donebear 0.4.3 → 0.4.4

package/dist/cli.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as toCliError, b as DONEBEAR_TOKEN_ENV, d as DEFAULT_OAUTH_CALLBACK_PATH, f as DEFAULT_OAUTH_CALLBACK_PORT, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, r as CliError, s as CLI_NAME, t as ensureLocalContext } from "./context-store-BBEVWudm.mjs";
-import { n as readStdin, t as promptForValue } from "./prompt-GfcWO85b.mjs";
+import { a as toCliError, d as DEFAULT_APP_URL, f as DEFAULT_OAUTH_CALLBACK_PATH, i as EXIT_CODES, l as CONFIG_DIR, n as setCurrentWorkspace, o as AUTH_FILE_PATH, p as DEFAULT_OAUTH_CALLBACK_PORT, r as CliError, s as CLI_NAME, t as ensureLocalContext, x as DONEBEAR_TOKEN_ENV } from "./context-store-BbZMKY0F.mjs";
+import { n as readStdin, t as promptForValue } from "./prompt-B66eG-Zm.mjs";
 import { createRequire } from "node:module";
 import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
@@ -18,7 +18,27 @@ import { createServer } from "node:http";
 import { fileURLToPath } from "node:url";
 import Database from "better-sqlite3";
 //#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
 //#endregion
 //#region src/output.ts
 const writeLine = (stream, message) => {
@@ -1291,7 +1311,7 @@ const WORKSPACE_INVITATION_CREATE_MUTATION = `
   mutation WorkspaceInvitationCreate($input: WorkspaceInvitationCreateInput!) {
     workspaceInvitationCreate(input: $input) {
       success lastSyncId
-      invitation { id email code role expiresAt createdAt usedAt usedByUserId workspaceId }
+      invitation { id email code role expiresAt createdAt usedAt usedByUserId workspaceId kind projectId }
     }
   }
 `;
@@ -1766,6 +1786,8 @@ const listWorkspaceInvitations = async (context, options) => await paginateGraph
 const createWorkspaceInvitation = async (context, options) => {
 	const input = omitUndefined({
 		email: options.email,
+		kind: options.kind,
+		projectId: options.projectId,
 		role: options.role,
 		workspaceId: options.workspaceId
 	});
@@ -2231,6 +2253,183 @@ const createOAuthState = () => randomBytes(24).toString("hex");
 const createCodeVerifier = () => randomBytes(64).toString("base64url");
 const createCodeChallenge = (verifier) => createHash("sha256").update(verifier).digest().toString("base64url");
 //#endregion
+//#region src/api/agent-signup.ts
+const parseJson = async (response) => {
+	const raw = await response.text();
+	if (raw.length === 0) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return raw;
+	}
+};
+const throwForFailure = (status, payload) => {
+	const message = typeof payload === "string" && payload.length > 0 ? payload : extractErrorMessage(payload);
+	const record = typeof payload === "object" && payload !== null ? payload : {};
+	const code = typeof record.code === "string" ? record.code : null;
+	if (status === 409 || code === "DUPLICATE_EMAIL") throw new CliError(message, EXIT_CODES.AUTH_REQUIRED, "Run `donebear auth login` with this email. Do not start another signup.");
+	if (status === 429 || code === "RATE_LIMIT_EXCEEDED") throw new CliError(message, EXIT_CODES.ERROR, "Wait, then retry.");
+	if (status === 400 || code === "INVALID_REQUEST") throw new CliError(message, EXIT_CODES.VALIDATION);
+	throw new CliError(message, EXIT_CODES.ERROR);
+};
+const request = async (endpoint, options) => {
+	const headers = new Headers({ Accept: "application/json" });
+	if (options.token) headers.set("Authorization", `Bearer ${options.token}`);
+	if (options.body !== void 0) headers.set("Content-Type", "application/json");
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+			headers,
+			method: options.method ?? "GET"
+		});
+	} catch (error) {
+		throw new CliError("Cannot connect to Done Bear API.", EXIT_CODES.NETWORK, error instanceof Error ? error.message : void 0);
+	}
+	const payload = await parseJson(response);
+	if (!response.ok) throwForFailure(response.status, payload);
+	return payload;
+};
+const startAgentSignup = async (_context, apiBaseUrl, input) => {
+	return await request(`${apiBaseUrl}/api/agent-signup`, {
+		body: {
+			email: input.email,
+			...input.name ? { name: input.name } : {}
+		},
+		method: "POST"
+	});
+};
+const pollAgentSignup = async (_context, apiBaseUrl, pollToken) => {
+	return await request(`${apiBaseUrl}/api/agent-signup/poll`, {
+		method: "GET",
+		token: pollToken
+	});
+};
+const verifyAgentSignupCode = async (_context, apiBaseUrl, input) => {
+	return await request(`${apiBaseUrl}/api/agent-signup/verify`, {
+		body: input,
+		method: "POST"
+	});
+};
+//#endregion
+//#region src/commands/auth-signup.ts
+const MISSING_EMAIL_MESSAGE = "Pass --email with the human's address. Do not invent one.";
+const POLL_INTERVAL_MS = 2e3;
+const defaultClock = {
+	now: () => Date.now(),
+	sleep: (ms, signal) => new Promise((resolve, reject) => {
+		if (signal.aborted) {
+			resolve();
+			return;
+		}
+		const timer = setTimeout(resolve, ms);
+		signal.addEventListener("abort", () => {
+			clearTimeout(timer);
+			reject(/* @__PURE__ */ new Error("aborted"));
+		}, { once: true });
+	})
+};
+const isComplete = (value) => value.status === "complete";
+const printWaiting = (context, verifyUrl, instructions) => {
+	writeWarning(context, instructions.agent);
+	writeWarning(context, instructions.human);
+	writeWarning(context, `Verify link: ${verifyUrl}`);
+	writeWarning(context, "Waiting for the human to verify. The CLI will continue once that happens.");
+};
+const sessionFromComplete = (complete) => ({
+	accessToken: complete.apiKey.key,
+	createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+	expiresAt: null,
+	provider: "oauth2",
+	refreshToken: null,
+	tokenType: "bearer",
+	user: {
+		email: complete.user.email,
+		id: complete.user.id
+	}
+});
+const printComplete = (context, complete, verifyUrl) => {
+	if (context.json) {
+		writeJson({
+			apiKey: complete.apiKey,
+			email: complete.email,
+			instructions: {
+				agent: "Store the API key as DONEBEAR_TOKEN. Paste mcp.cursor into the MCP config. Do not log the full key.",
+				human: "Verification is done."
+			},
+			mcp: complete.mcp,
+			ok: true,
+			sessionStored: true,
+			status: "complete",
+			user: complete.user,
+			verifyUrl,
+			workspace: complete.workspace
+		});
+		return;
+	}
+	writeSuccess(context, "Signup complete. API key stored in the CLI session.");
+	writeInfo(context, `Signed in as ${complete.user.email}`);
+	writeInfo(context, `Workspace: ${complete.workspace.name} (${complete.workspace.urlKey ?? complete.workspace.id})`);
+	writeInfo(context, "API key (shown once):");
+	writeInfo(context, complete.apiKey.key);
+	writeInfo(context, "Paste-ready MCP config for Cursor:");
+	writeInfo(context, JSON.stringify(complete.mcp.cursor, null, 2));
+	writeInfo(context, complete.mcp.claude);
+};
+const runAgentSignup = async (context, options, clock = defaultClock) => {
+	const email = options.email?.trim() ?? "";
+	if (email.length === 0) throw new CliError(MISSING_EMAIL_MESSAGE, EXIT_CODES.VALIDATION, "Example: donebear auth signup --email person@example.com");
+	const apiBaseUrl = resolveApiBaseUrl(context);
+	const started = await startAgentSignup(context, apiBaseUrl, {
+		email,
+		name: options.name?.trim() || void 0
+	});
+	printWaiting(context, started.verifyUrl, started.instructions);
+	const abort = new AbortController();
+	const canPrompt = options.interactive && process.stdin.isTTY && !context.json && !context.quiet;
+	let submittedCode = null;
+	const promptTask = canPrompt ? promptForValue(context, "6-digit email code", abort.signal).then((value) => {
+		submittedCode = value;
+	}) : Promise.resolve();
+	const deadline = clock.now() + options.timeout * 1e3;
+	try {
+		while (clock.now() < deadline) {
+			if (submittedCode) {
+				const verified = await verifyAgentSignupCode(context, apiBaseUrl, {
+					code: submittedCode,
+					pollToken: started.pollToken
+				});
+				if (isComplete(verified)) {
+					abort.abort();
+					await writeStoredAuthSession(sessionFromComplete(verified));
+					printComplete(context, verified, started.verifyUrl);
+					return;
+				}
+				if (verified.status === "consumed") throw new CliError(verified.message, EXIT_CODES.ERROR);
+				submittedCode = null;
+			}
+			const polled = await pollAgentSignup(context, apiBaseUrl, started.pollToken);
+			if (isComplete(polled)) {
+				abort.abort();
+				await writeStoredAuthSession(sessionFromComplete(polled));
+				printComplete(context, polled, started.verifyUrl);
+				return;
+			}
+			if (polled.status === "consumed") throw new CliError(polled.message, EXIT_CODES.ERROR);
+			try {
+				await clock.sleep(POLL_INTERVAL_MS, abort.signal);
+			} catch {
+				break;
+			}
+		}
+	} finally {
+		abort.abort();
+		await promptTask.catch(() => void 0);
+	}
+	throw new CliError("Signup timed out before the email was verified.", EXIT_CODES.ERROR, "Ask the human to open the verify link, then run this command again if the code expired.");
+};
+const parseSignupTimeout = (value) => parsePositiveInteger(value, "Timeout");
+//#endregion
 //#region src/commands/auth.ts
 const runLogin = async (context, options) => {
 	const { authorizeUrl, tokenUrl } = buildOAuthUrls(resolveSupabaseConfig());
@@ -2333,6 +2532,7 @@ const getOptionalSupabaseConfig = () => {
 const registerAuthCommands = (program) => {
 	const auth = program.command("auth").description("Authenticate donebear CLI").addHelpText("after", `
 Examples:
+  donebear auth signup --email person@example.com --json
   donebear auth login
   donebear auth login --no-open     (print URL, don't open browser)
   donebear auth status --json
@@ -2361,6 +2561,25 @@ Non-interactive / CI use:
 			await runLogin(context, options);
 		});
 	});
+	auth.command("signup").description("Create a Done Bear account from a human email (agent signup)").option("--email <email>", "Human email to verify. Do not invent one.").option("--name <name>", "Optional display name").option("--timeout <seconds>", "Seconds to wait for email verification", parseSignupTimeout, 600).option("--no-interactive", "Never prompt for the email code; poll the verify link instead").addHelpText("after", `
+Creates a real human account. One person must verify the email (code or link).
+Do not invent an email address. If the address is already registered, run
+\`donebear auth login\` instead.
+
+Examples:
+  donebear auth signup --email person@example.com
+  donebear auth signup --email person@example.com --json --no-interactive
+`).action(async (options, command) => {
+		const context = contextFromCommand(command);
+		await runWithErrorHandling(context, async () => {
+			await runAgentSignup(context, {
+				email: options.email,
+				interactive: options.interactive !== false,
+				name: options.name,
+				timeout: options.timeout
+			});
+		});
+	});
 	auth.command("status").description("Check authentication status").action(async (_options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
@@ -2566,6 +2785,11 @@ const createTeamProjectId = (params) => createCompositeSyncId("TeamProject", [
 	params.teamId,
 	params.projectId
 ]);
+const createTeamMembershipId = (params) => createCompositeSyncId("TeamMembership", [
+	params.workspaceId,
+	params.teamId,
+	params.userId
+]);
 const createProjectMembershipId = (params) => createCompositeSyncId("ProjectMembership", [
 	params.workspaceId,
 	params.projectId,
@@ -3987,7 +4211,7 @@ const checkAuth = async (context) => {
 };
 const checkWorkspace = async () => {
 	try {
-		const { ensureLocalContext } = await import("./context-store-ClAx1T2N.mjs");
+		const { ensureLocalContext } = await import("./context-store-D8zfa5LS.mjs");
 		const localContext = await ensureLocalContext();
 		if (!localContext.workspaceId) return {
 			message: "No workspace selected (run `donebear workspace use`)",
@@ -4309,6 +4533,10 @@ state and start date rather than stored as a column:
 
 - inbox     captured, not yet placed
 - today     start date today or earlier
+
+A private email address (Settings on the web) can also drop a message into
+today as a task: subject is the title, body is the notes. Slack capture is
+unchanged.
 - upcoming  start date in the future
 - anytime   actionable now, no date pressure
 - someday   parked, off every working list
@@ -4324,7 +4552,9 @@ completed task's view is logbook, so \`--state done --view today\` matches
 nothing. What was finished today or this week comes off the completion date,
 not the ordering: the list prints it in the \`completed\` column, \`task show
 --json\` reports it as \`completedAtIso\`, and each row from \`task list --json\`
-carries \`completedAt\`.
+carries \`completedAt\`. The iOS and web apps can keep completed to-dos on Today
+until a day roll or Log Completed (Settings → Preferences → Logging). The CLI
+still treats every completed task as logbook.
 
     donebear task add "Renew passport" --when upcoming --deadline 2030-03-01 --json
     donebear task list --view logbook --json
@@ -4382,8 +4612,16 @@ Clear a date with the explicit flag rather than passing an empty value:
     donebear task edit 12 --clear-deadline --json
     donebear project edit launch --clear-target-date --json
 
-Repeating tasks exist in Done Bear but are not editable from the CLI. If a user
-asks to make something repeat, say so rather than creating a run of copies.`,
+Repeat rules are configured in the app and cannot be edited from the CLI. If a user
+asks to make something repeat, say so rather than creating a run of copies.
+
+Upcoming copies can be edited or completed early. Fixed repeats keep their
+calendar schedule; after-completion repeats count from actual completion.
+CLI date edits affect the copy only. Use When in the app to choose Make
+Exception or Update Rule for a fixed series. Custom and count-limited
+patterns need the Repeat editor.
+In the app, search for Repeating to see rules and upcoming copies. Select multiple
+repeating tasks and use More to pause, resume, or stop their series.`,
 		title: "Dates and deadlines",
 		whenToUse: "Setting or clearing a due date, or choosing between a deadline and a start date."
 	},
@@ -4400,6 +4638,10 @@ never have to read a task first just to preserve its other fields.
 - cleared   use the paired flag: \`--clear-deadline\`, \`--clear-project\`,
             \`--clear-team\`, \`--clear-description\`.
 
+The description is markdown. Write a link as a bare URL (\`https://…\`), which
+every client shows as a link; \`<https://…>\` shows its angle brackets on iOS
+and here.
+
 Not on \`task edit\`:
 
 - labels      \`donebear label add|remove\`
@@ -4593,9 +4835,21 @@ off unless the user named a second one:
 Ids and names never cross workspaces. A missing task, project, or label is
 missing from *this* workspace before it is deleted.
 
+A workspace owner can turn on domain join from Settings → Members. People who
+later sign in with a verified address on that work domain join as members,
+without an invite code. Personal email hosts cannot be used. The CLI has no
+domain-join command; joining by code remains \`donebear workspace join\`.
+
 Auth precedence: \`DONEBEAR_TOKEN\` in the environment, then the stored session
-from \`donebear auth login\`. Set the env var for anything non-interactive; the
-browser login flow will hang in CI.
+from \`donebear auth login\` or \`donebear auth signup\`. Set the env var for
+anything non-interactive; the browser login flow will hang in CI.
+
+New accounts from a coding agent: \`donebear auth signup --email <human-email>
+--json --no-interactive\`. Do not invent an email. One human step verifies it
+(link or 6-digit code). The CLI then stores a \`db_\` key with read+write and
+prints paste-ready MCP config for \`https://mcp.donebear.com/mcp\`. If that
+email is already registered, run \`donebear auth login\` instead. WorkOS
+\`agent_auth\` and RFC 8628 device code are not offered.
 
     export DONEBEAR_TOKEN=<token>
     donebear whoami --json
@@ -4605,6 +4859,15 @@ write fails with an explicit message rather than silently doing nothing — tell
 the user they need a write-scoped key rather than trying to work around it.
 \`donebear doctor --json\` reports which of these is actually in effect.
 
+## Invites and share links
+
+\`donebear workspace invite --email user@example.com\` sends a single-use
+email invite. \`donebear workspace invite --share --copy\` mints a reusable
+join link at \`https://donebear.com/join?code=\`. \`--project <id>\` on
+\`--share\` scopes the link: whoever opens it joins the whole workspace as a
+member, gets that project, and uses a seat. Join with
+\`donebear workspace join <code>\` or by opening the link while signed in.
+
 ## Task attachments (read-only)
 
 Tasks can carry file/image attachments, capped at 10 MB per file and roughly
@@ -4625,6 +4888,9 @@ Three commands orient you, in order of cost:
     donebear guide <topic>     concepts and conventions, no auth
     donebear context --json    the live workspace: counts, recent tasks, projects
 
+No account yet: \`donebear auth signup --email <human-email> --json --no-interactive\`.
+Do not invent the email. A human verifies it, then the CLI stores a \`db_\` key.
+
 \`donebear spec <command> <subcommand>\` narrows to one command's flags, output
 shape, and examples. Read that before guessing at a flag.
 
@@ -4653,22 +4919,25 @@ workspace from the token.`,
 
 Two importers exist, and they are not the same thing.
 
+**In the apps**, Settings → Integrations & Import (web) and Settings → Import
+(iOS: Reminders, Todoist, Things) cover Todoist, TickTick, Microsoft To Do, Any.do, Apple
+Reminders, Things 3, Trello, Asana, Notion, Google Tasks, and plain CSV, JSON or
+iCal files. Things 3 is no longer CLI-only: on iPhone, Things → Settings →
+General → Diagnostics → Enter Code → \`491348\` → Send Things Database, then
+upload the \`.aar\` under Settings → Import → Things, or \`main.sqlite\` on the web.
+
 **In the terminal**, \`donebear import things\` reads a copy of a Things 3
 SQLite database and writes it into a workspace. It is the only import this CLI
-performs. \`donebear spec import things\` lists its flags.
+performs. \`donebear spec import things\` lists its flags. It is the power-user
+path; send people to the apps first.
 
 On macOS it finds that database itself — \`donebear import things --dry-run\`
-with no other flags is the whole command. This is worth volunteering, because
-Things keeps its database inside a folder Finder hides, under a dated directory
-whose name nobody can guess, and people hunting for it in Finder is the single
-most common way this import stalls. \`--database-url\` is for a database
-somewhere unusual: a backup, an external disk, another machine's copy.
+with no other flags is the whole command. \`--database-url\` is for a database
+somewhere unusual: an iPhone export, a backup, an external disk, another
+machine's copy.
 
-**In the web app**, Settings → Integrations & Import covers Todoist, TickTick,
-Microsoft To Do, Any.do, Apple Reminders, Things 3, Trello, Asana, Notion,
-Google Tasks, and plain CSV, JSON or iCal files. If a user asks how to move a
-backlog in from anything other than Things, that is where to send them; there
-is no CLI equivalent to offer.
+If a user asks how to move a backlog in from anything other than Things, that is
+the web import screen; there is no CLI equivalent to offer.
 
 Each of those is a file the user exports and uploads — Todoist from Settings →
 Backups, Google Tasks from Google Takeout, Microsoft To Do from a read-only
@@ -4677,6 +4946,13 @@ that may change: a read-only connect flow is being built so Done Bear can make
 that call instead, so treat the Graph export as the current route and check the
 import screen before promising a connection.
 
+Every importer, here and in the apps, only reads the source; none of them
+writes, edits or deletes anything in the app being left. The one path that
+does is Reminders Inbox on iPhone (Settings → Import → Reminders Inbox), which
+is a capture bridge rather than an import: a chosen Reminders list shows at the
+top of Inbox, and importing a to-do from there creates the task and removes it
+from Reminders after a confirmation. It has no CLI equivalent.
+
 The other direction is here though: \`donebear export\` writes a portable JSON
 archive of a workspace, and the web importer restores one.
 
@@ -4709,9 +4985,8 @@ only what is new.
 
 There is no undo for \`donebear import things\`; a run has to be unpicked by
 hand. The web importer does offer one on its completion screen, but the receipt
-lives in the browser that ran the import, so it cannot be reached from the CLI,
-another device or the iOS app. Say that plainly rather than sending someone
-looking for a flag.`,
+lives in the browser that ran the import. An iOS import is undone with the
+usual undo for that change, not from the web receipt.`,
 		title: "Importing from another app",
 		whenToUse: "Moving a backlog in from Things 3 or another task manager, or restoring an export."
 	}
@@ -4952,9 +5227,10 @@ const createDeterministicImportId = (params) => createDeterministicId(THINGS_IMP
 //#endregion
 //#region ../../packages/import-core/src/things/labels.ts
 const normalizeThingsLabelLookupKey = (value) => value.trim().toLocaleLowerCase();
+const normalizeThingsTeamLookupKey = (value) => value.trim().toLocaleLowerCase();
 //#endregion
 //#region ../../packages/import-core/src/things/values.ts
-var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
+var import_rrule = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function webpackUniversalModuleDefinition(root, factory) {
 		if (typeof exports === "object" && typeof module === "object") module.exports = factory();
 		else if (typeof define === "function" && define.amd) define([], factory);
@@ -7708,7 +7984,7 @@ var import_rrule = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return __webpack_exports__;
 		})();
 	});
-})))();
+})))(), 1);
 const PACKED_DATE_MULTIPLIER = 128;
 const PACKED_DATE_DAY_MASK = 31;
 const PACKED_DATE_MONTH_MASK = 15;
@@ -7769,6 +8045,7 @@ const combineThingsReminderAt = (options) => {
 };
 //#endregion
 //#region ../../packages/import-core/src/things/recurrence.ts
+const { RRule, rrulestr } = typeof import_rrule.RRule === "function" ? import_rrule : import_rrule.default;
 const THINGS_FREQUENCY_TO_RRULE = new Map([
 	[4, "YEARLY"],
 	[8, "MONTHLY"],
@@ -7809,8 +8086,8 @@ const parseOffsets = (xml) => {
 };
 const parseRRule = (rule) => {
 	try {
-		const parsed = (0, import_rrule.rrulestr)(rule);
-		return parsed instanceof import_rrule.RRule ? parsed : null;
+		const parsed = rrulestr(rule);
+		return parsed instanceof RRule ? parsed : null;
 	} catch {
 		return null;
 	}
@@ -8016,14 +8293,14 @@ const pickCompletedAt = (task) => {
 	return decodeThingsUnixSeconds(task.stopDate) ?? decodeThingsUnixSeconds(task.userModificationDate) ?? decodeThingsUnixSeconds(task.creationDate);
 };
 const sortValue = (primary, fallback) => typeof primary === "number" ? primary : fallback;
-const textDecoder = new TextDecoder();
+const textDecoder$1 = new TextDecoder();
 const encodeBase64 = (value) => {
 	let binary = "";
 	for (const byte of value) binary += String.fromCodePoint(byte);
 	return btoa(binary);
 };
 const sanitizeBinary = (value) => {
-	const asText = textDecoder.decode(value);
+	const asText = textDecoder$1.decode(value);
 	if (!asText.includes("�") && READABLE_TEXT_PATTERN.test(asText)) {
 		const trimmed = asText.trim();
 		if (trimmed.length > 0) return trimmed;
@@ -8183,19 +8460,25 @@ const buildChecklistMutation = (options) => {
 };
 const buildTeamActions = (ctx, areas) => {
 	const teams = [];
+	const teamMemberships = [];
+	const membershipIds = /* @__PURE__ */ new Set();
 	for (const area of [...areas].toSorted((a, b) => {
 		const indexComparison = compareNullableNumber(a.sortIndex, b.sortIndex);
 		if (indexComparison !== 0) return indexComparison;
 		return a.uuid.localeCompare(b.uuid);
 	})) {
-		const teamId = createDeterministicImportId({
+		const teamName = normalizeTitle(area.title, `Area ${area.uuid.slice(0, 8)}`);
+		const teamLookupKey = normalizeThingsTeamLookupKey(teamName);
+		const existingTeamId = ctx.existingTeamIdByName.get(teamLookupKey);
+		const teamId = existingTeamId ?? createDeterministicImportId({
 			modelName: "Team",
 			sourceId: area.uuid,
 			workspaceId: ctx.workspaceId
 		});
+		ctx.existingTeamIdByName.set(teamLookupKey, teamId);
 		ctx.areaTeamIdBySourceId.set(area.uuid, teamId);
 		const areaTagTitles = (ctx.areaTagMap.get(area.uuid) ?? []).map((link) => ctx.tagTitleById.get(link.tagId) ?? null).filter((title) => typeof title === "string");
-		teams.push({
+		if (!existingTeamId) teams.push({
 			modelId: teamId,
 			modelName: "Team",
 			payload: {
@@ -8204,14 +8487,36 @@ const buildTeamActions = (ctx, areas) => {
 				description: appendMetadataBlock(null, ctx.metadataMode, buildAreaMetadata(area, areaTagTitles)),
 				icon: null,
 				key: ctx.teamKeys.get(area.uuid) ?? "AREA",
-				name: normalizeTitle(area.title, `Area ${area.uuid.slice(0, 8)}`),
+				name: teamName,
 				updatedAt: ctx.createdAtFallback,
 				workspaceId: ctx.workspaceId
 			},
 			sourceId: area.uuid
 		});
+		const membershipId = createTeamMembershipId({
+			teamId,
+			userId: ctx.creatorId,
+			workspaceId: ctx.workspaceId
+		});
+		if (!membershipIds.has(membershipId)) {
+			membershipIds.add(membershipId);
+			teamMemberships.push({
+				modelId: membershipId,
+				modelName: "TeamMembership",
+				payload: {
+					createdAt: ctx.createdAtFallback,
+					teamId,
+					userId: ctx.creatorId,
+					workspaceId: ctx.workspaceId
+				},
+				sourceId: `${area.uuid}:${ctx.creatorId}`
+			});
+		}
 	}
-	return teams;
+	return {
+		teamMemberships,
+		teams
+	};
 };
 const buildLabelActions = (ctx, tags) => {
 	const labels = [];
@@ -8244,6 +8549,7 @@ const buildLabelActions = (ctx, tags) => {
 };
 const buildProjectActions = (ctx, sourceProjects) => {
 	const projects = [];
+	const projectMemberships = [];
 	const teamProjects = [];
 	for (const project of [...sourceProjects].toSorted((a, b) => {
 		const indexComparison = compareNullableNumber(a.sortIndex, b.sortIndex);
@@ -8279,6 +8585,21 @@ const buildProjectActions = (ctx, sourceProjects) => {
 			},
 			sourceId: project.uuid
 		});
+		projectMemberships.push({
+			modelId: createProjectMembershipId({
+				projectId,
+				userId: ctx.creatorId,
+				workspaceId: ctx.workspaceId
+			}),
+			modelName: "ProjectMembership",
+			payload: {
+				createdAt: decodeThingsUnixSeconds(project.creationDate) ?? ctx.createdAtFallback,
+				projectId,
+				userId: ctx.creatorId,
+				workspaceId: ctx.workspaceId
+			},
+			sourceId: `${project.uuid}:${ctx.creatorId}`
+		});
 		if (project.areaId !== null) {
 			const teamId = ctx.areaTeamIdBySourceId.get(project.areaId);
 			if (teamId) teamProjects.push({
@@ -8299,6 +8620,7 @@ const buildProjectActions = (ctx, sourceProjects) => {
 		}
 	}
 	return {
+		projectMemberships,
 		projects,
 		teamProjects
 	};
@@ -8551,6 +8873,7 @@ const buildThingsImportPlan = (options) => {
 		createdAtFallback: Date.now(),
 		creatorId: options.creatorId,
 		existingLabelIdByTitle: existingLabelsByTitle ?? /* @__PURE__ */ new Map(),
+		existingTeamIdByName: options.existingTeamsByName ?? /* @__PURE__ */ new Map(),
 		headingIdBySourceId: /* @__PURE__ */ new Map(),
 		metadataMode: options.metadataMode,
 		projectIdBySourceId: /* @__PURE__ */ new Map(),
@@ -8570,12 +8893,15 @@ const buildThingsImportPlan = (options) => {
 		todayDateOnly: localDateToDateOnlyEpoch(/* @__PURE__ */ new Date()),
 		workspaceId
 	};
-	const teams = options.skipTeams ? [] : buildTeamActions(ctx, snapshot.areas);
+	const { teamMemberships, teams } = options.skipTeams ? {
+		teamMemberships: [],
+		teams: []
+	} : buildTeamActions(ctx, snapshot.areas);
 	const labels = buildLabelActions(ctx, snapshot.tags);
 	const sourceProjects = snapshot.tasks.filter((task) => classifyTaskKind(task) === "project");
 	const sourceHeadings = snapshot.tasks.filter((task) => classifyTaskKind(task) === "heading");
 	const sourceTasks = snapshot.tasks.filter((task) => classifyTaskKind(task) === "task");
-	const { projects, teamProjects } = buildProjectActions(ctx, sourceProjects);
+	const { projectMemberships, projects, teamProjects } = buildProjectActions(ctx, sourceProjects);
 	const headings = buildHeadingActions(ctx, sourceHeadings);
 	const { tasks, taskLabels, checklistItems } = buildTaskActions(ctx, sourceTasks);
 	const phases = [
@@ -8583,6 +8909,10 @@ const buildThingsImportPlan = (options) => {
 			items: teams,
 			name: "teams"
 		},
+		{
+			items: teamMemberships,
+			name: "teamMemberships"
+		},
 		{
 			items: labels,
 			name: "labels"
@@ -8591,6 +8921,10 @@ const buildThingsImportPlan = (options) => {
 			items: projects,
 			name: "projects"
 		},
+		{
+			items: projectMemberships,
+			name: "projectMemberships"
+		},
 		{
 			items: teamProjects,
 			name: "teamProjects"
@@ -8632,6 +8966,155 @@ const buildThingsImportPlan = (options) => {
 	};
 };
 //#endregion
+//#region ../../packages/import-core/src/things/snapshot.ts
+const textDecoder = new TextDecoder();
+const THINGS_REQUIRED_TABLE = "TMTask";
+const THINGS_SQLITE_FILE = "main.sqlite";
+const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
+const toThingsStringValue = (value) => {
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		return trimmed.length > 0 ? trimmed : null;
+	}
+	if (value instanceof Uint8Array) {
+		const text = textDecoder.decode(value).trim();
+		return text.length > 0 ? text : null;
+	}
+	return null;
+};
+const toThingsNumberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+const toThingsBooleanValue = (value) => {
+	const numeric = toThingsNumberValue(value);
+	return numeric === null ? null : numeric !== 0;
+};
+const normalizeThingsTaskRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		afterCompletionReferenceDate: toThingsNumberValue(row.rt1_afterCompletionReferenceDate ?? row.afterCompletionReferenceDate),
+		areaId: toThingsStringValue(row.area),
+		contactId: toThingsStringValue(row.contact ?? row.delegate),
+		creationDate: toThingsNumberValue(row.creationDate),
+		deadline: toThingsNumberValue(row.deadline ?? row.dueDate),
+		deadlineOffset: toThingsNumberValue(row.t2_deadlineOffset ?? row.dueDateOffset),
+		deadlineSuppressionDate: toThingsNumberValue(row.deadlineSuppressionDate ?? row.dueDateSuppressionDate),
+		headingId: toThingsStringValue(row.heading ?? row.actionGroup),
+		instanceCreationCount: toThingsNumberValue(row.rt1_instanceCreationCount ?? row.instanceCreationCount),
+		instanceCreationPaused: toThingsBooleanValue(row.rt1_instanceCreationPaused ?? row.instanceCreationPaused) ?? false,
+		instanceCreationStartDate: toThingsNumberValue(row.rt1_instanceCreationStartDate ?? row.instanceCreationStartDate),
+		lastReminderInteractionDate: toThingsNumberValue(row.lastReminderInteractionDate ?? row.lastAlarmInteractionDate),
+		nextInstanceStartDate: toThingsNumberValue(row.rt1_nextInstanceStartDate ?? row.nextInstanceStartDate),
+		notes: toThingsStringValue(row.notes),
+		projectId: toThingsStringValue(row.project),
+		raw: row,
+		recurrenceRuleRaw: toThingsStringValue(row.rt1_recurrenceRule ?? row.recurrenceRule),
+		reminderTime: toThingsNumberValue(row.reminderTime),
+		repeatTemplateSourceId: toThingsStringValue(row.rt1_repeatingTemplate ?? row.repeatingTemplate),
+		repeaterMigrationDate: toThingsNumberValue(row.repeaterMigrationDate),
+		repeaterRaw: toThingsStringValue(row.repeater),
+		sortIndex: toThingsNumberValue(row.index),
+		start: toThingsNumberValue(row.start),
+		startBucket: toThingsNumberValue(row.startBucket),
+		startDate: toThingsNumberValue(row.startDate),
+		status: toThingsNumberValue(row.status),
+		stopDate: toThingsNumberValue(row.stopDate),
+		title: toThingsStringValue(row.title),
+		todayIndex: toThingsNumberValue(row.todayIndex),
+		todayIndexReferenceDate: toThingsNumberValue(row.todayIndexReferenceDate),
+		trashed: toThingsBooleanValue(row.trashed) ?? false,
+		type: toThingsNumberValue(row.type),
+		userModificationDate: toThingsNumberValue(row.userModificationDate),
+		uuid
+	};
+};
+const normalizeThingsAreaRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		raw: row,
+		sortIndex: toThingsNumberValue(row.index),
+		title: toThingsStringValue(row.title),
+		uuid,
+		visible: toThingsBooleanValue(row.visible)
+	};
+};
+const normalizeThingsTagRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		parentId: toThingsStringValue(row.parent),
+		raw: row,
+		shortcut: toThingsStringValue(row.shortcut),
+		sortIndex: toThingsNumberValue(row.index),
+		title: toThingsStringValue(row.title),
+		usedDate: toThingsNumberValue(row.usedDate),
+		uuid
+	};
+};
+const normalizeThingsChecklistItemRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		creationDate: toThingsNumberValue(row.creationDate),
+		raw: row,
+		sortIndex: toThingsNumberValue(row.index),
+		status: toThingsNumberValue(row.status),
+		stopDate: toThingsNumberValue(row.stopDate),
+		taskId: toThingsStringValue(row.task),
+		title: toThingsStringValue(row.title),
+		userModificationDate: toThingsNumberValue(row.userModificationDate),
+		uuid
+	};
+};
+const normalizeThingsTaskTagRecord = (row) => {
+	const taskId = toThingsStringValue(row.tasks);
+	const tagId = toThingsStringValue(row.tags);
+	return taskId && tagId ? {
+		tagId,
+		taskId
+	} : null;
+};
+const normalizeThingsAreaTagRecord = (row) => {
+	const areaId = toThingsStringValue(row.areas);
+	const tagId = toThingsStringValue(row.tags);
+	return areaId && tagId ? {
+		areaId,
+		tagId
+	} : null;
+};
+const normalizeThingsContactRecord = (row) => {
+	const uuid = toThingsStringValue(row.uuid);
+	if (!uuid) return null;
+	return {
+		appleAddressBookId: toThingsStringValue(row.appleAddressBookId),
+		displayName: toThingsStringValue(row.displayName),
+		emails: toThingsStringValue(row.emails),
+		firstName: toThingsStringValue(row.firstName),
+		lastName: toThingsStringValue(row.lastName),
+		raw: row,
+		uuid
+	};
+};
+const mapPresent = (rows, normalize) => rows.map(normalize).filter((record) => record !== null);
+/**
+* Turns raw Things tables into the snapshot `buildThingsImportPlan` consumes.
+* Callers supply the SQL; this is the one place row → record mapping lives.
+*/
+const buildThingsDatabaseSnapshot = (reader, databasePath) => {
+	if (!reader.hasTable("TMTask")) throw new Error("This does not look like a Things 3 database. Select the main.sqlite file that contains the TMTask table.");
+	return {
+		areaTags: reader.hasTable("TMAreaTag") ? mapPresent(reader.readRows("TMAreaTag"), normalizeThingsAreaTagRecord) : [],
+		areas: reader.hasTable("TMArea") ? mapPresent(reader.readRows("TMArea"), normalizeThingsAreaRecord) : [],
+		checklistItems: reader.hasTable("TMChecklistItem") ? mapPresent(reader.readRows("TMChecklistItem"), normalizeThingsChecklistItemRecord) : [],
+		contacts: reader.hasTable("TMContact") ? mapPresent(reader.readRows("TMContact"), normalizeThingsContactRecord) : [],
+		databasePath,
+		tags: reader.hasTable("TMTag") ? mapPresent(reader.readRows("TMTag"), normalizeThingsTagRecord) : [],
+		taskColumns: reader.getTableColumns(THINGS_REQUIRED_TABLE),
+		taskTags: reader.hasTable("TMTaskTag") ? mapPresent(reader.readRows("TMTaskTag"), normalizeThingsTaskTagRecord) : [],
+		tasks: mapPresent(reader.readRows(THINGS_REQUIRED_TABLE), normalizeThingsTaskRecord)
+	};
+};
+//#endregion
 //#region ../../packages/sync-ids/src/meet-done-bear.ts
 /**
 * Ids for the "Meet Done Bear" sample project every new workspace is seeded
@@ -8685,8 +9168,6 @@ const listMeetDoneBearArchiveTargets = (options) => {
 //#region src/import/things-sqlite.ts
 const THINGS_CONTAINER_PATH = join(homedir(), "Library/Group Containers/JLMPQHK86H.com.culturedcode.ThingsMac");
 const THINGS_BUNDLE_NAME = "Things Database.thingsdatabase";
-const THINGS_SQLITE_FILE = "main.sqlite";
-const LEGACY_THINGS_SQLITE_FILE = "Things.sqlite3";
 const URL_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:/iu;
 const isUrlLike = (value) => URL_SCHEME_PATTERN.test(value);
 const resolveInputPath = (databaseUrl) => {
@@ -8699,7 +9180,7 @@ const resolveInputPath = (databaseUrl) => {
 const expandThingsDatabasePath = (inputPath) => {
 	const resolvedPath = resolve(inputPath);
 	const lastSegment = basename(resolvedPath);
-	if (lastSegment === THINGS_SQLITE_FILE || lastSegment === LEGACY_THINGS_SQLITE_FILE) return resolvedPath;
+	if (lastSegment === "main.sqlite" || lastSegment === "Things.sqlite3") return resolvedPath;
 	if (lastSegment === THINGS_BUNDLE_NAME) return join(resolvedPath, THINGS_SQLITE_FILE);
 	if (lastSegment.startsWith("ThingsData-")) return join(resolvedPath, THINGS_BUNDLE_NAME, THINGS_SQLITE_FILE);
 	return resolvedPath;
@@ -8744,130 +9225,6 @@ const getTableColumns = (database, tableName) => {
 	if (!hasTable(database, tableName)) return [];
 	return database.prepare(`PRAGMA table_info(${tableName})`).all().map((row) => typeof row.name === "string" ? row.name : null).filter((name) => name !== null);
 };
-const toStringValue = (value) => {
-	if (typeof value === "string") {
-		const trimmed = value.trim();
-		return trimmed.length > 0 ? trimmed : null;
-	}
-	if (Buffer.isBuffer(value)) {
-		const text = value.toString("utf-8").trim();
-		return text.length > 0 ? text : null;
-	}
-	return null;
-};
-const toNumberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
-const toBooleanValue = (value) => {
-	const numeric = toNumberValue(value);
-	return numeric === null ? null : numeric !== 0;
-};
-const normalizeTaskRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		afterCompletionReferenceDate: toNumberValue(row.rt1_afterCompletionReferenceDate ?? row.afterCompletionReferenceDate),
-		areaId: toStringValue(row.area),
-		contactId: toStringValue(row.contact ?? row.delegate),
-		creationDate: toNumberValue(row.creationDate),
-		deadline: toNumberValue(row.deadline ?? row.dueDate),
-		deadlineOffset: toNumberValue(row.t2_deadlineOffset ?? row.dueDateOffset),
-		deadlineSuppressionDate: toNumberValue(row.deadlineSuppressionDate ?? row.dueDateSuppressionDate),
-		headingId: toStringValue(row.heading ?? row.actionGroup),
-		instanceCreationCount: toNumberValue(row.rt1_instanceCreationCount ?? row.instanceCreationCount),
-		instanceCreationPaused: toBooleanValue(row.rt1_instanceCreationPaused ?? row.instanceCreationPaused) ?? false,
-		instanceCreationStartDate: toNumberValue(row.rt1_instanceCreationStartDate ?? row.instanceCreationStartDate),
-		lastReminderInteractionDate: toNumberValue(row.lastReminderInteractionDate ?? row.lastAlarmInteractionDate),
-		nextInstanceStartDate: toNumberValue(row.rt1_nextInstanceStartDate ?? row.nextInstanceStartDate),
-		notes: toStringValue(row.notes),
-		projectId: toStringValue(row.project),
-		raw: row,
-		recurrenceRuleRaw: toStringValue(row.rt1_recurrenceRule ?? row.recurrenceRule),
-		reminderTime: toNumberValue(row.reminderTime),
-		repeatTemplateSourceId: toStringValue(row.rt1_repeatingTemplate ?? row.repeatingTemplate),
-		repeaterMigrationDate: toNumberValue(row.repeaterMigrationDate),
-		repeaterRaw: toStringValue(row.repeater),
-		sortIndex: toNumberValue(row.index),
-		start: toNumberValue(row.start),
-		startBucket: toNumberValue(row.startBucket),
-		startDate: toNumberValue(row.startDate),
-		status: toNumberValue(row.status),
-		stopDate: toNumberValue(row.stopDate),
-		title: toStringValue(row.title),
-		todayIndex: toNumberValue(row.todayIndex),
-		todayIndexReferenceDate: toNumberValue(row.todayIndexReferenceDate),
-		trashed: toBooleanValue(row.trashed) ?? false,
-		type: toNumberValue(row.type),
-		userModificationDate: toNumberValue(row.userModificationDate),
-		uuid
-	};
-};
-const normalizeAreaRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		raw: row,
-		sortIndex: toNumberValue(row.index),
-		title: toStringValue(row.title),
-		uuid,
-		visible: toBooleanValue(row.visible)
-	};
-};
-const normalizeTagRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		parentId: toStringValue(row.parent),
-		raw: row,
-		shortcut: toStringValue(row.shortcut),
-		sortIndex: toNumberValue(row.index),
-		title: toStringValue(row.title),
-		usedDate: toNumberValue(row.usedDate),
-		uuid
-	};
-};
-const normalizeChecklistItemRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		creationDate: toNumberValue(row.creationDate),
-		raw: row,
-		sortIndex: toNumberValue(row.index),
-		status: toNumberValue(row.status),
-		stopDate: toNumberValue(row.stopDate),
-		taskId: toStringValue(row.task),
-		title: toStringValue(row.title),
-		userModificationDate: toNumberValue(row.userModificationDate),
-		uuid
-	};
-};
-const normalizeTaskTagRecord = (row) => {
-	const taskId = toStringValue(row.tasks);
-	const tagId = toStringValue(row.tags);
-	return taskId && tagId ? {
-		tagId,
-		taskId
-	} : null;
-};
-const normalizeAreaTagRecord = (row) => {
-	const areaId = toStringValue(row.areas);
-	const tagId = toStringValue(row.tags);
-	return areaId && tagId ? {
-		areaId,
-		tagId
-	} : null;
-};
-const normalizeContactRecord = (row) => {
-	const uuid = toStringValue(row.uuid);
-	if (!uuid) return null;
-	return {
-		appleAddressBookId: toStringValue(row.appleAddressBookId),
-		displayName: toStringValue(row.displayName),
-		emails: toStringValue(row.emails),
-		firstName: toStringValue(row.firstName),
-		lastName: toStringValue(row.lastName),
-		raw: row,
-		uuid
-	};
-};
 const resolveThingsDatabasePath = (databaseUrl) => expandThingsDatabasePath(resolveInputPath(databaseUrl));
 const resolveDefaultThingsDatabasePath = () => {
 	const resolved = findLatestThingsDatabasePath();
@@ -8882,17 +9239,11 @@ const loadThingsDatabase = (databaseUrl) => {
 		readonly: true
 	});
 	try {
-		return {
-			areaTags: hasTable(database, "TMAreaTag") ? readRows(database, "TMAreaTag").map(normalizeAreaTagRecord).filter((record) => record !== null) : [],
-			areas: hasTable(database, "TMArea") ? readRows(database, "TMArea").map(normalizeAreaRecord).filter((record) => record !== null) : [],
-			checklistItems: hasTable(database, "TMChecklistItem") ? readRows(database, "TMChecklistItem").map(normalizeChecklistItemRecord).filter((record) => record !== null) : [],
-			contacts: hasTable(database, "TMContact") ? readRows(database, "TMContact").map(normalizeContactRecord).filter((record) => record !== null) : [],
-			databasePath,
-			tags: hasTable(database, "TMTag") ? readRows(database, "TMTag").map(normalizeTagRecord).filter((record) => record !== null) : [],
-			taskColumns: getTableColumns(database, "TMTask"),
-			taskTags: hasTable(database, "TMTaskTag") ? readRows(database, "TMTaskTag").map(normalizeTaskTagRecord).filter((record) => record !== null) : [],
-			tasks: readRows(database, "TMTask").map(normalizeTaskRecord).filter((record) => record !== null)
-		};
+		return buildThingsDatabaseSnapshot({
+			getTableColumns: (tableName) => getTableColumns(database, tableName),
+			hasTable: (tableName) => hasTable(database, tableName),
+			readRows: (tableName) => readRows(database, tableName)
+		}, databasePath);
 	} finally {
 		database.close();
 	}
@@ -8900,7 +9251,15 @@ const loadThingsDatabase = (databaseUrl) => {
 //#endregion
 //#region src/import/things-runner.ts
 const WORKSPACE_SCOPED_MODELS = SYNC_CONTENT_MODELS;
-const INSERT_ONLY_MODELS = new Set(["TaskLabel", "TeamProject"]);
+const INSERT_ONLY_MODELS = new Set([
+	"TaskLabel",
+	"TeamProject",
+	"TeamMembership",
+	"ProjectMembership"
+]);
+/** Membership joins are not in SYNC_CONTENT_MODELS (identity surface), but
+* Things import writes the importer's own rows and needs them for skip-on-rerun. */
+const THINGS_MEMBERSHIP_MODELS = ["TeamMembership", "ProjectMembership"];
 const chunk = (items, size) => {
 	const result = [];
 	for (let index = 0; index < items.length; index += size) result.push(items.slice(index, index + size));
@@ -8944,9 +9303,9 @@ const loadWorkspaceScopedRowsByModel = async (context, options) => {
 };
 const loadExistingImportState = async (options) => {
 	let modelNames;
-	if (options.dryRun) modelNames = ["Label"];
-	else if (options.skipTeams) modelNames = WORKSPACE_SCOPED_MODELS.filter((m) => m !== "Team" && m !== "TeamProject");
-	else modelNames = WORKSPACE_SCOPED_MODELS;
+	if (options.dryRun) modelNames = options.skipTeams ? ["Label"] : ["Label", "Team"];
+	else if (options.skipTeams) modelNames = [...WORKSPACE_SCOPED_MODELS.filter((m) => m !== "Team" && m !== "TeamProject"), "ProjectMembership"];
+	else modelNames = [...WORKSPACE_SCOPED_MODELS, ...THINGS_MEMBERSHIP_MODELS];
 	const rowsByModel = await loadWorkspaceScopedRowsByModel(options.context, {
 		apiBaseUrl: options.commandContext.apiBaseUrl,
 		modelNames,
@@ -8955,6 +9314,7 @@ const loadExistingImportState = async (options) => {
 	});
 	return {
 		existingLabelIdsByTitle: buildExistingLabelIdsByTitle(rowsByModel),
+		existingTeamIdsByName: buildExistingTeamIdsByName(rowsByModel),
 		rowsByModel
 	};
 };
@@ -8972,9 +9332,23 @@ const buildExistingLabelIdsByTitle = (rowsByModel) => {
 	}
 	return labelsByTitle;
 };
+const buildExistingTeamIdsByName = (rowsByModel) => {
+	const rows = rowsByModel.get("Team") ?? [];
+	const teamsByName = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (typeof row !== "object" || row === null) continue;
+		const record = row;
+		if (record.__class !== "Team") continue;
+		const id = typeof record.id === "string" ? record.id : null;
+		const name = typeof record.name === "string" ? record.name.trim() : "";
+		if (!id || name.length === 0) continue;
+		teamsByName.set(normalizeThingsTeamLookupKey(name), id);
+	}
+	return teamsByName;
+};
 const buildExistingIds = (rowsByModel) => {
-	const entries = WORKSPACE_SCOPED_MODELS.map((modelName) => [modelName, collectRowIds(rowsByModel.get(modelName) ?? [], modelName)]);
-	return new Map(entries);
+	const modelNames = [...WORKSPACE_SCOPED_MODELS, ...THINGS_MEMBERSHIP_MODELS];
+	return new Map(modelNames.map((modelName) => [modelName, collectRowIds(rowsByModel.get(modelName) ?? [], modelName)]));
 };
 const buildTransactions = (phaseItems, options) => {
 	const transactions = [];
@@ -8992,6 +9366,7 @@ const buildTransactions = (phaseItems, options) => {
 		if (action === "INSERT") {
 			inserted += 1;
 			existingIds.add(item.modelId);
+			options.existingIds.set(item.modelName, existingIds);
 		} else updated += 1;
 		transactions.push({
 			action,
@@ -9077,6 +9452,7 @@ const runThingsImport = async (options) => {
 	const plan = buildThingsImportPlan({
 		creatorId: options.creatorId,
 		existingLabelsByTitle: existingState.existingLabelIdsByTitle,
+		existingTeamsByName: existingState.existingTeamIdsByName,
 		metadataMode: options.metadataMode,
 		skipTeams: options.skipTeams,
 		snapshot,
@@ -9305,6 +9681,30 @@ const runLabelCreate = async (context, title, options) => {
 	}
 	writeSuccess(context, `Created label: ${title.trim()}`);
 };
+/**
+* A TaskLabel row is keyed on task, label and workspace together, so a DELETE
+* needs `workspaceId` as much as an INSERT does: without it the server cannot
+* address the row and rejects the mutation.
+*/
+const buildTaskLabelTransaction = (options) => {
+	const { action, clientId, labelId, taskId, workspaceId } = options;
+	const key = {
+		labelId,
+		taskId,
+		workspaceId
+	};
+	return {
+		action,
+		clientId,
+		clientTxId: randomUUID(),
+		modelId: `${taskId}:${labelId}`,
+		modelName: "TaskLabel",
+		payload: action === "INSERT" ? {
+			...key,
+			createdAt: Date.now()
+		} : key
+	};
+};
 const runLabelAdd = async (context, taskRef, labelRef, options) => {
 	const commandContext = await resolveCommandContext(context);
 	const workspaceRef = normalizeWorkspaceRef(options.workspace);
@@ -9322,19 +9722,13 @@ const runLabelAdd = async (context, taskRef, labelRef, options) => {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
 			batchId: randomUUID(),
-			transactions: [{
+			transactions: [buildTaskLabelTransaction({
 				action: "INSERT",
 				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
-				modelId: `${task.id}:${label.id}`,
-				modelName: "TaskLabel",
-				payload: {
-					createdAt: Date.now(),
-					labelId: label.id,
-					taskId: task.id,
-					workspaceId: task.workspaceId
-				}
-			}]
+				labelId: label.id,
+				taskId: task.id,
+				workspaceId: task.workspaceId
+			})]
 		},
 		token: commandContext.token
 	});
@@ -9366,17 +9760,13 @@ const runLabelRemove = async (context, taskRef, labelRef, options) => {
 		baseUrl: commandContext.apiBaseUrl,
 		request: {
 			batchId: randomUUID(),
-			transactions: [{
+			transactions: [buildTaskLabelTransaction({
 				action: "DELETE",
 				clientId: commandContext.localContext.clientId,
-				clientTxId: randomUUID(),
-				modelId: `${task.id}:${label.id}`,
-				modelName: "TaskLabel",
-				payload: {
-					labelId: label.id,
-					taskId: task.id
-				}
-			}]
+				labelId: label.id,
+				taskId: task.id,
+				workspaceId: task.workspaceId
+			})]
 		},
 		token: commandContext.token
 	});
@@ -9581,7 +9971,7 @@ const resolveProjectName = async (context, rawName) => {
 		const trimmed = rawName.trim();
 		if (trimmed.length > 0) return trimmed;
 	}
-	const { promptForValue } = await import("./prompt-B7mDo4K7.mjs");
+	const { promptForValue } = await import("./prompt--P7Y1FBL.mjs");
 	const prompted = await promptForValue(context, "Project name");
 	if (prompted) return prompted;
 	throw new CliError("Project name is required.", EXIT_CODES.VALIDATION, "Provide a name: donebear project add \"My project\"");
@@ -10017,7 +10407,7 @@ Examples:
 //#endregion
 //#region src/commands/spec.ts
 const OVERVIEW = {
-	authentication: "Set DONEBEAR_TOKEN env var, or run: donebear auth login",
+	authentication: "Set DONEBEAR_TOKEN env var, run: donebear auth login, or create an account with donebear auth signup --email <human-email>",
 	commands: {
 		"api-key": {
 			description: "Manage personal API keys",
@@ -10033,8 +10423,9 @@ const OVERVIEW = {
 			quick_example: "donebear auth status --json",
 			subcommands: [
 				"login",
-				"status",
-				"logout"
+				"logout",
+				"signup",
+				"status"
 			]
 		},
 		comment: {
@@ -10264,6 +10655,44 @@ const COMMAND_SPECS = {
 		},
 		usage: "donebear auth login [options]"
 	},
+	"auth signup": {
+		command: "auth signup",
+		examples: ["donebear auth signup --email person@example.com", "donebear auth signup --email person@example.com --json --no-interactive"],
+		json_output: {
+			apiKey: "{ id, key, prefix, scopes }",
+			email: "string",
+			instructions: "{ agent, human }",
+			mcp: "{ url, headers, cursor, claude }",
+			ok: "boolean",
+			sessionStored: "boolean",
+			status: "complete",
+			user: "{ id, email }",
+			verifyUrl: "string",
+			workspace: "{ id, name, urlKey }"
+		},
+		non_interactive: "Requires --email. Do not invent an address. --json and --no-interactive print the verify link on stderr, poll until the human verifies, then emit one complete JSON object on stdout. If the email is already registered, run donebear auth login instead.",
+		notes: "Creates a real human workspace after email verification, then mints a db_ API key with read+write (not admin). WorkOS agent_auth and RFC 8628 device code are not offered.",
+		options: {
+			"--email": {
+				description: "Human email to verify. Required. Do not invent an address.",
+				type: "string"
+			},
+			"--name": {
+				description: "Optional display name",
+				type: "string"
+			},
+			"--no-interactive": {
+				description: "Never prompt for the email code; poll the verify link instead",
+				type: "boolean"
+			},
+			"--timeout": {
+				default: 600,
+				description: "Seconds to wait for email verification",
+				type: "number"
+			}
+		},
+		usage: "donebear auth signup [options]"
+	},
 	"auth status": {
 		command: "auth status",
 		examples: ["donebear auth status --json"],
@@ -11120,6 +11549,44 @@ const COMMAND_SPECS = {
 		options: {},
 		usage: "donebear whoami"
 	},
+	"workspace invite": {
+		arguments: { workspace: {
+			description: "Workspace id, urlKey, or name. Defaults to the current workspace.",
+			required: false,
+			type: "string"
+		} },
+		command: "workspace invite",
+		examples: [
+			"donebear workspace invite --email user@example.com --role member",
+			"donebear workspace invite --share --copy",
+			"donebear workspace invite --share --project <project-id>"
+		],
+		json_output: {
+			invitation: "WorkspaceInvitationRecord",
+			workspace: "WorkspaceRecord"
+		},
+		notes: "Email invites are single-use. --share mints a reusable /join?code= link. --project requires --share.",
+		options: {
+			"--email": {
+				description: "Email address to invite (single-use)",
+				type: "string"
+			},
+			"--project": {
+				description: "Scope a share link so joiners also become members of this project",
+				type: "string"
+			},
+			"--role": {
+				default: "member",
+				description: "Role for an email invite: member|admin",
+				type: "string"
+			},
+			"--share": {
+				description: "Create a reusable join link instead of an email invite",
+				type: "boolean"
+			}
+		},
+		usage: "donebear workspace invite [workspace] [options]"
+	},
 	"workspace list": {
 		command: "workspace list",
 		examples: ["donebear workspace list --json"],
@@ -11162,10 +11629,11 @@ const TOP_LEVEL_SPECS = {
 	auth: {
 		command: "auth",
 		description: "Authentication",
-		non_interactive: "Set DONEBEAR_TOKEN=<token> to skip interactive login.",
+		non_interactive: "Set DONEBEAR_TOKEN=<token> to skip interactive login. New accounts: donebear auth signup --email <human-email> --json --no-interactive.",
 		subcommands: {
 			login: "OAuth login (Google or GitHub)",
 			logout: "Sign out and remove stored session",
+			signup: "Create an account from a human email (agent signup)",
 			status: "Show auth status"
 		},
 		tip: "donebear spec auth login: get full spec for auth login"
@@ -11252,7 +11720,7 @@ const TOP_LEVEL_SPECS = {
 			create: "Create a new workspace",
 			current: "Show the active workspace",
 			invitations: "List pending invitations",
-			invite: "Invite a user by email",
+			invite: "Invite by email, or mint a reusable --share join link",
 			join: "Join a workspace by invite",
 			list: "List all workspaces",
 			members: "List workspace members",
@@ -11300,6 +11768,7 @@ Examples:
   donebear spec project list     Detailed spec for project list
   donebear spec import things    Detailed spec for the Things importer
   donebear spec search           Detailed spec for search
+  donebear spec auth signup      Agent signup from a human email
   donebear spec auth login       Auth login options and non-interactive notes
 `).action(async (command, subcommand, _options, cmd) => {
 		const context = contextFromCommand(cmd);
@@ -11758,10 +12227,14 @@ const runWorkspaceInvite = async (context, workspaceRefArg, workspaceOverride, o
 		token: commandContext.token,
 		workspaceRef: workspaceOverride ?? workspaceRefArg ?? null
 	});
+	if (options.share && options.email) throw new CliError("Use --share or --email, not both.", EXIT_CODES.VALIDATION);
+	if (options.project && !options.share) throw new CliError("--project requires --share.", EXIT_CODES.VALIDATION);
 	const invitation = await createWorkspaceInvitation(context, {
 		baseUrl: commandContext.apiBaseUrl,
 		email: options.email,
-		role: options.role ?? "member",
+		kind: options.share ? "share" : void 0,
+		projectId: options.project,
+		role: options.share ? "member" : options.role ?? "member",
 		token: commandContext.token,
 		workspaceId: workspace.id
 	});
@@ -11777,7 +12250,7 @@ const runWorkspaceInvite = async (context, workspaceRefArg, workspaceOverride, o
 	writeInfo(context, `role: ${invitation.role}`);
 	writeInfo(context, `expires: ${invitation.expiresAt}`);
 	if (invitation.email) writeInfo(context, `email: ${invitation.email}`);
-	const link = `${commandContext.apiBaseUrl}/invite/${invitation.code}`;
+	const link = `${DEFAULT_APP_URL}/join?code=${encodeURIComponent(invitation.code)}`;
 	writeInfo(context, `link: ${link}`);
 	if (context.copy) {
 		if (copyToClipboard(link)) writeInfo(context, "Link copied to clipboard.");
@@ -11793,6 +12266,8 @@ Examples:
   donebear workspace members
   donebear workspace invitations
   donebear workspace invite --email user@example.com --role member
+  donebear workspace invite --share --copy
+  donebear workspace invite --share --project <project-id>
 `).action(async (_options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
@@ -11847,7 +12322,7 @@ Examples:
 			await runWorkspaceInvitations(context, workspaceRef, workspaceOverride);
 		});
 	});
-	workspace.command("invite").description("Create an invitation for the current or specified workspace").argument("[workspace]", "Workspace id, slug, or exact name").option("--email <email>", "Email address to invite").option("--role <role>", "Role for the invitee: member|admin", "member").action(async (workspaceRef, options, command) => {
+	workspace.command("invite").description("Create an invitation for the current or specified workspace").argument("[workspace]", "Workspace id, slug, or exact name").option("--email <email>", "Email address to invite").option("--share", "Create a reusable join link").option("--project <id>", "Scope a share link: joiners join the whole workspace as a member, get this project, and use a seat").option("--role <role>", "Role for the invitee: member|admin", "member").action(async (workspaceRef, options, command) => {
 		const context = contextFromCommand(command);
 		await runWithErrorHandling(context, async () => {
 			await runWorkspaceInvite(context, workspaceRef, workspaceOverride, options);
@@ -11875,8 +12350,9 @@ With auth:
   donebear import things --dry-run --json
 
 Auth:
-  donebear auth login            OAuth browser login
-  DONEBEAR_TOKEN=<token>         Non-interactive / CI: set this env var
+  donebear auth signup --email you@…   Create an account (human verifies email)
+  donebear auth login                  OAuth browser login
+  DONEBEAR_TOKEN=<token>               Non-interactive / CI: set this env var
 
 Workspace targeting:
   donebear workspace=myorg task list