fluxmail 0.4.1 → 0.6.0

package/dist/cli.js

@@ -1,42 +1,43 @@
 #!/usr/bin/env node
-import { realpathSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { emitKeypressEvents } from 'node:readline';
+import { createInterface } from 'node:readline/promises';
+import { hostname } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { Command } from 'commander';
 import { serve } from '@hono/node-server';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { EmailError } from '@fluxmail/core';
+import { EmailError, isEmailError } from '@fluxmail/core';
 import { createContext } from './context.js';
-import { configFilePath, maskStoredConfigValue, readStoredConfig, resolveDataDir, setStoredConfig, unsetStoredConfig, } from './config.js';
+import { configTomlPath, createConfigurationService, deploymentToml, readLoggingSettings, resolveDataDir, resolveStoreLocation, writeDeploymentConfig, } from './config.js';
+import { migrateConfigurationFile, parseEnvContent, recognizedMigrationSettings } from './configMigration.js';
 import { createApp } from './http/app.js';
 import { buildMcpServer } from './mcp/buildServer.js';
 import { runLoopbackFlow } from './accounts/googleAuth.js';
 import { runMicrosoftLoopbackFlow } from './accounts/microsoftAuth.js';
 import { prepareHostedGmailConnection, prepareHostedOutlookConnection, selectGmailConnectionMode, validateAccountConnectionFlags, } from './accounts/gmailConnection.js';
-import { createApiKey, listApiKeys, revokeApiKey, updateApiKeyAccounts, updateApiKeyPermissions, } from './storage/apiKeys.js';
-import { addMember, findMember, listMembers, removeMember, setMemberRole } from './storage/members.js';
-import { activateLicense } from './licensing/activation.js';
-import { LICENSE_KEY_PATTERN, releaseLicense } from './licensing/client.js';
-import { licensePublicKeys, verifyLease } from './licensing/lease.js';
-import { checkLicenseState, clearLease, getEntitlements, readLeaseRow, } from './licensing/entitlements.js';
-import { loadInstanceId } from './licensing/refresher.js';
+import { listApiKeys } from './storage/apiKeys.js';
+import { findMember } from './storage/members.js';
+import { LICENSE_KEY_PATTERN } from './licensing/client.js';
+import { checkLicenseState, getEntitlements } from './licensing/entitlements.js';
 import { VERSION } from './version.js';
+import { inspectStoreCompatibility, MIN_SUPPORTED_STORE_FORMAT, openDb, openReadonlyDb, } from './storage/db.js';
 import { customPermissionPolicy, ADMIN_CAPABILITIES, FULL_PERMISSION_POLICY, isNamedPermissionProfile, MCP_CAPABILITIES, NAMED_PERMISSION_PROFILES, permissionPolicyForProfile, } from './permissions.js';
-import { getTelemetry, installTelemetryStreamEndHandler, isTelemetryEnabled, setTelemetryEnabled, shutdownTelemetry, } from './telemetry.js';
+import { captureOperation, getTelemetry, installTelemetryStreamEndHandler, isTelemetryEnabled, setTelemetryEnabled, shutdownTelemetry, telemetryDisabledInAnyEnvironment, } from './telemetry.js';
+import { clearSessionToken, instanceClient, loadInstanceConfig, removeInstance, resolveInstance, saveLocalInstance, saveRemoteInstance, saveSessionToken, useInstance, } from './cliInstances.js';
+import { authenticateBearer, normalizeAndValidatePassword, recoverAdminPassword, setupInitialAdmin } from './auth.js';
+import { recordAdminAuditEvent } from './storage/adminAudit.js';
+import { canManageOwnedAccount } from './authorization.js';
+import { createCliUpdateNotifier } from './updateNotifier.js';
+import { registerMailCommands } from './cliMail.js';
+import { flushLogging, escapeLogTextForConsole, getLogger, logCodedFailure, logFailure, readLocalLogs, shutdownLogging, } from './logging.js';
 function collectOption(value, previous) {
     return [...previous, value];
 }
 function accountIdsFromRefs(ctx, refs) {
     return refs.length ? [...new Set(refs.map((ref) => ctx.registry.findAccount(ref).id))] : null;
 }
-function sharingMode(shared, sharedMemberIds) {
-    if (shared)
-        return 'all';
-    if (sharedMemberIds.length)
-        return 'selected';
-    return 'private';
-}
 export function permissionPolicyFromOptions(opts, requireSelection = false) {
     const supplemental = opts.admin ?? [];
     if (opts.profile && opts.allow.length) {
@@ -85,11 +86,11 @@ function connectionSecurity(value, option) {
 }
 async function hiddenPrompt(label) {
     if (!process.stdin.isTTY || !process.stdin.setRawMode) {
-        throw new EmailError('invalid_request', `${label} must be supplied through a password environment variable.`);
+        throw new EmailError('invalid_request', `${label} requires an interactive terminal or an explicit non-interactive input.`);
     }
+    const wasFlowing = process.stdin.readableFlowing === true;
     emitKeypressEvents(process.stdin);
     const wasRaw = process.stdin.isRaw;
-    const wasPaused = process.stdin.isPaused();
     process.stdout.write(`${label}: `);
     process.stdin.setRawMode(true);
     process.stdin.resume();
@@ -98,7 +99,7 @@ async function hiddenPrompt(label) {
         const finish = (error) => {
             process.stdin.off('keypress', onKeypress);
             process.stdin.setRawMode(wasRaw);
-            if (wasPaused)
+            if (!wasFlowing)
                 process.stdin.pause();
             process.stdout.write('\n');
             if (error)
@@ -126,6 +127,39 @@ async function hiddenPrompt(label) {
         process.stdin.on('keypress', onKeypress);
     });
 }
+async function textPrompt(label) {
+    if (!process.stdin.isTTY)
+        throw new EmailError('invalid_request', `${label} must be supplied as an option.`);
+    const prompt = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return (await prompt.question(`${label}: `)).trim();
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function loginPassword(label = 'Password') {
+    return process.env.FLUXMAIL_PASSWORD ?? hiddenPrompt(label);
+}
+async function newPassword(label, member, prompt) {
+    return withNewPassword(label, member, prompt, async (password) => password);
+}
+async function withNewPassword(label, member, prompt, submit) {
+    const configured = process.env.FLUXMAIL_PASSWORD;
+    if (configured !== undefined)
+        return submit(normalizeAndValidatePassword(configured, member));
+    for (;;) {
+        const password = await prompt(label);
+        try {
+            return await submit(normalizeAndValidatePassword(password, member));
+        }
+        catch (error) {
+            if (!(error instanceof EmailError) || error.code !== 'invalid_request')
+                throw error;
+            console.error(`Error: ${error.message}`);
+        }
+    }
+}
 async function accountSecret(envName, label) {
     if (!envName)
         return hiddenPrompt(label);
@@ -134,6 +168,15 @@ async function accountSecret(envName, label) {
         throw new EmailError('invalid_request', `${envName} is not set or is empty.`);
     return value;
 }
+function readSecretFile(file) {
+    const value = readFileSync(file === '-' ? 0 : file, 'utf8').replace(/\r?\n$/, '');
+    if (!value)
+        throw new EmailError('invalid_request', 'The secret input is empty.');
+    return value;
+}
+async function secretInput(file, label) {
+    return file === undefined ? hiddenPrompt(label) : readSecretFile(file);
+}
 function planLine(ent) {
     const members = `${ent.maxMembers} member${ent.maxMembers === 1 ? '' : 's'}`;
     return `${ent.plan} (up to ${ent.maxAccounts} mailboxes, ${members})`;
@@ -144,13 +187,86 @@ function warnLicense(db, log = console.error) {
     if (warning)
         log(`Warning: ${warning}`);
 }
+const activeCliOperations = new WeakMap();
+const activeUpdateNotifiers = new WeakMap();
+function finishCliOperation(program, outcome, errorCode, error) {
+    const active = activeCliOperations.get(program);
+    if (!active)
+        return;
+    activeCliOperations.delete(program);
+    if (outcome === 'error' && !active.errorLogged) {
+        const context = { productSurface: 'cli', operation: active.operation, skipConsole: true };
+        if (error !== undefined)
+            logFailure(active.logger, 'cli.operation_failed', error, context);
+        else
+            logCodedFailure(active.logger, 'cli.operation_failed', errorCode ?? 'command_failed', 'CLI command failed', context);
+    }
+    captureOperation(active.telemetry, {
+        productSurface: 'cli',
+        operation: active.operation,
+        outcome,
+        durationMs: performance.now() - active.startedAt,
+        errorCode,
+    });
+}
+function logActiveCliError(program, error) {
+    const active = activeCliOperations.get(program);
+    if (!active || active.errorLogged)
+        return;
+    active.errorLogged = true;
+    logFailure(active.logger, 'cli.operation_failed', error, {
+        productSurface: 'cli',
+        operation: active.operation,
+        skipConsole: true,
+    });
+}
+export function waitForServerListening(server) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off('listening', onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off('error', onError);
+            resolve();
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+    });
+}
+async function shutdownTelemetryThenLogging() {
+    try {
+        await shutdownTelemetry();
+    }
+    finally {
+        await shutdownLogging();
+    }
+}
+export async function shutdownTelemetryAndLogging() {
+    const initialLogFlush = flushLogging().catch(() => { });
+    try {
+        await shutdownTelemetry();
+    }
+    finally {
+        await initialLogFlush;
+        await shutdownLogging();
+    }
+}
+export function installStdioShutdownHandler(stream) {
+    installTelemetryStreamEndHandler(stream, shutdownTelemetryThenLogging);
+}
 /** Build the command tree without parsing arguments or running command actions. */
-export function createCliProgram() {
+export function createCliProgram(options = {}) {
     const program = new Command();
     program
         .name('fluxmail')
-        .description('Fluxmail, a self-hosted MCP server for your email')
+        .description('Fluxmail, a self-hosted email API with MCP, REST, and CLI access')
+        .option('--instance <name>', 'Use a named local or remote instance')
+        .option('-a, --mail-account <id-or-email>', 'Use an email account by ID or address')
+        .option('--no-update-notifier', 'Skip the automatic update check for this command')
         .version(VERSION, '-v, --version');
+    const selectedInstance = () => program.opts().instance;
+    const selectedAccount = () => program.opts().mailAccount;
     function commandPath(command) {
         const names = [];
         for (let current = command; current?.parent; current = current.parent)
@@ -159,7 +275,7 @@ export function createCliProgram() {
     }
     let telemetrySignalHandlersInstalled = false;
     const TELEMETRY_SIGNAL_SHUTDOWN_TIMEOUT_MS = 1_000;
-    /** Flush queued telemetry before restoring Node's default signal behavior. */
+    /** Flush queued telemetry and local logs before restoring Node's default signal behavior. */
     function installTelemetrySignalHandlers() {
         if (telemetrySignalHandlersInstalled)
             return;
@@ -176,7 +292,7 @@ export function createCliProgram() {
                 process.kill(process.pid, signal);
             };
             const timeout = setTimeout(resignal, TELEMETRY_SIGNAL_SHUTDOWN_TIMEOUT_MS);
-            void shutdownTelemetry().finally(() => {
+            void shutdownTelemetryAndLogging().finally(() => {
                 clearTimeout(timeout);
                 resignal();
             });
@@ -190,72 +306,367 @@ export function createCliProgram() {
     }
     program.hook('preAction', (_command, actionCommand) => {
         const command = commandPath(actionCommand);
+        const updateNotifierEnabled = program.opts().updateNotifier;
+        if (updateNotifierEnabled && actionCommand.name() !== 'stdio') {
+            try {
+                const notifier = options.updateNotifierFactory?.();
+                if (notifier)
+                    activeUpdateNotifiers.set(program, notifier);
+            }
+            catch {
+                // Update checks must not affect command execution.
+            }
+        }
         // Respect the opt-out before creating a telemetry client or recording this command.
         if (command === 'telemetry disable')
             return;
-        const dataDir = resolveDataDir();
-        getTelemetry(dataDir).capture('cli command used', {
-            product_surface: 'cli',
-            command,
+        let telemetryEnvironment;
+        let telemetryDataDir;
+        if (command === 'config migrate') {
+            const migration = actionCommand.opts();
+            if (migration.from) {
+                try {
+                    const values = parseEnvContent(readFileSync(path.resolve(migration.from), 'utf8'));
+                    if (values.FLUXMAIL_DATA_DIR !== undefined) {
+                        telemetryDataDir = resolveDataDir({
+                            env: { ...process.env, FLUXMAIL_DATA_DIR: values.FLUXMAIL_DATA_DIR },
+                        });
+                    }
+                    if (telemetryDisabledInAnyEnvironment(process.env, values)) {
+                        telemetryEnvironment = { ...process.env, FLUXMAIL_TELEMETRY: '0' };
+                    }
+                }
+                catch {
+                    // The command action reports file and parsing errors.
+                }
+            }
+        }
+        const dataDir = telemetryDataDir ?? resolveDataDir();
+        let logging;
+        try {
+            logging = readLoggingSettings(dataDir);
+        }
+        catch {
+            // Keep recovery and remote commands available when logging configuration is invalid.
+            logging = { level: 'info', destination: 'both' };
+        }
+        const mode = actionCommand.name() === 'serve' ? 'serve' : actionCommand.name() === 'stdio' ? 'stdio' : 'cli';
+        activeCliOperations.set(program, {
+            telemetry: options.telemetry ?? getTelemetry(dataDir, telemetryEnvironment),
+            operation: command,
+            startedAt: performance.now(),
+            initialExitCode: process.exitCode,
+            logger: getLogger(dataDir, mode, logging),
         });
     });
     program.hook('postAction', async (_command, actionCommand) => {
-        if (actionCommand.name() !== 'serve' && actionCommand.name() !== 'stdio')
-            await shutdownTelemetry();
+        const active = activeCliOperations.get(program);
+        const failed = active !== undefined &&
+            process.exitCode !== active.initialExitCode &&
+            process.exitCode !== undefined &&
+            process.exitCode !== 0;
+        finishCliOperation(program, failed ? 'error' : 'success', failed ? 'command_failed' : undefined);
+        try {
+            if (actionCommand.name() !== 'serve' && actionCommand.name() !== 'stdio') {
+                await Promise.all([options.telemetry ? Promise.resolve() : shutdownTelemetry(), shutdownLogging()]);
+            }
+        }
+        finally {
+            const notifier = activeUpdateNotifiers.get(program);
+            activeUpdateNotifiers.delete(program);
+            try {
+                notifier?.notify();
+            }
+            catch {
+                // Update notices must not affect the command outcome.
+            }
+        }
+    });
+    program
+        .command('setup')
+        .description('Create the first local administrator or claim a migrated administrator')
+        .option('--name <name>', 'Administrator name')
+        .option('--email <email>', 'Administrator email')
+        .option('--existing-admin <member>', 'Existing administrator id or email for a migrated instance')
+        .action(async (opts) => {
+        try {
+            const name = opts.name ?? (opts.existingAdmin ? undefined : await textPrompt('Administrator name'));
+            const email = opts.email ?? (await textPrompt('Administrator email'));
+            const context = createContext();
+            const passwordMember = opts.existingAdmin
+                ? { ...findMember(context.db, opts.existingAdmin), email }
+                : { name: name ?? '', email };
+            const password = await newPassword('New password', passwordMember, options.passwordPrompt ?? hiddenPrompt);
+            const result = await setupInitialAdmin(context.db, {
+                ...(name ? { name } : {}),
+                email,
+                password,
+                ...(opts.existingAdmin ? { existingAdmin: opts.existingAdmin } : {}),
+                deviceName: `CLI on ${hostname()}`,
+            });
+            saveLocalInstance('local');
+            saveSessionToken('local', result.session.token);
+            recordAdminAuditEvent(context.db, {
+                operation: 'auth.setup',
+                outcome: 'success',
+                actorMemberId: result.member.id,
+                actorSessionId: result.session.info.id,
+            });
+            console.log(`Fluxmail is ready. Logged in to local as ${result.member.name}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    program
+        .command('login')
+        .description('Log in to a local or remote instance')
+        .option('--server <url>', 'Add or update a remote instance')
+        .option('--email <email>', 'Member email')
+        .option('--enroll', 'Use a one-time enrollment code')
+        .option('--reset', 'Use a one-time password reset code')
+        .action(async (opts) => {
+        try {
+            if (opts.enroll && opts.reset) {
+                throw new EmailError('invalid_request', '--enroll and --reset cannot be used together.');
+            }
+            const requestedInstance = selectedInstance();
+            if (!opts.server && requestedInstance === 'local' && !loadInstanceConfig().instances.local) {
+                saveLocalInstance('local');
+            }
+            const instanceName = requestedInstance ?? (opts.server ? 'remote' : resolveInstance().name);
+            if (opts.server)
+                saveRemoteInstance(instanceName, opts.server);
+            const client = instanceClient(instanceName, false);
+            const deviceName = `CLI on ${hostname()}`;
+            const result = opts.enroll || opts.reset
+                ? await (async () => {
+                    const token = (opts.reset ? process.env.FLUXMAIL_RESET_CODE : process.env.FLUXMAIL_INVITE_CODE) ??
+                        (await hiddenPrompt(opts.reset ? 'Password reset code' : 'Enrollment code'));
+                    return withNewPassword('New password', undefined, options.passwordPrompt ?? hiddenPrompt, (password) => client.json(opts.reset ? '/api/v1/auth/password-reset' : '/api/v1/auth/enroll', {
+                        method: 'POST',
+                        headers: { 'content-type': 'application/json' },
+                        body: JSON.stringify({ token, password, deviceName }),
+                    }, false));
+                })()
+                : await client.json('/api/v1/auth/login', {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify({
+                        email: opts.email ?? (await textPrompt('Email')),
+                        password: await loginPassword(),
+                        deviceName,
+                    }),
+                }, false);
+            saveSessionToken(instanceName, result.token);
+            useInstance(instanceName);
+            console.log(`Logged in to ${instanceName} as ${result.member.name}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    program
+        .command('logout')
+        .description('Revoke the current CLI session')
+        .action(async () => {
+        try {
+            const selected = resolveInstance(selectedInstance());
+            const response = await instanceClient(selected.name).request('/api/v1/auth/logout', { method: 'POST' });
+            if (!response.ok && response.status !== 401) {
+                throw new EmailError('invalid_request', `Logout failed with HTTP ${response.status}.`);
+            }
+            clearSessionToken(selected.name);
+            console.log(`Logged out of ${selected.name}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    const instances = program.command('instances').description('Manage local and remote CLI instances');
+    instances
+        .command('list')
+        .description('List configured instances')
+        .action(() => {
+        const config = loadInstanceConfig();
+        for (const [name, profile] of Object.entries(config.instances)) {
+            console.log(`${name}${config.active === name ? ' *' : ''}  ${profile.kind}${profile.kind === 'remote' ? `  ${profile.serverUrl}` : ''}`);
+        }
+    });
+    instances
+        .command('use')
+        .argument('<name>')
+        .description('Select the default instance')
+        .action((name) => {
+        try {
+            useInstance(name);
+            console.log(`Using ${name}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    instances
+        .command('remove')
+        .argument('<name>')
+        .description('Remove a CLI profile and its local session')
+        .action((name) => {
+        try {
+            removeInstance(name);
+            console.log(`Removed CLI instance ${name}. Server data was not changed.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    const authCommand = program.command('auth').description('Manage interactive authentication');
+    authCommand
+        .command('recover-admin')
+        .argument('<member>', 'Administrator id or email')
+        .description('Reset an administrator password using local filesystem access')
+        .action(async (memberRef) => {
+        try {
+            const selected = resolveInstance(selectedInstance());
+            if (selected.profile.kind !== 'local') {
+                throw new EmailError('invalid_request', 'Administrator recovery is only available on the local instance host.');
+            }
+            const context = createContext();
+            const target = findMember(context.db, memberRef);
+            const password = await newPassword('New password', target, options.passwordPrompt ?? hiddenPrompt);
+            const member = await recoverAdminPassword(context.db, memberRef, password);
+            recordAdminAuditEvent(context.db, {
+                operation: 'auth.recover_admin',
+                outcome: 'success',
+                actorMemberId: member.id,
+                resourceType: 'member',
+                resourceId: member.id,
+            });
+            console.log(`Reset ${member.name}'s password and revoked existing sessions.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    authCommand
+        .command('sessions')
+        .description('List sessions for the current member')
+        .action(async () => {
+        try {
+            const sessions = await instanceClient(selectedInstance()).json('/api/v1/me/sessions');
+            for (const session of sessions) {
+                console.log(`${session.id}${session.current ? ' *' : ''}  ${session.deviceName}  created=${new Date(session.createdAt).toISOString()}  expires=${new Date(session.expiresAt).toISOString()}`);
+            }
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    authCommand
+        .command('revoke-session')
+        .argument('<sessionId>')
+        .description("Revoke one of the current member's sessions")
+        .action(async (sessionId) => {
+        try {
+            await instanceClient(selectedInstance()).json(`/api/v1/me/sessions/${encodeURIComponent(sessionId)}`, {
+                method: 'DELETE',
+            });
+            console.log(`Revoked ${sessionId}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
     });
     program
         .command('serve')
         .description('Run the HTTP server (MCP at /mcp and REST at /api/v1)')
-        .action(() => {
+        .action(async () => {
         installTelemetrySignalHandlers();
         const ctx = createContext();
         const app = createApp(ctx);
         ctx.scheduler.start();
-        serve({ fetch: app.fetch, port: ctx.config.port }, () => {
+        const server = serve({ fetch: app.fetch, port: ctx.config.port }, () => {
+            ctx.logger.info('server.started', 'Fluxmail HTTP server started', {
+                details: { port: ctx.config.port },
+                skipConsole: true,
+            });
             ctx.telemetry.capture('mcp server started', { product_surface: 'mcp', transport: 'http' });
             console.log(`Fluxmail listening on ${ctx.config.publicUrl}`);
             console.log(`  MCP endpoint:   ${ctx.config.publicUrl}/mcp`);
             console.log(`  REST API:       ${ctx.config.publicUrl}/api/v1`);
             console.log(`  OpenAPI:        ${ctx.config.publicUrl}/api/v1/openapi.json`);
-            console.log(`  Auth mode:      ${ctx.config.authMode}`);
-            if (ctx.config.authMode === 'apikey' && listApiKeys(ctx.db).length === 0) {
-                console.log('  Note: no API keys exist yet. Run "fluxmail apikey create --name <name> --member <member>" to create one.');
-            }
-            const accounts = ctx.registry.listAccounts();
-            console.log(accounts.length
-                ? `  Accounts:       ${accounts.map((a) => `${a.email} (${a.status})`).join(', ')}`
-                : '  Accounts:       none (run "fluxmail accounts add gmail --owner <member>", "fluxmail accounts add outlook --owner <member>", or the IMAP equivalent)');
+            if (listApiKeys(ctx.db).length === 0) {
+                console.log('  Note: no API keys exist yet. Run "fluxmail apikey create --name <name>" to create one.');
+            }
+            try {
+                const accounts = ctx.registry.listAccounts();
+                console.log(accounts.length
+                    ? `  Accounts:       ${accounts.map((a) => `${a.email} (${a.status})`).join(', ')}`
+                    : '  Accounts:       none (run "fluxmail accounts add gmail", "fluxmail accounts add outlook", or the IMAP equivalent)');
+            }
+            catch {
+                console.log('  Accounts:       unavailable until an existing administrator claims this instance');
+            }
             console.log(`  Plan:           ${planLine(getEntitlements(ctx.db))}`);
             warnLicense(ctx.db, console.log);
-            ctx.licenseController.start(console.log);
+            ctx.licenseController.start();
         });
+        await waitForServerListening(server);
     });
     program
         .command('stdio')
         .description('Run as a stdio MCP server (for Claude Desktop / Claude Code local config)')
-        .requiredOption('--member <member>', 'Member (id or email) using this MCP process')
         .option('--account <account>', 'Limit access to one mailbox; repeat as needed', collectOption, [])
         .option('--profile <profile>', `Tool profile: ${NAMED_PERMISSION_PROFILES.join(', ')}`)
         .option('--allow <capability>', 'Allow one MCP capability; repeat as needed', collectOption, [])
         .action(async (opts) => {
         installTelemetrySignalHandlers();
-        installTelemetryStreamEndHandler(process.stdin);
+        installStdioShutdownHandler(process.stdin);
         const ctx = createContext();
         const permissions = permissionPolicyFromOptions(opts);
-        const member = findMember(ctx.db, opts.member);
+        const selected = resolveInstance(selectedInstance());
+        if (selected.profile.kind !== 'local') {
+            throw new EmailError('invalid_request', 'Stdio MCP only supports the local instance. Use the remote HTTP MCP endpoint with an API key.');
+        }
+        if (!selected.token)
+            throw new EmailError('permission_denied', 'Log in to the local instance before starting stdio MCP.');
+        const principal = authenticateBearer(ctx.db, selected.token);
+        if (!principal || principal.kind !== 'session')
+            throw new EmailError('permission_denied', 'The local CLI session has expired. Run "fluxmail login --instance local".');
         const accountIds = accountIdsFromRefs(ctx, opts.account);
-        const scopedService = ctx.service.withScope({ memberId: member.id, role: member.role, accountIds });
+        const scopedService = ctx.service.withPrincipal({ ...principal, accountIds });
         const server = buildMcpServer(scopedService, {
             permissions,
             maxAttachmentBytes: ctx.config.maxAttachmentBytes,
             telemetry: ctx.telemetry,
             transport: 'stdio',
+            logger: ctx.logger,
         });
         ctx.scheduler.start();
         await server.connect(new StdioServerTransport());
         ctx.telemetry.capture('mcp server started', { product_surface: 'mcp', transport: 'stdio' });
+        ctx.logger.info('server.started', 'Fluxmail stdio MCP server started', {
+            productSurface: 'mcp',
+            details: { transport: 'stdio' },
+            skipConsole: true,
+        });
         // stdout belongs to the MCP protocol; log to stderr only.
-        ctx.licenseController.start(console.error);
+        ctx.licenseController.start();
         console.error('Fluxmail MCP server running on stdio');
         warnLicense(ctx.db);
         const pending = scopedService.listScheduled().filter((send) => send.status === 'pending').length;
@@ -267,10 +678,6 @@ export function createCliProgram() {
         .command('add')
         .argument('<provider>', 'Email provider: gmail, outlook, or imap')
         .option('--reauthorize <account-id>', 'Reconnect an existing account')
-        .option('--owner <member>', 'Member (id or email) who owns the new mailbox')
-        .option('--member <member>', 'Deprecated alias for --owner')
-        .option('--shared', 'Share the mailbox with every member')
-        .option('--share-with <member>', 'Share with one member; repeat as needed', collectOption, [])
         .option('--local', 'Use the local browser callback for OAuth')
         .option('--hosted', 'Use FLUXMAIL_PUBLIC_URL for the OAuth callback')
         .option('--email <address>', 'Mailbox address (required for IMAP)')
@@ -295,102 +702,149 @@ export function createCliProgram() {
         .action(async (providerInput, opts, command) => {
         const provider = providerInput === 'microsoft' ? 'outlook' : providerInput;
         if (provider !== 'gmail' && provider !== 'outlook' && provider !== 'imap') {
+            finishCliOperation(program, 'error', 'invalid_request');
             console.error(`Provider "${providerInput}" is not supported. Available: gmail, outlook, imap`);
             process.exitCode = 1;
             return;
         }
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        const selected = resolveInstance(selectedInstance());
+        if (!selected.token) {
+            console.error(`Error: Log in to instance "${selected.name}" before connecting a mailbox.`);
+            process.exitCode = 1;
+            return;
+        }
         try {
             validateAccountConnectionFlags(provider, opts);
-            if (opts.owner && opts.member) {
-                throw new EmailError('invalid_request', '--owner and --member cannot be combined. Use --owner.');
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+            return;
+        }
+        let useControlPlane = selected.profile.kind === 'remote' || provider === 'imap';
+        if (selected.profile.kind === 'local' && provider !== 'imap') {
+            try {
+                useControlPlane = selectGmailConnectionMode(createContext().config, opts) === 'hosted';
+            }
+            catch (err) {
+                logActiveCliError(program, err);
+                console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        if (useControlPlane) {
+            try {
+                if (selected.profile.kind === 'remote' && opts.local) {
+                    throw new EmailError('invalid_request', '--local is only available for the local instance.');
+                }
+                let request = {
+                    provider,
+                    ...(opts.reauthorize ? { reauthorizeAccountId: opts.reauthorize } : {}),
+                };
+                if (provider === 'imap') {
+                    const email = opts.email?.trim();
+                    if (!email || !email.includes('@'))
+                        throw new EmailError('invalid_request', '--email must be a mailbox address.');
+                    if (!opts.imapHost)
+                        throw new EmailError('invalid_request', '--imap-host is required for IMAP accounts.');
+                    if (!opts.smtpHost)
+                        throw new EmailError('invalid_request', '--smtp-host is required for IMAP accounts.');
+                    const imapPassword = await accountSecret(opts.imapPasswordEnv, 'IMAP password');
+                    const smtpPassword = opts.smtpPasswordEnv
+                        ? await accountSecret(opts.smtpPasswordEnv, 'SMTP password')
+                        : imapPassword;
+                    const imapUser = opts.imapUser ?? email;
+                    request = {
+                        ...request,
+                        email,
+                        ...(opts.displayName ? { displayName: opts.displayName } : {}),
+                        imap: {
+                            host: opts.imapHost,
+                            port: connectionPort(opts.imapPort, '--imap-port'),
+                            security: connectionSecurity(opts.imapSecurity, '--imap-security'),
+                            user: imapUser,
+                            password: imapPassword,
+                        },
+                        smtp: {
+                            host: opts.smtpHost,
+                            port: connectionPort(opts.smtpPort, '--smtp-port'),
+                            security: connectionSecurity(opts.smtpSecurity, '--smtp-security'),
+                            user: opts.smtpUser ?? imapUser,
+                            password: smtpPassword,
+                        },
+                        ...(command.getOptionValueSource('saveSent') !== 'default' ? { saveSent: opts.saveSent } : {}),
+                        folderOverrides: {
+                            ...(opts.sentFolder ? { sent: opts.sentFolder } : {}),
+                            ...(opts.draftsFolder ? { drafts: opts.draftsFolder } : {}),
+                            ...(opts.trashFolder ? { trash: opts.trashFolder } : {}),
+                            ...(opts.archiveFolder ? { archive: opts.archiveFolder } : {}),
+                            ...(opts.spamFolder ? { spam: opts.spamFolder } : {}),
+                        },
+                    };
+                }
+                const result = await instanceClient(selected.name).json('/api/v1/accounts/connections', {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify(request),
+                });
+                if (result.connectionUrl)
+                    console.log(`Open this URL in your browser:\n\n  ${result.connectionUrl}\n`);
+                if (result.account) {
+                    console.log(`Connected ${result.account.email} (account id: ${result.account.id})`);
+                    for (const warning of result.warnings ?? [])
+                        console.log(`Warning: ${warning.message}.`);
+                }
             }
-            if (opts.shared && opts.shareWith.length) {
-                throw new EmailError('invalid_request', '--shared and --share-with cannot be combined.');
+            catch (err) {
+                logActiveCliError(program, err);
+                console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+                process.exitCode = 1;
             }
-            const ownerRef = opts.owner ?? opts.member;
-            if (opts.member)
-                console.error('Warning: --member is deprecated; use --owner.');
-            if (opts.reauthorize && (ownerRef || opts.shared || opts.shareWith.length)) {
-                throw new EmailError('invalid_request', 'Ownership and sharing options cannot be combined with --reauthorize. Use "fluxmail accounts assign" or "fluxmail accounts access".');
+            return;
+        }
+        const ctx = createContext();
+        warnLicense(ctx.db);
+        try {
+            const principal = authenticateBearer(ctx.db, selected.token);
+            if (!principal || principal.kind !== 'session') {
+                throw new EmailError('permission_denied', 'The local CLI session has expired. Run "fluxmail login --instance local".');
             }
-            // Resolve before the OAuth flow so a typo fails fast.
-            const owner = ownerRef ? findMember(ctx.db, ownerRef) : undefined;
+            const owner = findMember(ctx.db, principal.memberId);
             const existing = opts.reauthorize ? ctx.registry.getAccount(opts.reauthorize) : undefined;
+            if (existing && !canManageOwnedAccount(principal, existing)) {
+                throw new EmailError('permission_denied', 'Only the mailbox owner or an administrator can reauthorize it.');
+            }
             if (existing && existing.provider !== provider) {
                 throw new EmailError('invalid_request', `Account ${existing.id} uses ${existing.provider}, not ${provider}.`);
             }
             if (!existing)
                 ctx.registry.assertCanAddAccount();
-            if (!existing && !owner) {
-                throw new EmailError('invalid_request', '--owner <id-or-email> is required when connecting a mailbox.');
-            }
-            const sharedMemberIds = opts.shareWith.map((ref) => findMember(ctx.db, ref).id);
-            const access = {
-                sharingMode: sharingMode(opts.shared, sharedMemberIds),
-                sharedMemberIds,
-            };
-            if (provider === 'imap') {
-                const previousCredentials = existing ? ctx.registry.loadImapCredentials(existing.id) : undefined;
-                const email = opts.email?.trim();
-                if (!email || !email.includes('@'))
-                    throw new EmailError('invalid_request', '--email must be a mailbox address.');
-                if (!opts.imapHost)
-                    throw new EmailError('invalid_request', '--imap-host is required for IMAP accounts.');
-                if (!opts.smtpHost)
-                    throw new EmailError('invalid_request', '--smtp-host is required for IMAP accounts.');
-                if (existing && existing.email !== email) {
-                    throw new EmailError('invalid_request', `Account ${existing.id} belongs to ${existing.email}, not ${email}.`);
+            const access = { sharedWithAll: false, grantedMemberIds: [] };
+            const auditConnection = (operation, accountId) => {
+                try {
+                    recordAdminAuditEvent(ctx.db, {
+                        operation,
+                        outcome: 'success',
+                        actorMemberId: principal.memberId,
+                        actorSessionId: principal.sessionId,
+                        ...(accountId ? { resourceType: 'account', resourceId: accountId } : {}),
+                    });
                 }
-                const imapPassword = await accountSecret(opts.imapPasswordEnv, 'IMAP password');
-                const smtpPassword = opts.smtpPasswordEnv
-                    ? await accountSecret(opts.smtpPasswordEnv, 'SMTP password')
-                    : imapPassword;
-                const imapUser = opts.imapUser ?? email;
-                const credentials = {
-                    imap: {
-                        host: opts.imapHost,
-                        port: connectionPort(opts.imapPort, '--imap-port'),
-                        security: connectionSecurity(opts.imapSecurity, '--imap-security'),
-                        user: imapUser,
-                        password: imapPassword,
-                    },
-                    smtp: {
-                        host: opts.smtpHost,
-                        port: connectionPort(opts.smtpPort, '--smtp-port'),
-                        security: connectionSecurity(opts.smtpSecurity, '--smtp-security'),
-                        user: opts.smtpUser ?? imapUser,
-                        password: smtpPassword,
-                    },
-                    saveSent: previousCredentials && command.getOptionValueSource('saveSent') === 'default'
-                        ? previousCredentials.saveSent
-                        : opts.saveSent,
-                    folderOverrides: {
-                        ...previousCredentials?.folderOverrides,
-                        ...(opts.sentFolder ? { sent: opts.sentFolder } : {}),
-                        ...(opts.draftsFolder ? { drafts: opts.draftsFolder } : {}),
-                        ...(opts.trashFolder ? { trash: opts.trashFolder } : {}),
-                        ...(opts.archiveFolder ? { archive: opts.archiveFolder } : {}),
-                        ...(opts.spamFolder ? { spam: opts.spamFolder } : {}),
-                    },
-                };
-                console.log('Checking IMAP and SMTP settings...');
-                const warnings = await ctx.registry.testImapCredentials(email, credentials, opts.displayName);
-                const account = ctx.registry.addImapAccount(email, credentials, opts.displayName, owner?.id, opts.reauthorize, access);
-                console.log(`Connected ${account.email} (account id: ${account.id})`);
-                for (const warning of warnings)
-                    console.log(`Warning: ${warning.message}.`);
-                return;
-            }
+                catch {
+                    // Audit storage must not replace the connection result.
+                }
+            };
             if (provider === 'outlook') {
                 const connectionMode = selectGmailConnectionMode(ctx.config, opts);
                 if (connectionMode === 'hosted') {
                     const { connectionUrl } = prepareHostedOutlookConnection(ctx.db, ctx.config, {
-                        ...(owner ? { memberId: owner.id } : {}),
+                        ownerMemberId: owner.id,
                         ...(existing ? { reauthorizeAccountId: existing.id } : {}),
-                        ...(!existing ? { sharingMode: access.sharingMode, sharedMemberIds: access.sharedMemberIds } : {}),
+                        ...(!existing ? access : {}),
                     });
+                    auditConnection('account.connection.prepare', existing?.id);
                     console.log('\nOpen this URL in your browser to connect Outlook:\n');
                     console.log(`  ${connectionUrl}\n`);
                     console.log('This link expires in 10 minutes and can only be used once.');
@@ -401,23 +855,31 @@ export function createCliProgram() {
                     console.log(`  ${url}\n`);
                     console.log('Waiting for Microsoft to redirect back...');
                 }, (result) => {
+                    const duplicate = ctx.registry
+                        .listAccounts()
+                        .find((candidate) => candidate.email.toLowerCase() === result.email.toLowerCase());
+                    if (duplicate && !canManageOwnedAccount(principal, duplicate)) {
+                        throw new EmailError('permission_denied', 'Only the mailbox owner or an administrator can reauthorize it.');
+                    }
                     if (existing && result.email.toLowerCase() !== existing.email.toLowerCase()) {
                         throw new EmailError('invalid_request', `Microsoft authorized ${result.email}, but account ${existing.id} belongs to ${existing.email}. ` +
                             'Try again and choose the matching Microsoft account.');
                     }
-                    return ctx.registry.addOutlookAccount(result.email, result.credentials, result.displayName, owner?.id, existing?.id, access);
+                    return ctx.registry.addOutlookAccount(result.email, result.credentials, result.displayName, owner.id, existing?.id, access);
                 });
+                auditConnection('account.connection.complete', account.id);
                 console.log(`\nConnected ${account.email} (account id: ${account.id})` +
-                    (owner && account.ownerId === owner.id ? ` for member ${owner.name}` : ''));
+                    (account.ownerMemberId === owner.id ? ` for member ${owner.name}` : ''));
                 return;
             }
             const gmailConnectionMode = selectGmailConnectionMode(ctx.config, opts);
             if (gmailConnectionMode === 'hosted') {
                 const { connectionUrl } = prepareHostedGmailConnection(ctx.db, ctx.config, {
-                    ...(owner ? { memberId: owner.id } : {}),
+                    ownerMemberId: owner.id,
                     ...(existing ? { reauthorizeAccountId: existing.id } : {}),
-                    ...(!existing ? { sharingMode: access.sharingMode, sharedMemberIds: access.sharedMemberIds } : {}),
+                    ...(!existing ? access : {}),
                 });
+                auditConnection('account.connection.prepare', existing?.id);
                 console.log('\nOpen this URL in your browser to connect Gmail:\n');
                 console.log(`  ${connectionUrl}\n`);
                 console.log('This link expires in 10 minutes and can only be used once.');
@@ -428,21 +890,29 @@ export function createCliProgram() {
                 console.log(`  ${url}\n`);
                 console.log('Waiting for Google to redirect back…');
             }, (result) => {
+                const duplicate = ctx.registry
+                    .listAccounts()
+                    .find((candidate) => candidate.email.toLowerCase() === result.email.toLowerCase());
+                if (duplicate && !canManageOwnedAccount(principal, duplicate)) {
+                    throw new EmailError('permission_denied', 'Only the mailbox owner or an administrator can reauthorize it.');
+                }
                 if (existing && result.email !== existing.email) {
                     throw new EmailError('invalid_request', `Google authorized ${result.email}, but account ${existing.id} belongs to ${existing.email}. ` +
                         'Try again and choose the matching Google account.');
                 }
-                return ctx.registry.addGmailAccount(result.email, result.tokens, result.displayName, owner?.id, access);
+                return ctx.registry.addGmailAccount(result.email, result.tokens, result.displayName, owner.id, access, result.oauthClient);
             });
+            auditConnection('account.connection.complete', account.id);
             console.log(`\nConnected ${account.email} (account id: ${account.id})` +
-                (owner && account.ownerId === owner.id ? ` for member ${owner.name}` : ''));
-            if (owner && account.ownerId !== owner.id) {
+                (account.ownerMemberId === owner.id ? ` for member ${owner.name}` : ''));
+            if (account.ownerMemberId !== owner.id) {
                 // The mailbox was already connected; re-auth keeps its existing owner.
                 console.log(`${account.email} was already connected, so its ownership is unchanged. ` +
                     `To assign it to ${owner.name}, run "fluxmail accounts assign ${account.id} --owner ${owner.id}".`);
             }
         }
         catch (err) {
+            finishCliOperation(program, 'error', isEmailError(err) ? err.code : 'internal', err);
             console.error(`\nError: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -457,8 +927,6 @@ export function createCliProgram() {
         .option('--spam-folder <path>', 'Spam path, or auto to clear the override')
         .description('Set special folder paths for an IMAP account')
         .action(async (accountId, opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
         try {
             const changes = [
                 ['sent', opts.sentFolder],
@@ -470,41 +938,22 @@ export function createCliProgram() {
             if (!changes.some(([, value]) => value !== undefined)) {
                 throw new EmailError('invalid_request', 'Pass at least one folder option.');
             }
-            const credentials = ctx.registry.loadImapCredentials(accountId);
-            const provider = ctx.registry.getProvider(accountId);
-            try {
-                const existingPaths = new Set((await provider.listFolders()).map((folder) => folder.id));
-                const overrides = { ...credentials.folderOverrides };
-                for (const [role, value] of changes) {
-                    if (value === undefined)
-                        continue;
-                    if (value === 'auto')
-                        delete overrides[role];
-                    else {
-                        if (!existingPaths.has(value)) {
-                            throw new EmailError('not_found', `No selectable mailbox named "${value}".`);
-                        }
-                        overrides[role] = value;
-                    }
-                }
-                credentials.folderOverrides = overrides;
-                ctx.registry.saveImapCredentials(accountId, credentials);
-                const checked = ctx.registry.getProvider(accountId);
-                try {
-                    console.log(`Updated folder settings for ${accountId}.`);
-                    for (const warning of (await checked.getFolderWarnings?.()) ?? []) {
-                        console.log(`Warning: ${warning.message}.`);
-                    }
-                }
-                finally {
-                    await checked.close?.();
-                }
-            }
-            finally {
-                await provider.close?.();
+            const patch = {};
+            for (const [role, value] of changes) {
+                if (value !== undefined)
+                    patch[role] = value === 'auto' ? null : value;
             }
+            const result = await instanceClient(selectedInstance()).json(`/api/v1/accounts/${encodeURIComponent(accountId)}/imap/folders`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(patch),
+            });
+            console.log(`Updated folder settings for ${accountId}.`);
+            for (const warning of result.warnings)
+                console.log(`Warning: ${warning.message}.`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -512,67 +961,61 @@ export function createCliProgram() {
     accounts
         .command('list')
         .description('List connected accounts')
-        .action(() => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        const all = ctx.registry.listAccounts();
-        if (!all.length) {
-            console.log('No accounts connected. Run "fluxmail accounts add gmail --owner <member>", "fluxmail accounts add outlook --owner <member>", or the IMAP equivalent.');
-            return;
+        .action(async () => {
+        try {
+            const all = await instanceClient(selectedInstance()).json('/api/v1/accounts');
+            if (!all.length) {
+                console.log('No accounts connected. Run "fluxmail accounts add <provider>".');
+                return;
+            }
+            for (const a of all) {
+                const access = a.sharedWithAll
+                    ? 'all'
+                    : a.grantedMemberIds.length
+                        ? `selected:${a.grantedMemberIds.join(',')}`
+                        : 'owner-only';
+                console.log(`${a.id}  ${a.provider}  ${a.email}  [${a.status}]  owner=${a.ownerMemberId}  access=${access}`);
+            }
         }
-        const memberNames = new Map(listMembers(ctx.db).map((m) => [m.id, m.name]));
-        for (const a of all) {
-            const owner = a.ownerId ? (memberNames.get(a.ownerId) ?? a.ownerId) : '-';
-            const access = a.sharingMode === 'selected'
-                ? `selected:${a.sharedMemberIds.map((id) => memberNames.get(id) ?? id).join(',')}`
-                : a.sharingMode;
-            console.log(`${a.id}  ${a.provider}  ${a.email}  [${a.status}]  owner=${owner}  access=${access}`);
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
         }
     });
     accounts
         .command('remove')
         .argument('<accountId>')
         .description('Disconnect an account and delete its stored tokens')
-        .action((accountId) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        ctx.registry.removeAccount(accountId);
-        console.log(`Removed ${accountId}`);
+        .action(async (accountId) => {
+        try {
+            await instanceClient(selectedInstance()).json(`/api/v1/accounts/${encodeURIComponent(accountId)}/connection`, {
+                method: 'DELETE',
+            });
+            console.log(`Removed ${accountId}`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
     });
     accounts
         .command('assign')
         .argument('<accountId>')
-        .option('--owner <member>', 'Member (id or email) to own the mailbox')
-        .option('--member <member>', 'Deprecated alias for --owner')
-        .option('--shared', 'Deprecated alias for sharing with all members')
+        .requiredOption('--owner <member>', 'Member id or email to own the mailbox')
         .description('Change mailbox ownership')
-        .action((accountId, opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (accountId, opts) => {
         try {
-            if (opts.owner && opts.member) {
-                throw new EmailError('invalid_request', '--owner and --member cannot be combined. Use --owner.');
-            }
-            const ownerRef = opts.owner ?? opts.member;
-            if (!ownerRef && !opts.shared) {
-                throw new EmailError('invalid_request', 'Pass --owner <member>.');
-            }
-            if (ownerRef && opts.shared) {
-                throw new EmailError('invalid_request', '--owner and --shared cannot be combined.');
-            }
-            if (opts.member)
-                console.error('Warning: --member is deprecated; use --owner.');
-            if (opts.shared) {
-                console.error('Warning: "accounts assign --shared" is deprecated; use "accounts access --shared".');
-                const account = ctx.registry.setAccountAccess(accountId, { sharingMode: 'all' });
-                console.log(`${account.email} is now shared with every member. Its owner is unchanged.`);
-                return;
-            }
-            const owner = findMember(ctx.db, ownerRef);
-            const account = ctx.registry.assignAccountOwner(accountId, owner.id);
-            console.log(`${account.email} is now owned by ${owner.name}.`);
+            const account = await instanceClient(selectedInstance()).json(`/api/v1/admin/accounts/${encodeURIComponent(accountId)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ ownerMemberId: opts.owner }),
+            });
+            console.log(`${account.email} is now owned by ${account.ownerMemberId}.`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -584,22 +1027,21 @@ export function createCliProgram() {
         .option('--shared', 'Share the mailbox with every member')
         .option('--share-with <member>', 'Replace selected access with this member; repeat as needed', collectOption, [])
         .description('Set who can access a mailbox')
-        .action((accountId, opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (accountId, opts) => {
         try {
             const choices = Number(Boolean(opts.ownerOnly)) + Number(Boolean(opts.shared)) + Number(opts.shareWith.length > 0);
             if (choices !== 1) {
                 throw new EmailError('invalid_request', 'Pass exactly one of --owner-only, --shared, or one or more --share-with options.');
             }
-            const sharedMemberIds = opts.shareWith.map((ref) => findMember(ctx.db, ref).id);
-            const account = ctx.registry.setAccountAccess(accountId, {
-                sharingMode: sharingMode(opts.shared, sharedMemberIds),
-                sharedMemberIds,
+            const account = await instanceClient(selectedInstance()).json(`/api/v1/admin/accounts/${encodeURIComponent(accountId)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ sharedWithAll: opts.shared === true, grantedMemberIds: opts.shareWith }),
             });
-            console.log(`Updated access for ${account.email}: ${account.sharingMode}.`);
+            console.log(`Updated access for ${account.email}: ${account.sharedWithAll ? 'all members' : `${account.grantedMemberIds.length} explicit grant(s)`}.`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -608,24 +1050,25 @@ export function createCliProgram() {
     membersCmd
         .command('add')
         .requiredOption('--name <name>', 'Member name')
-        .option('--email <email>', 'Member email, usable as a shorthand in --member flags')
+        .requiredOption('--email <email>', 'Member login email')
         .option('--role <role>', 'Member role: admin or member')
         .description('Add a member (subject to the plan seat limit)')
-        .action((opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (opts) => {
         try {
             if (opts.role && opts.role !== 'admin' && opts.role !== 'member') {
                 throw new EmailError('invalid_request', '--role must be "admin" or "member".');
             }
-            const member = addMember(ctx.db, {
-                name: opts.name,
-                ...(opts.email ? { email: opts.email } : {}),
-                ...(opts.role ? { role: opts.role } : {}),
+            const member = await instanceClient(selectedInstance()).json('/api/v1/admin/members', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ name: opts.name, email: opts.email, role: opts.role ?? 'member' }),
             });
-            console.log(`Added member ${member.name} (id: ${member.id}, role: ${member.role})`);
+            console.log(`Added ${member.name} (id: ${member.id}, role: ${member.role}).`);
+            console.log(`Enrollment code (shown once): ${member.invitation.token}`);
+            console.log(`Expires: ${new Date(member.invitation.expiresAt).toISOString()}`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -633,30 +1076,36 @@ export function createCliProgram() {
     membersCmd
         .command('list')
         .description('List members with their mailbox and API key counts')
-        .action(() => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        const all = listMembers(ctx.db);
-        if (!all.length) {
-            console.log('No members. Run "fluxmail members add --name <name>".');
-            return;
+        .action(async () => {
+        try {
+            const all = await instanceClient(selectedInstance()).json('/api/v1/admin/members');
+            if (!all.length) {
+                console.log('No members. Run "fluxmail members add --name <name>".');
+                return;
+            }
+            for (const m of all) {
+                console.log(`${m.id}  ${m.name}  role=${m.role}  status=${m.status}  email=${m.email ?? '-'}  mailboxes=${m.accountCount}  keys=${m.apiKeyCount}`);
+            }
         }
-        for (const m of all) {
-            console.log(`${m.id}  ${m.name}  role=${m.role}  email=${m.email ?? '-'}  mailboxes=${m.accountCount}  keys=${m.apiKeyCount}`);
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
         }
     });
     membersCmd
         .command('remove')
         .argument('<memberId>')
         .description('Remove a member after reassigning or removing their mailboxes')
-        .action((memberId) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (memberId) => {
         try {
-            const { name, revokedApiKeys } = removeMember(ctx.db, memberId);
-            console.log(`Removed ${name} and revoked ${revokedApiKeys} API key(s).`);
+            await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberId)}`, {
+                method: 'DELETE',
+            });
+            console.log(`Removed ${memberId}.`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -666,17 +1115,97 @@ export function createCliProgram() {
         .argument('<member>', 'Member id or email')
         .argument('<role>', 'admin or member')
         .description('Change a member role')
-        .action((memberRef, role) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (memberRef, role) => {
         try {
             if (role !== 'admin' && role !== 'member') {
                 throw new EmailError('invalid_request', 'Role must be "admin" or "member".');
             }
-            const member = setMemberRole(ctx.db, memberRef, role);
+            const member = await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberRef)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ role }),
+            });
             console.log(`${member.name} now has the ${member.role} role.`);
         }
         catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    membersCmd
+        .command('status')
+        .argument('<member>', 'Member id or email')
+        .argument('<status>', 'active or suspended')
+        .description('Activate or suspend a member')
+        .action(async (memberRef, status) => {
+        try {
+            if (status !== 'active' && status !== 'suspended') {
+                throw new EmailError('invalid_request', 'Status must be "active" or "suspended".');
+            }
+            const member = await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberRef)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ status }),
+            });
+            console.log(`${member.name} is now ${member.status}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    for (const [commandName, endpoint, label] of [
+        ['invite', 'invitation', 'Enrollment code'],
+        ['password-reset', 'password-reset', 'Password reset code'],
+    ]) {
+        membersCmd
+            .command(commandName)
+            .argument('<member>', 'Member id or email')
+            .description(commandName === 'invite' ? 'Issue a new enrollment code' : 'Issue a password reset code')
+            .action(async (memberRef) => {
+            try {
+                const token = await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberRef)}/${endpoint}`, { method: 'POST' });
+                console.log(`${label} (shown once): ${token.token}`);
+                console.log(`Expires: ${new Date(token.expiresAt).toISOString()}`);
+            }
+            catch (err) {
+                logActiveCliError(program, err);
+                console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+                process.exitCode = 1;
+            }
+        });
+    }
+    membersCmd
+        .command('sessions')
+        .argument('<member>', 'Member id or email')
+        .description('List sessions for a member')
+        .action(async (memberRef) => {
+        try {
+            const sessions = await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberRef)}/sessions`);
+            for (const session of sessions) {
+                console.log(`${session.id}  ${session.deviceName}  expires=${new Date(session.expiresAt).toISOString()}`);
+            }
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    membersCmd
+        .command('revoke-session')
+        .argument('<member>', 'Member id or email')
+        .argument('<sessionId>')
+        .description('Revoke a member session')
+        .action(async (memberRef, sessionId) => {
+        try {
+            await instanceClient(selectedInstance()).json(`/api/v1/admin/members/${encodeURIComponent(memberRef)}/sessions/${encodeURIComponent(sessionId)}`, { method: 'DELETE' });
+            console.log(`Revoked ${sessionId}.`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -692,27 +1221,48 @@ export function createCliProgram() {
     apikey
         .command('create')
         .requiredOption('--name <name>', 'Human-readable key name')
-        .requiredOption('--member <member>', 'Member (id or email) the key is issued to')
+        .option('--member <member>', 'Admin only: issue the key to another member')
         .option('--account <account>', 'Limit the key to one mailbox; repeat as needed', collectOption, [])
         .option('--profile <profile>', `Tool profile: ${NAMED_PERMISSION_PROFILES.join(', ')}`)
         .option('--allow <capability>', 'Allow one capability in a custom policy; repeat as needed', collectOption, [])
         .option('--admin <capability>', 'Add one admin capability to a named profile; repeat as needed', collectOption, [])
         .description('Create an API key (shown once)')
-        .action((opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (opts) => {
         try {
-            const member = findMember(ctx.db, opts.member);
-            const accountIds = accountIdsFromRefs(ctx, opts.account);
             const permissions = permissionPolicyFromOptions(opts);
-            const { key, info } = createApiKey(ctx.db, opts.name, member.id, permissions, accountIds);
-            console.log(`Created API key "${info.name}" (id: ${info.id}, profile: ${info.permissionProfile})` +
-                ` for member ${member.name}` +
-                '\n');
-            console.log(`  ${key}\n`);
+            const body = {
+                name: opts.name,
+                ...(opts.member ? { member: opts.member } : {}),
+                accounts: opts.account.length ? opts.account : null,
+                ...(permissions.profile === 'custom'
+                    ? { customCapabilities: permissions.capabilities }
+                    : {
+                        permissionProfile: permissions.profile,
+                        supplementalCapabilities: permissions.supplementalCapabilities,
+                    }),
+            };
+            const created = await instanceClient(selectedInstance()).json(opts.member ? '/api/v1/admin/api-keys' : '/api/v1/me/api-keys', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(opts.member
+                    ? body
+                    : {
+                        name: body.name,
+                        accountIds: body.accounts,
+                        ...(permissions.profile === 'custom'
+                            ? { capabilities: permissions.capabilities }
+                            : {
+                                permissionProfile: permissions.profile,
+                                supplementalCapabilities: permissions.supplementalCapabilities,
+                            }),
+                    }),
+            });
+            console.log(`Created API key "${created.name}" (id: ${created.id}, profile: ${created.permissionProfile}).\n`);
+            console.log(`  ${created.key}\n`);
             console.log('Store it now; it cannot be shown again.');
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -720,23 +1270,28 @@ export function createCliProgram() {
     apikey
         .command('list')
         .description('List API keys')
-        .action(() => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        const keys = listApiKeys(ctx.db);
-        if (!keys.length) {
-            console.log('No API keys. Run "fluxmail apikey create --name <name> --member <member>".');
-            return;
+        .action(async () => {
+        try {
+            const client = instanceClient(selectedInstance());
+            const me = await client.json('/api/v1/me');
+            const keys = await client.json(me.role === 'admin' ? '/api/v1/admin/api-keys' : '/api/v1/me/api-keys');
+            if (!keys.length) {
+                console.log('No API keys. Run "fluxmail apikey create --name <name>".');
+                return;
+            }
+            for (const k of keys) {
+                const lastUsed = k.lastUsedAt ? new Date(k.lastUsedAt).toISOString() : 'never';
+                const accountScope = k.accountIds === null ? 'all granted' : k.accountIds.join(',') || 'none';
+                console.log(`${k.id}  ${k.name}  member=${k.memberId}  accounts=${accountScope}  profile=${k.permissionProfile}` +
+                    (k.permissionProfile === 'custom' ? `  allows=${k.capabilities.join(',')}` : '') +
+                    (k.supplementalCapabilities.length ? `  admin=${k.supplementalCapabilities.join(',')}` : '') +
+                    `  created=${new Date(k.createdAt).toISOString()}  lastUsed=${lastUsed}`);
+            }
         }
-        const memberNames = new Map(listMembers(ctx.db).map((m) => [m.id, m.name]));
-        for (const k of keys) {
-            const lastUsed = k.lastUsedAt ? new Date(k.lastUsedAt).toISOString() : 'never';
-            const member = k.memberId ? (memberNames.get(k.memberId) ?? k.memberId) : 'system';
-            const accountScope = k.accountIds === null ? 'all granted' : k.accountIds.join(',') || 'none';
-            console.log(`${k.id}  ${k.name}  member=${member}  accounts=${accountScope}  profile=${k.permissionProfile}` +
-                (k.permissionProfile === 'custom' ? `  allows=${k.capabilities.join(',')}` : '') +
-                (k.supplementalCapabilities.length ? `  admin=${k.supplementalCapabilities.join(',')}` : '') +
-                `  created=${new Date(k.createdAt).toISOString()}  lastUsed=${lastUsed}`);
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
         }
     });
     apikey
@@ -745,22 +1300,23 @@ export function createCliProgram() {
         .option('--account <account>', 'Replace the allowlist with this mailbox; repeat as needed', collectOption, [])
         .option('--all-accounts', 'Clear the allowlist')
         .description('Replace or clear an API key mailbox allowlist')
-        .action((keyId, opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (keyId, opts) => {
         try {
             if (Boolean(opts.allAccounts) === Boolean(opts.account.length)) {
                 throw new EmailError('invalid_request', 'Pass --all-accounts or at least one --account.');
             }
-            const accountIds = opts.allAccounts ? null : accountIdsFromRefs(ctx, opts.account);
-            if (!updateApiKeyAccounts(ctx.db, keyId, accountIds)) {
-                throw new EmailError('not_found', `No key with id ${keyId}.`);
-            }
+            const accountIds = opts.allAccounts ? null : opts.account;
+            await instanceClient(selectedInstance()).json(`/api/v1/admin/api-keys/${encodeURIComponent(keyId)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ accounts: accountIds }),
+            });
             console.log(accountIds === null
                 ? `Cleared the mailbox allowlist for ${keyId}.`
                 : `Updated ${keyId} to ${accountIds.length} mailbox(es).`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -772,25 +1328,30 @@ export function createCliProgram() {
         .option('--allow <capability>', 'Allow one capability in a custom policy; repeat as needed', collectOption, [])
         .option('--admin <capability>', 'Add one admin capability to a named profile; repeat as needed', collectOption, [])
         .description('Change the permissions for an API key')
-        .action((keyId, opts) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
+        .action(async (keyId, opts) => {
         try {
-            const existing = listApiKeys(ctx.db).find((key) => key.id === keyId);
+            const client = instanceClient(selectedInstance());
+            const existing = (await client.json('/api/v1/admin/api-keys')).find((key) => key.id === keyId);
             if (!existing) {
                 console.error(`No key with id ${keyId}`);
                 process.exitCode = 1;
                 return;
             }
             const permissions = permissionPolicyForUpdate(opts, existing);
-            if (!updateApiKeyPermissions(ctx.db, keyId, permissions)) {
-                console.error(`No key with id ${keyId}`);
-                process.exitCode = 1;
-                return;
-            }
+            await client.json(`/api/v1/admin/api-keys/${encodeURIComponent(keyId)}`, {
+                method: 'PATCH',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(permissions.profile === 'custom'
+                    ? { customCapabilities: permissions.capabilities }
+                    : {
+                        permissionProfile: permissions.profile,
+                        supplementalCapabilities: permissions.supplementalCapabilities,
+                    }),
+            });
             console.log(`Updated ${keyId} to profile ${permissions.profile}`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
@@ -799,151 +1360,267 @@ export function createCliProgram() {
         .command('revoke')
         .argument('<keyId>')
         .description('Revoke an API key')
-        .action((keyId) => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        console.log(revokeApiKey(ctx.db, keyId) ? `Revoked ${keyId}` : `No key with id ${keyId}`);
+        .action(async (keyId) => {
+        try {
+            const client = instanceClient(selectedInstance());
+            const me = await client.json('/api/v1/me');
+            const path = me.role === 'admin'
+                ? `/api/v1/admin/api-keys/${encodeURIComponent(keyId)}`
+                : `/api/v1/me/api-keys/${encodeURIComponent(keyId)}`;
+            await client.json(path, { method: 'DELETE' });
+            console.log(`Revoked ${keyId}`);
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
     });
     const license = program.command('license').description('Manage the paid-tier license');
     license
         .command('activate')
-        .argument('<key>', 'License key (fluxmail_lic_…), shown once at purchase')
+        .argument('[key]', 'Deprecated: license key shown once at purchase')
+        .option('--key-file <path>', 'Read the license key from a file, or use - for stdin')
         .description('Store a license key and validate it with the license server')
-        .action(async (key) => {
-        if (!LICENSE_KEY_PATTERN.test(key)) {
-            console.error('That does not look like a Fluxmail license key (expected "fluxmail_lic_" followed by 40 hex characters).');
+        .action(async (deprecatedKey, options) => {
+        if (deprecatedKey && options.keyFile) {
+            console.error('Error: The deprecated positional key cannot be combined with --key-file.');
             process.exitCode = 1;
             return;
         }
-        const dataDir = resolveDataDir();
-        const overridingKey = process.env.FLUXMAIL_LICENSE_KEY?.trim();
-        if (overridingKey && overridingKey !== key) {
-            console.error('FLUXMAIL_LICENSE_KEY is already set by the shell or a .env file, which takes precedence over stored settings. Remove it before activating a different key.');
-            process.exitCode = 1;
-            return;
+        if (deprecatedKey) {
+            console.error('Warning: Passing a license key as an argument is deprecated. Use --key-file or hidden input.');
         }
-        const ctx = createContext();
-        const result = await activateLicense(ctx.db, {
-            licenseKey: key,
-            serverUrl: ctx.config.licenseServerUrl,
-            dataDir,
-        });
-        if (result.outcome === 'refreshed') {
-            const { lease } = result;
-            console.log(`License activated: ${lease.plan} plan, up to ${lease.maxAccounts} mailboxes and ` +
-                `${lease.maxMembers} member${lease.maxMembers === 1 ? '' : 's'}.`);
-            console.log(`The lease is valid until ${lease.expiresAt} and renews automatically while the server runs.`);
+        const key = deprecatedKey ?? (await secretInput(options.keyFile, 'License key'));
+        if (!LICENSE_KEY_PATTERN.test(key)) {
+            console.error('That does not look like a Fluxmail license key (expected "fluxmail_lic_" followed by 40 hex characters).');
+            process.exitCode = 1;
             return;
         }
-        console.error(result.message);
-        if (result.outcome === 'outage') {
-            console.error('The key is saved; validation will be retried automatically once the server can reach it.');
+        try {
+            const result = await instanceClient(selectedInstance()).json('/api/v1/admin/license/activate', {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ licenseKey: key }),
+            });
+            if (result.lease) {
+                console.log(`License activated: ${result.lease.plan} plan, up to ${result.lease.maxAccounts} mailboxes and ` +
+                    `${result.lease.maxMembers} member${result.lease.maxMembers === 1 ? '' : 's'}.`);
+                console.log(`The lease is valid until ${result.lease.expiresAt} and renews automatically while the server runs.`);
+            }
+            else {
+                console.log('The license key was saved. Validation will retry when the instance can reach the license server.');
+            }
         }
-        else {
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
     });
     license
         .command('status')
         .description('Show the configured license and cached lease')
-        .action(() => {
-        const ctx = createContext();
-        if (ctx.config.licenseKey) {
-            console.log(`License key: ${maskStoredConfigValue('FLUXMAIL_LICENSE_KEY', ctx.config.licenseKey)}`);
-        }
-        else {
-            console.log('No license key configured. Run "fluxmail license activate <key>" after purchasing one.');
-        }
-        const row = readLeaseRow(ctx.db);
-        if (row) {
-            console.log(`Last validated: ${new Date(row.updatedAt).toISOString()}`);
-            try {
-                const lease = verifyLease(row.token, licensePublicKeys(), new Date(), { allowExpired: true });
-                const expired = Date.parse(lease.expiresAt) <= Date.now();
-                console.log(`Lease ${expired ? 'expired' : 'valid until'} ${lease.expiresAt}: ${lease.plan} plan, ` +
-                    `up to ${lease.maxAccounts} mailboxes and ${lease.maxMembers} member${lease.maxMembers === 1 ? '' : 's'}.`);
-            }
-            catch (err) {
-                console.log(`Cached lease is not usable (${err instanceof Error ? err.message : String(err)}).`);
-            }
+        .action(async () => {
+        try {
+            const status = await instanceClient(selectedInstance()).json('/api/v1/admin/license');
+            console.log(status.configured
+                ? `License configured from ${status.source}.`
+                : 'No license key configured. Run "fluxmail license activate" after purchasing one.');
+            console.log(`Current plan: ${planLine(status.entitlements)}`);
+            console.log(`Usage: ${status.usage.accounts} mailbox(es), ${status.usage.members} member(s)` +
+                (status.usage.overQuota ? ' (over plan limits)' : ''));
+            if (status.lastValidatedAt)
+                console.log(`Last validated: ${status.lastValidatedAt}`);
+            if (status.warning)
+                console.log(`Warning: ${status.warning}`);
         }
-        else {
-            console.log('No cached lease.');
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
         }
-        console.log(`Current plan: ${planLine(getEntitlements(ctx.db))}`);
-        warnLicense(ctx.db, console.log);
     });
     license
         .command('deactivate')
         .description('Release the license from this instance and remove the stored key and cached lease')
         .action(async () => {
-        const dataDir = resolveDataDir();
-        // Captured before createContext() merges the stored config into the
-        // environment: truthy only when the key comes from the shell or a .env file.
-        const envLicenseKey = process.env.FLUXMAIL_LICENSE_KEY?.trim();
-        const ctx = createContext();
-        // Best effort: free the server-side instance binding so the key can be
-        // activated elsewhere. Local deactivation proceeds either way.
-        if (ctx.config.licenseKey) {
-            const released = await releaseLicense({
-                serverUrl: ctx.config.licenseServerUrl,
-                licenseKey: ctx.config.licenseKey,
-                instanceId: loadInstanceId(dataDir),
-            });
-            console.log(released
-                ? 'Released the license from this instance; it can now be activated elsewhere.'
-                : 'Could not reach the license server to release this instance; unused bindings are released automatically after a while.');
-        }
-        const removed = unsetStoredConfig(dataDir, 'FLUXMAIL_LICENSE_KEY');
-        clearLease(ctx.db);
-        console.log(removed
-            ? 'License removed; this instance is back to Personal-plan limits.'
-            : 'No stored license key; cleared any cached lease.');
-        if (envLicenseKey) {
-            console.log('Note: FLUXMAIL_LICENSE_KEY is still set in the environment or a .env file.');
-        }
-    });
-    const configCmd = program
-        .command('config')
-        .description('Persistent settings stored in the data dir, usable from any directory');
+        try {
+            const result = await instanceClient(selectedInstance()).json('/api/v1/admin/license', { method: 'DELETE' });
+            console.log(result.released
+                ? 'Released the license from this instance.'
+                : 'The local license was removed. The remote binding, if any, will expire automatically.');
+            console.log('This instance is back to Personal plan limits.');
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
+    });
+    const configCmd = program.command('config').description('Inspect and initialize deployment configuration');
     configCmd
-        .command('set')
-        .argument('<key>', 'Setting name, e.g. GOOGLE_CLIENT_ID')
-        .argument('<value>')
-        .description('Store a setting (shell env vars and local .env files still take precedence)')
-        .action((key, value) => {
+        .command('init')
+        .description('Create config.toml in the Fluxmail data directory')
+        .action(() => {
         try {
             const dataDir = resolveDataDir();
-            setStoredConfig(dataDir, key, value);
-            console.log(`Set ${key} in ${configFilePath(dataDir)}`);
+            const file = configTomlPath(dataDir);
+            writeDeploymentConfig(file, deploymentToml(), { exclusive: true });
+            console.log(`Created ${file}`);
         }
         catch (err) {
+            logActiveCliError(program, err);
             console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
         }
     });
     configCmd
-        .command('unset')
-        .argument('<key>')
-        .description('Remove a stored setting')
-        .action((key) => {
-        const dataDir = resolveDataDir();
-        console.log(unsetStoredConfig(dataDir, key) ? `Removed ${key}` : `${key} is not set`);
+        .command('show')
+        .description('Show effective configuration, sources, paths, and restart requirements')
+        .action(() => {
+        const deployment = resolveStoreLocation().deployment;
+        const compatibility = inspectStoreCompatibility(deployment.dbPath, deployment.dataDir);
+        const canReadInstanceSettings = compatibility.storeFormat >= MIN_SUPPORTED_STORE_FORMAT &&
+            compatibility.storeFormat <= compatibility.maximumSupportedFormat;
+        const db = canReadInstanceSettings && deployment.dbPath !== ':memory:'
+            ? openReadonlyDb(deployment.dbPath)
+            : openDb(':memory:', { backupBeforeMigration: false });
+        try {
+            const configuration = createConfigurationService(deployment, db);
+            const config = configuration.config;
+            console.log(`Data directory: ${deployment.dataDir} [${deployment.sources.dataDir}]`);
+            console.log(`Configuration file: ${deployment.configFile}${existsSync(deployment.configFile) ? '' : ' (not created)'}`);
+            console.log(`Database: ${deployment.dbPath} [${deployment.sources.dbPath}] restart required`);
+            console.log(`Server port: ${deployment.port} [${deployment.sources.port}] restart required`);
+            console.log(`Public URL: ${deployment.publicUrl} [${deployment.sources.publicUrl}] restart required`);
+            console.log(`Trust proxy: ${deployment.trustProxy} [${deployment.sources.trustProxy}] restart required`);
+            console.log(`Local OAuth host: ${deployment.oauthHost} [${deployment.sources.oauthHost}] restart required`);
+            console.log(`Local OAuth port: ${deployment.oauthPort} [${deployment.sources.oauthPort}] restart required`);
+            console.log(`Maximum attachment: ${deployment.maxAttachmentBytes / (1024 * 1024)} MB [${deployment.sources.maxAttachmentBytes}] restart required`);
+            console.log(`Encryption key: ${deployment.encryptionKey.length === 32 ? 'configured' : 'not configured'} [${deployment.sources.encryptionKey}]`);
+            const oauth = configuration.oauthStatus();
+            console.log(`Google OAuth: configured [${oauth.google.source}]`);
+            console.log(`Outlook OAuth: ${oauth.outlook.clientId ? 'configured' : 'not configured'} [${oauth.outlook.source ?? 'none'}]`);
+            console.log(`License: ${config.licenseKey ? 'configured' : 'not configured'} [${configuration.licenseSource() ?? 'none'}]`);
+        }
+        finally {
+            db.$client.close();
+        }
     });
     configCmd
-        .command('list')
-        .description('Show stored settings (secret values are masked)')
-        .action(() => {
-        const dataDir = resolveDataDir();
-        const stored = readStoredConfig(dataDir);
-        const keys = Object.keys(stored);
-        if (!keys.length) {
-            console.log(`No stored settings. Run "fluxmail config set <KEY> <value>" (file: ${configFilePath(dataDir)}).`);
+        .command('migrate')
+        .requiredOption('--from <env-file>', 'Read recognized settings from this env file')
+        .option('--dry-run', 'Show recognized setting names without changing Fluxmail')
+        .description('Import settings from an env file without deleting it')
+        .action((options) => {
+        const source = path.resolve(options.from);
+        if (options.dryRun) {
+            const recognized = recognizedMigrationSettings(parseEnvContent(readFileSync(source, 'utf8')));
+            console.log(recognized.length ? recognized.join('\n') : 'No recognized settings found.');
             return;
         }
-        for (const key of keys) {
-            const value = stored[key] ?? '';
-            console.log(`${key}=${maskStoredConfigValue(key, value)}`);
+        const result = migrateConfigurationFile(source);
+        console.log(`Imported ${result.recognized.length} recognized setting${result.recognized.length === 1 ? '' : 's'} from ${result.source}.`);
+        console.log('Restart Fluxmail to apply deployment configuration changes.');
+    });
+    const oauth = program.command('oauth').description('Manage OAuth applications');
+    oauth
+        .command('status')
+        .description('Show OAuth application status without secrets')
+        .action(async () => {
+        const status = await instanceClient(selectedInstance()).json('/api/v1/admin/oauth-apps');
+        console.log(JSON.stringify(status, null, 2));
+    });
+    const oauthConfigure = oauth.command('configure').description('Configure an OAuth application');
+    oauthConfigure
+        .command('google')
+        .requiredOption('--client-id <id>', 'Google OAuth client ID')
+        .option('--client-secret-file <path>', 'Read the client secret from a file, or use - for stdin')
+        .description('Configure a custom Google OAuth application')
+        .action(async (options) => {
+        const clientSecret = await secretInput(options.clientSecretFile, 'Google client secret');
+        await instanceClient(selectedInstance()).json('/api/v1/admin/oauth-apps/google', {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ clientId: options.clientId, clientSecret }),
+        });
+        console.log('Google OAuth application configured.');
+    });
+    oauthConfigure
+        .command('outlook')
+        .requiredOption('--client-id <id>', 'Microsoft OAuth client ID')
+        .option('--tenant-id <tenant>', 'Microsoft tenant ID', 'common')
+        .option('--public-client', 'Configure a public client without a secret')
+        .option('--client-secret-file <path>', 'Read the client secret from a file, or use - for stdin')
+        .description('Configure a custom Microsoft OAuth application')
+        .action(async (options) => {
+        if (options.publicClient && options.clientSecretFile) {
+            throw new EmailError('invalid_request', '--public-client cannot be combined with --client-secret-file.');
+        }
+        const clientSecret = options.publicClient
+            ? undefined
+            : await secretInput(options.clientSecretFile, 'Microsoft client secret');
+        await instanceClient(selectedInstance()).json('/api/v1/admin/oauth-apps/outlook', {
+            method: 'PUT',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                clientId: options.clientId,
+                tenantId: options.tenantId,
+                publicClient: Boolean(options.publicClient),
+                ...(clientSecret ? { clientSecret } : {}),
+            }),
+        });
+        console.log('Microsoft OAuth application configured.');
+    });
+    oauth
+        .command('reset')
+        .argument('<provider>', 'google or outlook')
+        .description('Remove a stored OAuth application')
+        .action(async (provider) => {
+        if (provider !== 'google' && provider !== 'outlook') {
+            throw new EmailError('invalid_request', 'Provider must be google or outlook.');
+        }
+        await instanceClient(selectedInstance()).json(`/api/v1/admin/oauth-apps/${provider}`, { method: 'DELETE' });
+        console.log(`${provider === 'google' ? 'Google' : 'Microsoft'} OAuth application reset.`);
+    });
+    program
+        .command('logs')
+        .description('Show recent local log entries')
+        .option('--tail <count>', 'Number of entries to show, from 1 through 1000', '100')
+        .option('--level <level>', 'Minimum level: info, warn, or error', 'info')
+        .option('--json', 'Print each entry as JSON')
+        .action((opts) => {
+        try {
+            const tail = Number(opts.tail);
+            if (!Number.isInteger(tail) || tail < 1 || tail > 1000) {
+                throw new EmailError('invalid_request', '--tail must be an integer from 1 through 1000.');
+            }
+            if (!['info', 'warn', 'error'].includes(opts.level)) {
+                throw new EmailError('invalid_request', '--level must be info, warn, or error.');
+            }
+            const result = readLocalLogs(resolveDataDir(), {
+                tail,
+                minimumLevel: opts.level,
+            });
+            for (const entry of result.entries) {
+                if (opts.json) {
+                    console.log(entry.raw);
+                    continue;
+                }
+                const singleLine = escapeLogTextForConsole;
+                const code = entry.record.error?.code ? ` [${singleLine(entry.record.error.code)}]` : '';
+                console.log(`${singleLine(entry.record.timestamp)} ${entry.record.level.toUpperCase()} ${singleLine(entry.record.event)}${code}: ${singleLine(entry.record.message)}`);
+            }
+            if (result.malformedLines > 0) {
+                console.error(`Warning: skipped ${result.malformedLines} malformed local log line${result.malformedLines === 1 ? '' : 's'}.`);
+            }
+        }
+        catch (error) {
+            const code = isEmailError(error) ? error.code : 'internal';
+            finishCliOperation(program, 'error', code, error);
+            console.error(`Error [${code}]: ${error instanceof Error ? error.message : String(error)}`);
+            process.exitCode = 1;
         }
     });
     const telemetryCmd = program.command('telemetry').description('Manage anonymous usage telemetry');
@@ -961,7 +1638,6 @@ export function createCliProgram() {
         .action(() => {
         const dataDir = resolveDataDir();
         setTelemetryEnabled(dataDir, true);
-        unsetStoredConfig(dataDir, 'FLUXMAIL_TELEMETRY');
         console.log('Telemetry enabled. FLUXMAIL_TELEMETRY=0 or DO_NOT_TRACK=1 can still turn it off.');
     });
     telemetryCmd
@@ -971,24 +1647,41 @@ export function createCliProgram() {
         const dataDir = resolveDataDir();
         console.log(`Telemetry is ${isTelemetryEnabled(dataDir) ? 'enabled' : 'disabled'}.`);
     });
+    registerMailCommands(program, {
+        selectedInstance,
+        selectedAccount,
+        reportError: (error, code) => {
+            finishCliOperation(program, 'error', code, error);
+            console.error(`Error [${code}]: ${error instanceof Error ? error.message : String(error)}`);
+            process.exitCode = 1;
+        },
+    });
     program
         .command('status')
-        .description('Show accounts, members, entitlements, and provider availability')
+        .description('Show mailbox and provider status for the selected instance')
         .action(async () => {
-        const ctx = createContext();
-        warnLicense(ctx.db);
-        console.log(JSON.stringify(await ctx.service.status(), null, 2));
+        try {
+            const status = await instanceClient(selectedInstance()).json('/api/v1/status');
+            console.log(JSON.stringify(status, null, 2));
+        }
+        catch (err) {
+            logActiveCliError(program, err);
+            console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exitCode = 1;
+        }
     });
     return program;
 }
 export async function runCli(argv = process.argv) {
+    const program = createCliProgram({ updateNotifierFactory: createCliUpdateNotifier });
     try {
-        await createCliProgram().parseAsync([...argv]);
+        await program.parseAsync([...argv]);
     }
     catch (err) {
+        finishCliOperation(program, 'error', isEmailError(err) ? err.code : 'internal', err);
         console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
         process.exitCode = 1;
-        await shutdownTelemetry();
+        await Promise.all([shutdownTelemetry(), shutdownLogging()]);
     }
 }
 function isEntrypoint() {