intentdna 1.7.5 → 1.8.0

package/dist/cli/index.js

@@ -13,6 +13,7 @@
  */
 import { parseArgs } from "node:util";
 import { getPackageVersion } from "./util/version.js";
+import { WORKFLOW_ASSET_IDS } from "../templates/metadata.js";
 const fallbackVersion = "unknown";
 function helpText(version) {
     return `Intent DNA CLI v${version}
@@ -33,8 +34,17 @@ Commands:
   evolve        Preview epigenetic marker changes from persisted outcomes
   epigenetic    Record outcomes, view markers and summaries
   feedback      Build local kernel report (--days <N>, --json, --package, --evolve preview, --dna-id <id>)
+  report        Package and stage local runtime evidence for hidden transport
   context       Inspect planning-only advisory context sources
   templates     Template management (deploy to global install)
+  assets        Read-only workflow asset inventory and evidence links
+  workflow      External-agent workflow authoring packet, routes, evidence suggestions, and legacy scaffold preview
+  org           Local organization/project asset bindings and review
+  guide         Show the workflow governance route and next commands
+  quickstart    Show the shortest local route: choose, init, sync, run, sign, verify
+  release       Plan deploy gates for web/public surfaces
+  cloud         Check, bootstrap, and plan SaaS backend deployment (Supabase)
+  auth          Manage CLI API token authentication for cloud features
 
 Options:
   --help, -h    Show help for a command
@@ -45,11 +55,72 @@ Examples:
   dna guard --level strict            Enterprise-grade guardrails
   dna guard --audit                   Show last 7 days of violation logs
   dna guard --remove                  Remove all guardrails
-  dna init --template flutter-rewrite Create DNA config from template
+  dna init --template ${WORKFLOW_ASSET_IDS.default} Create DNA config from template
   dna init --template list            List all available templates with namespaces
   dna init --register my.dna.yaml     Register a custom template (checks namespace uniqueness)
   dna generate "Flutter app with behavior locking"  Generate config prompt with schema spec
   dna generate "Secure API backend" --match         Find matching templates
+  dna assets library                Browse workflow assets by readiness and next command
+  dna assets candidates ${WORKFLOW_ASSET_IDS.default}  Find workflow candidates from dogfood evidence
+  dna assets lineage ${WORKFLOW_ASSET_IDS.default} Explain origin, cascade, evidence, and evolution route
+  dna assets lifecycle ${WORKFLOW_ASSET_IDS.default} Show cascade/evidence/evolution lifecycle
+  dna assets list                   List workflow assets compiled from templates
+  dna assets inspect ${WORKFLOW_ASSET_IDS.default} --evidence  Inspect a workflow asset and evidence links
+  dna assets evidence ${WORKFLOW_ASSET_IDS.default}            Summarize dogfood progress JSON for an asset
+  dna org intake "Mobile rewrite team" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex
+  dna org init --name "My Org" --project "Mobile Rewrite" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex
+  dna org review                                Review local organization asset bindings and next actions
+  dna org receipt --json                       Emit local org review receipt projection input
+  dna org rollout                               Review sync/downstream rollout readiness
+  dna release deploy-plan                       Decide whether Vercel deploy + URL verification is required
+  dna release deploy-plan apps/online/src/main.ts --json
+  dna cloud status --json                       Check Supabase cloud config without network access
+  dna cloud env-manifest --secrets-check <json> --vercel-env-check <json>  Classify local env with saved remote evidence overlay
+  dna cloud vercel-env-plan --json              Plan browser-safe Vercel env setup for online Supabase projection
+  dna cloud vercel-env-check --json             Check Vercel production public Supabase env presence
+  dna cloud credential-check --secrets-check <json> --vercel-env-check <json>  Include saved remote evidence without rerunning checks
+  dna cloud rollout-pack --secrets-check <json> --vercel-env-check <json>  Include saved remote evidence without rerunning checks
+  dna cloud production-evidence --secrets-check <json> --vercel-env-check <json>  Include saved remote evidence in production evidence
+  dna cloud vercel-env-apply --dry-run --json   Preview guarded Vercel public Supabase env writes
+  dna cloud secrets-plan --json                 Plan guarded Supabase Function secret setup
+  dna cloud secrets-apply --dry-run --json      Preview guarded Supabase Function secret writes
+  dna cloud secrets-check --json                Check Supabase Function secret names without reading values
+  dna cloud credential-check --json             Summarize Supabase live credential readiness gates
+  dna cloud handoff --json                      Build a redacted Supabase operator credential handoff packet
+  dna cloud runbook --json                      Build a redacted Supabase/Vercel production operator runbook
+  dna cloud operator-checklist --json           Build a concise local-only operator checklist for SaaS launch blockers
+  dna cloud production-evidence --json          Aggregate Supabase production evidence without mutation
+  dna cloud edge-check --json                   Run local Supabase Edge Function typechecks without deploy
+  dna cloud contract-check --json               Verify local Supabase artifact contracts before live deploy
+  dna cloud function-health --json              Probe deployed Supabase Edge Functions with OPTIONS only
+  dna cloud deploy-plan --json                  Plan Supabase live deployment without network access
+  dna cloud deploy-execute --dry-run --json      Preview guarded Supabase deployment execution
+  dna cloud smoke-plan --json                   Plan post-deploy cloud ingestion smoke without network access
+  dna cloud smoke-execute --dry-run --json       Preview guarded post-deploy ingestion smoke execution
+  dna cloud smoke-receipt-check --receipt <path> --json  Check a saved live smoke receipt locally
+  dna cloud bootstrap --admin-user-id <uuid> --admin-email me@example.com --org "My Org" --project "IntentDNA" --json
+  dna auth status --json                        Check local CLI API token status
+  dna auth token set <token> --json             Store a CLI API token outside the project repo
+  dna auth user-jwt set <jwt> --json            Store Supabase user JWT for account onboarding commands
+  dna auth bootstrap-account --org "My Org" --project "IntentDNA" --dry-run --json  Create/reuse account org/project before CLI token onboarding
+  dna auth onboard --dry-run --json                 Preview project discovery plus CLI API token issuance
+  dna auth issue-token --project-id <uuid> --dry-run --json  Preview Supabase user JWT token issuance
+  dna auth projects --dry-run --json            Preview account project discovery through Supabase user JWT
+  dna auth tokens list --dry-run --json         Preview account API token listing through Supabase user JWT
+  dna report package                            Write .dna/reports/latest-report-package.json
+  dna report push --dry-run --json              Preview hidden evidence transport envelope
+  dna report sign --json                        Sign a local report package into an ingest envelope and print envelope_path
+  dna report verify .dna/reports/ingest/report-ingest.json --json
+  dna report receipts --project-id <uuid> --dry-run --json  Preview cloud receipt projection listing
+  dna quickstart --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex
+  dna guide --asset ${WORKFLOW_ASSET_IDS.default} --name "Samuel AI Lab" --project "Mobile Rewrite" --goal "Rewrite module with logic equivalence"
+  dna workflow examples              List workflow draft examples
+  dna workflow authoring-packet "Create a code review workflow" --json
+  dna workflow intake "Rewrite module with logic equivalence"  Recommend reuse or authoring path
+  dna workflow suggestions ${WORKFLOW_ASSET_IDS.default}       Suggest human-reviewed improvements from evidence
+  dna workflow mine ${WORKFLOW_ASSET_IDS.default}              Mine candidate workflow assets from evidence
+  dna workflow draft "Rewrite module with logic equivalence" --example rewrite_governance --strictness high  # scaffold fallback only
+  dna assets adoption workflow-evidence-review
   dna sync                            Auto-detect .dna/config.yaml + environment, sync all
   dna sync .dna/config.yaml --target claude-md --inject CLAUDE.md --context work
   dna sync my.dna.json --target claude-md --inject CLAUDE.md --hooks .claude/hooks
@@ -74,19 +145,116 @@ Examples:
 `;
 }
 const COMMAND_HELP = {
-    sync: `Usage: dna sync [files...] [options]\n\nOptions:\n  --mode auto|plugin|bin   Sync mode (default: auto)\n  --dry-run                Print planned outputs without writing files\n  --post-summary           Print registry-backed output summary\n  --target <target>        Markdown target for injection\n  --inject <path>          File to inject markdown into\n  --agents <dir>           Generate agent files\n  --skills <dir>           Generate skill files\n  --workflow <dir>         Generate workflow shell scripts\n  --settings <path>        Write hook settings in bin mode\n  --lock <path>            Write lock file (default .dna/lock)\n`,
+    cloud: `Usage: dna cloud status [--auth-config-dir <dir>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud daily-report [--auth-config-dir <dir>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud env-manifest [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud vercel-env-plan [--json]
+       dna cloud vercel-env-check [--json]
+       dna cloud vercel-env-apply [--dry-run] [--yes] [--json]
+       dna cloud secrets-plan [--json]
+       dna cloud secrets-apply [--dry-run] [--yes] [--json]
+       dna cloud secrets-check [--json]
+       dna cloud credential-check [--endpoint <url>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud handoff [--endpoint <url>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud runbook [--endpoint <url>] [--secrets-check <path>] [--vercel-env-check <path>] [--output <path>] [--json]
+       dna cloud operator-checklist [--endpoint <url>] [--deployment-url <url>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud production-evidence [--endpoint <url>] [--deployment-url <url>] [--receipt <path>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud contract-check [--json]
+       dna cloud edge-check [--json]
+       dna cloud function-health [--endpoint <url>] [--json]
+       dna cloud deploy-plan [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud deploy-execute [--dry-run] [--yes] [--json]
+       dna cloud smoke-plan [--endpoint <url>] [--json]
+       dna cloud smoke-execute [--endpoint <url>] [--dry-run] [--yes] [--json]
+       dna cloud smoke-receipt-check --receipt <path> [--json]
+       dna cloud rollout-pack [--endpoint <url>] [--secrets-check <path>] [--vercel-env-check <path>] [--json]
+       dna cloud bootstrap [options]
+
+Subcommands:
+  daily-report            Emit the manager daily status packet from manager_brief without network or mutation
+  env-manifest             Classify browser, CLI, Supabase operator, server-secret, and manual confirmation env
+  vercel-env-plan          Plan browser-safe Vercel production env setup without writing values
+  vercel-env-check         Check Vercel production env presence without reading values or writing env
+  vercel-env-apply         Execute guarded Vercel public Supabase env writes only with --yes
+  secrets-plan             Plan guarded Supabase Function secret setup without writing secrets
+  secrets-apply            Execute guarded Supabase Function secret writes only with --yes
+  secrets-check            Check Supabase Function secret names without reading values or writing secrets
+  credential-check         Summarize live Supabase/Vercel/CLI credential readiness gates
+  handoff                  Build a redacted Supabase operator credential handoff packet
+  runbook                  Build a redacted Supabase/Vercel production operator runbook
+  operator-checklist       Build a local-only checklist of user/operator inputs, commands, and verification gates
+  production-evidence      Aggregate contract, deploy, health, smoke, rollout, secrets, and online production evidence without mutation
+  contract-check           Verify local migration/function contracts
+  edge-check               Run local Deno typechecks for Supabase Edge Functions
+  function-health          Probe deployed Supabase Edge Functions with OPTIONS requests only
+  deploy-execute           Execute guarded Supabase link/db push/secrets/functions only with --yes
+  smoke-receipt-check      Check a saved live smoke receipt locally before production evidence aggregation
+
+Boundaries:
+  - Supabase SaaS configuration checks preserve local runtime truth; local planning commands perform no network request unless the subcommand explicitly says it is a read-only live check
+  - daily-report is manager status evidence only; it does not deploy, upload, set secrets, execute workflows, or create runtime authority
+  - performs no network request for local-only planning/status commands
+  - env-manifest and credential-check print placement/readiness guidance and masked previews only; do not write env files
+  - vercel-env-plan lists Vercel env/deploy/evidence commands but does not write env values, deploy, or read secrets
+  - vercel-env-check runs a read-only Vercel production env presence check and omits env values from output
+  - vercel-env-apply requires --yes before writing Vercel env
+  - secrets-plan lists Supabase Function secret commands but does not set secrets
+  - secrets-apply requires --yes before writing Supabase Function secrets
+  - secrets-check reads Supabase Function secret names only; it does not print real secrets, set secrets, upload reports, or grant runtime authority
+  - handoff does not print real secrets
+  - runbook does not run them, deploy online, or write files unless --output is explicit
+  - operator-checklist condenses user/operator blockers and commands
+  - status, daily-report, env-manifest, deploy-plan, credential-check, handoff, runbook, operator-checklist, rollout-pack, and production-evidence may read supplied --secrets-check and --vercel-env-check artifacts locally instead of rerunning remote checks
+  - production-evidence aggregates local checks, remote secret-name checks or a supplied secrets-check artifact, Vercel env-name checks or a supplied vercel-env-check artifact, unauthenticated function health, supplied live smoke receipt, and online deployment URL
+  - smoke-receipt-check reads one local receipt JSON only
+  - contract-check does not run Supabase or Deno
+  - edge-check does not link Supabase, deploy functions, set secrets, or validate live credentials
+  - function-health sends no auth and performs no upload, publish, migration, or secret mutation
+  - deploy-execute requires --yes before mutating Supabase
+  - deploy-plan does not run migrations, deploy functions, set secrets, execute bootstrap SQL, or smoke-test upload
+  - rollout-pack does not run deployment, create accounts, or upload reports
+  - smoke-plan does not run report upload or perform a network request
+  - Service role keys are server-only; token peppers are also server-only and are never accepted as browser or CLI client configuration
+  - API tokens are the CLI auth path, not MCP authorization
+`,
+    sync: `Usage: dna sync [status|doctor|remove] [files...] [options]\n\nSubcommands:\n  status                   Show registry-tracked sync artifacts and drift posture\n  doctor                   Check whether registry-tracked artifacts still match last sync\n  remove                   Remove safe hash-matching IntentDNA-owned/diagnostic artifacts from the registry\n\nOptions:\n  --mode auto|plugin|bin   Sync mode (default: auto)\n  --dry-run                Print planned outputs without writing files; with remove, preview removals\n  --post-summary           Print registry-backed output summary after sync\n  --json                   Print status/doctor JSON to stdout\n  --project-dir <path>     Read/write local sync configs and artifacts in another project directory\n  --target <target>        Markdown target for injection\n  --inject <path>          File to inject markdown into\n  --agents <dir>           Generate agent files\n  --skills <dir>           Generate skill files\n  --workflow <dir>         Generate workflow shell scripts\n  --settings <path>        Write hook settings in bin mode\n  --codex                  Generate Codex CLI instruction, plugin, fallback hook, and evidence artifacts\n  --codex-install-mode <mode>  plugin_scoped|project_fallback|managed|none (default project_fallback)\n  --codex-dogfood          Probe codex exec --json and attach diagnostic evidence\n  --lock <path>            Write lock file (default .dna/lock)\n  --remove                 Legacy explicit-target removal; requires --inject/--agents/--skills/--workflow/--codex\n`,
     verify: `Usage: dna verify [--lock <path>] [--stats] [--health] [--strict]\n\nOptions:\n  --health                 Comprehensive installation health check\n  --stats                  Show hook call statistics\n  --strict                 Require valid RuntimeDecisionEvent enterprise evidence\n  --lock <path>            Lock file path (default .dna/lock)\n`,
-    templates: `Usage: dna templates <list|show|deploy>\n\nSubcommands:\n  list                     List built-in and project templates\n  show <name>              Show template metadata and YAML\n  deploy                   Copy local templates to global install\n`,
+    templates: `Usage: dna templates <list|marketplace|manage|sources|show|publish|publications|revoke|deploy> [name] [--json] [--project-dir <path>]\n\nSubcommands:\n  list                     List built-in and project templates with marketplace visibility/harness metadata\n  marketplace              Export a shared intentdna.template_marketplace_catalog.v1 catalog\n  manage [name]            Show template management view: tags/details/marketplace/step index plus full YAML\n  sources [reference]      Review external workflow/skill references that may be translated into DNA templates\n  show <name>              Show template metadata, marketplace metadata, and YAML\n  publish                  Publish an org-private template through Supabase using a local receipt evidence file\n  publications             List org-private template publications through Supabase as read-only projection\n  revoke                   Mark one org-private template publication unpublished through Supabase metadata\n  deploy                   Copy local templates to global install\n\nOptions:\n  --json                   Print manage/sources/marketplace/publish/publications/revoke JSON to stdout\n  --project-dir <path>     Include project-local .dna/templates from another project directory\n  --output <path>          For marketplace: write catalog JSON for online/static import\n  --source-dir <path>      Scan a reference workflow/skill directory (repeatable)\n  --focus all|refresh|gaps For sources list: all references, existing-template refreshes, or uncovered gaps\n  --candidate              For sources <reference>: print a read-only candidate template YAML preview\n  --save-template <name>   With --candidate, save the preview as project-local .dna/templates/<name>.dna.yaml\n  --org <org>              For publish/publications/revoke: organization id/slug/name\n  --project <project>      For publish/publications/revoke: project id/slug/name\n  --template <name>        For publish/publications: template name filter\n  --publication-id <id>    For revoke: org-private template publication id from dna templates publications\n  --reason <text>          For revoke: optional human reason stored in request metadata\n  --receipt <path>         For publish: intentdna.org_review_receipt.v1 or intentdna.report_ingest_receipt.v1 evidence file\n  --endpoint <url>         For publish/publications/revoke: Supabase Edge Function endpoint override\n  --auth-config-dir <dir>  Read CLI API token config from a specific directory for isolated template publication checks\n  --dry-run                For publish/publications/revoke: validate request without network upload\n`,
+    assets: `Usage: dna assets <list|library|candidates|lineage|show|inspect|status|review|governance|lifecycle|adoption|suggestions|diff|evidence> [name] [--evidence] [--json]\n\nSubcommands:\n  list                     List template-backed workflow assets\n  library                  Browse workflow assets by readiness with evidence/governance next commands\n  candidates [name]        Find candidate workflow assets to extract or promote from dogfood evidence\n  lineage <name>           Explain origin, cascade, evidence, and human-reviewed evolution route\n  lifecycle <name>         Show cascade, evidence, suggestion, draft, review, adoption, bind, and sync lifecycle\n  show <name>              Show workflow asset summary\n  inspect <name>           Show workflows, controllers, roles, steps, and optional evidence links\n  status [name]            Show read-only management, evidence, and project configuration posture\n  review                   Show manager-facing asset health summary and next actions\n  governance <name>        Explain cascade inheritance and preview-first evolution for an asset\n  adoption <name>          Show adoption readiness checks and the safe adoption path\n  suggestions <name>       Suggest human-reviewed workflow improvements from evidence\n  diff <from> <to>         Compare two workflow assets for manager review before adoption\n  evidence <name>          Summarize registered dogfood progress JSON for a workflow asset\n\nOptions:\n  --evidence               Include registered evidence/reference links\n  --project-dir <path>     Read project-local workflow assets and configs from another project directory\n  --json                   Print JSON to stdout\n`,
+    workflow: `Usage: dna workflow <examples|authoring-packet|intake|route|suggestions|mine|draft|edit-plan|review-suggestion|improve-from-suggestions|from-candidate> [description] [--example <id>] [--strictness standard|high] [--json|--yaml]\n\nSubcommands:\n  examples                 List draft examples\n  authoring-packet [goal]  Emit the C3 packet for external-agent workflow authoring; no intent modeling or mutation\n  intake <description>     Review a workflow request and recommend reuse or authoring path\n  route <description>      Show the personal no-canvas route: describe, author, validate, run; use --org for organization rollout gates\n  suggestions <asset>      Suggest human-reviewed workflow improvements from evidence without mutation\n  mine [asset]             Find candidate workflow assets or follow-up drafts from real evidence\n  draft <description>      Clone a built-in example as a scaffold fallback; structure is not derived from the goal\n  edit-plan <instruction>  Preview a workflow edit without writing DNA or runtime files\n  review-suggestion        Persist accept/reject/defer for an evidence-backed suggestion\n  improve-from-suggestions Build a reviewable edit plan from an accepted asset suggestion\n  from-candidate <id>      Act on a dogfood-backed candidate without copying a long command\n\nOptions:\n  --name <org>             Organization name for --org route planning\n  --project <project>      Project name for --org route planning\n  --sync-target <target>   Runtime surface for --org route planning, such as codex or claude\n  --org                    Include organization binding, configure, rollout, sync, deploy, improve, and evolution gates\n  --from-template <name>   Source workflow asset for route/edit/candidate commands\n  --workflow <id>          Select a workflow inside a multi-workflow asset template such as fix or behavior-lock\n  --suggestion <id>        Suggestion id such as template-model-verifier or template-blocked-triage\n  --decision <decision>    For review-suggestion: accept|reject|defer\n  --save-template <name>   Save a draft/scaffold as .dna/templates/<name>.dna.yaml for human review and asset inspection\n  --project-dir <path>     Read/write workflow assets in another project directory\n  --force                  Overwrite an existing saved workflow asset draft\n  --operation <op>         Optional override; otherwise auto-chosen from the instruction\n  --target-step <id>       Optional override; otherwise auto-chosen from the edit\n  --role <role>            Optional override; otherwise auto-chosen/defaulted from the edit\n\nExamples:\n  dna workflow examples\n  dna workflow authoring-packet "Create a code review workflow" --json\n  dna workflow intake "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence" --org --name "Project Admin" --project "Mobile Rewrite" --sync-target codex\n  dna workflow suggestions ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow mine ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow draft "Rewrite module with logic equivalence" --example rewrite_governance --strictness high  # scaffold fallback only\n  dna workflow draft "Rewrite module with logic equivalence" --save-template team-rewrite-flow  # scaffold fallback only\n  dna workflow edit-plan "Add equivalence verifier after rewrite" --from-template team-rewrite-flow --save-template team-rewrite-flow-v2\n  dna workflow review-suggestion --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --decision accept\n  dna workflow improve-from-suggestions --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --save-template ${WORKFLOW_ASSET_IDS.default}-v2\n  dna workflow from-candidate extract-diagnosis-review-${WORKFLOW_ASSET_IDS.default} --from-template ${WORKFLOW_ASSET_IDS.default} --save-template ${WORKFLOW_ASSET_IDS.rewriteDiagnosisReview}\n`,
+    org: `Usage: dna org <intake|configure-plan|route|rollout|init|bind|status|review|receipt> [description] [options]\n\nSubcommands:\n  intake [description]     Plan organization/project setup and asset binding without writing files\n  configure-plan           List explicit dna init commands for declared assets missing project config\n  route                    Show the organization operating route and rollout readiness without syncing\n  rollout                  Review sync/downstream rollout readiness without syncing (alias-compatible with route)\n  init                     Create local .dna/org.yaml with organization/project bindings\n  bind                     Add or update a workflow asset binding for a project\n  status                   Show local organization, projects, assets, sync targets, and evidence totals\n  review                   Show manager-facing gaps and next actions\n  receipt                  Emit intentdna.org_review_receipt.v1 from local org review and rollout data\n\nOptions:\n  --name <organization>    Organization name for intake or init\n  --project <project>      Project name/id for intake, init, or bind\n  --asset <asset>          Bind a workflow asset such as ${WORKFLOW_ASSET_IDS.default}\n  --status <status>        planned|active|paused for org bind (default planned)\n  --sync-target <target>   Declare a target such as codex or claude\n  --project-dir <path>     Read/write organization state in a different project directory\n  --apply                  For configure-plan only: create missing .dna/configs from declared assets\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - org receipt is local projection evidence only; cloud_authority=false\n  - internal_ready candidates are adoption candidates, not org-private SaaS visibility\n  - No online org auth, permissions, backend persistence, or cloud storage is implied\n\nExamples:\n  dna org intake "Mobile rewrite team" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n  dna org configure-plan\n  dna org configure-plan --apply\n  dna org route\n  dna org rollout\n  dna org receipt --json\n  dna org init --name "My Org" --project "Mobile Rewrite" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n  dna org bind --asset team-rewrite-flow-v2 --status active --sync-target codex\n  dna org review\n`,
+    release: `Usage: dna release <deploy-plan|evidence> [files...] [--json]\n\nSubcommands:\n  deploy-plan              Read changed files and decide whether Vercel and/or Supabase release verification is required\n  evidence                 Record deploy-plan, deployed URL, checked routes, and cloud checks as intentdna.release_evidence.v1\n\nOptions:\n  --json                   Print JSON to stdout\n  --output <path>          For evidence: write release evidence JSON (default .dna/release/latest-release-evidence.json)\n  --deployment-url <url>   For evidence: deployed URL captured from Vercel CLI stdout when web routes changed\n  --checked-route <route>  For evidence: route verified on the deployed URL (repeatable or comma-separated)\n  --checked-cloud-check <id> For evidence: cloud check completed, such as cloud-contract-check or cloud-edge-check (repeatable or comma-separated)\n  --dry-run                For evidence: do not write the evidence file\n\nBoundaries:\n  - CLI/core/runtime/docs/wiki changes do not require Vercel deployment by themselves\n  - Web/public surfaces require Vercel CLI deploy only when reviewers or users need a deployed URL\n  - Supabase SaaS surfaces require cloud contract, Edge Function, deploy-plan, remote secret-name presence, Vercel public env presence, function health, and live ingest-smoke evidence before production release claims\n  - Deployment is separate from org rollout and runtime sync\n  - A web deploy is not complete until the deployed URL is opened or fetched and verified\n  - A cloud deploy is not complete until Supabase migrations/functions/secrets, Vercel public env presence, and ingestion smoke evidence are recorded\n  - Release evidence records supplied checks; it does not run build, deploy, URL verification, Supabase commands, sync, or policy enforcement\n\nExamples:\n  dna release deploy-plan\n  dna release deploy-plan apps/online/src/main.ts\n  dna release deploy-plan src/cli/index.ts --json\n  dna release deploy-plan supabase/functions/ingest-report/index.ts --json\n  dna release evidence apps/online/src/main.ts --deployment-url https://intentdna.vercel.app --checked-route / --checked-route '/?mode=public' --checked-route '/?mode=public&embed=1' --checked-route /runtime --checked-route /templates --checked-route /readiness --json\n  dna release evidence supabase/functions/ingest-report/index.ts --checked-cloud-check cloud-contract-check --checked-cloud-check cloud-edge-check --checked-cloud-check cloud-deploy-plan --checked-cloud-check cloud-function-health --checked-cloud-check cloud-secrets-check --checked-cloud-check cloud-vercel-env-check --checked-cloud-check cloud-ingest-smoke --json\n`,
+    auth: `Usage: dna auth status [--auth-config-dir <dir>] [--json]\n       dna auth token set <token> [--auth-config-dir <dir>] [--json]\n       dna auth token clear [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt status [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt set <jwt> [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt clear [--auth-config-dir <dir>] [--json]\n       dna auth bootstrap-account [--org <name>] [--project <name>] [options]\n       dna auth onboard [--project-id <id>] [options]\n       dna auth issue-token --project-id <id> [options]\n       dna auth projects [options]\n       dna auth tokens list [options]\n       dna auth tokens revoke <token-id> [--yes] [options]\n\nSubcommands:\n  status                   Show local CLI API token status without network validation\n  token set <token>        Store a CLI API token in user config outside the project repository\n  token clear              Remove the stored CLI API token; idempotent if already absent\n  user-jwt status          Show local Supabase user JWT account bridge status without network validation\n  user-jwt set <jwt>       Store a Supabase user JWT for account onboarding commands outside the project repository\n  user-jwt clear           Remove the stored Supabase user JWT; idempotent if already absent\n  bootstrap-account        Create/reuse Supabase account org/project with a user JWT; token issuance remains dna auth onboard\n  onboard                  Discover account projects, select one safely, issue a CLI API token, and store it locally\n  issue-token              Call Supabase issue-api-token with a user JWT and store the issued CLI token\n  projects                 Call Supabase list-projects with a user JWT for account onboarding projection\n  tokens list              Call Supabase manage-api-tokens to list API token metadata only\n  tokens revoke <token-id> Revoke an API token after explicit --yes confirmation\n\nOptions:\n  --org <name>             Organization name for account bootstrap\n  --project <name>         Project name for account bootstrap\n  --org-slug <slug>        Optional organization slug for account bootstrap\n  --project-slug <slug>    Optional project slug for account bootstrap\n  --project-hint <path>    Optional local project hint stored as account bootstrap metadata\n  --project-id <id>        Supabase projects.id for issue-token or token filtering\n  --organization-id <id>   Optional organization id to cross-check or filter\n  --token-id <id>          API token id for revoke or filtering\n  --include-revoked        Include revoked API token metadata in tokens list\n  --limit <n>              Maximum token summaries to request, capped at 100\n  --user-jwt <jwt>         Supabase user access token override; env or dna auth user-jwt set can also supply it\n  --endpoint <url>         Edge Function URL; defaults from INTENTDNA_CLOUD_URL\n  --auth-config-dir <dir>  Read/write CLI API token and user JWT config in a specific directory for isolated local checks\n  --token-name <name>      Display name for the issued CLI token\n  --scope <scope>          Requested scope; repeatable or comma-separated, defaults to report:ingest\n  --expires-at <iso>       Optional token expiry timestamp\n  --dry-run                Build the request without making a network call or storing a token\n  --yes                    Required before live dna auth tokens revoke mutates account auth state\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - CLI ingestion auth uses IntentDNA API tokens, not MCP authorization\n  - dna auth bootstrap-account is an onboarding mutation only; it does not issue CLI tokens, upload reports, publish templates, or run workflows\n  - dna auth onboard is a CLI onboarding convenience over projects plus issue-token; it does not guess between multiple projects\n  - Supabase user JWTs are account onboarding credentials for projects, issue-token, and token management; they are not CLI ingestion API tokens\n  - User JWTs are stored only by explicit dna auth user-jwt set and output uses masked previews only\n  - Token status is local until cloud token verification exists\n  - Raw tokens are not printed after set or issue-token; token list/revoke never prints raw tokens or token hashes\n  - Service role keys are server-only and rejected as CLI/user tokens when detected\n  - Auth state and account projections do not grant runtime allow/warn/block/validate authority\n\nExamples:\n  dna auth status --json\n  dna auth token set idna_example_token --json\n  dna auth token set idna_example_token --auth-config-dir /tmp/intentdna-auth --json\n  dna auth status --auth-config-dir /tmp/intentdna-auth --json\n  dna auth token clear --json\n  dna auth user-jwt status --json\n  dna auth user-jwt set eyJhbGciOi... --json\n  dna auth user-jwt clear --json\n  dna auth bootstrap-account --org "My Org" --project "IntentDNA" --dry-run --json\n  dna auth bootstrap-account --org "My Org" --project "IntentDNA" --json\n  dna auth onboard --dry-run --json\n  dna auth onboard --project-id 00000000-0000-4000-8000-000000000000 --json\n  dna auth issue-token --project-id 00000000-0000-4000-8000-000000000000 --dry-run --json\n  dna auth issue-token --project-id 00000000-0000-4000-8000-000000000000 --token-name "Laptop CLI" --json\n  dna auth projects --dry-run --json\n  dna auth tokens list --project-id 00000000-0000-4000-8000-000000000000 --dry-run --json\n  dna auth tokens revoke token_123 --yes --json\n`,
+    report: `Usage: dna report <package|push|sign|verify|upload|receipts> [envelope-path] [--days <N>] [--session-id <id>] [--dna-id <id>] [--package <path>] [--output <path>] [--endpoint <url>] [--auth-config-dir <dir>] [--json] [--dry-run]\n\nSubcommands:\n  package                  Build and write a local intentdna.report_package.v1 evidence package\n  push                     Stage the same package into a local hidden-transport outbox envelope\n  sign                     Wrap an existing or freshly built package in intentdna.report_ingest_envelope.v1 with envelope_path\n  verify <envelope-path>   Verify a local signed envelope and emit intentdna.report_ingest_receipt.v1\n  upload <envelope-path>   Upload a verified signed envelope/package to cloud ingestion with a CLI API token\n  receipts                 List cloud receipt projections through Supabase user JWT account auth\n\nOptions:\n  --days <N>               Days to look back (default 7)\n  --session-id <id>        Filter evidence by session id\n  --dna-id <id>            Include DNA id for marker preview resolution\n  --include-marker-preview Include preview-only marker changes\n  --project-dir <path>     Read evidence from another project directory\n  --package <path>         For sign: existing intentdna.report_package.v1 to wrap instead of rebuilding\n  --output <path>          Package output for package/push; envelope output for sign\n  --actor <id>             Local actor id recorded in the signed ingest envelope\n  --visibility <mode>      runtime-local|personal|internal for local projection metadata\n  --redaction-policy-version <id> Local redaction policy version recorded in the envelope\n  --endpoint <url>         For push: future metadata only; upload/receipts Edge Function endpoint override\n  --auth-config-dir <dir>  Read CLI API token/user JWT config from a specific directory for isolated local upload/receipt checks\n  --user-jwt <jwt>         For receipts: Supabase user access token override\n  --organization-id <id>   For receipts: optional organization filter/cross-check\n  --project-id <id>        For receipts: required Supabase project id\n  --status <status>        For receipts: verified|pending|rejected\n  --limit <n>              For receipts: maximum receipt summaries to request, capped at 100\n  --dry-run                Preview package/push/sign/upload/receipts without writing upload network state; upload/receipts dry-run performs no network request\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - dna report package/push/sign/verify/upload/receipts does not execute workflows or enforce policy\n  - push stages a local outbox envelope only; network_performed is always false in this lane\n  - sign and verify are local verifier trust evidence only, not cloud trusted ingestion\n  - upload sends signed evidence to cloud ingestion, but runtime_authority remains false\n  - receipts lists read-only account projections with a Supabase user JWT; it does not upload reports or read storage object contents\n  - Report upload uses IntentDNA CLI API tokens; receipt listing uses Supabase user JWT account credentials\n  - Online may import/project packages and receipts later, but dna-hook remains runtime truth\n  - MCP remains hidden transport, not a visible product entry\n\nExamples:\n  dna report package\n  dna report package --days 1 --json\n  dna report push --dry-run --json\n  dna report push --endpoint https://example.com/api/intentdna/evidence\n  dna report sign --json\n  dna report verify "$(dna report sign --json | node -pe 'JSON.parse(require("fs").readFileSync(0,"utf8")).envelope_path')" --json\n  dna report sign --package .dna/reports/latest-report-package.json --output .dna/reports/ingest/local-envelope.json --json\n  dna report verify .dna/reports/ingest/local-envelope.json --json\n  dna report upload .dna/reports/ingest/local-envelope.json --json\n  dna report upload .dna/reports/ingest/local-envelope.json --endpoint https://example.supabase.co/functions/v1/ingest-report --auth-config-dir /tmp/intentdna-auth --dry-run --json\n  dna report receipts --project-id 00000000-0000-4000-8000-000000000000 --dry-run --json\n  dna report receipts --project-id 00000000-0000-4000-8000-000000000000 --status verified --limit 10 --json\n`,
+    guide: `Usage: dna guide [asset] [--asset <name>] [--name <org>] [--project <project>] [--goal <workflow>] [--sync-target <target>] [--brief] [--json]\n\nShows the current workflow governance route: organization setup, external-agent authoring/validated asset editing, asset governance, runtime sync, evidence review, and manager review.\n\nOptions:\n  --asset <name>           Focus the guide on a workflow asset (default prefers ${WORKFLOW_ASSET_IDS.default})\n  --name <org>             Organization/workspace name to use in suggested setup commands\n  --project <project>      Project name to use in suggested commands\n  --goal <workflow>        Natural-language workflow goal for intake/authoring-packet commands\n  --sync-target <target>   Runtime surface such as codex or claude for suggested commands\n  --project-dir <path>     Read organization state and project-local assets from another project directory\n  --brief                  Print the current stage, current command, checkpoints, and near next steps only\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - dna CLI/core/runtime owns product behavior and governance decisions\n  - Claude Code and Codex are runtime surfaces/adapters\n  - Dashboard is read-only projection\n  - Obsidian/wiki is internal project memory, not product runtime\n  - Web/public surface changes require Vercel CLI deploy + deployed URL verification\n`,
+    quickstart: `Usage: dna quickstart [asset] [--asset <name>] [--sync-target <target>] [--project-dir <path>] [--json]\n\nShows the shortest local route for getting value without Online or Supabase: choose a workflow asset, initialize local dna, preview sync, sync the harness, run in the harness, package/sign/verify local evidence, then inspect sync status.\n\nOptions:\n  --asset <name>           Workflow asset to start from (default prefers ${WORKFLOW_ASSET_IDS.default})\n  --sync-target <target>   Runtime surface such as codex or claude for suggested commands\n  --project-dir <path>     Read organization state and project-local assets from another project directory\n  --json                   Print a concise intentdna.local_quickstart.v1 packet\n\nBoundaries:\n  - quickstart is read-only guidance; it does not initialize, sync, run workflows, sign reports, upload reports, or deploy anything\n  - local dna/dna-hook remain runtime truth\n  - Online, marketplace, and Supabase do not execute workflows or make allow/warn/block/validate decisions\n  - MCP remains hidden transport\n`,
     context: `Usage: dna context <index|search|doc> [query|id] [files...]\n\nSubcommands:\n  index                    List explicitly declared planning-only advisory context sources\n  search <query>           Search source metadata\n  doc <id>                 Read a local file/doc source body\n`,
-    run: `Usage: dna run --dna <file> --workflow <name> --task <id> [options]\n\nOptions:\n  --dry-run                Print execution plan only\n  --permission-mode <mode> Claude permission mode (default: default)\n`,
+    run: `Usage: dna run --dna <file> --workflow <name> --task <id> [options]\n\nOptions:\n  --dry-run                Print execution plan only\n  --permission-mode <mode> Claude permission mode (default: default)\n  --project-dir <path>     Run and write project-scoped agents, IR, state, and logs in another project directory\n`,
     compile: `Usage: dna compile <files...> [--target claude-sdk] [--context <name>] [--output <path>] [--ir]\n`,
+    evolve: `Usage: dna evolve <dna-id> [--store-dir <path>] [--preview] [--apply]\n\nPreview self-evolution marker changes from recorded outcomes. This command is read-only; it never writes markers or runtime artifacts.\n\nOptions:\n  --store-dir <path>       Evolution store directory (default .dna/evolution)\n  --preview                Explicit preview flag; preview is the default behavior\n  --apply                  Rejected in this kernel; use reviewed dna sync --evolve for mutation\n\nRoute:\n  1. Record outcomes: dna epigenetic record <dna-id> --action <action> --genes <gene[,gene]> --feedback '[{\"gene\":\"quality\",\"effect\":\"helped\"}]'\n  2. Inspect outcomes: dna epigenetic summary <dna-id>\n  3. Preview marker changes: dna evolve <dna-id>\n  4. Mutate only after review: dna sync --evolve\n\nBoundaries:\n  - No outcomes means no evidence to evolve\n  - dna evolve is preview-only and does not create missing outcome or marker directories\n  - Marker mutation is allowed only through explicit reviewed sync/evolve gates\n`,
+    epigenetic: `Usage: dna epigenetic <record|summary|markers> <dna-id> [options]\n\nSubcommands:\n  record                   Record an execution outcome for self-evolution\n  summary                  Show outcome summary for a DNA id\n  markers                  Show persisted epigenetic markers\n\nOptions:\n  --store-dir <path>       Evolution store directory (default .dna/evolution)\n  --action <action>        Action name for record\n  --success                Mark record outcome as success (default true)\n  --genes <a,b>            Active genes for record\n  --feedback <json>        Constraint feedback JSON array\n  --json                   Print JSON for summary or markers\n\nExamples:\n  dna epigenetic record template_flutter_rewrite --action fix-loop --genes quality --feedback '[{\"gene\":\"quality\",\"effect\":\"helped\"}]'\n  dna epigenetic summary template_flutter_rewrite\n  dna epigenetic markers template_flutter_rewrite\n`,
     validate: `Usage: dna validate <files...> [--quiet]\n`,
     show: `Usage: dna show <files...> [--context <name>] [--json]\n`,
-    init: `Usage: dna init [--template <name>|--template list|--register <path>|--upgrade <name>]\n`,
+    init: `Usage: dna init [--template <name>|--template list|--register <path>|--upgrade <name>] [--project-dir <path>]\n`,
 };
 function commandHelp(command) {
     return command ? COMMAND_HELP[command] : undefined;
 }
+function authConfigDirOption(values) {
+    return values["auth-config-dir"] ?? values["config-dir"];
+}
+function unsupportedGlobalOption(args) {
+    return args.find((arg) => arg === "--cwd" || arg.startsWith("--cwd="));
+}
+function waitForDrain(stream) {
+    if (!stream.writableNeedDrain)
+        return Promise.resolve();
+    return new Promise((resolveDrain) => stream.once("drain", resolveDrain));
+}
+async function exitWith(code) {
+    process.exitCode = code;
+    await Promise.all([waitForDrain(process.stdout), waitForDrain(process.stderr)]);
+}
 async function main() {
     const args = process.argv.slice(2);
     const command = args[0];
@@ -94,23 +262,28 @@ async function main() {
     const help = helpText(version);
     if (command === "--version" || command === "-v") {
         process.stdout.write(`${version}\n`);
-        process.exit(0);
+        return exitWith(0);
     }
     if (!command || command === "--help" || command === "-h") {
         process.stderr.write(help);
-        process.exit(0);
+        return exitWith(0);
     }
     if (command === "help") {
         const commandSpecificHelp = commandHelp(args[1]);
         process.stderr.write(commandSpecificHelp ?? help);
-        process.exit(0);
+        return exitWith(0);
     }
     // Parse remaining args (after command)
     const rest = args.slice(1);
+    const unsupportedOption = unsupportedGlobalOption(rest);
+    if (unsupportedOption) {
+        process.stderr.write(`Error: ${unsupportedOption} is not a supported dna option. Run dna from the target directory, or use --project-dir where the command supports it.\n`);
+        return exitWith(2);
+    }
     if (rest.includes("--help") || rest.includes("-h")) {
         const commandSpecificHelp = commandHelp(command);
         process.stderr.write(commandSpecificHelp ?? help);
-        process.exit(commandSpecificHelp ? 0 : 2);
+        return exitWith(commandSpecificHelp ? 0 : 2);
     }
     switch (command) {
         case "sync": {
@@ -129,24 +302,39 @@ async function main() {
                     "workflow-name": { type: "string" },
                     skills: { type: "string" },
                     settings: { type: "string" },
+                    codex: { type: "boolean", default: false },
+                    "codex-install-mode": { type: "string", default: "project_fallback" },
+                    "codex-dogfood": { type: "boolean", default: false },
                     lock: { type: "string", default: ".dna/lock" },
                     remove: { type: "boolean", default: false },
                     mode: { type: "string", default: "auto" },
                     plugin: { type: "boolean" },
                     "dry-run": { type: "boolean", default: false },
                     "post-summary": { type: "boolean", default: false },
+                    "project-dir": { type: "string" },
+                    json: { type: "boolean", default: false },
                 },
                 allowPositionals: true,
                 strict: false,
             });
+            const syncSubcommands = new Set(["status", "doctor", "remove"]);
+            const syncAction = syncSubcommands.has(positionals[0] ?? "")
+                ? positionals.shift()
+                : undefined;
             const mode = values.mode;
             if (!["auto", "plugin", "bin"].includes(mode)) {
                 process.stderr.write(`Error: --mode must be one of: auto, plugin, bin\n`);
-                process.exit(2);
+                return exitWith(2);
+            }
+            const codexInstallMode = values["codex-install-mode"];
+            if (!["plugin_scoped", "project_fallback", "managed", "none"].includes(codexInstallMode)) {
+                process.stderr.write(`Error: --codex-install-mode must be one of: plugin_scoped, project_fallback, managed, none\n`);
+                return exitWith(2);
             }
             const { runSync } = await import("./commands/sync.js");
             const code = await runSync({
                 files: positionals,
+                action: syncAction === "remove" ? "remove-registry" : syncAction,
                 target: values.target,
                 inject: values.inject,
                 context: values.context,
@@ -160,13 +348,18 @@ async function main() {
                 skillsDir: values.skills,
                 settingsPath: values.settings,
                 lockFile: values.lock,
+                codex: values.codex,
+                codexInstallMode: codexInstallMode,
+                codexDogfood: values["codex-dogfood"],
                 remove: values.remove,
                 mode: mode,
                 plugin: values.plugin,
                 dryRun: values["dry-run"],
                 postSummary: values["post-summary"],
+                projectDir: values["project-dir"],
+                json: values.json,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "verify": {
@@ -188,7 +381,7 @@ async function main() {
                 health: verifyValues.health,
                 strict: verifyValues.strict,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "run": {
@@ -206,6 +399,7 @@ async function main() {
                     "permission-mode": { type: "string" },
                     agents: { type: "string" },
                     hooks: { type: "string" },
+                    "project-dir": { type: "string" },
                 },
                 allowPositionals: true,
                 strict: false,
@@ -234,8 +428,9 @@ async function main() {
                 permissionMode: runValues["permission-mode"],
                 agentsDir: runValues.agents,
                 hooksDir: runValues.hooks,
+                projectDir: runValues["project-dir"],
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "import": {
@@ -254,7 +449,7 @@ async function main() {
                 output: importValues.output,
                 format: importValues.format ?? "yaml",
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "validate": {
@@ -271,7 +466,7 @@ async function main() {
                 files: positionals,
                 quiet: values.quiet,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "compile": {
@@ -294,7 +489,7 @@ async function main() {
                 output: values.output,
                 ir: values.ir,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "generate": {
@@ -313,7 +508,7 @@ async function main() {
                 output: genValues.output,
                 match: genValues.match,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "show": {
@@ -332,7 +527,7 @@ async function main() {
                 context: values.context,
                 json: values.json,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "init": {
@@ -345,6 +540,8 @@ async function main() {
                     template: { type: "string" },
                     register: { type: "string" },
                     upgrade: { type: "string" },
+                    "project-dir": { type: "string" },
+                    json: { type: "boolean", default: false },
                 },
                 allowPositionals: true,
                 strict: false,
@@ -357,8 +554,10 @@ async function main() {
                 template: values.template,
                 register: values.register,
                 upgrade: values.upgrade,
+                projectDir: values["project-dir"],
+                json: values.json,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "evolve": {
@@ -379,7 +578,7 @@ async function main() {
                 apply: values.apply,
                 storeDir: values["store-dir"],
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "epigenetic": {
@@ -410,7 +609,7 @@ async function main() {
                 feedback: epiValues.feedback,
                 json: epiValues.json,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "guard": {
@@ -427,14 +626,14 @@ async function main() {
             const guardLevel = guardValues.level;
             if (!["standard", "yolo", "strict"].includes(guardLevel)) {
                 process.stderr.write(`Error: unknown level '${guardLevel}'. Available: standard, yolo, strict\n`);
-                process.exit(2);
+                return exitWith(2);
             }
             const code = await runGuard({
                 level: guardLevel,
                 audit: guardValues.audit,
                 remove: guardValues.remove,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "setup": {
@@ -450,7 +649,7 @@ async function main() {
             const setupScope = setupValues.scope;
             if (setupScope !== "user" && setupScope !== "project") {
                 process.stderr.write(`Error: --scope must be 'user' or 'project', got '${setupScope}'\n`);
-                process.exit(2);
+                return exitWith(2);
             }
             const { runSetup } = await import("./commands/setup.js");
             const code = await runSetup({
@@ -458,7 +657,7 @@ async function main() {
                 yes: setupValues.yes,
                 upgrade: setupValues.upgrade,
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "context": {
@@ -477,7 +676,7 @@ async function main() {
                 id: subcommand === "doc" ? positionals[0] : undefined,
                 files: subcommand === "index" ? positionals : positionals.slice(1),
             });
-            process.exit(code);
+            return exitWith(code);
             break;
         }
         case "feedback": {
@@ -500,35 +699,503 @@ async function main() {
                 packageReport: fbValues.package,
                 dnaId: fbValues["dna-id"],
             });
-            process.exit(code);
+            return exitWith(code);
+            break;
+        }
+        case "report": {
+            const subcommand = rest[0] ?? "package";
+            if (subcommand !== "package" && subcommand !== "push" && subcommand !== "sign" && subcommand !== "verify" && subcommand !== "upload" && subcommand !== "receipts") {
+                process.stderr.write(COMMAND_HELP.report);
+                return exitWith(2);
+            }
+            const reportRest = rest.slice(1);
+            const { values: reportValues, positionals: reportPositionals } = parseArgs({
+                args: reportRest,
+                options: {
+                    days: { type: "string", short: "d", default: "7" },
+                    "session-id": { type: "string" },
+                    "dna-id": { type: "string" },
+                    "include-marker-preview": { type: "boolean", default: false },
+                    "project-dir": { type: "string" },
+                    package: { type: "string" },
+                    output: { type: "string", short: "o" },
+                    actor: { type: "string" },
+                    visibility: { type: "string" },
+                    "redaction-policy-version": { type: "string" },
+                    endpoint: { type: "string" },
+                    "auth-config-dir": { type: "string" },
+                    "config-dir": { type: "string" },
+                    "user-jwt": { type: "string" },
+                    "organization-id": { type: "string" },
+                    "project-id": { type: "string" },
+                    status: { type: "string" },
+                    limit: { type: "string" },
+                    json: { type: "boolean", default: false },
+                    "dry-run": { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const visibility = reportValues.visibility;
+            if (visibility && !["runtime-local", "personal", "internal"].includes(visibility)) {
+                process.stderr.write("Error: --visibility must be one of: runtime-local, personal, internal\n");
+                return exitWith(2);
+            }
+            const receiptStatus = reportValues.status;
+            if (receiptStatus && !["verified", "pending", "rejected"].includes(receiptStatus)) {
+                process.stderr.write("Error: --status must be one of: verified, pending, rejected\n");
+                return exitWith(2);
+            }
+            const { runReport } = await import("./commands/report.js");
+            const code = await runReport({
+                action: subcommand,
+                projectDir: reportValues["project-dir"],
+                days: parseInt(reportValues.days, 10) || 7,
+                sessionId: reportValues["session-id"],
+                dnaId: reportValues["dna-id"],
+                includeMarkerPreview: reportValues["include-marker-preview"],
+                output: reportValues.output,
+                packagePath: reportValues.package,
+                envelopePath: reportPositionals[0],
+                actor: reportValues.actor,
+                visibility: visibility,
+                redactionPolicyVersion: reportValues["redaction-policy-version"],
+                endpoint: reportValues.endpoint,
+                configDir: authConfigDirOption(reportValues),
+                userJwt: reportValues["user-jwt"],
+                organizationId: reportValues["organization-id"],
+                projectId: reportValues["project-id"],
+                status: receiptStatus,
+                limit: reportValues.limit ? parseInt(reportValues.limit, 10) : undefined,
+                json: reportValues.json,
+                dryRun: reportValues["dry-run"],
+            });
+            return exitWith(code);
             break;
         }
         case "templates": {
             const subcommand = rest[0] ?? "list";
-            const { runTemplatesDeploy, runTemplatesList, runTemplatesShow } = await import("./commands/templates.js");
+            const templateRest = rest.slice(1);
+            const { values: templateValues, positionals: templatePositionals } = parseArgs({
+                args: templateRest,
+                options: {
+                    json: { type: "boolean", default: false },
+                    "project-dir": { type: "string" },
+                    "source-dir": { type: "string", multiple: true },
+                    output: { type: "string", short: "o" },
+                    focus: { type: "string", default: "all" },
+                    candidate: { type: "boolean", default: false },
+                    "save-template": { type: "string" },
+                    org: { type: "string" },
+                    project: { type: "string" },
+                    template: { type: "string" },
+                    "publication-id": { type: "string" },
+                    reason: { type: "string" },
+                    receipt: { type: "string" },
+                    endpoint: { type: "string" },
+                    "auth-config-dir": { type: "string" },
+                    "config-dir": { type: "string" },
+                    "dry-run": { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runTemplatesDeploy, runTemplatesList, runTemplatesManage, runTemplatesMarketplace, runTemplatesPublications, runTemplatesPublish, runTemplatesRevoke, runTemplatesShow, runTemplatesSources } = await import("./commands/templates.js");
             if (subcommand === "list") {
-                const code = await runTemplatesList();
-                process.exit(code);
+                const code = await runTemplatesList({ projectDir: templateValues["project-dir"] });
+                return exitWith(code);
+            }
+            if (subcommand === "marketplace") {
+                const code = await runTemplatesMarketplace({
+                    projectDir: templateValues["project-dir"],
+                    output: templateValues.output,
+                    json: templateValues.json,
+                });
+                return exitWith(code);
+            }
+            if (subcommand === "manage") {
+                const code = await runTemplatesManage({
+                    name: templatePositionals[0],
+                    projectDir: templateValues["project-dir"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
+            }
+            if (subcommand === "sources") {
+                const focus = templateValues.focus;
+                if (!["all", "refresh", "gaps"].includes(focus)) {
+                    process.stderr.write("Error: --focus must be one of: all, refresh, gaps\n");
+                    return exitWith(2);
+                }
+                const code = await runTemplatesSources({
+                    sourceId: templatePositionals[0],
+                    projectDir: templateValues["project-dir"],
+                    sourceDirs: templateValues["source-dir"],
+                    focus: focus,
+                    candidate: templateValues.candidate,
+                    saveTemplate: templateValues["save-template"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
             }
             if (subcommand === "show") {
-                const code = await runTemplatesShow({ name: rest[1] ?? "" });
-                process.exit(code);
+                const code = await runTemplatesShow({
+                    name: templatePositionals[0] ?? "",
+                    projectDir: templateValues["project-dir"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
+            }
+            if (subcommand === "publish") {
+                const code = await runTemplatesPublish({
+                    org: templateValues.org,
+                    project: templateValues.project,
+                    template: templateValues.template,
+                    receipt: templateValues.receipt,
+                    endpoint: templateValues.endpoint,
+                    projectDir: templateValues["project-dir"],
+                    configDir: authConfigDirOption(templateValues),
+                    dryRun: templateValues["dry-run"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
+            }
+            if (subcommand === "publications") {
+                const code = await runTemplatesPublications({
+                    org: templateValues.org,
+                    project: templateValues.project,
+                    template: templateValues.template,
+                    endpoint: templateValues.endpoint,
+                    projectDir: templateValues["project-dir"],
+                    configDir: authConfigDirOption(templateValues),
+                    dryRun: templateValues["dry-run"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
+            }
+            if (subcommand === "revoke") {
+                const code = await runTemplatesRevoke({
+                    org: templateValues.org,
+                    project: templateValues.project,
+                    publicationId: templateValues["publication-id"],
+                    reason: templateValues.reason,
+                    endpoint: templateValues.endpoint,
+                    projectDir: templateValues["project-dir"],
+                    configDir: authConfigDirOption(templateValues),
+                    dryRun: templateValues["dry-run"],
+                    json: templateValues.json,
+                });
+                return exitWith(code);
             }
             if (subcommand === "deploy") {
                 const code = await runTemplatesDeploy();
-                process.exit(code);
+                return exitWith(code);
             }
             process.stderr.write(COMMAND_HELP.templates);
-            process.exit(2);
+            return exitWith(2);
+            break;
+        }
+        case "assets": {
+            const subcommand = rest[0] ?? "list";
+            const assetRest = rest.slice(1);
+            const { values: assetValues, positionals: assetPositionals } = parseArgs({
+                args: assetRest,
+                options: {
+                    evidence: { type: "boolean", default: false },
+                    "project-dir": { type: "string" },
+                    json: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runAssets } = await import("./commands/assets.js");
+            const code = await runAssets({
+                subcommand,
+                name: assetPositionals[0],
+                compareTo: assetPositionals[1],
+                evidence: assetValues.evidence,
+                projectDir: assetValues["project-dir"],
+                json: assetValues.json,
+            });
+            return exitWith(code);
+            break;
+        }
+        case "workflow": {
+            const subcommand = rest[0] ?? "draft";
+            const workflowRest = rest.slice(1);
+            const { values: workflowValues, positionals: workflowPositionals } = parseArgs({
+                args: workflowRest,
+                options: {
+                    example: { type: "string", default: "rewrite_governance" },
+                    strictness: { type: "string", default: "standard" },
+                    operation: { type: "string" },
+                    "target-step": { type: "string" },
+                    role: { type: "string" },
+                    suggestion: { type: "string" },
+                    decision: { type: "string" },
+                    workflow: { type: "string" },
+                    "from-template": { type: "string" },
+                    "save-template": { type: "string" },
+                    name: { type: "string" },
+                    project: { type: "string" },
+                    "sync-target": { type: "string" },
+                    "project-dir": { type: "string" },
+                    force: { type: "boolean", default: false },
+                    org: { type: "boolean", default: false },
+                    json: { type: "boolean", default: false },
+                    yaml: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runWorkflow } = await import("./commands/workflow.js");
+            const code = await runWorkflow({
+                subcommand,
+                goal: workflowPositionals.length > 0 ? workflowPositionals.join(" ") : undefined,
+                example: workflowValues.example,
+                strictness: workflowValues.strictness,
+                operation: workflowValues.operation,
+                targetStep: workflowValues["target-step"],
+                role: workflowValues.role,
+                suggestion: workflowValues.suggestion,
+                decision: workflowValues.decision,
+                workflow: workflowValues.workflow,
+                fromTemplate: workflowValues["from-template"],
+                saveTemplate: workflowValues["save-template"],
+                name: workflowValues.name,
+                project: workflowValues.project,
+                syncTarget: workflowValues["sync-target"],
+                projectDir: workflowValues["project-dir"],
+                force: workflowValues.force,
+                org: workflowValues.org,
+                json: workflowValues.json,
+                yaml: workflowValues.yaml,
+            });
+            return exitWith(code);
+            break;
+        }
+        case "org": {
+            const subcommand = rest[0] ?? "status";
+            const orgRest = rest.slice(1);
+            const { values: orgValues, positionals: orgPositionals } = parseArgs({
+                args: orgRest,
+                options: {
+                    name: { type: "string" },
+                    project: { type: "string" },
+                    asset: { type: "string" },
+                    status: { type: "string" },
+                    "sync-target": { type: "string" },
+                    "project-dir": { type: "string" },
+                    apply: { type: "boolean", default: false },
+                    json: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runOrg } = await import("./commands/org.js");
+            const code = await runOrg({
+                subcommand,
+                description: orgPositionals.join(" "),
+                name: orgValues.name,
+                project: orgValues.project,
+                asset: orgValues.asset,
+                status: orgValues.status,
+                syncTarget: orgValues["sync-target"],
+                projectDir: orgValues["project-dir"],
+                apply: orgValues.apply,
+                json: orgValues.json,
+            });
+            return exitWith(code);
+            break;
+        }
+        case "quickstart":
+        case "guide": {
+            const { values: guideValues, positionals: guidePositionals } = parseArgs({
+                args: rest,
+                options: {
+                    asset: { type: "string" },
+                    name: { type: "string" },
+                    project: { type: "string" },
+                    goal: { type: "string" },
+                    "sync-target": { type: "string" },
+                    "project-dir": { type: "string" },
+                    brief: { type: "boolean", default: false },
+                    json: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runGuide } = await import("./commands/guide.js");
+            const code = await runGuide({
+                asset: guideValues.asset ?? guidePositionals[0],
+                name: guideValues.name,
+                project: guideValues.project,
+                goal: guideValues.goal,
+                syncTarget: guideValues["sync-target"],
+                projectDir: guideValues["project-dir"],
+                brief: command === "quickstart" ? true : guideValues.brief,
+                json: guideValues.json,
+                quickstart: command === "quickstart",
+            });
+            return exitWith(code);
+            break;
+        }
+        case "release": {
+            const subcommand = rest[0] ?? "deploy-plan";
+            const releaseRest = rest.slice(1);
+            const { values: releaseValues, positionals: releasePositionals } = parseArgs({
+                args: releaseRest,
+                options: {
+                    json: { type: "boolean", default: false },
+                    output: { type: "string", short: "o" },
+                    "deployment-url": { type: "string" },
+                    "checked-route": { type: "string", multiple: true },
+                    "checked-cloud-check": { type: "string", multiple: true },
+                    "dry-run": { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runRelease } = await import("./commands/release.js");
+            const code = await runRelease({
+                subcommand,
+                files: releasePositionals,
+                json: releaseValues.json,
+                output: releaseValues.output,
+                deploymentUrl: releaseValues["deployment-url"],
+                checkedRoute: releaseValues["checked-route"],
+                checkedCloudCheck: releaseValues["checked-cloud-check"],
+                dryRun: releaseValues["dry-run"],
+            });
+            return exitWith(code);
+            break;
+        }
+        case "cloud": {
+            const subcommand = rest[0] ?? "status";
+            const cloudRest = rest.slice(1);
+            const { values: cloudValues } = parseArgs({
+                args: cloudRest,
+                options: {
+                    "admin-user-id": { type: "string" },
+                    "admin-email": { type: "string" },
+                    org: { type: "string" },
+                    project: { type: "string" },
+                    "project-hint": { type: "string" },
+                    "token-name": { type: "string" },
+                    "token-pepper": { type: "string" },
+                    "expires-at": { type: "string" },
+                    template: { type: "string" },
+                    receipt: { type: "string" },
+                    "secrets-check": { type: "string" },
+                    "vercel-env-check": { type: "string" },
+                    endpoint: { type: "string" },
+                    "auth-config-dir": { type: "string" },
+                    "config-dir": { type: "string" },
+                    "deployment-url": { type: "string" },
+                    output: { type: "string", short: "o" },
+                    "dry-run": { type: "boolean", default: false },
+                    yes: { type: "boolean", default: false },
+                    json: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runCloud } = await import("./commands/cloud.js");
+            const code = await runCloud({
+                subcommand,
+                json: cloudValues.json,
+                adminUserId: cloudValues["admin-user-id"],
+                adminEmail: cloudValues["admin-email"],
+                orgName: cloudValues.org,
+                projectName: cloudValues.project,
+                projectHint: cloudValues["project-hint"],
+                tokenName: cloudValues["token-name"],
+                tokenPepper: cloudValues["token-pepper"],
+                expiresAt: cloudValues["expires-at"],
+                templateName: cloudValues.template,
+                receiptPath: cloudValues.receipt,
+                secretsCheckPath: cloudValues["secrets-check"],
+                vercelEnvCheckPath: cloudValues["vercel-env-check"],
+                endpoint: cloudValues.endpoint,
+                configDir: authConfigDirOption(cloudValues),
+                deploymentUrl: cloudValues["deployment-url"],
+                output: cloudValues.output,
+                dryRun: cloudValues["dry-run"],
+                yes: cloudValues.yes,
+            });
+            return exitWith(code);
+            break;
+        }
+        case "auth": {
+            const subcommand = rest[0] ?? "status";
+            const hasTokenAction = subcommand === "token" || subcommand === "tokens";
+            const hasUserJwtAction = subcommand === "user-jwt";
+            const authRest = hasTokenAction || hasUserJwtAction ? rest.slice(2) : rest.slice(1);
+            const tokenAction = hasTokenAction ? rest[1] : undefined;
+            const userJwtAction = hasUserJwtAction ? rest[1] : undefined;
+            const { values: authValues, positionals: authPositionals } = parseArgs({
+                args: authRest,
+                options: {
+                    "user-jwt": { type: "string" },
+                    endpoint: { type: "string" },
+                    org: { type: "string" },
+                    project: { type: "string" },
+                    "org-slug": { type: "string" },
+                    "project-slug": { type: "string" },
+                    "project-hint": { type: "string" },
+                    "project-id": { type: "string" },
+                    "organization-id": { type: "string" },
+                    "token-id": { type: "string" },
+                    "token-name": { type: "string" },
+                    scope: { type: "string", multiple: true },
+                    "expires-at": { type: "string" },
+                    "include-revoked": { type: "boolean", default: false },
+                    limit: { type: "string" },
+                    "auth-config-dir": { type: "string" },
+                    "config-dir": { type: "string" },
+                    "dry-run": { type: "boolean", default: false },
+                    yes: { type: "boolean", default: false },
+                    json: { type: "boolean", default: false },
+                },
+                allowPositionals: true,
+                strict: false,
+            });
+            const { runAuth } = await import("./commands/auth.js");
+            const code = await runAuth({
+                subcommand,
+                tokenAction,
+                userJwtAction,
+                token: authPositionals[0],
+                tokenId: authValues["token-id"] ?? (subcommand === "tokens" ? authPositionals[0] : undefined),
+                userJwt: authValues["user-jwt"] ?? (subcommand === "user-jwt" ? authPositionals[0] : undefined),
+                endpoint: authValues.endpoint,
+                orgName: authValues.org,
+                projectName: authValues.project,
+                orgSlug: authValues["org-slug"],
+                projectSlug: authValues["project-slug"],
+                projectHint: authValues["project-hint"],
+                projectId: authValues["project-id"],
+                organizationId: authValues["organization-id"],
+                tokenName: authValues["token-name"],
+                scopes: authValues.scope,
+                expiresAt: authValues["expires-at"],
+                includeRevoked: authValues["include-revoked"],
+                limit: authValues.limit ? Number(authValues.limit) : undefined,
+                configDir: authConfigDirOption(authValues),
+                dryRun: authValues["dry-run"],
+                yes: authValues.yes,
+                json: authValues.json,
+            });
+            return exitWith(code);
             break;
         }
         default:
             process.stderr.write(`Unknown command: ${command}\n\n`);
             process.stderr.write(help);
-            process.exit(2);
+            return exitWith(2);
     }
 }
 main().catch((err) => {
     process.stderr.write(`Fatal: ${err instanceof Error ? err.message : String(err)}\n`);
-    process.exit(1);
+    return exitWith(1);
 });