hirify-cli 0.4.6 → 0.5.0

package/bin/hirify.js

@@ -1,1887 +1,4 @@
 #!/usr/bin/env node
-// Hirify CLI: job search for AI agents.
-//
-// A thin client over `api.hirify.me/api/agent/*`, the same API the MCP server serves.
-// No dependencies: Node 18+ (built-in fetch), runs through `npx hirify-cli`.
-//
-// Metering, same as on the server: lists and searches are free, and three actions are
-// metered - reading a vacancy in full, revealing a contact, and applying. Repeating a read
-// or a reveal on the same vacancy is free. No number for any of them is written down in
-// this file: `hirify account show` reports what the server has left, and that is the only
-// place any of them is true.
-//
-import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join, dirname } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { createServer } from 'node:http'
-import { execFileSync, spawn, spawnSync } from 'node:child_process'
-import { randomBytes, createHash } from 'node:crypto'
-
-const API = process.env.HIRIFY_API || 'https://api.hirify.me'
-// The two public well-known documents the CLI is allowed to hardcode. OAuth discovery is
-// unchanged; the Hirify agent document is where the CLI learns the manifest URL, so it never
-// has to hardcode an agent operation path of its own.
-const OAUTH_WELL_KNOWN = '/.well-known/oauth-authorization-server'
-const AGENT_WELL_KNOWN = '/.well-known/hirify-agent'
-const CONFIG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'hirify')
-// One file for either way of signing in. Working out where the current token came from
-// is cheaper from a single `kind` field than from two files that may both exist.
-const AUTH_FILE = join(CONFIG_DIR, 'auth.json')
-// The key file from 0.1: still read for anyone who has one, never written again.
-const LEGACY_KEY_FILE = join(CONFIG_DIR, 'key')
-
-// What to ask for at sign-in when the server does not publish its own list. An OAuth token
-// carries exactly what the person agreed to, and nothing can add an ability to it later
-// without sending them back through the consent screen, so a sign-in that asks for too
-// little is a sign-in the person has to repeat.
-//
-// This is a fallback, not the list. The authorization server publishes `scopes_supported`
-// (RFC 8414) and that is what we ask for, because a list frozen here is a list that goes
-// stale: on 18.08 the server had no `agent:feedback` and dropped it from the request in
-// silence, and everyone who signed in that day still cannot send a report.
-const FALLBACK_SCOPES = 'agent:read agent:reveal agent:apply agent:manage agent:feedback offline_access'
-const CALLBACK_PATH = '/callback'
-// How long we wait for the browser. The authorization code lives the same five minutes.
-const LOGIN_TIMEOUT_MS = 5 * 60 * 1000
-
-// The two kinds of report the API takes. This one is ours to know: it is the word a
-// person types, and the CLI has to tell them which words there are before it can send
-// anything at all.
-const FEEDBACK_TYPES = ['bug', 'feature']
-
-// Read from package.json rather than repeated here: the server records which client sent
-// a report, and a version that drifts from the published one makes that record useless.
-const VERSION = (() => {
-  try {
-    const pkg = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json')
-    return JSON.parse(readFileSync(pkg, 'utf8')).version || '0'
-  } catch {
-    return '0'
-  }
-})()
-const USER_AGENT = `hirify-cli/${VERSION}`
-const PACKAGE_NAME = 'hirify-cli'
-const PACKAGE_LATEST = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`
-const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm'
-
-const HELP = `hirify - job search for AI agents
-
-  hirify intro                    what this can do, and in what order
-  hirify version                  installed version
-
-  hirify login                    sign in through your browser       [--force]
-  hirify logout                   sign out on this computer
-  hirify account show             your plan and allowances
-
-  hirify vacancy search <query>   search the board          [--limit N] [--page N]
-  hirify vacancy read <slug>      one vacancy in full, with its text
-  hirify vacancy reveal <slug>    where to apply: uses 1 reveal
-  hirify vacancy apply <slug>     apply on Hirify           [--profile N] [--cover T]
-
-  hirify feed list                the feeds you saved on the site
-  hirify feed show <id>           vacancies from one feed   [--limit N] [--page N]
-  hirify feed create <name>       save a search             [--filters JSON] [--telegram] [--webhook N]
-  hirify feed deliver <id>        change delivery           [--telegram|--no-telegram] [--webhook N|--no-webhook]
-
-  hirify profile list             the profiles you can apply with
-  hirify webhook list             your delivery endpoints
-  hirify webhook create <name> <url>
-
-  hirify filter guide             what search can filter on, from the server
-  hirify feedback send <kind>     report a bug or ask for a feature
-  hirify api call <capability>    invoke any capability        [--data JSON] [--fields a,b]
-
-  --json                          raw JSON instead of text
-
-Free: account show, feed list, feed show, vacancy search, profile list, webhook list,
-filter guide.
-Metered: vacancy read spends one of the day's vacancy opens, vacancy reveal spends 1 reveal,
-and vacancy apply counts against its own daily allowance. Repeating a read or a reveal on the
-same vacancy is free. vacancy apply also sends a real application to a recruiter and cannot be
-taken back, so ask the person first.
-What is left of each: hirify account show.
-
-New here: hirify intro
-A noun on its own lists its verbs: hirify vacancy
-Rules for your agent: npx skills add hirifyme/hirify-cli
-No browser (CI, servers): hirify auth <key>, or the HIRIFY_KEY variable.
-Key: hirify.me/account/api-access`
-
-// ── helpers ────────────────────────────────────────────────────────────────
-// Exit codes are a stable contract, so a caller can branch on them: 0 is success, 1 is an
-// ordinary error, and 2 means this Hirify speaks a newer manifest than this build can read -
-// "update the CLI", told apart from "the command failed". These three do not change.
-const EXIT_OK = 0
-const EXIT_ERROR = 1
-const EXIT_MANIFEST_UNSUPPORTED = 2
-
-const die = (msg, code = EXIT_ERROR) => { console.error(`hirify: ${msg}`); process.exit(code) }
-
-/** Compare the public numeric part of two npm versions without adding a dependency. */
-function newerVersion(candidate, current) {
-  const parts = (value) => {
-    const match = String(value).match(/^(\d+)\.(\d+)\.(\d+)(?:-|$)/)
-    return match ? match.slice(1).map(Number) : null
-  }
-  const next = parts(candidate)
-  const installed = parts(current)
-  if (!next || !installed) return false
-  for (let i = 0; i < 3; i++) {
-    if (next[i] !== installed[i]) return next[i] > installed[i]
-  }
-  return false
-}
-
-/**
- * A package launched from npx already follows the requested npm version. Only a global
- * installation is ours to update: local project dependencies and the npx cache must not be
- * changed behind their owner. `npm root -g` is asked only when this file is under node_modules,
- * so a checkout and the test suite take no extra process or network trip.
- */
-function isGlobalInstall() {
-  const script = fileURLToPath(import.meta.url)
-  if (!script.includes(`${join('node_modules', PACKAGE_NAME)}`)) return false
-  try {
-    const root = execFileSync(NPM, ['root', '-g'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 2000,
-    }).trim()
-    return script.startsWith(join(root, PACKAGE_NAME) + '/') || script.startsWith(join(root, PACKAGE_NAME) + '\\')
-  } catch {
-    return false
-  }
-}
-
-/**
- * Update a global installation before running the requested command. A failed registry check is
- * silent because job search must keep working offline. A failed install leaves one exact recovery
- * command and then continues with the installed version.
- */
-async function autoUpdate() {
-  if (process.env.HIRIFY_NO_AUTO_UPDATE === '1' || !isGlobalInstall()) return false
-
-  const controller = new AbortController()
-  const timeout = setTimeout(() => controller.abort(), 2000)
-  let latest
-  try {
-    const response = await fetch(PACKAGE_LATEST, {
-      headers: { Accept: 'application/json', 'User-Agent': USER_AGENT },
-      signal: controller.signal,
-    })
-    if (!response.ok) return false
-    latest = (await response.json())?.version
-  } catch {
-    return false
-  } finally {
-    clearTimeout(timeout)
-  }
-
-  if (!newerVersion(latest, VERSION)) return false
-
-  console.error(`Updating Hirify CLI from ${VERSION} to ${latest}...`)
-  const update = spawnSync(NPM, ['install', '-g', `${PACKAGE_NAME}@latest`], {
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-    timeout: 120000,
-  })
-
-  if (update.status !== 0) {
-    console.error(`Hirify CLI ${latest} is available. Automatic update could not complete.`)
-    console.error(`Run: npm install -g ${PACKAGE_NAME}@latest`)
-    return false
-  }
-
-  console.error(`Hirify CLI updated to ${latest}.`)
-  const rerun = spawnSync(process.execPath, [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
-    stdio: 'inherit',
-  })
-  process.exit(rerun.status ?? EXIT_ERROR)
-}
-
-// Options that stand on their own. Everything else takes the next word as its value, and
-// that rule is what lets `search` carry a filter the CLI has never heard of: the list of
-// filters lives on the server, and a CLI that keeps its own copy is a CLI that lags.
-//
-// It used to be the other way round, a list of options known to take a value. That list
-// was the ceiling: an option missing from it silently swallowed nothing and its value was
-// read as data.
-const BOOLEAN_FLAGS = new Set(['--json', '--help', '--no-browser', '--telegram', '--no-telegram', '--no-webhook'])
-
-// Ours, not the API's. These never reach a query string: `--json` steers the CLI, and
-// `--fields` chooses which fields a compact render prints.
-const CLI_ONLY = new Set(['json', 'fields'])
-
-/** Does this option take the word after it, or does it stand alone? */
-const takesValue = (args, i) =>
-  !BOOLEAN_FLAGS.has(args[i]) && args[i + 1] !== undefined && !args[i + 1].startsWith('--')
-
-const flag = (args, name) => {
-  const i = args.indexOf(name)
-  if (i !== -1) return args[i + 1]
-  const eq = args.find((a) => a.startsWith(`${name}=`))
-  return eq === undefined ? null : eq.slice(name.length + 1)
-}
-
-/**
- * The arguments that are not options. The router finds the verb through this, and every
- * command reads its slug or id through it, because reading `args[0]` directly made a flag
- * look like one: `hirify webhook --json list` was refused as an unknown verb, and `hirify
- * feed --json show 7` asked the server for a feed literally called "--json".
- */
-const positional = (args) => {
-  const rest = []
-  for (let i = 0; i < args.length; i++) {
-    if (args[i].startsWith('--')) {
-      if (takesValue(args, i)) i++
-      continue
-    }
-    rest.push(args[i])
-  }
-  return rest
-}
-
-/**
- * Every option and the value it was given, as a plain map. `search` forwards these to the
- * API unchanged, so a filter added on the server works from the terminal the same day,
- * without a new flag being written here.
- *
- * Both `--key value` and `--key=value` are the same thing. A key given more than once is
- * joined with a comma, which is how the site sends a filter with several values.
- */
-const options = (args) => {
-  const found = new Map()
-  for (let i = 0; i < args.length; i++) {
-    if (!args[i].startsWith('--')) continue
-    const eq = args[i].indexOf('=')
-    const name = eq === -1 ? args[i].slice(2) : args[i].slice(2, eq)
-    if (!name) continue
-    const value = eq !== -1 ? args[i].slice(eq + 1) : takesValue(args, i) ? args[++i] : 'true'
-    found.set(name, found.has(name) ? `${found.get(name)},${value}` : value)
-  }
-  return found
-}
-
-/**
- * A number as the server sent it, or `null` when the field is not there. Every printed
- * figure goes through this: a field the API stopped sending used to reach the screen as
- * the word `undefined`, which reads like a fact about the account and is not one.
- */
-const count = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null)
-
-const out = (data, text) => {
-  if (process.argv.includes('--json')) {
-    // --json hands over the whole envelope, so a `meta.notice` on it travels structured and
-    // untouched. The human notice below is only for text mode.
-    console.log(JSON.stringify(data, null, 2))
-    return
-  }
-  text()
-  printNotice(data?.meta?.notice)
-}
-
-/**
- * Print a structured notice the server attached to a successful answer (`meta.notice`). The
- * call still succeeded, so this comes after the useful result, not in place of it. The CLI
- * shows the text the server wrote and reads nothing into the policy behind it: it knows the
- * notice object, not what produced it. No notice, or one with no message, prints nothing.
- */
-function printNotice(notice) {
-  const message = typeof notice?.message === 'string' ? notice.message.trim() : ''
-  if (!message) return
-  console.log(`\nNotice: ${message}`)
-}
-
-// Text our own server wrote for the agent to read: application rules, address rejections.
-// Passing it through beats paraphrasing, because paraphrasing drifts from the real rule.
-function serverMessage(body) {
-  const firstLine = (value) => {
-    if (typeof value === 'string' && value.trim()) return value.trim()
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        const line = firstLine(item)
-        if (line) return line
-      }
-    }
-    if (value && typeof value === 'object') {
-      for (const item of Object.values(value)) {
-        const line = firstLine(item)
-        if (line) return line
-      }
-    }
-    return null
-  }
-
-  return firstLine(body?.error?.details) || firstLine(body?.error?.message) || firstLine(body?.message)
-}
-
-/**
- * The one-line report for a policy restriction: a canonical 403 that names itself
- * `access_restricted`. It is kept apart from the quota and rate-limit walls on purpose,
- * because those clear on their own and this one does not. The CLI states what the server
- * sent - the message it wrote, when the restriction lifts, where to ask for a review - and
- * adds no rule of its own about why it was applied.
- */
-function accessRestrictedMessage(body) {
-  const err = (body && typeof body.error === 'object' && body.error) || {}
-  const line = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null)
-  const parts = [line(err.message) || line(body?.message) || 'access on this account is restricted (403).']
-  const until = line(err.restricted_until)
-  if (until) parts.push(`It stays in place until ${until}.`)
-  const appeal = line(err.appeal_url)
-  if (appeal) parts.push(`To ask us to look at it again: ${appeal}`)
-  return parts.join('\n        ')
-}
-
-/**
- * The report for a blocking notice: a canonical 409 that names itself `action_required`.
- * Unlike a `meta.notice` on a success, this one stands in place of the answer - the server is
- * holding the result until the person confirms - so the CLI shows the text the server wrote and
- * the one command that clears it, and reads nothing into the policy behind it. That command is
- * the acknowledgement capability the server lists in its manifest, reached the same way as any
- * other, so no route to it is written here. It carries the notice's own id and its first
- * advertised action, both as the server sent them, so the printed line runs as it stands.
- */
-function actionRequiredMessage(body) {
-  const notice = (body && typeof body.error === 'object' && body.error && typeof body.error.notice === 'object' && body.error.notice) || {}
-  const line = (v) => (typeof v === 'string' && v.trim() ? v.trim() : null)
-  const parts = [line(notice.message) || 'this needs your confirmation before it can go ahead (409).']
-
-  const id = line(notice.id)
-  const action = Array.isArray(notice.actions) ? notice.actions.map(line).find(Boolean) : null
-  const call = 'hirify api call security.notices.ack'
-  parts.push(id && action
-    ? `To continue, acknowledge this notice: ${call} --data '${JSON.stringify({ id, action })}'`
-    : `To continue, acknowledge this notice: ${call}`)
-  return parts.join('\n        ')
-}
-
-const b64url = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-const now = () => Math.floor(Date.now() / 1000)
-
-// ── stored access ──────────────────────────────────────────────────────────
-function readSession() {
-  if (existsSync(AUTH_FILE)) {
-    try {
-      const s = JSON.parse(readFileSync(AUTH_FILE, 'utf8'))
-      if (s && typeof s.access_token === 'string' && s.access_token) return s
-    } catch {
-      // A damaged file is not worth crashing over: behave as if nobody is signed in.
-    }
-  }
-  if (existsSync(LEGACY_KEY_FILE)) {
-    const key = readFileSync(LEGACY_KEY_FILE, 'utf8').trim()
-    if (key) return { kind: 'key', access_token: key }
-  }
-  return null
-}
-
-function writeSession(session) {
-  mkdirSync(CONFIG_DIR, { recursive: true })
-  writeFileSync(AUTH_FILE, JSON.stringify(session, null, 2) + '\n', { mode: 0o600 })
-}
-
-function forgetSession() {
-  let had = false
-  for (const file of [AUTH_FILE, LEGACY_KEY_FILE]) {
-    if (existsSync(file)) { rmSync(file); had = true }
-  }
-  return had
-}
-
-const NOT_SIGNED_IN =
-  'you are not signed in yet. Run `hirify login` and your browser will open.\n' +
-  '        No browser (CI, servers): `hirify auth <key>`, or set HIRIFY_KEY.\n' +
-  '        Key: hirify.me/account/api-access'
-
-/**
- * The token for a request. The environment variable wins: it is only ever set on
- * purpose, on CI or a server, and a local sign-in should not quietly override it.
- * A browser session is renewed a minute before it expires, so nobody meets a 401
- * they could have avoided.
- */
-async function accessToken() {
-  if (process.env.HIRIFY_KEY) return process.env.HIRIFY_KEY
-
-  const session = readSession()
-  if (!session) die(NOT_SIGNED_IN)
-
-  if (session.kind === 'oauth' && session.expires_at && session.expires_at - 60 <= now()) {
-    return (await refreshSession(session)).access_token
-  }
-  return session.access_token
-}
-
-// ── talking to the API ─────────────────────────────────────────────────────
-// `path` is a whole path under the API base, the way the manifest writes it
-// (`/api/agent/...`). The CLI does not assemble it from parts of its own, so a path the
-// server moves is followed from the manifest without a change here.
-async function request(path, method, token, payload) {
-  const headers = { Authorization: `Bearer ${token}`, Accept: 'application/json', 'User-Agent': USER_AGENT }
-  if (payload) headers['Content-Type'] = 'application/json'
-  try {
-    return await fetch(`${API}${path}`, {
-      method,
-      headers,
-      body: payload ? JSON.stringify(payload) : undefined,
-    })
-  } catch (e) {
-    die(`the network seems to be unavailable: ${e.message}`)
-  }
-}
-
-/**
- * `allow` lists statuses the caller wants to read itself instead of dying on. Feedback
- * needs it: a 429 there means "too many reports", not "your reveals are used up", and
- * saying the wrong one sends the person looking in the wrong place.
- */
-async function api(path, { method = 'GET', payload = null, allow = [], raw = false } = {}) {
-  let res = await request(path, method, await accessToken(), payload)
-
-  // A 401 on a live session is ordinary: the access token is dropped when the refresh
-  // token rotates. One quiet exchange and a retry, and only then ask for a new sign-in.
-  if (res.status === 401 && !process.env.HIRIFY_KEY) {
-    const session = readSession()
-    if (session?.kind === 'oauth' && session.refresh_token) {
-      const fresh = await refreshSession(session)
-      res = await request(path, method, fresh.access_token, payload)
-    }
-  }
-
-  // `api call` reads every answer itself, refusal included: that is what it is for, and a
-  // sentence of ours in place of the server's own reply would defeat the point of `api call`.
-  if (raw) {
-    const text = await res.text()
-    let body = null
-    try {
-      body = JSON.parse(text)
-    } catch {
-      // Not JSON. The text is handed over as it came rather than thrown away.
-    }
-    return { status: res.status, body, text }
-  }
-
-  // A policy restriction is a canonical 403 that names itself `access_restricted`. It is not a
-  // used-up allowance and not a rate limit, and retrying cannot lift it: the CLI reports it once
-  // and never retries. Checked ahead of `allow` so a caller that reads its own 403s still cannot
-  // take this one for an ordinary refusal. The clone leaves the body readable for the paths below.
-  if (res.status === 403) {
-    const restriction = await res.clone().json().catch(() => null)
-    if (restriction?.error?.code === 'access_restricted') die(accessRestrictedMessage(restriction))
-  }
-
-  // A blocking notice is a canonical 409 that names itself `action_required`. Unlike a
-  // `meta.notice` on a success, it stands in place of the answer: the server is holding the
-  // result until the person acknowledges the notice, so the CLI reports it, exits unsuccessfully,
-  // and never retries - retrying cannot clear it. Checked ahead of `allow`, like the restriction
-  // above, so a caller that reads its own 409s cannot take this one for an ordinary conflict; a
-  // 409 without this code is left to the handling below, unchanged. The clone leaves the body
-  // readable for those paths.
-  if (res.status === 409) {
-    const blocked = await res.clone().json().catch(() => null)
-    if (blocked?.error?.code === 'action_required') die(actionRequiredMessage(blocked))
-  }
-
-  if (allow.includes(res.status)) {
-    return {
-      status: res.status,
-      body: await res.json().catch(() => null),
-      retryAfter: res.headers.get('retry-after'),
-    }
-  }
-
-  if (res.status === 401) {
-    die(process.env.HIRIFY_KEY || readSession()?.kind === 'key'
-      ? 'the key was not accepted (401). It may have been revoked, or copied incompletely.'
-      : 'your sign-in is no longer valid. Please run `hirify login` again.')
-  }
-  if (res.status === 403) die('no access (403). This needs an active paid plan, or the sign-in is missing a permission.')
-  if (res.status === 404) die('not found (404).')
-  if (res.status === 429) {
-    // Several walls answer 429: a metered action has run out, or the requests came too
-    // fast. The metered ones carry a quota block naming themselves in `quota.action`.
-    // Naming the wrong wall leaves someone waiting out a limit they still have, or
-    // spending reveals they no longer do.
-    const spent = await res.json().catch(() => null)
-    const wait = Number(res.headers.get('retry-after'))
-    const action = spent?.quota?.action
-    if (action === 'vacancy_opens') {
-      die('you have opened as many vacancies today as the daily allowance covers.' +
-        '\n        Feeds and search still work, and so does anything already read today.')
-    }
-    if (action === 'contact_reveals') die('you have no reveals left right now. Reading still works.')
-    if (action === 'apply') {
-      die('you have sent as many applications today as the daily allowance covers.' +
-        '\n        Reading and revealing still work. What is left: hirify account show')
-    }
-    // A budget we have no sentence for yet. Name the one the server named rather than
-    // guessing: guessing is how a spent read once came back as a spent reveal.
-    if (spent?.quota) {
-      die(`today's allowance for ${String(action ?? 'that action').replace(/_/g, ' ')} is used up.` +
-        '\n        What is left: hirify account show')
-    }
-    die('too many requests in a short time.' +
-      (Number.isFinite(wait) && wait > 0 ? ` Please try again in ${wait} seconds.` : ' Please try again in a minute.'))
-  }
-  const body = await res.json().catch(() => null)
-  if (!res.ok) {
-    // Everything expected is handled above. What lands here is not, and it used to print
-    // the raw response body: status codes and internal fields in front of a person. The
-    // answer is for debugging, not for reading, so it goes behind HIRIFY_DEBUG.
-    if (process.env.HIRIFY_DEBUG) {
-      console.error(`hirify: server answered ${res.status}: ${body ? JSON.stringify(body) : '(empty body)'}`)
-    }
-    die(res.status >= 500
-      ? 'something went wrong on our side. Please try again in a minute.'
-      : 'that command could not be completed. Please check it and try again.')
-  }
-  // Return the WHOLE body: lists carry `meta` (total/last_page) next to `data`, and an
-  // agent reading --json needs it too. Unwrapping happens in the commands.
-  return body
-}
-
-// ── the capability manifest ─────────────────────────────────────────────────
-// The version of the manifest this CLI can read. A server that answers with a higher one
-// speaks a document this build cannot interpret safely, and the CLI says so rather than
-// guessing. Lower or equal is fine: unknown fields are ignored, not refused.
-const SUPPORTED_SCHEMA_VERSION = 1
-
-/**
- * Where the manifest lives, learned from the public Hirify agent document rather than
- * hardcoded. The CLI is allowed to know the well-known path and nothing past it, so the
- * address of every operation stays the server's to move.
- *
- * Cached for the process: the document does not change under one command.
- */
-let agentDiscoveryCache = null
-async function agentDiscovery() {
-  if (agentDiscoveryCache) return agentDiscoveryCache
-  try {
-    const res = await fetch(`${API}${AGENT_WELL_KNOWN}`, { headers: { Accept: 'application/json' } })
-    if (!res.ok) return (agentDiscoveryCache = { manifest_url: null, intro: null })
-    const doc = await res.json()
-    agentDiscoveryCache = {
-      manifest_url: typeof doc.manifest_url === 'string' && doc.manifest_url ? doc.manifest_url : null,
-      // Release-approved intro text, published here so it can be refreshed without a new CLI.
-      // `hirify intro` prints it and falls back to the built-in text when it is absent.
-      intro: typeof doc.intro === 'string' && doc.intro ? doc.intro : null,
-    }
-  } catch {
-    // Unreachable is the same fact as unusable to the caller: no manifest, so no operations.
-    agentDiscoveryCache = { manifest_url: null, intro: null }
-  }
-  return agentDiscoveryCache
-}
-
-// The manifest, held for this process only and never written to disk, so a fresh run always
-// starts from the server's current document. `etag` rides along so a later fetch in the same
-// process can revalidate instead of downloading the whole thing again.
-let manifestCache = null
-
-/**
- * Fetch and validate the manifest once per process. The first call downloads and checks it;
- * a later call in the same process sends the stored ETag and reuses the cache on a 304, so
- * the document is parsed and validated once even if it is asked for again.
- */
-async function loadManifest() {
-  const { manifest_url } = await agentDiscovery()
-  if (!manifest_url) {
-    die('could not reach Hirify to load what it can do. Please check your connection and try again.')
-  }
-
-  const headers = {
-    Authorization: `Bearer ${await accessToken()}`,
-    Accept: 'application/json',
-    'User-Agent': USER_AGENT,
-  }
-  if (manifestCache?.etag) headers['If-None-Match'] = manifestCache.etag
-
-  let res
-  try {
-    res = await fetch(manifest_url, { headers })
-  } catch (e) {
-    if (manifestCache) return manifestCache.doc
-    die(`the network seems to be unavailable: ${e.message}`)
-  }
-
-  // The manifest is behind the sign-in, so a rotated access token answers 401 once. One
-  // quiet exchange and a retry, the same as an ordinary request.
-  if (res.status === 401 && !process.env.HIRIFY_KEY) {
-    const session = readSession()
-    if (session?.kind === 'oauth' && session.refresh_token) {
-      headers.Authorization = `Bearer ${(await refreshSession(session)).access_token}`
-      try {
-        res = await fetch(manifest_url, { headers })
-      } catch (e) {
-        die(`the network seems to be unavailable: ${e.message}`)
-      }
-    }
-  }
-
-  if (res.status === 304 && manifestCache) return manifestCache.doc
-  if (res.status === 401) {
-    die(process.env.HIRIFY_KEY || readSession()?.kind === 'key'
-      ? 'the key was not accepted (401). It may have been revoked, or copied incompletely.'
-      : 'your sign-in is no longer valid. Please run `hirify login` again.')
-  }
-  if (!res.ok) die('could not load what Hirify can do right now. Please try again in a minute.')
-
-  const doc = await res.json().catch(() => null)
-  validateManifest(doc)
-  manifestCache = { doc, etag: res.headers.get('etag') || null }
-  return doc
-}
-
-/** Refuse a manifest this build cannot read, and say which way to fix it. */
-function validateManifest(doc) {
-  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
-    die('Hirify sent something this CLI could not read as a manifest. Please try again in a minute.')
-  }
-  const version = doc.schema_version
-  if (typeof version !== 'number' || !Number.isFinite(version)) {
-    die('Hirify sent a manifest without a version. Please try again in a minute.')
-  }
-  if (version > SUPPORTED_SCHEMA_VERSION) {
-    die('this Hirify speaks a newer manifest than this CLI can read' +
-      ` (its version is ${version}, this CLI reads ${SUPPORTED_SCHEMA_VERSION}).` +
-      '\n        Please update the CLI: npm install -g hirify-cli, or run it with npx hirify-cli.',
-      EXIT_MANIFEST_UNSUPPORTED)
-  }
-  if (!Array.isArray(doc.capabilities)) {
-    die('Hirify sent a manifest with no list of what it can do. Please try again in a minute.')
-  }
-}
-
-/**
- * Find one capability by its stable id. This is how a command reaches the server: it names
- * the capability it wants, and the manifest says which method and path answer it today.
- */
-async function resolveCapability(id) {
-  const manifest = await loadManifest()
-  const cap = manifest.capabilities.find((c) => c && c.id === id)
-  if (!cap || typeof cap.method !== 'string' || typeof cap.path !== 'string') {
-    die(`this Hirify does not offer "${id}". It may be an older server, or the operation has moved.`)
-  }
-  return cap
-}
-
-/** Put values into a path template: `/api/agent/vacancies/{slug}` plus `{slug}` -> a path. */
-function fillPath(template, params = {}) {
-  return template.replace(/\{([a-z_]+)\}/g, (_, name) => {
-    const value = params[name]
-    if (value === undefined || value === null) {
-      die(`this call needs "${name}", and it was not given.`)
-    }
-    return encodeURIComponent(String(value))
-  })
-}
-
-/**
- * Call a capability by its id. The command supplies the parts it owns - the path values, the
- * query, the body - and the manifest supplies the method and the path, so no route is written
- * into this file.
- */
-async function callCapability(id, { params = {}, query = null, payload = null, allow = [], raw = false } = {}) {
-  const cap = await resolveCapability(id)
-  let path = fillPath(cap.path, params)
-  const qs = query ? query.toString() : ''
-  if (qs) path += `?${qs}`
-  return api(path, { method: cap.method, payload, allow, raw })
-}
-
-// ── signing in through the browser ─────────────────────────────────────────
-/**
- * Where the authorization server lives. We ask it rather than hardcode it (RFC 8414),
- * so the CLI follows if the endpoints move. No document, no problem: use the defaults.
- */
-async function discover() {
-  const fallback = {
-    authorization_endpoint: `${API}/oauth/authorize`,
-    token_endpoint: `${API}/oauth/token`,
-    registration_endpoint: `${API}/oauth/register`,
-    scopes: FALLBACK_SCOPES,
-  }
-  try {
-    const res = await fetch(`${API}${OAUTH_WELL_KNOWN}`, { headers: { Accept: 'application/json' } })
-    if (!res.ok) return fallback
-    const meta = await res.json()
-    // The abilities are the server's to name. We ask for every one it publishes, because
-    // the person is agreeing once and cannot be given a missing one afterwards.
-    const published = Array.isArray(meta.scopes_supported)
-      ? meta.scopes_supported.filter((s) => typeof s === 'string' && s).join(' ')
-      : ''
-    return {
-      authorization_endpoint: meta.authorization_endpoint || fallback.authorization_endpoint,
-      token_endpoint: meta.token_endpoint || fallback.token_endpoint,
-      registration_endpoint: meta.registration_endpoint || fallback.registration_endpoint,
-      scopes: published || fallback.scopes,
-    }
-  } catch {
-    return fallback
-  }
-}
-
-/** A form body, not JSON: RFC 6749 requires it and the server expects it. */
-async function postForm(url, params) {
-  let res
-  try {
-    res = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
-      body: new URLSearchParams(params),
-    })
-  } catch (e) {
-    die(`the network seems to be unavailable: ${e.message}`)
-  }
-  const body = await res.json().catch(() => null)
-  return { ok: res.ok, status: res.status, body }
-}
-
-/**
- * Listen for the browser on the loopback interface. The port is ephemeral (0), so it is
- * always free and two sign-ins in a row never fight over the same number.
- */
-async function startCallbackServer() {
-  let settle
-  const received = new Promise((resolve) => { settle = resolve })
-
-  const server = createServer((req, res) => {
-    const url = new URL(req.url, 'http://127.0.0.1')
-    if (url.pathname !== CALLBACK_PATH) {
-      res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
-      res.end('not found')
-      return
-    }
-    const error = url.searchParams.get('error')
-    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' })
-    res.end(browserPage(error))
-    settle({
-      code: url.searchParams.get('code'),
-      state: url.searchParams.get('state'),
-      error,
-      // Only the server attaches a description, and only when the server itself refused.
-      // A person pressing "deny" arrives without one, which is how we tell them apart.
-      description: url.searchParams.get('error_description'),
-    })
-  })
-
-  await new Promise((resolve, reject) => {
-    const onError = (e) => reject(e)
-    server.once('error', onError)
-    server.listen(0, '127.0.0.1', () => {
-      server.off('error', onError)
-      // Past this point one malformed browser request should not bring the CLI down.
-      server.on('error', () => {})
-      resolve()
-    })
-  })
-
-  return {
-    port: server.address().port,
-    received,
-    close: () => {
-      server.close()
-      server.closeIdleConnections?.()
-    },
-  }
-}
-
-/**
- * What the person sees in the browser. It does not say "you are signed in": the code is
- * exchanged for tokens after this page is served, and the page cannot promise the result.
- * The result belongs in the terminal.
- */
-function browserPage(error) {
-  const title = error ? 'Sign-in was not completed' : 'Confirmation received'
-  const text = error
-    ? 'Please return to your terminal and try again.'
-    : 'You can close this tab and return to your terminal.'
-  return `<!doctype html><html lang="en"><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Hirify</title>
-<style>
-  body { margin:0; min-height:100vh; display:grid; place-items:center;
-         font:16px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;
-         color:#1a1a1a; background:#fafafa; }
-  main { max-width:32rem; padding:2rem; text-align:center; }
-  h1 { font-size:1.4rem; margin:0 0 .5rem; }
-  p { margin:0; color:#555; }
-</style>
-<main><h1>${title}</h1><p>${text}</p></main></html>`
-}
-
-/**
- * Open the browser. Success here means the command started: whether a window actually
- * appeared is not something we can know, so the link is printed either way.
- */
-function openBrowser(url) {
-  const candidates = process.env.BROWSER
-    ? [[process.env.BROWSER, [url]]]
-    : process.platform === 'darwin' ? [['open', [url]]]
-    : process.platform === 'win32' ? [['cmd', ['/c', 'start', '', url]]]
-    : [['xdg-open', [url]], ['gio', ['open', url]], ['sensible-browser', [url]], ['x-www-browser', [url]]]
-
-  const tryOne = (i) => new Promise((resolve) => {
-    if (i >= candidates.length) return resolve(false)
-    const [cmd, args] = candidates[i]
-    let child
-    try {
-      child = spawn(cmd, args, { stdio: 'ignore', detached: true })
-    } catch {
-      return resolve(tryOne(i + 1))
-    }
-    child.once('error', () => resolve(tryOne(i + 1)))
-    child.once('spawn', () => { child.unref(); resolve(true) })
-  })
-
-  return tryOne(0)
-}
-
-async function cmdLogin(args) {
-  const noBrowser = args.includes('--no-browser')
-  const force = args.includes('--force')
-  const current = readSession()
-
-  if (!force && current?.kind === 'oauth') {
-    if (current.expires_at && current.expires_at - 60 <= now() && current.refresh_token) {
-      await refreshSession(current)
-    }
-    console.log('Already signed in. Use `hirify login --force` to sign in again.')
-    await cmdAccountShow()
-    console.log('\nRules for your agent: npx skills add hirifyme/hirify-cli')
-    return
-  }
-
-  const endpoints = await discover()
-
-  let listener
-  try {
-    listener = await startCallbackServer()
-  } catch (e) {
-    die('could not open a local address for the browser to answer on: ' + e.message +
-      '\n        Please sign in with a key instead: `hirify auth <key>` (hirify.me/account/api-access).')
-  }
-
-  const redirectUri = `http://127.0.0.1:${listener.port}${CALLBACK_PATH}`
-
-  // A client is registered on every sign-in: the return address is matched exactly and
-  // our port is new each time. The client holds no secret; PKCE is what protects the code.
-  let clientId
-  try {
-    const res = await fetch(endpoints.registration_endpoint, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-      body: JSON.stringify({ client_name: 'Hirify CLI', redirect_uris: [redirectUri] }),
-    })
-    const body = await res.json().catch(() => null)
-    if (!res.ok || !body?.client_id) {
-      listener.close()
-      die(`could not start the sign-in: the server answered ${res.status}. Please try again.`)
-    }
-    clientId = body.client_id
-  } catch (e) {
-    listener.close()
-    die(`the network seems to be unavailable: ${e.message}`)
-  }
-
-  const verifier = b64url(randomBytes(32))
-  const challenge = b64url(createHash('sha256').update(verifier).digest())
-  const state = b64url(randomBytes(16))
-
-  const authUrl = `${endpoints.authorization_endpoint}?` + new URLSearchParams({
-    response_type: 'code',
-    client_id: clientId,
-    redirect_uri: redirectUri,
-    scope: endpoints.scopes,
-    state,
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-  })
-
-  const opened = noBrowser ? false : await openBrowser(authUrl)
-  console.log(opened
-    ? 'Opening your browser. Please confirm access on hirify.me.'
-    : 'Please open this link in your browser and confirm access:')
-  if (!opened) console.log(`\n${authUrl}\n`)
-  else console.log(`If it did not open, use this link:\n${authUrl}`)
-
-  let timeoutId
-  const timeout = new Promise((resolve) => {
-    timeoutId = setTimeout(() => resolve({ timedOut: true }), LOGIN_TIMEOUT_MS)
-  })
-  const answer = await Promise.race([listener.received, timeout])
-  clearTimeout(timeoutId)
-  listener.close()
-
-  if (answer.timedOut) {
-    // Older servers show a refusal as a page on their own domain instead of returning it
-    // here, and then the browser stops there while we wait out the clock. This hint is
-    // the only place a person learns it was about access rather than about the command.
-    die('we did not get a confirmation in the browser. Please run `hirify login` again.' +
-      '\n        If the browser said API access is not enabled, that is about your plan,' +
-      '\n        not the command: hirify.me/account/api-access')
-  }
-  if (answer.error === 'access_denied') {
-    // The server sends its description for a program to read, in ASCII, as the spec
-    // requires. A person gets our own sentence; the machine string stays behind
-    // HIRIFY_DEBUG rather than sitting in the middle of the normal output.
-    if (answer.description) {
-      if (process.env.HIRIFY_DEBUG) console.error(`hirify: the server refused: ${answer.description}`)
-      die('API access is not enabled for this account, and nothing was saved.' +
-        '\n        Details and how to enable it: hirify.me/account/api-access')
-    }
-    die('access was not confirmed and nothing was saved. If that was a mistake, run `hirify login` again.')
-  }
-  if (answer.error) {
-    die('the sign-in did not finish. Please run `hirify login` again.')
-  }
-  if (answer.state !== state) {
-    die('that answer came from a different sign-in. Please run `hirify login` again.')
-  }
-  if (!answer.code) {
-    die('the browser came back without a confirmation code. Please run `hirify login` again.')
-  }
-
-  const { ok, body } = await postForm(endpoints.token_endpoint, {
-    grant_type: 'authorization_code',
-    client_id: clientId,
-    code: answer.code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier,
-  })
-
-  if (!ok || !body?.access_token) {
-    // The confirmation code lives five minutes and works once. Most arrivals here simply
-    // took too long, so the useful advice is to start again.
-    die('the sign-in did not finish: the confirmation expired or was already used.' +
-      '\n        Please run `hirify login` again.')
-  }
-
-  writeSession({
-    kind: 'oauth',
-    issuer: API,
-    client_id: clientId,
-    token_endpoint: endpoints.token_endpoint,
-    access_token: body.access_token,
-    refresh_token: body.refresh_token || null,
-    scope: body.scope || endpoints.scopes,
-    expires_at: body.expires_in ? now() + Number(body.expires_in) : null,
-  })
-
-  console.log(`\nSigned in. Access saved to ${AUTH_FILE}`)
-  // Show the remaining limit right away: it is the first thing anyone asks anyway.
-  try {
-    await cmdAccountShow()
-  } catch {
-    // The sign-in worked; the plan summary is a nicety, not a requirement.
-  }
-  console.log('\nRules for your agent: npx skills add hirifyme/hirify-cli')
-}
-
-/**
- * Trade the refresh token for a new pair. It rotates on every exchange, so the file is
- * written immediately: losing the new refresh token costs more than one extra write.
- */
-async function refreshSession(session) {
-  if (!session.refresh_token) {
-    die('your sign-in has expired. Please run `hirify login` again.')
-  }
-
-  const { ok, body } = await postForm(session.token_endpoint || `${API}/oauth/token`, {
-    grant_type: 'refresh_token',
-    client_id: session.client_id,
-    refresh_token: session.refresh_token,
-  })
-
-  if (!ok || !body?.access_token) {
-    die('your sign-in has expired. Please run `hirify login` again.')
-  }
-
-  const fresh = {
-    ...session,
-    access_token: body.access_token,
-    refresh_token: body.refresh_token || session.refresh_token,
-    scope: body.scope || session.scope,
-    expires_at: body.expires_in ? now() + Number(body.expires_in) : null,
-  }
-  writeSession(fresh)
-  return fresh
-}
-
-function cmdLogout() {
-  console.log(forgetSession()
-    ? 'Signed out on this computer.'
-    : 'Nobody is signed in here.')
-}
-
-function cmdVersion() {
-  console.log(VERSION)
-}
-
-// ── commands ───────────────────────────────────────────────────────────────
-async function cmdAccountShow() {
-  const body = await callCapability('account.status')
-  const d = body?.data ?? {}
-  const left = count(d?.quota?.reveal?.remaining)
-  // Reading one vacancy in full has its own daily allowance, so it gets its own line.
-  // Without it an agent planning a session can only find the wall by hitting it.
-  const reads = count(d?.quota?.read?.remaining)
-  // So does applying, and this line was missing while the skill told agents that applying
-  // spends nothing. The server has reported `quota.apply` all along; dropping a budget the
-  // server publishes is the same error as inventing one, pointing the other way.
-  const applies = count(d?.quota?.apply?.remaining)
-  const u = d?.usage?.reveal ?? {}
-  // Whatever the server sent, and nothing else: a period it left out is simply not shown.
-  const spent = [[u.today, 'today'], [u.last_7d, 'in 7d'], [u.last_30d, 'in 30d']]
-    .filter(([n]) => count(n) !== null)
-    .map(([n, when]) => `${n} ${when}`)
-  out(body, () => {
-    console.log(`plan:    ${d?.plan ?? '-'}`)
-    // How many are left, and no denominator. Reveals are not a fraction of a number the
-    // person has, so `N of M` would be inventing the M.
-    console.log(`reveals: ${left === null ? '-' : `${left} left`}`)
-    if (reads !== null) console.log(`opens:   ${reads} left today`)
-    if (applies !== null) console.log(`applies: ${applies} left today`)
-    if (spent.length) console.log(`usage:   ${spent.join(' · ')}`)
-  })
-}
-
-async function cmdFeedList() {
-  const body = await callCapability('feeds.list')
-  const list = body?.data ?? []
-  out(body, () => {
-    if (!list.length) return console.log('You have no feeds yet. Save a filter on hirify.me and it becomes a feed.')
-    for (const f of list) {
-      const off = f.is_active === false ? '  (off)' : ''
-      console.log(`${String(f.id ?? '-').padEnd(6)} ${f.name || '(untitled)'}${off}`)
-    }
-    console.log(`\nVacancies from a feed: hirify feed show <id>`)
-  })
-}
-
-/**
- * The head of a vacancy, printed the same whether it comes from a list or from `read`.
- * Fields come straight from the API's vacancy resource: a card carries no contacts by
- * design, and for premium companies the name arrives masked.
- *
- * One function on purpose. A card that looks different depending on which command drew
- * it is a card an agent has to learn twice.
- */
-function vacancyHead(v) {
-  // `company_masked` is a FLAG meaning "the name is hidden until you reveal", not the
-  // name itself. It used to be printed as it came, and cards ended up saying "- true".
-  const company = v.company || (v.company_masked ? 'company hidden' : '-')
-  // Some of these arrive as arrays: live data has `work_format: []` next to
-  // `employee_type: ['employment']`. An empty array is truthy, so it used to survive
-  // the filter and print as a blank slot between two separators: "[usa ·  · b2]".
-  const label = (x) => (Array.isArray(x) ? x.filter(Boolean).join('/') : x)
-  const bits = [v.remote_type, v.work_format, v.employee_type, v.english_level].map(label).filter(Boolean)
-  if (v.salary && (v.salary.min || v.salary.max)) {
-    const { min, max, currency } = v.salary
-    bits.push([min, max].filter(Boolean).join('-') + (currency ? ` ${currency}` : ''))
-  }
-  if (v.verified) bits.push('verified')
-  // The slug is the handle every other command takes, so it leads the card. A card
-  // without one is still worth printing for its title, but the first line has to say
-  // that there is nothing to copy, not print the word `undefined` where a slug goes.
-  return `${v.slug ?? '-'}\n  ${v.title || '-'} · ${company}${bits.length ? `\n  [${bits.join(' · ')}]` : ''}`
-}
-
-function printVacancies(list, meta) {
-  if (!list.length) return console.log('Nothing found.')
-  for (const v of list) console.log(vacancyHead(v))
-
-  const page = count(meta?.page)
-  const perPage = count(meta?.per_page)
-  const lastPage = count(meta?.last_page)
-  const total = count(meta?.total)
-
-  // `of N` is printed only when N is larger than what came back, because only then is it a
-  // total and not a restatement of the page. The agent search endpoint currently answers
-  // with the size of the page it just returned, and "Showing 50 of 50" reads as "that is
-  // the whole board", which sends an agent away from vacancies that are there. The moment
-  // the server sends a real total, this prints it, with no change here.
-  const of = total !== null && total > list.length ? ` of ${total}` : ''
-  // `of L` once there is more than one page, on the last page too: "page 4 of 4" is how
-  // you know you have reached the end rather than lost the rest.
-  const where = page === null ? '' : `, page ${page}${lastPage !== null && lastPage > 1 ? ` of ${lastPage}` : ''}`
-  console.log(`\nShowing ${list.length}${of}${where}.`)
-  // The order the product asks for: read what looks right, reveal only what fits.
-  console.log('Read one: hirify vacancy read <slug>')
-  console.log('Where to apply: hirify vacancy reveal <slug> (uses 1 reveal)')
-
-  // A full page is the only honest sign that there may be another one while `last_page`
-  // says otherwise. Offering the next page costs nothing if it turns out to be empty.
-  const more = lastPage !== null && page !== null && lastPage > page
-    ? true
-    : perPage !== null && list.length >= perPage
-  if (more && page !== null) console.log(`More: add --page ${page + 1}`)
-}
-
-/** The vacancies in one saved feed, using the criteria the feed already holds. */
-async function cmdFeedShow(args, words) {
-  const [id] = words
-  if (!id) die('a feed id is required: hirify feed show <id>  (list them with hirify feed list)')
-
-  // A feed already carries its own criteria, so only the two that say which slice of it to
-  // return travel from here. Without `--page` the second page of a feed was unreachable.
-  const p = new URLSearchParams()
-  const limit = flag(args, '--limit'); if (limit) p.set('per_page', limit)
-  const page = flag(args, '--page'); if (page) p.set('page', page)
-
-  const body = await callCapability('feeds.vacancies', { params: { feed_id: id }, query: p })
-  out(body, () => printVacancies(body?.data ?? [], body?.meta))
-}
-
-/**
- * Search the board. The words are the phrase to look for; every option is passed on to the
- * API as it was written.
- *
- * The CLI keeps no list of filters on purpose. The endpoint accepts the same criteria the
- * site's own filter form produces, and the site can express all of them: a CLI that names
- * them one flag at a time decides what is expressible, and it decided wrong for a long time.
- * So every option travels by one rule, and a criterion added on the server works from here
- * the day it ships.
- *
- * This is also why no example here names a criterion. `hirify filter guide` is the
- * vocabulary, the server writes it, and an example frozen in this file would be a second
- * answer to the same question, going stale at its own pace.
- */
-async function cmdVacancySearch(args, words) {
-  const p = new URLSearchParams()
-
-  // The phrase first, so an explicit `--search` still wins if someone writes both.
-  //
-  // `search` and `per_page` are the only two parameter names this file is allowed to know,
-  // and they are structural rather than vocabulary: this command exists to put the words on
-  // `search`, and `--limit` has to land somewhere. Every other name belongs to the server
-  // and is fetched with `hirify filter guide`. Adding a third name here is the regression.
-  const phrase = words.join(' ')
-  if (phrase) p.set('search', phrase)
-
-  for (const [name, value] of options(args)) {
-    if (CLI_ONLY.has(name)) continue
-    // `--limit` is what this CLI has always called it. The API calls it `per_page`, and
-    // that is the name the server publishes, so both arrive at the same parameter.
-    p.set(name === 'limit' ? 'per_page' : name, value)
-  }
-
-  const body = await callCapability('vacancies.search', { query: p })
-  out(body, () => printVacancies(body?.data ?? [], body?.meta))
-}
-
-/**
- * The description as the site shows it, turned into something a terminal can print. The
- * API sends it as HTML (`description_format`), so the tags have to go somewhere: a block
- * ends with a line break and a list item starts with a dash. Nothing is dropped or
- * shortened here, and `--json` hands over the original untouched.
- */
-function asText(html) {
-  return String(html)
-    .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, '')
-    .replace(/<br\s*\/?>/gi, '\n')
-    .replace(/<li\b[^>]*>/gi, '- ')
-    .replace(/<\/(p|div|h[1-6]|li|tr|blockquote|ul|ol|table)>/gi, '\n')
-    .replace(/<[^>]+>/g, '')
-    .replace(/&nbsp;/gi, ' ')
-    .replace(/&lt;/gi, '<')
-    .replace(/&gt;/gi, '>')
-    .replace(/&quot;/gi, '"')
-    .replace(/&#0?39;|&apos;/gi, "'")
-    // Last, or `&amp;lt;` would come out as `<` rather than as the `&lt;` somebody wrote.
-    .replace(/&amp;/gi, '&')
-    .replace(/[ \t]+$/gm, '')
-    .replace(/\n{3,}/g, '\n\n')
-    .trim()
-}
-
-/** A timestamp as the day it names. The hour a vacancy was imported tells nobody anything. */
-const dateOnly = (v) => (typeof v === 'string' && v.length >= 10 ? v.slice(0, 10) : null)
-
-/**
- * The rows under the head, each one printed only when the server sent something for it.
- * They are collected rather than printed straight, so a vacancy that happens to carry
- * none of them does not get a blank line standing in for the block.
- */
-function detailRows(pairs) {
-  return pairs
-    .map(([label, value]) => [label, Array.isArray(value) ? value.filter(Boolean).join(' · ') : value])
-    .filter(([, text]) => text)
-    .map(([label, text]) => `${(label + ':').padEnd(10)}${text}`)
-}
-
-/**
- * One vacancy in full, with the text a person reads on the site. This is the command an
- * agent shortlists with, so it is deliberately the cheap one: it counts against the day's
- * vacancy opens, which is a generous allowance, and not against the reveal budget.
- *
- * The same vacancy read twice in a day costs nothing the second time.
- */
-async function cmdVacancyRead(args, words) {
-  const [slug] = words
-  if (!slug) {
-    die('a vacancy slug is required: hirify vacancy read <slug>' +
-      '\n        Slugs come from hirify vacancy search or hirify feed show.')
-  }
-
-  const res = await callCapability('vacancies.read', { params: { slug }, allow: [200, 404] })
-  if (res.status === 404) die('there is no vacancy with that slug.')
-
-  const d = res.body?.data ?? {}
-  // Codes, names and plain strings all arrive in these lists. English first: the rest of
-  // the output is English, and a card that switches language mid-way reads as a glitch.
-  const names = (list) => (Array.isArray(list) ? list.map((x) => x?.name_en || x?.name || x?.code || x).filter(Boolean) : [])
-
-  out(res.body, () => {
-    console.log(vacancyHead(d))
-
-    const rows = detailRows([
-      ['area', names(d.specializations)],
-      ['grade', names(d.grades)],
-      ['skills', names(d.skills)],
-      ['location', [...names(d.regions), ...names(d.cities)]],
-      ['posted', dateOnly(d.created_at)],
-      ['page', d.url],
-    ])
-    if (rows.length) console.log('\n' + rows.join('\n'))
-
-    const text = d.description ? asText(d.description) : ''
-    console.log(text ? `\n${text}\n` : '\nThis vacancy has no text on it.\n')
-
-    // Which of the two ways to apply this one takes, from the server's own flag. Guessing
-    // it from anything else is how a card came to promise an apply that answered 422.
-    console.log(d.can_apply_directly
-      ? `Apply on Hirify: hirify vacancy apply ${d.slug ?? slug}`
-      : `Where to apply: hirify vacancy reveal ${d.slug ?? slug} (uses 1 reveal)`)
-
-    console.log(res.body?.charged === false
-      ? '(no vacancy open used: this one was already opened today)'
-      : '(1 vacancy open used)')
-    const left = count(res.body?.quota?.remaining)
-    if (left !== null) console.log(`${left} ${left === 1 ? 'open' : 'opens'} left today`)
-  })
-}
-
-/**
- * One contact line: the address as it is, with the type only when it adds something.
- * An unknown shape is still printed as it came, because the contact is the whole point
- * of the command; an empty slot returns nothing, so no line is printed for it.
- */
-function contactLine(c) {
-  if (typeof c === 'string') return c
-  const value = c?.value ?? c?.url ?? c?.email ?? null
-  if (value) return c?.type && c.type !== 'url' ? `${value}  (${c.type})` : value
-  return c === null || c === undefined ? null : JSON.stringify(c)
-}
-
-async function cmdVacancyReveal(args, words) {
-  const [slug] = words
-  if (!slug) die('a vacancy slug is required: hirify vacancy reveal <slug>')
-  const body = await callCapability('vacancies.reveal', { params: { slug } })
-  const d = body?.data ?? {}
-  out(body, () => {
-    console.log(`company:  ${d.company ?? '-'}`)
-    if (d.linkedin) console.log(`linkedin: ${d.linkedin}`)
-    // A contact arrives as {type, value, short_code}. People and agents want the address,
-    // not its JSON: nobody unpacks a raw object by hand while reading a terminal.
-    for (const c of d.contacts ?? []) {
-      const line = contactLine(c)
-      if (line) console.log(`contact:  ${line}`)
-    }
-    console.log(d.charged === false
-      ? '\n(no reveal used: you have revealed this vacancy before)'
-      : '\n(1 reveal used)')
-    const left = count(d.quota?.remaining)
-    if (left !== null) console.log(`${left} ${left === 1 ? 'reveal' : 'reveals'} left`)
-  })
-}
-
-/**
- * Report a bug or ask for a feature. Free: it does not touch the reveal limit.
- *
- * What is required is checked here, because a missing `--body` is a fact about the command
- * and needs no round trip. How long a title may be is NOT checked here: that is the
- * server's rule, it has changed before, and a copy of it in this file is a copy that goes
- * stale and starts refusing reports the server would have taken. The server's own words
- * come back instead.
- */
-async function cmdFeedbackSend(args, words) {
-  const [type, title] = words
-  if (!FEEDBACK_TYPES.includes(type)) {
-    die('say what kind of report this is, bug or feature:\n' +
-      '        hirify feedback send bug "<title>" --body "<what happened>"\n' +
-      '        hirify feedback send feature "<title>" --body "<what you need>"')
-  }
-
-  const text = flag(args, '--body')
-  const vacancy = flag(args, '--vacancy')
-
-  if (!title) die('a title is required: hirify feedback send ' + type + ' "<title>" --body "<text>"')
-  if (!text) die('the report needs a body: add --body "<text>"')
-
-  const res = await callCapability('feedback.send', {
-    payload: { type, title, body: text, ...(vacancy ? { vacancy_slug: vacancy } : {}) },
-    allow: [201, 202, 404, 422, 429, 502, 503],
-  })
-
-  const d = res.body?.data ?? {}
-
-  if (res.status === 429) {
-    const wait = Number(res.retryAfter)
-    die('too many reports in a short time.' +
-      (Number.isFinite(wait) && wait > 0 ? ` Please try again in ${wait} seconds.` : ' Please try again a bit later.'))
-  }
-  if (res.status === 502) {
-    // Not queued and not retried on our side, because a retry would not fix it. Say that
-    // the fault is ours, so nobody rewrites a perfectly good report thinking it was them.
-    die('we could not pass your report on. That is on our side, not in what you wrote.' +
-      '\n        Please try again a bit later.')
-  }
-  if (res.status === 404 || res.status === 503) {
-    // 404 means this API does not have the feedback endpoint at all, 503 that it has it
-    // and it is switched off. Both are the same fact for the person in front of us, and
-    // "not found (404)" would send them looking for a mistake in their own command.
-    die('the feedback channel is not available right now. Please try again later.')
-  }
-  if (res.status === 422) {
-    // The server owns the lengths and it says which one is wrong, so its sentence is the
-    // useful one. Ours would have to name a bound, and naming a bound we do not own is how
-    // a client starts telling people a limit that moved.
-    if (process.env.HIRIFY_DEBUG) console.error(`hirify: server answered 422: ${JSON.stringify(res.body)}`)
-    die(serverMessage(res.body) || 'the report was not accepted. Please check the title and the text and try again.')
-  }
-
-  // Say `number`, never `id`. The number is the one a human at Hirify recognises; the id
-  // is for reading the ticket through their API, and telling a person the id would give
-  // them a number nobody there can look up. There is deliberately no link to a report:
-  // ticket numbers are sequential, and a public address would let anyone walk through
-  // other people's complaints. And nothing writes back afterwards, so we promise nothing.
-  const ticket = d.ticket?.number ?? (typeof d.ticket === 'number' ? d.ticket : null)
-
-  out(res.body, () => {
-    if (ticket && d.ticket?.duplicate) {
-      console.log(`Thank you. This matches a report we already have, number ${ticket}.`)
-    } else if (ticket) {
-      console.log(`Thank you. Your report was passed on as number ${ticket}.`)
-    } else {
-      console.log('Thank you. Your report was passed on. There is no number for it yet.')
-    }
-    if (d.reference) console.log(`reference: ${d.reference}`)
-  })
-}
-
-/** The profiles a person can apply with. Free, and the list `vacancy apply` picks from. */
-async function cmdProfileList() {
-  const body = await callCapability('profiles.list')
-  const list = body?.data ?? []
-  out(body, () => {
-    if (!list.length) {
-      return console.log('You have no profiles yet. Create one on hirify.me, then you can apply.')
-    }
-    for (const p of list) {
-      const state = [p.status, p.is_complete === false ? 'incomplete' : null].filter(Boolean).join(' · ')
-      console.log(`${String(p.profile_id ?? '-').padEnd(6)} ${p.name || p.title || '(untitled)'}${state ? `  [${state}]` : ''}`)
-    }
-    console.log('\nApply with one: hirify vacancy apply <slug> --profile <id>')
-  })
-}
-
-/**
- * Send a real application, on Hirify, to a real person. This is the one command here
- * that cannot be undone, so it never guesses: if the account has several profiles and
- * none was named, the server refuses and we pass that on rather than picking one.
- */
-async function cmdVacancyApply(args, words) {
-  const [slug] = words
-  if (!slug) die('a vacancy slug is required: hirify vacancy apply <slug> [--profile <id>]')
-
-  const profile = flag(args, '--profile')
-  const cover = flag(args, '--cover')
-
-  // A profile id is a number, and that is a fact about the flag, not a server limit. How
-  // long a cover letter may be is the server's rule and is not copied here: it answers 422
-  // in its own words, and those travel back untouched.
-  if (profile !== null && !/^\d+$/.test(profile)) die('--profile takes a profile id, a number. See hirify profile list.')
-
-  const res = await callCapability('applications.apply', {
-    params: { slug },
-    payload: { ...(profile ? { profile_id: Number(profile) } : {}), ...(cover ? { cover_letter: cover } : {}) },
-    allow: [201, 404, 422, 502],
-  })
-
-  if (res.status === 404) die('there is no vacancy with that slug.')
-  if (res.status === 502) die('the application could not be sent right now. Please try again in a minute.')
-  if (res.status === 422) {
-    // These come from the same rules the site applies: archived, flagged, hosted
-    // elsewhere, someone else's profile. They are written to be read, so pass them on
-    // instead of flattening every one of them into "something went wrong".
-    die(serverMessage(res.body) || 'the application was not accepted. Please check the vacancy and the profile.')
-  }
-
-  const d = res.body?.data ?? {}
-  out(res.body, () => {
-    console.log(d.application_id
-      ? `Applied. Application ${d.application_id}, status ${d.status ?? 'sent'}.`
-      : `Applied. Status ${d.status ?? 'sent'}.`)
-    console.log('Hirify does not follow up for you: the recruiter replies where they choose to.')
-  })
-}
-
-/** Save a search, the same thing a person does with the filter form on the site. */
-async function cmdFeedCreate(args, words) {
-  const [name] = words
-  // Required is ours to check; how long is the server's, and it says so in its own words.
-  if (!name) die('a name is required: hirify feed create "<name>" [--filters \'<json>\']')
-
-  // An empty set of criteria is legal and means "send me everything", exactly as it does
-  // on the site. So the field is always sent, and only bad JSON is refused.
-  let filters = {}
-  const raw = flag(args, '--filters')
-  if (raw) {
-    try {
-      filters = JSON.parse(raw)
-    } catch {
-      // No example criterion in the message: the shape is ours to state, the keys are not.
-      die('--filters expects JSON: the same criteria the site\'s filter form produces.\n' +
-        '        Their names and values: hirify filter guide')
-    }
-  }
-
-  const payload = { name, filters, notify_telegram: false }
-  if (args.includes('--no-telegram')) payload.notify_telegram = false
-  if (args.includes('--telegram')) payload.notify_telegram = true
-  const webhook = flag(args, '--webhook')
-  if (webhook) {
-    if (!/^\d+$/.test(webhook)) die('--webhook takes an endpoint id, a number. See hirify webhook list.')
-    payload.webhook_endpoint_id = Number(webhook)
-  }
-
-  const res = await callCapability('feeds.create', { payload, allow: [201, 422] })
-  if (res.status === 422) die(serverMessage(res.body) || 'the feed was not created. Please check the criteria.')
-
-  out(res.body, () => {
-    const feed = res.body?.data ?? {}
-    printFeedState(feed, 'Saved.')
-    if (!feed.notify_telegram && !feed.webhook_endpoint_id) {
-      console.log(`To receive new matches in Telegram: hirify feed deliver ${feed.id ?? '<id>'} --telegram`)
-    }
-  })
-}
-
-/** Change where a feed is delivered, without touching what it searches for. */
-async function cmdFeedDeliver(args, words) {
-  const [id] = words
-  if (!id || !/^\d+$/.test(id)) die('a feed id is required: hirify feed deliver <id> [--telegram|--no-telegram] [--webhook <id>|--no-webhook]')
-
-  const payload = {}
-  if (args.includes('--telegram')) payload.notify_telegram = true
-  if (args.includes('--no-telegram')) payload.notify_telegram = false
-  if (args.includes('--no-webhook')) payload.webhook_endpoint_id = null
-  const webhook = flag(args, '--webhook')
-  if (webhook) {
-    if (!/^\d+$/.test(webhook)) die('--webhook takes an endpoint id, a number. See hirify webhook list.')
-    payload.webhook_endpoint_id = Number(webhook)
-  }
-  if (!Object.keys(payload).length) {
-    die('say what to change: --telegram, --no-telegram, --webhook <id> or --no-webhook.')
-  }
-
-  const res = await callCapability('feeds.set_delivery', { params: { feed_id: id }, payload, allow: [200, 404, 422] })
-  if (res.status === 404) die('there is no feed with that id. See hirify feed list.')
-  if (res.status === 422) die(serverMessage(res.body) || 'the delivery settings were not accepted.')
-
-  out(res.body, () => printFeedState(res.body?.data ?? {}, 'Updated.'))
-}
-
-function printFeedState(f, lead) {
-  const where = [
-    f.notify_telegram ? 'Telegram' : null,
-    f.webhook_endpoint_id ? `webhook ${f.webhook_endpoint_id}` : null,
-  ].filter(Boolean)
-  console.log(`${lead} Feed ${f.id ?? '-'}: ${f.name || '(untitled)'}`)
-  console.log(where.length ? `Delivered to: ${where.join(' and ')}` : 'Delivery is off.')
-}
-
-/** The delivery endpoints on the account. Free; creating one needs the plan. */
-async function cmdWebhookList() {
-  const body = await callCapability('webhooks.list')
-  const list = body?.data ?? []
-  out(body, () => {
-    if (!list.length) {
-      return console.log('You have no delivery endpoints yet. Create one: hirify webhook create "<name>" <url>')
-    }
-    for (const w of list) {
-      console.log(`${String(w.id ?? '-').padEnd(6)} ${w.name || '(untitled)'}  ${w.url ?? '-'}${w.state ? `  [${w.state}]` : ''}`)
-    }
-    console.log('\nSend a feed to one: hirify feed deliver <feed id> --webhook <id>')
-  })
-}
-
-async function cmdWebhookCreate(args, words) {
-  const [name, url] = words
-  if (!name || !url) die('both a name and an address are required: hirify webhook create "<name>" <url>')
-
-  const res = await callCapability('webhooks.create', { payload: { name, url }, allow: [201, 403, 422] })
-  if (res.status === 403) die(serverMessage(res.body) || 'creating a delivery endpoint is not available on this account.')
-  if (res.status === 422) die(serverMessage(res.body) || 'that address was not accepted.')
-
-  const d = res.body?.data ?? {}
-  out(res.body, () => {
-    console.log(`Created. Endpoint ${d.id ?? '-'}: ${d.name || '(untitled)'} ${d.url ?? ''}`.trimEnd())
-    // The secret is shown once and never again, so it gets its own line and a warning
-    // rather than sitting inside a sentence someone may scroll past.
-    if (d.secret) {
-      console.log(`\nsecret: ${d.secret}`)
-      console.log('Store it now. It is shown once and it signs every delivery.')
-    }
-  })
-}
-
-/** The fallback for CI and servers with no browser. The normal way in is `hirify login`. */
-function cmdAuth(args, words) {
-  const [key] = words
-  if (!key) {
-    die('to sign in through the browser: `hirify login`.\n' +
-      '        With a key (CI, servers): `hirify auth <key>`, from hirify.me/account/api-access')
-  }
-  writeSession({ kind: 'key', access_token: key })
-  if (existsSync(LEGACY_KEY_FILE)) rmSync(LEGACY_KEY_FILE)
-  console.log(`Key saved to ${AUTH_FILE}`)
-}
-
-/**
- * The first command anyone runs, and the only long text the CLI carries. It is prose, not a
- * list: `--help` already lists the commands, and a list does not tell you the order to use
- * them in or which of them spends something.
- *
- * Written for two readers at once, because that is who is there: the agent doing the work,
- * and the person watching it. Neither needs a different version of the truth.
- *
- * No network call. This has to work before anyone has signed in.
- */
-const INTRO = `hirify - job search for AI agents
-
-Hirify is a job board. This CLI is how an agent works it for someone: the same vacancies, the
-same saved filters and the same account they have at hirify.me.
-
-Signing in
-  hirify login opens a browser and needs a person at the screen, so ask for it rather than
-  running it. On a server with no browser there is a key instead: hirify auth <key>, from
-  hirify.me/account/api-access.
-
-Start with what the account already has
-  Most people who use Hirify have saved a filter or two on the site. Those are feeds, and they
-  are the best place to start, because someone has already said in them what they want.
-
-    hirify account show          the plan and allowances
-    hirify feed list             what this account has saved
-    hirify feed show 31          the vacancies in one of them
-
-  When no feed fits, search the whole board. Search takes a phrase, and any criterion the
-  site's own filter form can express, written as an option:
-
-    hirify vacancy search "senior go"
-    hirify vacancy search "senior go" --page 2
-    hirify vacancy search "senior go" --<criterion> <value>
-
-  The criteria are the server's, not this CLI's, and nothing here names one on purpose: a
-  name written into this text would be a copy, and copies go stale quietly. Ask instead:
-
-    hirify filter guide
-
-  It prints what search can filter on and what the values are, written by the server from
-  the same source the site searches with. An option is sent on under the name you gave it;
-  give one twice and the values are joined, the way the site sends a filter with several
-  values.
-
-Read before you spend anything
-  A card is a headline: title, company, terms. Fit is decided in the text.
-
-    hirify vacancy read senior-go-engineer
-
-  This prints the whole vacancy, and it also says which of the two ways to apply this one
-  takes, so you do not have to work that out or find out from a refusal.
-
-What costs what
-  Lists and searches are free.
-  Reading one vacancy in full spends one of the Agent API's daily vacancy opens. There are
-  many of them, and reading a vacancy again the same day costs nothing. Read as much as you
-  need to.
-  Revealing where to apply spends 1 reveal, and reveals are the scarce one. Protect that
-  number: shortlist by reading, then reveal only the ones worth applying to.
-  Applying has a daily allowance of its own. It is not the free step it looks like.
-  hirify account show has all three, and it is the only place they are current.
-
-Where to apply
-    hirify vacancy reveal senior-go-engineer
-
-  Gives the company, its LinkedIn page when we know it, and the address to send the
-  application to. Revealing the same vacancy again returns the same thing and costs nothing.
-
-Applying
-  Most vacancies here came from somewhere else: company pages, Telegram channels, other
-  boards. For those, reveal brings back the address, and the application is made there rather
-  than through Hirify.
-  Vacancies hosted on Hirify can be applied to from here:
-
-    hirify profile list
-    hirify vacancy apply senior-go-engineer --profile 4 --cover "..."
-
-  An application reaches a real person and cannot be recalled. Ask first, every time, and
-  show what you are about to send. Nothing follows up afterwards: the recruiter replies
-  where they choose to.
-
-Two more things
-  A saved search can be created from here and delivered to Telegram or to a server of yours:
-  hirify feed create, hirify feed deliver, hirify webhook list.
-  Something broken or missing: hirify feedback send bug "<title>" --body "<what happened>". It
-  reaches the team and costs nothing.
-
-If a command you need is not here
-  hirify api call <capability> invokes any capability Hirify lists in its manifest and prints
-  the answer as it comes back, so a capability without its own command is a detour and not a
-  dead end. Inputs go in --data as a JSON object. Prefer the commands above where one fits:
-  they say what a thing costs and what a refusal means, and this one cannot.
-
-If you are an agent
-  Install the working rules once: npx skills add hirifyme/hirify-cli. They cover the order
-  above, what needs the person's permission before you do it, and what each refusal means.
-
-Every command takes --json. The full list of them: hirify --help`
-
-async function cmdIntro() {
-  // The intro is release-approved text published on the public agent well-known, so it can be
-  // refreshed without shipping a new CLI. It needs no sign-in and no manifest. When Hirify
-  // cannot be reached, or publishes none, the built-in text below stands in - so `hirify intro`
-  // and the sign-in help it carries work before login and with no network.
-  const { intro } = await agentDiscovery()
-  console.log(typeof intro === 'string' && intro ? intro : INTRO)
-}
-
-// The fields the compact vacancy view keeps from a full summary card: the shortlist signal a
-// scan needs, without the detail `vacancy read` adds. This is the selection the context budget
-// is measured against - twenty of them serialize small - so a page of results does not spend an
-// agent's context on fields it does not act on here. `--fields` narrows it; `--json` keeps the
-// whole card.
-const CARD_FIELDS = ['slug', 'title', 'company_masked', 'remote_type', 'work_format', 'english_level', 'salary']
-
-// The projections whose compact selection is the vacancy card. `api call` renders these with
-// CARD_FIELDS by default, the same shortlist view `vacancy search` prints.
-const KNOWN_CARD_PROJECTIONS = new Set(['vacancy.summary'])
-
-// The field names asked for with --fields, or null for "every field the answer carries".
-const fieldList = (args) => {
-  const raw = flag(args, '--fields')
-  return raw ? raw.split(',').map((s) => s.trim()).filter(Boolean) : null
-}
-
-// One item reduced to the fields asked for, keeping only the ones the server actually sent, so
-// a selection never manufactures a field the API did not return.
-function selectFields(item, fields) {
-  if (item === null || typeof item !== 'object' || Array.isArray(item)) return item
-  const keys = (fields ?? Object.keys(item)).filter((k) => Object.hasOwn(item, k))
-  return Object.fromEntries(keys.map((k) => [k, item[k]]))
-}
-
-// A value on one line: an address or a number as it is, a list joined, an object as compact
-// JSON. Nothing is dropped; a missing value reads as a dash rather than the word undefined.
-const scalarText = (v) => {
-  if (v === null || v === undefined) return '-'
-  if (Array.isArray(v)) return v.map(scalarText).filter((s) => s !== '').join(', ')
-  if (typeof v === 'object') return JSON.stringify(v)
-  return String(v)
-}
-
-/**
- * A compact view of a capability answer the CLI has no bespoke command for. It prints the
- * fields the server returned, one per line, item by item, so `hirify api call` reads without
- * --json. `--fields` narrows to the names asked for, and a known card projection is narrowed to
- * the shortlist selection by default. It never invents a field, and --json still hands over the
- * whole canonical answer.
- */
-function renderGeneric(body, fields = null) {
-  const payload = body && typeof body === 'object' && !Array.isArray(body) && 'data' in body ? body.data : body
-  const items = Array.isArray(payload) ? payload : [payload]
-  const blocks = []
-  for (const item of items) {
-    const picked = selectFields(item, fields)
-    if (picked === null || typeof picked !== 'object' || Array.isArray(picked)) {
-      const text = picked === null || picked === undefined ? '' : String(picked)
-      if (text) blocks.push(text)
-      continue
-    }
-    const rows = Object.entries(picked).map(([k, v]) => `${k}: ${scalarText(v)}`)
-    if (rows.length) blocks.push(rows.join('\n'))
-  }
-  const text = blocks.join('\n\n')
-  if (text) console.log(text)
-}
-
-// Which method takes a request body, so a `--data` input lands in the body rather than the
-// query string when the manifest does not say where it goes.
-const BODY_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE'])
-
-/**
- * The generic call. Every other command is a shape we chose for one job; this one takes a
- * capability by its id, looks it up in the manifest, and sends the request the manifest
- * describes, so a capability this CLI has no command for is a detour rather than a dead end -
- * and a capability the server adds later is reachable from here with no change to this file.
- *
- * Inputs travel in `--data` as one JSON object. Each value goes where the manifest says it
- * belongs: into the path, the query string, or the body. The answer is printed as it arrived,
- * refusals included: a sentence of ours in place of the server's own reply is exactly what
- * this command exists to get out of the way, and that also means it cannot say what a call
- * costs, which the named commands can.
- */
-async function cmdApiCall(args, words) {
-  const [id] = words
-  if (!id) {
-    die('a capability id is required: hirify api call <capability>\n' +
-      '        The ids are the ones Hirify lists in its manifest; the named commands cover the\n' +
-      '        common ones, and this reaches the rest. Inputs go in --data as a JSON object.')
-  }
-
-  // Read the inputs before reaching the server: a typo in --data is the caller's, and no
-  // manifest is needed to see it.
-  const data = flag(args, '--data')
-  let inputs = {}
-  if (data) {
-    try {
-      inputs = JSON.parse(data)
-    } catch {
-      die('--data expects JSON, for example --data \'{"slug":"senior-go-engineer"}\'')
-    }
-  }
-  if (inputs === null || typeof inputs !== 'object' || Array.isArray(inputs)) {
-    die('--data expects a JSON object of inputs, for example --data \'{"page":2}\'')
-  }
-
-  const cap = await resolveCapability(id)
-
-  // Where each input belongs, from the manifest. An input the manifest does not place goes to
-  // the body on a writing method and to the query otherwise, which is where an unplaced input
-  // most usefully lands.
-  const locations = (cap.inputs && cap.inputs.locations) || {}
-  const writes = BODY_METHODS.has(cap.method.toUpperCase())
-  const params = {}
-  const query = new URLSearchParams()
-  const body = {}
-  let hasBody = false
-
-  for (const [key, value] of Object.entries(inputs)) {
-    const where = locations[key] || (writes ? 'body' : 'query')
-    if (where === 'path') {
-      params[key] = value
-    } else if (where === 'body') {
-      body[key] = value
-      hasBody = true
-    } else {
-      query.set(key, Array.isArray(value)
-        ? value.join(',')
-        : value !== null && typeof value === 'object' ? JSON.stringify(value) : String(value))
-    }
-  }
-
-  // Invoke it. The capability is looked up again here, which revalidates the manifest with
-  // its ETag and reuses the cached document on a 304 rather than downloading it twice.
-  const res = await callCapability(id, { params, query, payload: hasBody ? body : null, raw: true })
-
-  // Under --json, or when the server refused, or when the answer is not JSON, the canonical
-  // body goes through untouched: --json is the raw contract, a refusal carries the server's own
-  // machine-readable words, and a non-JSON answer has no fields to select. Otherwise the answer
-  // is rendered compactly - a known card projection narrowed to its shortlist selection, any
-  // other shape by its own fields - so `api call` reads without --json and stays small in an
-  // agent's context. --fields narrows the selection further.
-  const raw = process.argv.includes('--json') || res.status >= 400 || res.body === null
-  if (raw) {
-    const text = res.body === null ? res.text.trim() : JSON.stringify(res.body, null, 2)
-    if (text) console.log(text)
-  } else {
-    const fields = fieldList(args) ?? (KNOWN_CARD_PROJECTIONS.has(cap.output_projection) ? CARD_FIELDS : null)
-    renderGeneric(res.body, fields)
-  }
-  // On stderr, so that stdout stays the server's answer and nothing else.
-  if (res.status >= 400) die(`the server answered ${res.status}. The answer is above.`)
-}
-
-/**
- * The filter vocabulary, printed as the server wrote it.
- *
- * `guide`, not `show`, and the reason is what comes back: this is not a list of keys but
- * the method the site's own filter generator works by, and calling it `show` would promise
- * a list. `eco mail inbox` is the same shape in the same grammar.
- *
- * Nothing about filters is written down in this file, and nothing should be. The endpoint
- * derives the list from the source the site searches with, so it cannot drift; a copy here
- * would start drifting the day it was written.
- */
-async function cmdFilterGuide() {
-  const res = await callCapability('filters.guide', { allow: [200, 404] })
-
-  // Older servers do not serve it. Say that, rather than "not found (404)", which reads as
-  // a mistake in the command. And do not offer a substitute: there is nothing here that
-  // knows the filters, and inventing advice about them is the whole problem this fixes.
-  if (res.status === 404) {
-    die('this Hirify server does not serve the filter guide yet.\n' +
-      '        Search still takes every criterion the site\'s filter form can express, but\n' +
-      '        their names have to come from someone who knows them.')
-  }
-
-  const guide = typeof res.body?.data?.guide === 'string' ? res.body.data.guide.trim() : ''
-  if (!guide) die('the server answered without a guide. Please try again in a minute.')
-
-  out(res.body, () => console.log(guide))
-}
-
-/** The skill ships through skills.sh now: one command installs it into every harness. */
-function cmdSkill() {
-  console.log('The rules for your agent install with one command:\n\n  npx skills add hirifyme/hirify-cli\n')
-  console.log('It puts them where your agent reads them: Claude Code, Codex, Cursor, OpenCode and others.')
-}
-
-// ── router ─────────────────────────────────────────────────────────────────
-// Commands that are not something you do to a thing. Signing in is not an operation on a
-// vacancy or a feed, and `intro` is the first thing anyone runs, so it stays one word.
-const PLAIN = {
-  intro: cmdIntro, skill: cmdSkill, version: cmdVersion,
-  login: cmdLogin, logout: cmdLogout, auth: cmdAuth,
-}
-
-// Everything else is a noun and a verb, the grammar the rest of our tools already use.
-// The noun is the thing you are working with, the verb is what you are doing to it.
-const NOUNS = {
-  account: { show: cmdAccountShow },
-  vacancy: { search: cmdVacancySearch, read: cmdVacancyRead, reveal: cmdVacancyReveal, apply: cmdVacancyApply },
-  feed: { list: cmdFeedList, show: cmdFeedShow, create: cmdFeedCreate, deliver: cmdFeedDeliver },
-  profile: { list: cmdProfileList },
-  webhook: { list: cmdWebhookList, create: cmdWebhookCreate },
-  feedback: { send: cmdFeedbackSend },
-  filter: { guide: cmdFilterGuide },
-  api: { call: cmdApiCall },
-}
-
-const [noun, ...args] = process.argv.slice(2)
-
-await autoUpdate()
-
-if (!noun || noun === '--help' || noun === '-h' || noun === 'help') { console.log(HELP); process.exit(EXIT_OK) }
-
-// `Object.hasOwn`, not a plain lookup: every object inherits `toString` and `constructor`,
-// and `hirify toString` used to find one and run it, which exits 0 having done nothing.
-if (Object.hasOwn(PLAIN, noun)) {
-  await PLAIN[noun](args, positional(args))
-} else if (Object.hasOwn(NOUNS, noun)) {
-  const verbs = NOUNS[noun]
-  const known = `hirify ${noun} takes a verb: ${Object.keys(verbs).join(', ')}`
-  if (args.includes('--help') || args.includes('-h')) { console.log(known); process.exit(EXIT_OK) }
-
-  // The verb is read from the positionals, so an option written in front of it cannot
-  // stand in for it: `hirify feed --json list` is still the list.
-  const [verb, ...rest] = positional(args)
-  if (!verb) die(known)
-  if (!Object.hasOwn(verbs, verb)) die(`hirify ${noun} has no verb "${verb}".\n        ${known}`)
-  await verbs[verb](args, rest)
-} else {
-  die(`unknown command: ${noun}\n\n${HELP}`)
-}
+import { main } from './lib/main.js'
+// Allow pipe output and cleanup to finish; deep modules never terminate the process.
+process.exitCode = await main()