the same rows when an import lands, and neither can read the ids
-* off the server. All three therefore re-derive them from the workspace id,
-* which only works while the namespace and the row counts agree — so they live
-* here rather than in each app.
-*
-* Unlike the composite ids in `./index`, these have no Swift port and no entry
-* in `test-vectors.json`: iOS never seeds or dismisses the sample project.
-*/
-const MEET_DONE_BEAR_ID_NAMESPACE = "b7e1d4a0-6c2f-4a8e-9d13-5f0c8a2b7e91";
-const createMeetDoneBearProjectId = (workspaceId) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Project:${workspaceId}`);
-const createMeetDoneBearHeadingId = (workspaceId, index) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Heading:${workspaceId}:${index}`);
-const createMeetDoneBearTaskId = (workspaceId, index) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Task:${workspaceId}:${index}`);
-//#endregion
-//#region src/import/meet-done-bear.ts
-/**
-* Sample rows that still exist in the pre-import bootstrap. Missing or
-* already-trashed rows are omitted so a later import does not fail.
-*/
-const listMeetDoneBearArchiveTargets = (options) => {
-	const projectId = createMeetDoneBearProjectId(options.workspaceId);
-	if (!options.existingProjectIds.has(projectId)) return [];
-	const targets = [{
-		modelId: projectId,
-		modelName: "Project"
-	}];
-	const headingIds = options.existingHeadingIds;
-	if (headingIds) for (let index = 0; index < 3; index += 1) {
-		const modelId = createMeetDoneBearHeadingId(options.workspaceId, index);
-		if (headingIds.has(modelId)) targets.push({
-			modelId,
-			modelName: "ProjectHeading"
-		});
-	}
-	for (let index = 0; index < 9; index += 1) {
-		const modelId = createMeetDoneBearTaskId(options.workspaceId, index);
-		if (options.existingTaskIds.has(modelId)) targets.push({
-			modelId,
-			modelName: "Task"
-		});
-	}
-	return targets;
-};
+//#region ../../packages/import-core/src/things/ids.ts
+const THINGS_IMPORT_ID_NAMESPACE = "b1f9f0ac-9f76-54ed-8eb0-7d6d3a0a0a31";
+const createDeterministicImportId = (params) => createDeterministicId(THINGS_IMPORT_ID_NAMESPACE, `things:${params.workspaceId}:${params.modelName}:${params.sourceId}`);
 //#endregion
-//#region src/import/things-labels.ts
+//#region ../../packages/import-core/src/things/labels.ts
 const normalizeThingsLabelLookupKey = (value) => value.trim().toLocaleLowerCase();
+const normalizeThingsTeamLookupKey = (value) => value.trim().toLocaleLowerCase();
 //#endregion
-//#region src/import/things-values.ts
-var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
+//#region ../../packages/import-core/src/things/values.ts
+var import_rrule = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function webpackUniversalModuleDefinition(root, factory) {
 		if (typeof exports === "object" && typeof module === "object") module.exports = factory();
 		else if (typeof define === "function" && define.amd) define([], factory);
@@ -7699,7 +7984,7 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return __webpack_exports__;
 		})();
 	});
-})))();
+})))(), 1);
 const PACKED_DATE_MULTIPLIER = 128;
 const PACKED_DATE_DAY_MASK = 31;
 const PACKED_DATE_MONTH_MASK = 15;
@@ -7759,7 +8044,8 @@ const combineThingsReminderAt = (options) => {
 	return baseInstant === null ? null : baseInstant + offset;
 };
 //#endregion
-//#region src/import/things-recurrence.ts
+//#region ../../packages/import-core/src/things/recurrence.ts
+const { RRule, rrulestr } = typeof import_rrule.RRule === "function" ? import_rrule : import_rrule.default;
 const THINGS_FREQUENCY_TO_RRULE = new Map([
 	[4, "YEARLY"],
 	[8, "MONTHLY"],
@@ -7800,8 +8086,8 @@ const parseOffsets = (xml) => {
 };
 const parseRRule = (rule) => {
 	try {
-		const parsed = (0, import_rrule.rrulestr)(rule);
-		return parsed instanceof import_rrule.RRule ? parsed : null;
+		const parsed = rrulestr(rule);
+		return parsed instanceof RRule ? parsed : null;
 	} catch {
 		return null;
 	}
@@ -7900,7 +8186,7 @@ const resolveThingsRepeatInstanceDate = (task, timeZone) => {
 	return decodeThingsPackedCalendarDate(task.startDate, repeatTimeZone) ?? decodeThingsPackedCalendarDate(task.nextInstanceStartDate, repeatTimeZone) ?? null;
 };
 //#endregion
-//#region src/import/things-mapper.ts
+//#region ../../packages/import-core/src/things/mapper.ts
 const MAX_CHECKLIST_TITLE_LENGTH = 500;
 const classifyTaskKind = (task) => {
 	if (task.type === 2) return "heading";
@@ -8007,14 +8293,14 @@ const pickCompletedAt = (task) => {
 	return decodeThingsUnixSeconds(task.stopDate) ?? decodeThingsUnixSeconds(task.userModificationDate) ?? decodeThingsUnixSeconds(task.creationDate);
 };
 const sortValue = (primary, fallback) => typeof primary === "number" ? primary : fallback;
-const textDecoder = new TextDecoder();
+const textDecoder$1 = new TextDecoder();
 const encodeBase64 = (value) => {
 	let binary = "";
 	for (const byte of value) binary += String.fromCodePoint(byte);
 	return btoa(binary);
 };
 const sanitizeBinary = (value) => {
-	const asText = textDecoder.decode(value);
+	const asText = textDecoder$1.decode(value);
 	if (!asText.includes("�") && READABLE_TEXT_PATTERN.test(asText)) {
 		const trimmed = asText.trim();
 		if (trimmed.length > 0) return trimmed;
@@ -8174,19 +8460,25 @@ const buildChecklistMutation = (options) => {
 };
 const buildTeamActions = (ctx, areas) => {
 	const teams = [];
+	const teamMemberships = [];
+	const membershipIds = /* @__PURE__ */ new Set();
 	for (const area of [...areas].toSorted((a, b) => {
 		const indexComparison = compareNullableNumber(a.sortIndex, b.sortIndex);
 		if (indexComparison !== 0) return indexComparison;
 		return a.uuid.localeCompare(b.uuid);
 	})) {
-		const teamId = createDeterministicImportId({
+		const teamName = normalizeTitle(area.title, `Area ${area.uuid.slice(0, 8)}`);
+		const teamLookupKey = normalizeThingsTeamLookupKey(teamName);
+		const existingTeamId = ctx.existingTeamIdByName.get(teamLookupKey);
+		const teamId = existingTeamId ?? createDeterministicImportId({
 			modelName: "Team",
 			sourceId: area.uuid,
 			workspaceId: ctx.workspaceId
 		});
+		ctx.existingTeamIdByName.set(teamLookupKey, teamId);
 		ctx.areaTeamIdBySourceId.set(area.uuid, teamId);
 		const areaTagTitles = (ctx.areaTagMap.get(area.uuid) ?? []).map((link) => ctx.tagTitleById.get(link.tagId) ?? null).filter((title) => typeof title === "string");
-		teams.push({
+		if (!existingTeamId) teams.push({
 			modelId: teamId,
 			modelName: "Team",
 			payload: {
@@ -8195,14 +8487,36 @@ const buildTeamActions = (ctx, areas) => {
 				description: appendMetadataBlock(null, ctx.metadataMode, buildAreaMetadata(area, areaTagTitles)),
 				icon: null,
 				key: ctx.teamKeys.get(area.uuid) ?? "AREA",
-				name: normalizeTitle(area.title, `Area ${area.uuid.slice(0, 8)}`),
+				name: teamName,
 				updatedAt: ctx.createdAtFallback,
 				workspaceId: ctx.workspaceId
 			},
 			sourceId: area.uuid
 		});
+		const membershipId = createTeamMembershipId({
+			teamId,
+			userId: ctx.creatorId,
+			workspaceId: ctx.workspaceId
+		});
+		if (!membershipIds.has(membershipId)) {
+			membershipIds.add(membershipId);
+			teamMemberships.push({
+				modelId: membershipId,
+				modelName: "TeamMembership",
+				payload: {
+					createdAt: ctx.createdAtFallback,
+					teamId,
+					userId: ctx.creatorId,
+					workspaceId: ctx.workspaceId
+				},
+				sourceId: `${area.uuid}:${ctx.creatorId}`
+			});
+		}
 	}
-	return teams;
+	return {
+		teamMemberships,
+		teams
+	};
 };
 const buildLabelActions = (ctx, tags) => {
 	const labels = [];
@@ -8235,6 +8549,7 @@ const buildLabelActions = (ctx, tags) => {
 };
 const buildProjectActions = (ctx, sourceProjects) => {
 	const projects = [];
+	const projectMemberships = [];
 	const teamProjects = [];
 	for (const project of [...sourceProjects].toSorted((a, b) => {
 		const indexComparison = compareNullableNumber(a.sortIndex, b.sortIndex);
@@ -8270,6 +8585,21 @@ const buildProjectActions = (ctx, sourceProjects) => {
 			},
 			sourceId: project.uuid
 		});
+		projectMemberships.push({
+			modelId: createProjectMembershipId({
+				projectId,
+				userId: ctx.creatorId,
+				workspaceId: ctx.workspaceId
+			}),
+			modelName: "ProjectMembership",
+			payload: {
+				createdAt: decodeThingsUnixSeconds(project.creationDate) ?? ctx.createdAtFallback,
+				projectId,
+				userId: ctx.creatorId,
+				workspaceId: ctx.workspaceId
+			},
+			sourceId: `${project.uuid}:${ctx.creatorId}`
+		});
 		if (project.areaId !== null) {
 			const teamId = ctx.areaTeamIdBySourceId.get(project.areaId);
 			if (teamId) teamProjects.push({
@@ -8290,6 +8620,7 @@ const buildProjectActions = (ctx, sourceProjects) => {
 		}
 	}
 	return {
+		projectMemberships,
 		projects,
 		teamProjects
 	};
@@ -8542,6 +8873,7 @@ const buildThingsImportPlan = (options) => {
 		createdAtFallback: Date.now(),
 		creatorId: options.creatorId,
 		existingLabelIdByTitle: existingLabelsByTitle ?? /* @__PURE__ */ new Map(),
+		existingTeamIdByName: options.existingTeamsByName ?? /* @__PURE__ */ new Map(),
 		headingIdBySourceId: /* @__PURE__ */ new Map(),
 		metadataMode: options.metadataMode,
 		projectIdBySourceId: /* @__PURE__ */ new Map(),
@@ -8558,15 +8890,18 @@ const buildThingsImportPlan = (options) => {
 			maxLength: 24
 		}),
 		timeZone: options.timeZone,
-		todayDateOnly: dateOnlyEpochFromLocalDate(),
+		todayDateOnly: localDateToDateOnlyEpoch(/* @__PURE__ */ new Date()),
 		workspaceId
 	};
-	const teams = options.skipTeams ? [] : buildTeamActions(ctx, snapshot.areas);
+	const { teamMemberships, teams } = options.skipTeams ? {
+		teamMemberships: [],
+		teams: []
+	} : buildTeamActions(ctx, snapshot.areas);
 	const labels = buildLabelActions(ctx, snapshot.tags);
 	const sourceProjects = snapshot.tasks.filter((task) => classifyTaskKind(task) === "project");
 	const sourceHeadings = snapshot.tasks.filter((task) => classifyTaskKind(task) === "heading");
 	const sourceTasks = snapshot.tasks.filter((task) => classifyTaskKind(task) === "task");
-	const { projects, teamProjects } = buildProjectActions(ctx, sourceProjects);
+	const { projectMemberships, projects, teamProjects } = buildProjectActions(ctx, sourceProjects);
 	const headings = buildHeadingActions(ctx, sourceHeadings);
 	const { tasks, taskLabels, checklistItems } = buildTaskActions(ctx, sourceTasks);
 	const phases = [
@@ -8574,6 +8909,10 @@ const buildThingsImportPlan = (options) => {
 			items: teams,
 			name: "teams"
 		},
+		{
+			items: teamMemberships,
+			name: "teamMemberships"
+		},
 		{
 			items: labels,
 			name: "labels"
@@ -8582,6 +8921,10 @@ const buildThingsImportPlan = (options) => {
 			items: projects,
 			name: "projects"
 		},
+		{
+			items: projectMemberships,
+			name: "projectMemberships"
+		},
 		{
 			items: teamProjects,
 			name: "teamProjects"
@@ -8623,11 +8966,208 @@ const buildThingsImportPlan = (options) => {
 	};
 };
 //#endregion
+//#region ../../packages/import-core/src/things/snapshot.ts
+const textDecoder = new TextDecoder();
+const THINGS_REQUIRED_TABLE = "TMTask";
+const THINGS_SQLITE_FILE = "main.sqlite";
+const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
+const toThingsStringValue = (value) => {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	if (value instanceof Uint8Array) {
+		const text = textDecoder.decode(value).trim();
+		return text.length > 0 ? text : null;
+	}
+	return null;
+};
+const toThingsNumberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+const toThingsBooleanValue = (value) => {
+	const numeric = toThingsNumberValue(value);
+	return numeric === null ? null : numeric !== 0;
+};
+const normalizeThingsTaskRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		afterCompletionReferenceDate: toThingsNumberValue(row.rt1_afterCompletionReferenceDate ?? row.afterCompletionReferenceDate),
+		areaId: toThingsStringValue(row.area),
+		contactId: toThingsStringValue(row.contact ?? row.delegate),
+		creationDate: toThingsNumberValue(row.creationDate),
+		deadline: toThingsNumberValue(row.deadline ?? row.dueDate),
+		deadlineOffset: toThingsNumberValue(row.t2_deadlineOffset ?? row.dueDateOffset),
+		deadlineSuppressionDate: toThingsNumberValue(row.deadlineSuppressionDate ?? row.dueDateSuppressionDate),
+		headingId: toThingsStringValue(row.heading ?? row.actionGroup),
+		instanceCreationCount: toThingsNumberValue(row.rt1_instanceCreationCount ?? row.instanceCreationCount),
+		instanceCreationPaused: toThingsBooleanValue(row.rt1_instanceCreationPaused ?? row.instanceCreationPaused) ?? false,
+		instanceCreationStartDate: toThingsNumberValue(row.rt1_instanceCreationStartDate ?? row.instanceCreationStartDate),
+		lastReminderInteractionDate: toThingsNumberValue(row.lastReminderInteractionDate ?? row.lastAlarmInteractionDate),
+		nextInstanceStartDate: toThingsNumberValue(row.rt1_nextInstanceStartDate ?? row.nextInstanceStartDate),
+		notes: toThingsStringValue(row.notes),
+		projectId: toThingsStringValue(row.project),
+		raw: row,
+		recurrenceRuleRaw: toThingsStringValue(row.rt1_recurrenceRule ?? row.recurrenceRule),
+		reminderTime: toThingsNumberValue(row.reminderTime),
+		repeatTemplateSourceId: toThingsStringValue(row.rt1_repeatingTemplate ?? row.repeatingTemplate),
+		repeaterMigrationDate: toThingsNumberValue(row.repeaterMigrationDate),
+		repeaterRaw: toThingsStringValue(row.repeater),
+		sortIndex: toThingsNumberValue(row.index),
+		start: toThingsNumberValue(row.start),
+		startBucket: toThingsNumberValue(row.startBucket),
+		startDate: toThingsNumberValue(row.startDate),
+		status: toThingsNumberValue(row.status),
+		stopDate: toThingsNumberValue(row.stopDate),
+		title: toThingsStringValue(row.title),
+		todayIndex: toThingsNumberValue(row.todayIndex),
+		todayIndexReferenceDate: toThingsNumberValue(row.todayIndexReferenceDate),
+		trashed: toThingsBooleanValue(row.trashed) ?? false,
+		type: toThingsNumberValue(row.type),
+		userModificationDate: toThingsNumberValue(row.userModificationDate),
+		uuid
+	};
+};
+const normalizeThingsAreaRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		raw: row,
+		sortIndex: toThingsNumberValue(row.index),
+		title: toThingsStringValue(row.title),
+		uuid,
+		visible: toThingsBooleanValue(row.visible)
+	};
+};
+const normalizeThingsTagRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		parentId: toThingsStringValue(row.parent),
+		raw: row,
+		shortcut: toThingsStringValue(row.shortcut),
+		sortIndex: toThingsNumberValue(row.index),
+		title: toThingsStringValue(row.title),
+		usedDate: toThingsNumberValue(row.usedDate),
+		uuid
+	};
+};
+const normalizeThingsChecklistItemRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		creationDate: toThingsNumberValue(row.creationDate),
+		raw: row,
+		sortIndex: toThingsNumberValue(row.index),
+		status: toThingsNumberValue(row.status),
+		stopDate: toThingsNumberValue(row.stopDate),
+		taskId: toThingsStringValue(row.task),
+		title: toThingsStringValue(row.title),
+		userModificationDate: toThingsNumberValue(row.userModificationDate),
+		uuid
+	};
+};
+const normalizeThingsTaskTagRecord = (row) => {
+	const taskId = toThingsStringValue(row.tasks);
+	const tagId = toThingsStringValue(row.tags);
+	return taskId && tagId ? {
+		tagId,
+		taskId
+	} : null;
+};
+const normalizeThingsAreaTagRecord = (row) => {
+	const areaId = toThingsStringValue(row.areas);
+	const tagId = toThingsStringValue(row.tags);
+	return areaId && tagId ? {
+		areaId,
+		tagId
+	} : null;
+};
+const normalizeThingsContactRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		appleAddressBookId: toThingsStringValue(row.appleAddressBookId),
+		displayName: toThingsStringValue(row.displayName),
+		emails: toThingsStringValue(row.emails),
+		firstName: toThingsStringValue(row.firstName),
+		lastName: toThingsStringValue(row.lastName),
+		raw: row,
+		uuid
+	};
+};
+const mapPresent = (rows, normalize) => rows.map(normalize).filter((record) => record !== null);
+/**
+* Turns raw Things tables into the snapshot `buildThingsImportPlan` consumes.
+* Callers supply the SQL; this is the one place row → record mapping lives.
+*/
+const buildThingsDatabaseSnapshot = (reader, databasePath) => {
+	if (!reader.hasTable("TMTask")) throw new Error("This does not look like a Things 3 database. Select the main.sqlite file that contains the TMTask table.");
+	return {
+		areaTags: reader.hasTable("TMAreaTag") ? mapPresent(reader.readRows("TMAreaTag"), normalizeThingsAreaTagRecord) : [],
+		areas: reader.hasTable("TMArea") ? mapPresent(reader.readRows("TMArea"), normalizeThingsAreaRecord) : [],
+		checklistItems: reader.hasTable("TMChecklistItem") ? mapPresent(reader.readRows("TMChecklistItem"), normalizeThingsChecklistItemRecord) : [],
+		contacts: reader.hasTable("TMContact") ? mapPresent(reader.readRows("TMContact"), normalizeThingsContactRecord) : [],
+		databasePath,
+		tags: reader.hasTable("TMTag") ? mapPresent(reader.readRows("TMTag"), normalizeThingsTagRecord) : [],
+		taskColumns: reader.getTableColumns(THINGS_REQUIRED_TABLE),
+		taskTags: reader.hasTable("TMTaskTag") ? mapPresent(reader.readRows("TMTaskTag"), normalizeThingsTaskTagRecord) : [],
+		tasks: mapPresent(reader.readRows(THINGS_REQUIRED_TABLE), normalizeThingsTaskRecord)
+	};
+};
+//#endregion
+//#region ../../packages/sync-ids/src/meet-done-bear.ts
+/**
+* Ids for the "Meet Done Bear" sample project every new workspace is seeded
+* with.
+*
+* `manage-api` seeds the rows; `manage-frontend` and the CLI have to recognise
+* and trash the same rows when an import lands, and neither can read the ids
+* off the server. All three therefore re-derive them from the workspace id,
+* which only works while the namespace and the row counts agree — so they live
+* here rather than in each app.
+*
+* iOS ports `createMeetDoneBearProjectId` / `isMeetDoneBearProjectId` in
+* `DeterministicIds.swift` so Quiet Invite can ignore seed tasks. There is
+* still no vector section — dedicated Swift tests pin the same namespace.
+*/
+const MEET_DONE_BEAR_ID_NAMESPACE = "b7e1d4a0-6c2f-4a8e-9d13-5f0c8a2b7e91";
+const createMeetDoneBearProjectId = (workspaceId) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Project:${workspaceId}`);
+const createMeetDoneBearHeadingId = (workspaceId, index) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Heading:${workspaceId}:${index}`);
+const createMeetDoneBearTaskId = (workspaceId, index) => createDeterministicId(MEET_DONE_BEAR_ID_NAMESPACE, `MeetDoneBear:Task:${workspaceId}:${index}`);
+//#endregion
+//#region src/import/meet-done-bear.ts
+/**
+* Sample rows that still exist in the pre-import bootstrap. Missing or
+* already-trashed rows are omitted so a later import does not fail.
+*/
+const listMeetDoneBearArchiveTargets = (options) => {
+	const projectId = createMeetDoneBearProjectId(options.workspaceId);
+	if (!options.existingProjectIds.has(projectId)) return [];
+	const targets = [{
+		modelId: projectId,
+		modelName: "Project"
+	}];
+	const headingIds = options.existingHeadingIds;
+	if (headingIds) for (let index = 0; index < 3; index += 1) {
+		const modelId = createMeetDoneBearHeadingId(options.workspaceId, index);
+		if (headingIds.has(modelId)) targets.push({
+			modelId,
+			modelName: "ProjectHeading"
+		});
+	}
+	for (let index = 0; index < 9; index += 1) {
+		const modelId = createMeetDoneBearTaskId(options.workspaceId, index);
+		if (options.existingTaskIds.has(modelId)) targets.push({
+			modelId,
+			modelName: "Task"
+		});
+	}
+	return targets;
+};
+//#endregion
 //#region src/import/things-sqlite.ts
 const THINGS_CONTAINER_PATH = join(homedir(), "Library/Group Containers/JLMPQHK86H.com.culturedcode.ThingsMac");
 const THINGS_BUNDLE_NAME = "Things Database.thingsdatabase";
-const THINGS_SQLITE_FILE = "main.sqlite";
-const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
 const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/iu;
 const isUrlLike = (value) => URL_SCHEME_PATTERN.test(value);
 const resolveInputPath = (databaseUrl) => {
@@ -8640,7 +9180,7 @@ const resolveInputPath = (databaseUrl) => {
 const expandThingsDatabasePath = (inputPath) => {
 	const resolvedPath = resolve(inputPath);
 	const lastSegment = basename(resolvedPath);
-	if (lastSegment === THINGS_SQLITE_FILE || lastSegment === LEGACY_THINGS_SQLITE_FILE) return resolvedPath;
+	if (lastSegment === "main.sqlite" || lastSegment === "Things.sqlite3") return resolvedPath;
 	if (lastSegment === THINGS_BUNDLE_NAME) return join(resolvedPath, THINGS_SQLITE_FILE);
 	if (lastSegment.startsWith("ThingsData-")) return join(resolvedPath, THINGS_BUNDLE_NAME, THINGS_SQLITE_FILE);
 	return resolvedPath;
@@ -8685,130 +9225,6 @@ const getTableColumns = (database, tableName) => {
 	if (!hasTable(database, tableName)) return [];
 	return database.prepare(`PRAGMA table_info(${tableName})`).all().map((row) => typeof row.name === "string" ? row.name : null).filter((name) => name !== null);
 };
-const toStringValue = (value) => {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	}
-	if (Buffer.isBuffer(value)) {
-		const text = value.toString("utf-8").trim();
-		return text.length > 0 ? text : null;
-	}
-	return null;
-};
-const toNumberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
-const toBooleanValue = (value) => {
-	const numeric = toNumberValue(value);
-	return numeric === null ? null : numeric !== 0;
-};
-const normalizeTaskRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		afterCompletionReferenceDate: toNumberValue(row.rt1_afterCompletionReferenceDate ?? row.afterCompletionReferenceDate),
-		areaId: toStringValue(row.area),
-		contactId: toStringValue(row.contact ?? row.delegate),
-		creationDate: toNumberValue(row.creationDate),
-		deadline: toNumberValue(row.deadline ?? row.dueDate),
-		deadlineOffset: toNumberValue(row.t2_deadlineOffset ?? row.dueDateOffset),
-		deadlineSuppressionDate: toNumberValue(row.deadlineSuppressionDate ?? row.dueDateSuppressionDate),
-		headingId: toStringValue(row.heading ?? row.actionGroup),
-		instanceCreationCount: toNumberValue(row.rt1_instanceCreationCount ?? row.instanceCreationCount),
-		instanceCreationPaused: toBooleanValue(row.rt1_instanceCreationPaused ?? row.instanceCreationPaused) ?? false,
-		instanceCreationStartDate: toNumberValue(row.rt1_instanceCreationStartDate ?? row.instanceCreationStartDate),
-		lastReminderInteractionDate: toNumberValue(row.lastReminderInteractionDate ?? row.lastAlarmInteractionDate),
-		nextInstanceStartDate: toNumberValue(row.rt1_nextInstanceStartDate ?? row.nextInstanceStartDate),
-		notes: toStringValue(row.notes),
-		projectId: toStringValue(row.project),
-		raw: row,
-		recurrenceRuleRaw: toStringValue(row.rt1_recurrenceRule ?? row.recurrenceRule),
-		reminderTime: toNumberValue(row.reminderTime),
-		repeatTemplateSourceId: toStringValue(row.rt1_repeatingTemplate ?? row.repeatingTemplate),
-		repeaterMigrationDate: toNumberValue(row.repeaterMigrationDate),
-		repeaterRaw: toStringValue(row.repeater),
-		sortIndex: toNumberValue(row.index),
-		start: toNumberValue(row.start),
-		startBucket: toNumberValue(row.startBucket),
-		startDate: toNumberValue(row.startDate),
-		status: toNumberValue(row.status),
-		stopDate: toNumberValue(row.stopDate),
-		title: toStringValue(row.title),
-		todayIndex: toNumberValue(row.todayIndex),
-		todayIndexReferenceDate: toNumberValue(row.todayIndexReferenceDate),
-		trashed: toBooleanValue(row.trashed) ?? false,
-		type: toNumberValue(row.type),
-		userModificationDate: toNumberValue(row.userModificationDate),
-		uuid
-	};
-};
-const normalizeAreaRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		raw: row,
-		sortIndex: toNumberValue(row.index),
-		title: toStringValue(row.title),
-		uuid,
-		visible: toBooleanValue(row.visible)
-	};
-};
-const normalizeTagRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		parentId: toStringValue(row.parent),
-		raw: row,
-		shortcut: toStringValue(row.shortcut),
-		sortIndex: toNumberValue(row.index),
-		title: toStringValue(row.title),
-		usedDate: toNumberValue(row.usedDate),
-		uuid
-	};
-};
-const normalizeChecklistItemRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		creationDate: toNumberValue(row.creationDate),
-		raw: row,
-		sortIndex: toNumberValue(row.index),
-		status: toNumberValue(row.status),
-		stopDate: toNumberValue(row.stopDate),
-		taskId: toStringValue(row.task),
-		title: toStringValue(row.title),
-		userModificationDate: toNumberValue(row.userModificationDate),
-		uuid
-	};
-};
-const normalizeTaskTagRecord = (row) => {
-	const taskId = toStringValue(row.tasks);
-	const tagId = toStringValue(row.tags);
-	return taskId && tagId ? {
-		tagId,
-		taskId
-	} : null;
-};
-const normalizeAreaTagRecord = (row) => {
-	const areaId = toStringValue(row.areas);
-	const tagId = toStringValue(row.tags);
-	return areaId && tagId ? {
-		areaId,
-		tagId
-	} : null;
-};
-const normalizeContactRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		appleAddressBookId: toStringValue(row.appleAddressBookId),
-		displayName: toStringValue(row.displayName),
-		emails: toStringValue(row.emails),
-		firstName: toStringValue(row.firstName),
-		lastName: toStringValue(row.lastName),
-		raw: row,
-		uuid
-	};
-};
 const resolveThingsDatabasePath = (databaseUrl) => expandThingsDatabasePath(resolveInputPath(databaseUrl));
 const resolveDefaultThingsDatabasePath = () => {
 	const resolved = findLatestThingsDatabasePath();
@@ -8823,17 +9239,11 @@ const loadThingsDatabase = (databaseUrl) => {
 		readonly: true
 	});
 	try {
-		return {
-			areaTags: hasTable(database, "TMAreaTag") ? readRows(database, "TMAreaTag").map(normalizeAreaTagRecord).filter((record) => record !== null) : [],
-			areas: hasTable(database, "TMArea") ? readRows(database, "TMArea").map(normalizeAreaRecord).filter((record) => record !== null) : [],
-			checklistItems: hasTable(database, "TMChecklistItem") ? readRows(database, "TMChecklistItem").map(normalizeChecklistItemRecord).filter((record) => record !== null) : [],
-			contacts: hasTable(database, "TMContact") ? readRows(database, "TMContact").map(normalizeContactRecord).filter((record) => record !== null) : [],
-			databasePath,
-			tags: hasTable(database, "TMTag") ? readRows(database, "TMTag").map(normalizeTagRecord).filter((record) => record !== null) : [],
-			taskColumns: getTableColumns(database, "TMTask"),
-			taskTags: hasTable(database, "TMTaskTag") ? readRows(database, "TMTaskTag").map(normalizeTaskTagRecord).filter((record) => record !== null) : [],
-			tasks: readRows(database, "TMTask").map(normalizeTaskRecord).filter((record) => record !== null)
-		};
+		return buildThingsDatabaseSnapshot({
+			getTableColumns: (tableName) => getTableColumns(database, tableName),
+			hasTable: (tableName) => hasTable(database, tableName),
+			readRows: (tableName) => readRows(database, tableName)
+		}, databasePath);
 	} finally {
 		database.close();
 	}
@@ -8841,7 +9251,15 @@ const loadThingsDatabase = (databaseUrl) => {
 //#endregion
 //#region src/import/things-runner.ts
 const WORKSPACE_SCOPED_MODELS = SYNC_CONTENT_MODELS;
-const INSERT_ONLY_MODELS = new Set(["TaskLabel", "TeamProject"]);
+const INSERT_ONLY_MODELS = new Set([
+	"TaskLabel",
+	"TeamProject",
+	"TeamMembership",
+	"ProjectMembership"
+]);
+/** Membership joins are not in SYNC_CONTENT_MODELS (identity surface), but
+* Things import writes the importer's own rows and needs them for skip-on-rerun. */
+const THINGS_MEMBERSHIP_MODELS = ["TeamMembership", "ProjectMembership"];
 const chunk = (items, size) => {
 	const result = [];
 	for (let index = 0; index < items.length; index += size) result.push(items.slice(index, index + size));
@@ -8885,9 +9303,9 @@ const loadWorkspaceScopedRowsByModel = async (context, options) => {
 };
 const loadExistingImportState = async (options) => {
 	let modelNames;
-	if (options.dryRun) modelNames = ["Label"];
-	else if (options.skipTeams) modelNames = WORKSPACE_SCOPED_MODELS.filter((m) => m !== "Team" && m !== "TeamProject");
-	else modelNames = WORKSPACE_SCOPED_MODELS;
+	if (options.dryRun) modelNames = options.skipTeams ? ["Label"] : ["Label", "Team"];
+	else if (options.skipTeams) modelNames = [...WORKSPACE_SCOPED_MODELS.filter((m) => m !== "Team" && m !== "TeamProject"), "ProjectMembership"];
+	else modelNames = [...WORKSPACE_SCOPED_MODELS, ...THINGS_MEMBERSHIP_MODELS];
 	const rowsByModel = await loadWorkspaceScopedRowsByModel(options.context, {
 		apiBaseUrl: options.commandContext.apiBaseUrl,
 		modelNames,
@@ -8896,6 +9314,7 @@ const loadExistingImportState = async (options) => {
 	});
 	return {
 		existingLabelIdsByTitle: buildExistingLabelIdsByTitle(rowsByModel),
+		existingTeamIdsByName: buildExistingTeamIdsByName(rowsByModel),
 		rowsByModel
 	};
 };
@@ -8913,9 +9332,23 @@ const buildExistingLabelIdsByTitle = (rowsByModel) => {
 	}
 	return labelsByTitle;
 };
+const buildExistingTeamIdsByName = (rowsByModel) => {
+	const rows = rowsByModel.get("Team") ?? [];
+	const teamsByName = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (typeof row !== "object" || row === null) continue;
+		const record = row;
+		if (record.__class !== "Team") continue;
+		const id = typeof record.id === "string" ? record.id : null;
+		const name = typeof record.name === "string" ? record.name.trim() : "";
+		if (!id || name.length === 0) continue;
+		teamsByName.set(normalizeThingsTeamLookupKey(name), id);
+	}
+	return teamsByName;
+};
 const buildExistingIds = (rowsByModel) => {
-	const entries = WORKSPACE_SCOPED_MODELS.map((modelName) => [modelName, collectRowIds(rowsByModel.get(modelName) ?? [], modelName)]);
-	return new Map(entries);
+	const modelNames = [...WORKSPACE_SCOPED_MODELS, ...THINGS_MEMBERSHIP_MODELS];
+	return new Map(modelNames.map((modelName) => [modelName, collectRowIds(rowsByModel.get(modelName) ?? [], modelName)]));
 };
 const buildTransactions = (phaseItems, options) => {
 	const transactions = [];
@@ -8933,6 +9366,7 @@ const buildTransactions = (phaseItems, options) => {
 		if (action === "INSERT") {
 			inserted += 1;
 			existingIds.add(item.modelId);
+			options.existingIds.set(item.modelName, existingIds);
 		} else updated += 1;
 		transactions.push({
 			action,
@@ -9018,6 +9452,7 @@ const runThingsImport = async (options) => {
 	const plan = buildThingsImportPlan({
 		creatorId: options.creatorId,
 		existingLabelsByTitle: existingState.existingLabelIdsByTitle,
+		existingTeamsByName: existingState.existingTeamIdsByName,
 		metadataMode: options.metadataMode,
 		skipTeams: options.skipTeams,
 		snapshot,
@@ -9246,6 +9681,30 @@ const runLabelCreate = async (context, title, options) => {
 	}
 	writeSuccess(context, `Created label: ${title.trim()}`);
 };
+/**
+* A TaskLabel row is keyed on task, label and workspace together, so a DELETE
+* needs `workspaceId` as much as an INSERT does: without it the server cannot
+* address the row and rejects the mutation.
+*/
+const buildTaskLabelTransaction = (options) => {
+	const { action, clientId, labelId, taskId, workspaceId } = options;
+	const key = {
+		labelId,
+		taskId,
+		workspaceId
+	};
+	return {
+		action,
+		clientId,
+		clientTxId: randomUUID(),
+		modelId: `${taskId}:${labelId}`,
+		modelName: "TaskLabel",
+		payload: action === "INSERT" ? {
+			...key,
+			createdAt: Date.now()
+		} : key
+	};
+};
 const runLabelAdd = async (context, taskRef, labelRef, options) => {
 	const commandContext = await resolveCommandContext(context);
 	const workspaceRef = normalizeWorkspaceRef(options.workspace);
@@ -9263,19 +9722,13 @@ const runLabelAdd = async (context, taskRef, labelRef, options) => {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
 			batchId: randomUUID(),
-			transactions: [{
+			transactions: [buildTaskLabelTransaction({
 				action: "INSERT",
 				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
-				modelId: `${task.id}:${label.id}`,
-				modelName: "TaskLabel",
-				payload: {
-					createdAt: Date.now(),
-					labelId: label.id,
-					taskId: task.id,
-					workspaceId: task.workspaceId
-				}
-			}]
+				labelId: label.id,
+				taskId: task.id,
+				workspaceId: task.workspaceId
+			})]
 		},
 		token: commandContext.token
 	});
@@ -9307,17 +9760,13 @@ const runLabelRemove = async (context, taskRef, labelRef, options) => {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
 			batchId: randomUUID(),
-			transactions: [{
+			transactions: [buildTaskLabelTransaction({
 				action: "DELETE",
 				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
-				modelId: `${task.id}:${label.id}`,
-				modelName: "TaskLabel",
-				payload: {
-					labelId: label.id,
-					taskId: task.id
-				}
-			}]
+				labelId: label.id,
+				taskId: task.id,
+				workspaceId: task.workspaceId
+			})]
 		},
 		token: commandContext.token
 	});
@@ -9522,7 +9971,7 @@ const resolveProjectName = async (context, rawName) => {
 		const trimmed = rawName.trim();
 		if (trimmed.length > 0) return trimmed;
 	}
-	const { promptForValue } = await import("./prompt-B7mDo4K7.mjs");
+	const { promptForValue } = await import("./prompt--P7Y1FBL.mjs");
 	const prompted = await promptForValue(context, "Project name");
 	if (prompted) return prompted;
 	throw new CliError("Project name is required.", EXIT_CODES.VALIDATION, "Provide a name: donebear project add \"My project\"");
@@ -9958,7 +10407,7 @@ Examples:
 //#endregion
 //#region src/commands/spec.ts
 const OVERVIEW = {
-	authentication: "Set DONEBEAR_TOKEN env var, or run: donebear auth login",
+	authentication: "Set DONEBEAR_TOKEN env var, run: donebear auth login, or create an account with donebear auth signup --email <human-email>",
 	commands: {
 		"api-key": {
 			description: "Manage personal API keys",
@@ -9974,8 +10423,9 @@ const OVERVIEW = {
 			quick_example: "donebear auth status --json",
 			subcommands: [
 				"login",
-				"status",
-				"logout"
+				"logout",
+				"signup",
+				"status"
 			]
 		},
 		comment: {
@@ -10205,6 +10655,44 @@ const COMMAND_SPECS = {
 		},
 		usage: "donebear auth login [options]"
 	},
+	"auth signup": {
+		command: "auth signup",
+		examples: ["donebear auth signup --email person@example.com", "donebear auth signup --email person@example.com --json --no-interactive"],
+		json_output: {
+			apiKey: "{ id, key, prefix, scopes }",
+			email: "string",
+			instructions: "{ agent, human }",
+			mcp: "{ url, headers, cursor, claude }",
+			ok: "boolean",
+			sessionStored: "boolean",
+			status: "complete",
+			user: "{ id, email }",
+			verifyUrl: "string",
+			workspace: "{ id, name, urlKey }"
+		},
+		non_interactive: "Requires --email. Do not invent an address. --json and --no-interactive print the verify link on stderr, poll until the human verifies, then emit one complete JSON object on stdout. If the email is already registered, run donebear auth login instead.",
+		notes: "Creates a real human workspace after email verification, then mints a db_ API key with read+write (not admin). WorkOS agent_auth and RFC 8628 device code are not offered.",
+		options: {
+			"--email": {
+				description: "Human email to verify. Required. Do not invent an address.",
+				type: "string"
+			},
+			"--name": {
+				description: "Optional display name",
+				type: "string"
+			},
+			"--no-interactive": {
+				description: "Never prompt for the email code; poll the verify link instead",
+				type: "boolean"
+			},
+			"--timeout": {
+				default: 600,
+				description: "Seconds to wait for email verification",
+				type: "number"
+			}
+		},
+		usage: "donebear auth signup [options]"
+	},
 	"auth status": {
 		command: "auth status",
 		examples: ["donebear auth status --json"],
@@ -10878,17 +11366,16 @@ const COMMAND_SPECS = {
 		command: "task list",
 		examples: [
 			"donebear task list --json",
-			"donebear task list --state done --json",
+			"donebear task list --view logbook --json",
 			"donebear task list --view today --json",
 			"donebear task list --search \"login\" --json"
 		],
 		json_output: {
 			autoSelected: "boolean",
 			count: "number",
-			limited: "TaskRecord[]",
-			ok: "boolean",
-			search: "string | null",
 			state: "string",
+			tasks: "TaskRecord[]",
+			total: "number",
 			view: "string | null",
 			workspace: "WorkspaceSummary"
 		},
@@ -10913,13 +11400,15 @@ const COMMAND_SPECS = {
 				type: "string"
 			},
 			"--view": {
-				description: "Filter by view bucket",
+				description: "Filter by view bucket. logbook and trash widen the state to done and archived, so they read the completed and archived tasks whatever --state says; every other view reads --state, and pairing --state done with one of them matches nothing",
 				enum: [
 					"inbox",
 					"anytime",
 					"today",
 					"upcoming",
-					"someday"
+					"someday",
+					"logbook",
+					"trash"
 				],
 				type: "string"
 			},
@@ -11060,6 +11549,44 @@ const COMMAND_SPECS = {
 		options: {},
 		usage: "donebear whoami"
 	},
+	"workspace invite": {
+		arguments: { workspace: {
+			description: "Workspace id, urlKey, or name. Defaults to the current workspace.",
+			required: false,
+			type: "string"
+		} },
+		command: "workspace invite",
+		examples: [
+			"donebear workspace invite --email user@example.com --role member",
+			"donebear workspace invite --share --copy",
+			"donebear workspace invite --share --project <project-id>"
+		],
+		json_output: {
+			invitation: "WorkspaceInvitationRecord",
+			workspace: "WorkspaceRecord"
+		},
+		notes: "Email invites are single-use. --share mints a reusable /join?code= link. --project requires --share.",
+		options: {
+			"--email": {
+				description: "Email address to invite (single-use)",
+				type: "string"
+			},
+			"--project": {
+				description: "Scope a share link so joiners also become members of this project",
+				type: "string"
+			},
+			"--role": {
+				default: "member",
+				description: "Role for an email invite: member|admin",
+				type: "string"
+			},
+			"--share": {
+				description: "Create a reusable join link instead of an email invite",
+				type: "boolean"
+			}
+		},
+		usage: "donebear workspace invite [workspace] [options]"
+	},
 	"workspace list": {
 		command: "workspace list",
 		examples: ["donebear workspace list --json"],
@@ -11102,10 +11629,11 @@ const TOP_LEVEL_SPECS = {
 	auth: {
 		command: "auth",
 		description: "Authentication",
-		non_interactive: "Set DONEBEAR_TOKEN=<token> to skip interactive login.",
+		non_interactive: "Set DONEBEAR_TOKEN=<token> to skip interactive login. New accounts: donebear auth signup --email <human-email> --json --no-interactive.",
 		subcommands: {
 			login: "OAuth login (Google or GitHub)",
 			logout: "Sign out and remove stored session",
+			signup: "Create an account from a human email (agent signup)",
 			status: "Show auth status"
 		},
 		tip: "donebear spec auth login: get full spec for auth login"
@@ -11192,7 +11720,7 @@ const TOP_LEVEL_SPECS = {
 			create: "Create a new workspace",
 			current: "Show the active workspace",
 			invitations: "List pending invitations",
-			invite: "Invite a user by email",
+			invite: "Invite by email, or mint a reusable --share join link",
 			join: "Join a workspace by invite",
 			list: "List all workspaces",
 			members: "List workspace members",
@@ -11240,6 +11768,7 @@ Examples:
   donebear spec project list     Detailed spec for project list
   donebear spec import things    Detailed spec for the Things importer
   donebear spec search           Detailed spec for search
+  donebear spec auth signup      Agent signup from a human email
   donebear spec auth login       Auth login options and non-interactive notes
 `).action(async (command, subcommand, _options, cmd) => {
 		const context = contextFromCommand(cmd);
@@ -11698,10 +12227,14 @@ const runWorkspaceInvite = async (context, workspaceRefArg, workspaceOverride, o
 		token: commandContext.token,
 		workspaceRef: workspaceOverride ?? workspaceRefArg ?? null
 	});
+	if (options.share && options.email) throw new CliError("Use --share or --email, not both.", EXIT_CODES.VALIDATION);
+	if (options.project && !options.share) throw new CliError("--project requires --share.", EXIT_CODES.VALIDATION);
 	const invitation = await createWorkspaceInvitation(context, {
 		baseUrl: commandContext.apiBaseUrl,
 		email: options.email,
-		role: options.role ?? "member",
+		kind: options.share ? "share" : void 0,
+		projectId: options.project,
+		role: options.share ? "member" : options.role ?? "member",
 		token: commandContext.token,
 		workspaceId: workspace.id
 	});
@@ -11717,7 +12250,7 @@ const runWorkspaceInvite = async (context, workspaceRefArg, workspaceOverride, o
 	writeInfo(context, `role: ${invitation.role}`);
 	writeInfo(context, `expires: ${invitation.expiresAt}`);
 	if (invitation.email) writeInfo(context, `email: ${invitation.email}`);
-	const link = `${commandContext.apiBaseUrl}/invite/${invitation.code}`;
+	const link = `${DEFAULT_APP_URL}/join?code=${encodeURIComponent(invitation.code)}`;
 	writeInfo(context, `link: ${link}`);
 	if (context.copy) {
 		if (copyToClipboard(link)) writeInfo(context, "Link copied to clipboard.");
@@ -11733,6 +12266,8 @@ Examples:
   donebear workspace members
   donebear workspace invitations
   donebear workspace invite --email user@example.com --role member
+  donebear workspace invite --share --copy
+  donebear workspace invite --share --project <project-id>
 `).action(async (_options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
@@ -11787,7 +12322,7 @@ Examples:
 			await runWorkspaceInvitations(context, workspaceRef, workspaceOverride);
 		});
 	});
-	workspace.command("invite").description("Create an invitation for the current or specified workspace").argument("[workspace]", "Workspace id, slug, or exact name").option("--email <email>", "Email address to invite").option("--role <role>", "Role for the invitee: member|admin", "member").action(async (workspaceRef, options, command) => {
+	workspace.command("invite").description("Create an invitation for the current or specified workspace").argument("[workspace]", "Workspace id, slug, or exact name").option("--email <email>", "Email address to invite").option("--share", "Create a reusable join link").option("--project <id>", "Scope a share link: joiners join the whole workspace as a member, get this project, and use a seat").option("--role <role>", "Role for the invitee: member|admin", "member").action(async (workspaceRef, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
 			await runWorkspaceInvite(context, workspaceRef, workspaceOverride, options);
@@ -11815,8 +12350,9 @@ With auth:
   donebear import things --dry-run --json
 
 Auth:
-  donebear auth login            OAuth browser login
-  DONEBEAR_TOKEN=<token>         Non-interactive / CI: set this env var
+  donebear auth signup --email you@…   Create an account (human verifies email)
+  donebear auth login                  OAuth browser login
+  DONEBEAR_TOKEN=<token>               Non-interactive / CI: set this env var
 
 Workspace targeting:
   donebear workspace=myorg task list