maeve-cli 0.9.0

package/dist/index.js

@@ -0,0 +1,2328 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { pathToFileURL } from "url";
+import { Command } from "commander";
+
+// src/commands/analytics.ts
+import { writeFile } from "fs/promises";
+
+// src/analytics-schema.ts
+import { z } from "zod";
+var uuid = z.string().uuid();
+var analyticsDays = z.union([z.literal("all"), z.coerce.number().int().min(1).max(90)]);
+var titlePageSchema = z.object({
+  enabled: z.boolean(),
+  title: z.string().max(200).optional(),
+  description: z.string().max(1e3).optional()
+}).strict();
+var reportSectionsSchema = z.object({
+  demographics: z.boolean().optional(),
+  topPosts: z.boolean().optional()
+}).strict();
+var analyticsReportSchema = z.object({
+  integrationId: uuid.optional(),
+  integrationIds: z.array(uuid).min(1).max(20).optional(),
+  days: analyticsDays.optional(),
+  titlePage: titlePageSchema.optional(),
+  sections: reportSectionsSchema.optional()
+}).strict().refine((payload) => Boolean(payload.integrationId || payload.integrationIds?.length), {
+  message: "Report payload must include integrationId or integrationIds."
+}).refine((payload) => new Set(payload.integrationIds ?? []).size === (payload.integrationIds ?? []).length, {
+  message: "integrationIds must be unique."
+});
+
+// src/client.ts
+import { createReadStream } from "fs";
+import { basename } from "path";
+
+// src/credentials.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+function getCredentialFilePath(env = process.env, platform = process.platform) {
+  const override = env.MAEVE_CLI_AUTH_FILE ?? env.EZIBREEZY_CLI_AUTH_FILE;
+  if (override) return override;
+  if (platform === "win32") {
+    return join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "Maeve", "cli-auth.json");
+  }
+  if (platform === "darwin") {
+    return join(homedir(), "Library", "Application Support", "Maeve", "cli-auth.json");
+  }
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "maeve", "cli-auth.json");
+}
+function getLegacyCredentialFilePath(env = process.env, platform = process.platform) {
+  if (env.MAEVE_CLI_AUTH_FILE ?? env.EZIBREEZY_CLI_AUTH_FILE) return void 0;
+  if (platform === "win32") {
+    return join(env.APPDATA || join(homedir(), "AppData", "Roaming"), "EziBreezy", "cli-auth.json");
+  }
+  if (platform === "darwin") {
+    return join(homedir(), "Library", "Application Support", "EziBreezy", "cli-auth.json");
+  }
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "ezibreezy", "cli-auth.json");
+}
+function migrateLegacyCredentialFile(env = process.env, platform = process.platform) {
+  const legacyPath = getLegacyCredentialFilePath(env, platform);
+  if (!legacyPath) return;
+  const targetPath = getCredentialFilePath(env, platform);
+  if (targetPath === legacyPath) return;
+  if (existsSync(targetPath) || !existsSync(legacyPath)) return;
+  try {
+    mkdirSync(dirname(targetPath), { recursive: true });
+    writeFileSync(targetPath, readFileSync(legacyPath, "utf8"), { mode: 384 });
+    restrictCredentialFilePermissions(targetPath);
+    rmSync(legacyPath, { force: true });
+  } catch {
+  }
+}
+function readCredentialFile(filePath = getCredentialFilePath()) {
+  if (!existsSync(filePath)) return { profiles: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, "utf8"));
+    return { profiles: parsed.profiles && typeof parsed.profiles === "object" ? parsed.profiles : {} };
+  } catch {
+    return { profiles: {} };
+  }
+}
+function getStoredCredential(apiUrl, filePath = getCredentialFilePath()) {
+  return readCredentialFile(filePath).profiles[apiUrl];
+}
+function writeStoredCredential(apiUrl, credential, filePath = getCredentialFilePath()) {
+  const existing = readCredentialFile(filePath);
+  const next = {
+    profiles: {
+      ...existing.profiles,
+      [apiUrl]: credential
+    }
+  };
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  restrictCredentialFilePermissions(filePath);
+}
+function deleteStoredCredential(apiUrl, filePath = getCredentialFilePath()) {
+  const existing = readCredentialFile(filePath);
+  if (!existing.profiles[apiUrl]) return false;
+  delete existing.profiles[apiUrl];
+  const hasProfiles = Object.keys(existing.profiles).length > 0;
+  if (!hasProfiles) {
+    rmSync(filePath, { force: true });
+    return true;
+  }
+  writeFileSync(filePath, `${JSON.stringify(existing, null, 2)}
+`, { mode: 384 });
+  restrictCredentialFilePermissions(filePath);
+  return true;
+}
+function restrictCredentialFilePermissions(filePath) {
+  if (process.platform === "win32") return;
+  try {
+    chmodSync(filePath, 384);
+  } catch {
+  }
+}
+
+// src/output.ts
+import { ZodError } from "zod";
+var CliError = class extends Error {
+  code;
+  status;
+  details;
+  constructor(message, options = {}) {
+    super(message);
+    this.name = "CliError";
+    this.code = options.code ?? "CLI_ERROR";
+    this.status = options.status;
+    this.details = options.details;
+  }
+};
+var SENSITIVE_KEY_PATTERN = /(?:api[-_]?key|access[-_]?token|refresh[-_]?token|id[-_]?token|client[-_]?secret|secret|password|authorization|cookie|set-cookie)/i;
+var API_KEY_VALUE_PATTERN = /\bezb_(?:live|test)_[A-Za-z0-9._-]+/g;
+var CLI_TOKEN_VALUE_PATTERN = /\bezb_cli_[A-Za-z0-9._~+/=-]+/g;
+var BEARER_VALUE_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+function redactString(value) {
+  return value.replace(API_KEY_VALUE_PATTERN, "[redacted-api-key]").replace(CLI_TOKEN_VALUE_PATTERN, "[redacted-cli-token]").replace(BEARER_VALUE_PATTERN, "Bearer [redacted]");
+}
+function sanitizeForOutput(value) {
+  if (typeof value === "string") return redactString(value);
+  if (Array.isArray(value)) return value.map((item) => sanitizeForOutput(item));
+  if (!value || typeof value !== "object") return value;
+  const sanitized = {};
+  for (const [key, nestedValue] of Object.entries(value)) {
+    sanitized[key] = SENSITIVE_KEY_PATTERN.test(key) ? "[redacted]" : sanitizeForOutput(nestedValue);
+  }
+  return sanitized;
+}
+function writeJson(data, meta = null) {
+  process.stdout.write(`${JSON.stringify({ data, meta }, null, 2)}
+`);
+}
+function writeRawJson(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function formatError(error) {
+  if (error instanceof CliError) {
+    return {
+      error: {
+        code: error.code,
+        message: redactString(error.message),
+        ...error.status ? { status: error.status } : {},
+        ...error.details !== void 0 ? { details: sanitizeForOutput(error.details) } : {}
+      }
+    };
+  }
+  if (error instanceof ZodError) {
+    return {
+      error: {
+        code: "VALIDATION_ERROR",
+        message: "Input validation failed.",
+        details: error.issues
+      }
+    };
+  }
+  if (error instanceof Error) {
+    return {
+      error: {
+        code: "UNEXPECTED_ERROR",
+        message: redactString(error.message)
+      }
+    };
+  }
+  return {
+    error: {
+      code: "UNEXPECTED_ERROR",
+      message: "Unexpected error."
+    }
+  };
+}
+function writeError(error) {
+  process.stderr.write(`${JSON.stringify(formatError(error), null, 2)}
+`);
+}
+
+// src/config.ts
+var DEFAULT_API_URL = "https://api.maevesocial.com";
+function cleanBaseUrl(value) {
+  return value.replace(/\/+$/, "");
+}
+function resolveConfig(command, env = process.env) {
+  const options = command?.optsWithGlobals?.() ?? {};
+  const envApiUrl = env.MAEVE_API_URL ?? env.EZIBREEZY_API_URL;
+  const apiUrl = options.apiUrl || envApiUrl || DEFAULT_API_URL;
+  const namedEnvApiKey = options.apiKeyEnv ? env[options.apiKeyEnv] : void 0;
+  const defaultEnvApiKey = options.apiKeyEnv ? void 0 : env.MAEVE_API_KEY ?? env.EZIBREEZY_API_KEY;
+  const apiKey = options.apiKey || namedEnvApiKey || defaultEnvApiKey;
+  const cleanApiUrl = cleanBaseUrl(apiUrl);
+  const storedCredential = getStoredCredential(cleanApiUrl, getCredentialFilePath(env));
+  const storedExpiry = storedCredential ? new Date(storedCredential.expiresAt).getTime() : Number.NaN;
+  const storedCliLoginExpired = storedCredential ? !Number.isFinite(storedExpiry) || storedExpiry <= Date.now() : false;
+  const storedCliToken = !apiKey && storedCredential && !storedCliLoginExpired ? storedCredential.token : void 0;
+  const credentialSource = options.apiKey ? "flag_api_key" : namedEnvApiKey ? "named_env_api_key" : defaultEnvApiKey ? "env_api_key" : storedCliToken ? "stored_cli_login" : void 0;
+  const credentialType = credentialSource === "flag_api_key" || credentialSource === "named_env_api_key" || credentialSource === "env_api_key" ? "api_key" : credentialSource === "stored_cli_login" ? "cli_login" : void 0;
+  return {
+    apiUrl: cleanApiUrl,
+    apiKey,
+    bearerToken: apiKey || storedCliToken,
+    apiUrlSource: options.apiUrl ? "flag" : envApiUrl ? "env" : "default",
+    apiKeySource: options.apiKey ? "flag" : namedEnvApiKey ? "named_env" : defaultEnvApiKey ? "env" : void 0,
+    apiKeyEnvName: options.apiKeyEnv,
+    namedEnvApiKeyConfigured: Boolean(namedEnvApiKey),
+    credentialSource,
+    credentialType,
+    storedCliLoginConfigured: Boolean(storedCredential),
+    storedCliLoginExpired
+  };
+}
+function requireBearerCredential(config) {
+  const token = config.bearerToken || config.apiKey;
+  if (!token) {
+    if (config.apiKeyEnvName && !config.namedEnvApiKeyConfigured) {
+      throw new CliError(`Missing credentials. Environment variable ${config.apiKeyEnvName} is not set.`, {
+        code: "MISSING_CREDENTIALS"
+      });
+    }
+    throw new CliError(
+      "Missing credentials. Set MAEVE_API_KEY, pass --api-key-env <name>, pass --api-key, or run maeve auth:login.",
+      {
+        code: "MISSING_CREDENTIALS"
+      }
+    );
+  }
+  return token;
+}
+function addConnectionOptions(command) {
+  return command.option("--api-url <url>", "Maeve API base URL.").option("--api-key-env <name>", "Name of an environment variable containing a Maeve API key.").option("--api-key <key>", "Maeve API key. Prefer MAEVE_API_KEY for local shells.");
+}
+
+// src/client.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
+var DEFAULT_UPLOAD_TIMEOUT_MS = 15 * 6e4;
+var CLI_USER_AGENT = "maeve-cli";
+function appendQuery(url, query = {}) {
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null || value === "") continue;
+    if (Array.isArray(value)) {
+      for (const item of value) url.searchParams.append(key, item);
+      continue;
+    }
+    url.searchParams.set(key, String(value));
+  }
+}
+async function parseApiResponse(response) {
+  if (response.status === 204) return null;
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) {
+    return response.text();
+  }
+  return response.json();
+}
+function apiErrorMessage(payload, fallback) {
+  if (!payload || typeof payload !== "object") return fallback;
+  const source = payload;
+  if (typeof source.message === "string") return source.message;
+  if (Array.isArray(source.message)) return source.message.join(", ");
+  if (typeof source.error === "string") return source.error;
+  return fallback;
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError";
+}
+function filenameFromContentDisposition(value) {
+  if (!value) return void 0;
+  const encodedMatch = /filename\*=UTF-8''([^;]+)/i.exec(value);
+  if (encodedMatch?.[1]) return decodeURIComponent(encodedMatch[1].replace(/^"|"$/g, ""));
+  const match = /filename="?([^";]+)"?/i.exec(value);
+  return match?.[1];
+}
+function createApiClient(config, fetchImpl = fetch) {
+  const bearerToken = requireBearerCredential(config);
+  async function fetchWithTimeout(input, init, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      return await fetchImpl(input, {
+        ...init,
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (isAbortError(error)) {
+        throw new CliError(`Request timed out after ${timeoutMs}ms.`, {
+          code: "REQUEST_TIMEOUT",
+          details: { timeoutMs }
+        });
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async function request(method, path, options = {}) {
+    const url = new URL(path, `${config.apiUrl}/`);
+    appendQuery(url, options.query);
+    const response = await fetchWithTimeout(
+      url,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${bearerToken}`,
+          "User-Agent": CLI_USER_AGENT,
+          Accept: "application/json",
+          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {},
+          ...options.headers
+        },
+        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+      },
+      options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS
+    );
+    const payload = await parseApiResponse(response);
+    if (!response.ok) {
+      throw new CliError(apiErrorMessage(payload, `API request failed with status ${response.status}.`), {
+        code: "API_ERROR",
+        status: response.status,
+        details: payload
+      });
+    }
+    return payload;
+  }
+  async function download(method, path, options = {}) {
+    const url = new URL(path, `${config.apiUrl}/`);
+    appendQuery(url, options.query);
+    const response = await fetchWithTimeout(
+      url,
+      {
+        method,
+        headers: {
+          Authorization: `Bearer ${bearerToken}`,
+          "User-Agent": CLI_USER_AGENT,
+          Accept: "application/pdf",
+          ...options.body !== void 0 ? { "Content-Type": "application/json" } : {},
+          ...options.headers
+        },
+        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+      },
+      options.timeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS
+    );
+    if (!response.ok) {
+      const payload = await parseApiResponse(response);
+      throw new CliError(apiErrorMessage(payload, `API request failed with status ${response.status}.`), {
+        code: "API_ERROR",
+        status: response.status,
+        details: payload
+      });
+    }
+    return {
+      body: Buffer.from(await response.arrayBuffer()),
+      contentType: response.headers.get("content-type") ?? "application/octet-stream",
+      filename: filenameFromContentDisposition(response.headers.get("content-disposition"))
+    };
+  }
+  async function uploadFile(path, filePath, contentType, fileSize, body, uploadTimeoutMs = DEFAULT_UPLOAD_TIMEOUT_MS) {
+    const upload = await request("POST", path, { body });
+    const uploadInit = {
+      method: "PUT",
+      headers: {
+        "Content-Type": contentType,
+        "Content-Length": String(fileSize)
+      },
+      body: createReadStream(filePath),
+      duplex: "half"
+    };
+    const response = await fetchWithTimeout(upload.data.uploadUrl, uploadInit, uploadTimeoutMs);
+    if (!response.ok) {
+      const payload = await parseApiResponse(response);
+      throw new CliError(apiErrorMessage(payload, `File upload failed with status ${response.status}.`), {
+        code: "UPLOAD_ERROR",
+        status: response.status,
+        details: payload
+      });
+    }
+    return request("POST", `${path}/${upload.data.sessionId}/complete`, {
+      body: {}
+    });
+  }
+  return { request, download, uploadFile };
+}
+
+// src/files.ts
+import { readFile, stat } from "fs/promises";
+import { extname } from "path";
+var CONTENT_TYPES = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".mp4": "video/mp4",
+  ".mov": "video/quicktime"
+};
+async function readJsonFile(filePath) {
+  try {
+    return JSON.parse(await readFile(filePath, "utf8"));
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      throw new CliError(`Invalid JSON file: ${filePath}`, { code: "INVALID_JSON" });
+    }
+    throw error;
+  }
+}
+async function getUploadFileInfo(filePath) {
+  const extension = extname(filePath).toLowerCase();
+  const contentType = CONTENT_TYPES[extension];
+  if (!contentType) {
+    throw new CliError(`Unsupported upload file type: ${extension || "unknown"}`, {
+      code: "UNSUPPORTED_FILE_TYPE",
+      details: { supportedExtensions: Object.keys(CONTENT_TYPES) }
+    });
+  }
+  const file = await stat(filePath);
+  if (!file.isFile()) {
+    throw new CliError(`Upload path is not a file: ${filePath}`, { code: "INVALID_FILE" });
+  }
+  return {
+    filename: filePath.split(/[\\/]/).pop() ?? filePath,
+    contentType,
+    fileSize: file.size
+  };
+}
+
+// src/commands/analytics.ts
+function registerAnalyticsCommands(program) {
+  addConnectionOptions(program.command("analytics:summary")).description("Fetch analytics summary for a workspace or one integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--days <range>", "Analytics lookback window: 1-90 or all.", "30").option("--integration <id>", "Integration ID. Uses account analytics instead of aggregate analytics.").option("--integration-ids <ids>", "Comma-separated integration IDs for aggregate analytics.").action(async (options, command) => {
+    if (options.integration && options.integrationIds) {
+      throw new CliError("Use either --integration or --integration-ids, not both.", { code: "INVALID_OPTIONS" });
+    }
+    const client = createApiClient(resolveConfig(command));
+    const path = options.integration ? `/v1/workspaces/${options.workspace}/analytics` : `/v1/workspaces/${options.workspace}/analytics/aggregate`;
+    writeRawJson(
+      await client.request("GET", path, {
+        query: {
+          days: options.days,
+          integrationId: options.integration,
+          integrationIds: options.integrationIds
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("analytics:health")).description("Fetch analytics health for an integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--integration <id>", "Integration ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/analytics/health`, {
+        query: { integrationId: options.integration }
+      })
+    );
+  });
+  addConnectionOptions(program.command("analytics:posts")).description("List post analytics for an integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--integration <id>", "Integration ID.").option("--limit <number>", "Page size.").option("--offset <number>", "Page offset.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/analytics/posts`, {
+        query: {
+          integrationId: options.integration,
+          limit: options.limit,
+          offset: options.offset
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("analytics:posts-aggregate")).description("List aggregated post analytics for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--days <range>", "Analytics lookback window: 1-90 or all.", "30").option("--integration-ids <ids>", "Comma-separated integration IDs to include.").option("--limit <number>", "Page size.").option("--offset <number>", "Page offset.").option("--sort-by <field>", "Sort field: recent, engagement, or views.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/analytics/posts/aggregate`, {
+        query: {
+          days: options.days,
+          integrationIds: options.integrationIds,
+          limit: options.limit,
+          offset: options.offset,
+          sortBy: options.sortBy
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("analytics:post")).description("Fetch analytics for a single published content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <postId>", "Published content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/analytics/posts/${options.id}`));
+  });
+  addConnectionOptions(program.command("analytics:demographics")).description("Fetch audience demographics for an integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--integration <id>", "Integration ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/analytics/demographics`, {
+        query: { integrationId: options.integration }
+      })
+    );
+  });
+  addConnectionOptions(program.command("analytics:report")).description("Generate an agency-plan analytics PDF report.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--provider <provider>", "Report provider: instagram, facebook, youtube, tiktok, pinterest, or threads.").requiredOption("--json <file>", "JSON file containing report integration IDs and report options.").requiredOption("--output <file>", "PDF output file.").option("--yes", "Confirm report generation.").action(
+    async (options, command) => {
+      if (!options.yes) {
+        throw new CliError("analytics:report requires --yes because PDF generation can be expensive.", {
+          code: "INVALID_OPTIONS"
+        });
+      }
+      const payload = analyticsReportSchema.parse(await readJsonFile(options.json));
+      const client = createApiClient(resolveConfig(command));
+      const report = await client.download(
+        "POST",
+        `/v1/workspaces/${options.workspace}/analytics/report/${options.provider}`,
+        { body: payload }
+      );
+      await writeFile(options.output, report.body);
+      writeJson({
+        output: options.output,
+        bytes: report.body.length,
+        contentType: report.contentType,
+        filename: report.filename ?? null
+      });
+    }
+  );
+}
+
+// src/commands/auth.ts
+import { spawn } from "child_process";
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function parseJsonResponse(response) {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json")) return response.text();
+  return response.json();
+}
+async function requestJson(apiUrl, path, body, bearerToken) {
+  const response = await fetch(new URL(path, `${apiUrl}/`), {
+    method: "POST",
+    headers: {
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      ...bearerToken ? { Authorization: `Bearer ${bearerToken}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+  const payload = await parseJsonResponse(response);
+  return { payload, response };
+}
+function deviceFlowError(payload) {
+  if (!payload || typeof payload !== "object") return {};
+  const source = payload;
+  if (source.error && typeof source.error === "object") return source.error;
+  return source;
+}
+function openBrowser(url) {
+  const command = process.platform === "win32" ? { file: process.env.ComSpec ?? "cmd.exe", args: ["/c", "start", '""', url] } : process.platform === "darwin" ? { file: "open", args: [url] } : { file: "xdg-open", args: [url] };
+  const child = spawn(command.file, command.args, {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true
+  });
+  child.unref();
+}
+async function login(command) {
+  const config = resolveConfig(command);
+  const { payload: device, response } = await requestJson(
+    config.apiUrl,
+    "/v1/cli-auth/device",
+    {
+      client_id: "maeve-cli"
+    }
+  );
+  if (!response.ok) {
+    const error = deviceFlowError(device);
+    throw new CliError(error.error_description || error.message || "Could not start CLI login.", {
+      code: error.error?.toUpperCase() || "CLI_LOGIN_FAILED",
+      status: response.status,
+      details: error
+    });
+  }
+  const options = command.opts();
+  process.stderr.write(`Open this URL to approve CLI login:
+${device.verification_uri_complete}
+
+`);
+  process.stderr.write(`User code: ${device.user_code}
+`);
+  if (options.browser !== false) {
+    try {
+      openBrowser(device.verification_uri_complete);
+    } catch {
+      process.stderr.write(`Could not open a browser automatically. Use the URL above.
+`);
+    }
+  }
+  let intervalSeconds = Math.max(0, Number(device.interval ?? 5));
+  const deadline = Date.now() + Number(device.expires_in ?? 600) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalSeconds * 1e3);
+    const { payload, response: tokenResponse } = await requestJson(
+      config.apiUrl,
+      "/v1/cli-auth/device/token",
+      {
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+        device_code: device.device_code,
+        client_id: "maeve-cli"
+      }
+    );
+    if (tokenResponse.ok) {
+      const token = payload;
+      const expiresAt = new Date(Date.now() + token.expires_in * 1e3).toISOString();
+      writeStoredCredential(config.apiUrl, {
+        authType: "cli_login",
+        token: token.access_token,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        expiresAt
+      });
+      writeJson({
+        apiUrl: config.apiUrl,
+        authType: "cli_login",
+        tokenType: token.token_type,
+        expiresAt
+      });
+      return;
+    }
+    const error = deviceFlowError(payload);
+    if (error.error === "authorization_pending") {
+      continue;
+    }
+    if (error.error === "slow_down") {
+      const retryAfter = Number(tokenResponse.headers.get("retry-after"));
+      intervalSeconds = Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : intervalSeconds + 5;
+      continue;
+    }
+    if (error.error === "access_denied") {
+      throw new CliError("CLI login was denied.", { code: "CLI_LOGIN_DENIED", status: tokenResponse.status });
+    }
+    if (error.error === "expired_token") {
+      throw new CliError("CLI login expired before it was approved.", {
+        code: "CLI_LOGIN_EXPIRED",
+        status: tokenResponse.status
+      });
+    }
+    throw new CliError(error.error_description || error.message || "CLI login failed.", {
+      code: error.error?.toUpperCase() || "CLI_LOGIN_FAILED",
+      status: tokenResponse.status,
+      details: error
+    });
+  }
+  throw new CliError("CLI login expired before it was approved.", { code: "CLI_LOGIN_EXPIRED" });
+}
+async function logout(command) {
+  const config = resolveConfig(command);
+  const filePath = getCredentialFilePath(process.env);
+  const storedCredential = getStoredCredential(config.apiUrl, filePath);
+  let serverRevoked = false;
+  if (storedCredential?.token) {
+    try {
+      const { response } = await requestJson(config.apiUrl, "/v1/cli-auth/logout", {}, storedCredential.token);
+      serverRevoked = response.ok || response.status === 401 || response.status === 403;
+    } catch {
+      serverRevoked = false;
+    }
+  }
+  const removed = deleteStoredCredential(config.apiUrl, filePath);
+  writeJson({
+    apiUrl: config.apiUrl,
+    removed,
+    serverRevoked
+  });
+}
+function registerAuthCommands(program) {
+  addConnectionOptions(program.command("auth:login")).description("Sign in locally with a browser-based CLI login.").option("--no-browser", "Print the verification URL without opening a browser.").action(async (_options, command) => {
+    await login(command);
+  });
+  addConnectionOptions(program.command("auth:logout")).description("Remove the stored CLI login token and revoke it server-side when possible.").action(async (_options, command) => {
+    await logout(command);
+  });
+  addConnectionOptions(program.command("auth:status")).description("Show non-secret CLI authentication status.").action((_options, command) => {
+    const config = resolveConfig(command);
+    writeJson({
+      apiUrl: config.apiUrl,
+      apiUrlSource: config.apiUrlSource,
+      flagApiKeyConfigured: config.apiKeySource === "flag",
+      envApiKeyConfigured: config.apiKeySource === "env",
+      namedEnvApiKeyConfigured: Boolean(config.namedEnvApiKeyConfigured),
+      apiKeyEnvName: config.apiKeyEnvName ?? null,
+      apiKeyConfigured: Boolean(config.apiKey),
+      apiKeySource: config.apiKeySource ?? null,
+      storedCliLoginConfigured: Boolean(config.storedCliLoginConfigured),
+      storedCliLoginExpired: Boolean(config.storedCliLoginExpired),
+      activeCredentialSource: config.credentialSource ?? null,
+      activeCredentialType: config.credentialType ?? null,
+      credentialFile: getCredentialFilePath(process.env)
+    });
+  });
+  addConnectionOptions(program.command("auth:whoami")).description("Show the current authenticated user and accessible workspaces.").action(async (_options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", "/v1/cli-auth/me"));
+  });
+}
+
+// src/approval-schema.ts
+import { z as z2 } from "zod";
+var uuid2 = z2.string().uuid();
+var nonEmptyString = z2.string().min(1);
+var nullableString = z2.string().nullable().optional();
+var approvalPolicy = z2.enum(["any", "all"]);
+var workflowMode = z2.enum(["client", "internal_client"]);
+var attachmentContentType = z2.enum(["image/jpeg", "image/png", "image/gif", "image/webp"]);
+var reviewLifecyclePhase = z2.enum(["none", "internal", "client"]);
+var reviewLifecycleState = z2.enum([
+  "none",
+  "internal_review_pending",
+  "internal_review_approved",
+  "internal_changes_requested",
+  "internal_review_withdrawn",
+  "waiting_internal_before_client",
+  "ready_to_send_to_client",
+  "client_review_active",
+  "client_review_outdated",
+  "client_changes_requested",
+  "client_review_approved",
+  "client_review_admin_overridden",
+  "client_review_cancelled",
+  "client_review_expired"
+]);
+var reviewLifecycleActor = z2.enum(["none", "agency", "author", "approver", "client", "system"]);
+var reviewLifecycleNextAction = z2.enum([
+  "none",
+  "request_internal_approval",
+  "complete_internal_review",
+  "address_internal_changes",
+  "send_to_client",
+  "notify_client",
+  "wait_for_client",
+  "address_client_changes",
+  "refresh_client_share",
+  "schedule",
+  "publish",
+  "set_intended_publish_time"
+]);
+var reviewLifecycleBlockerCode = z2.enum([
+  "missing_schedule",
+  "internal_approval_pending",
+  "internal_changes_requested",
+  "client_review_not_sent",
+  "client_review_pending",
+  "client_review_outdated",
+  "client_changes_requested",
+  "client_review_cancelled",
+  "client_review_expired",
+  "missing_review_snapshot",
+  "review_snapshot_hash_mismatch"
+]);
+var reviewLifecycleSharedVersionStatus = z2.enum([
+  "not_shared",
+  "current",
+  "stale",
+  "missing_snapshot",
+  "hash_mismatch"
+]);
+var clientReviewBatchStatus = z2.enum(["open", "waiting_internal", "pending", "completed", "expired", "cancelled"]);
+var clientReviewItemStatus = z2.enum(["pending", "approved", "changes_requested", "admin_overridden", "cancelled"]);
+var approvalRequestSchema = z2.object({
+  approverIds: z2.array(uuid2).min(1),
+  policy: approvalPolicy
+});
+var approvalDecisionSchema = z2.object({
+  decision: z2.enum(["approve", "reject"]),
+  override: z2.boolean().optional(),
+  reason: z2.string().max(2e3).optional()
+}).refine((payload) => !(payload.decision === "reject" || payload.override === true) || Boolean(payload.reason?.trim()), {
+  message: "reason is required when rejecting or using override."
+});
+var approvalCommentSchema = z2.object({
+  body: z2.string().max(2e3).optional(),
+  attachmentId: uuid2.optional()
+}).refine((payload) => Boolean(payload.body?.trim() || payload.attachmentId), {
+  message: "Comment payload must include body or attachmentId."
+});
+var approvalAttachmentInitSchema = z2.object({
+  contentId: uuid2,
+  batchId: uuid2.optional(),
+  audience: z2.enum(["internal", "client"]),
+  filename: nonEmptyString.max(255),
+  contentType: attachmentContentType,
+  fileSize: z2.number().int().min(1)
+});
+var approvalReactionSchema = z2.object({
+  emoji: nonEmptyString.max(16)
+});
+var clientReviewerSchema = z2.object({
+  name: nonEmptyString.max(255),
+  email: z2.string().email().max(320)
+});
+var clientReviewConfigSchema = z2.object({
+  reviewers: z2.array(clientReviewerSchema).min(1),
+  policy: approvalPolicy,
+  expiresAt: nullableString,
+  inviteNote: nullableString.refine((value) => value === void 0 || value === null || value.length <= 2e3, {
+    message: "inviteNote must be 2000 characters or fewer."
+  }),
+  batchLabel: nullableString.refine((value) => value === void 0 || value === null || value.length <= 255, {
+    message: "batchLabel must be 255 characters or fewer."
+  })
+});
+var internalReviewConfigSchema = z2.object({
+  approverIds: z2.array(uuid2).min(1),
+  policy: approvalPolicy
+});
+var clientReviewCreateSchema = z2.object({
+  contentIds: z2.array(uuid2).min(1),
+  workflowMode,
+  client: clientReviewConfigSchema,
+  internal: internalReviewConfigSchema.optional()
+}).refine((payload) => payload.workflowMode !== "internal_client" || Boolean(payload.internal), {
+  message: "internal is required when workflowMode is internal_client."
+});
+var clientReviewPostMutationSchema = z2.object({
+  contentId: uuid2
+});
+var clientReviewOverrideSchema = z2.object({
+  contentId: uuid2,
+  reason: nonEmptyString.max(2e3)
+});
+var clientReviewParticipantUpdateSchema = z2.object({
+  participantId: uuid2,
+  email: z2.string().email().max(320),
+  name: z2.string().max(255).optional()
+});
+var clientReviewCommentSchema = z2.object({
+  contentId: uuid2,
+  body: z2.string().max(2e3).optional(),
+  attachmentId: uuid2.optional()
+}).refine((payload) => Boolean(payload.body?.trim() || payload.attachmentId), {
+  message: "Comment payload must include body or attachmentId."
+});
+var reviewLifecycleSchema = z2.object({
+  phase: reviewLifecyclePhase,
+  state: reviewLifecycleState,
+  actor: reviewLifecycleActor,
+  nextAction: reviewLifecycleNextAction,
+  blocksPublishing: z2.boolean(),
+  blockers: z2.array(
+    z2.object({
+      code: reviewLifecycleBlockerCode,
+      message: z2.string().optional(),
+      details: z2.record(z2.string(), z2.unknown()).optional()
+    }).strict()
+  ),
+  progress: z2.object({
+    policy: approvalPolicy.nullable(),
+    requestedCount: z2.number().int().min(0),
+    approvedCount: z2.number().int().min(0),
+    changesRequestedCount: z2.number().int().min(0).optional()
+  }).strict().nullable().optional(),
+  clientReview: z2.object({
+    batchId: uuid2.nullable(),
+    itemId: uuid2.nullable(),
+    batchStatus: clientReviewBatchStatus.nullable(),
+    itemStatus: clientReviewItemStatus.nullable(),
+    isClientFacing: z2.boolean(),
+    sharedVersionStatus: reviewLifecycleSharedVersionStatus,
+    hasSentLinkBefore: z2.boolean().optional(),
+    readyForClientSend: z2.boolean().optional()
+  }).strict().nullable().optional(),
+  labels: z2.object({
+    phase: z2.string().optional(),
+    state: z2.string().optional(),
+    nextAction: z2.string().optional()
+  }).strict().optional()
+}).strict();
+var reviewLifecycleResponseSchema = z2.object({
+  reviewLifecycle: reviewLifecycleSchema.nullable().optional()
+}).passthrough();
+
+// src/commands/client-reviews.ts
+function registerClientReviewCommands(program) {
+  addConnectionOptions(program.command("client-reviews:create")).description("Create a client review batch. Requires agency plan and client review send capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the client review batch payload.").action(async (options, command) => {
+    const payload = clientReviewCreateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/client-review-batches`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:open")).description(
+    "List open client review batches that have not had links sent. Requires agency plan and client review read capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").option("--workflow-mode <mode>", "Workflow mode: client or internal_client.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/content/client-review-batches/open`, {
+        query: { workflowMode: options.workflowMode }
+      })
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:get")).description("Get one client review batch. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "GET",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}`
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:add-post")).description("Add content to an open client review batch. Requires agency plan and client review send capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").requiredOption("--json <file>", "JSON file containing contentId.").action(async (options, command) => {
+    const payload = clientReviewPostMutationSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/add-post`,
+        { body: payload }
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:remove-post")).description(
+    "Remove content from an open client review batch. Requires agency plan and client review send capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").requiredOption("--json <file>", "JSON file containing contentId.").action(async (options, command) => {
+    const payload = clientReviewPostMutationSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/remove-post`,
+        { body: payload }
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:send")).description(
+    "Send a client review batch. Requires agency plan and client review send capability; may notify reviewers."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").option("--yes", "Confirm reviewer notifications.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("client-reviews:send requires --yes because it may notify reviewers.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/send`
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:resend")).description(
+    "Resend a client review batch. Requires agency plan and client review send capability; may notify reviewers."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").option("--yes", "Confirm reviewer notifications.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("client-reviews:resend requires --yes because it may notify reviewers.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/resend`
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:cancel")).description("Cancel a client review batch. Requires agency plan and client review send capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/cancel`
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:override")).description("Override a client review batch item. Requires agency plan and content review override capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").requiredOption("--json <file>", "JSON file containing contentId and reason.").action(async (options, command) => {
+    const payload = clientReviewOverrideSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/override`,
+        { body: payload }
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:update-participant")).description("Update a client review participant. Requires agency plan and client review send capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").requiredOption("--json <file>", "JSON file containing participantId and email.").action(async (options, command) => {
+    const payload = clientReviewParticipantUpdateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/update-participant`,
+        { body: payload }
+      )
+    );
+  });
+  addConnectionOptions(program.command("client-reviews:comment")).description(
+    "Add an internal client-review thread comment. Requires agency plan and client review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").requiredOption("--json <file>", "JSON file containing contentId and body or attachmentId.").action(async (options, command) => {
+    const payload = clientReviewCommentSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/client-review-batches/${options.batch}/comment`,
+        { body: payload }
+      )
+    );
+  });
+}
+
+// src/commands/content.ts
+import { randomUUID } from "crypto";
+
+// src/content-schema.ts
+import { z as z3 } from "zod";
+var uuid3 = z3.string().uuid();
+var isoWithTimezone = z3.string().refine(
+  (value) => {
+    const date = new Date(value);
+    return !Number.isNaN(date.getTime()) && (value.endsWith("Z") || /[+-]\d{2}:\d{2}$/.test(value));
+  },
+  {
+    message: "scheduledAt must be an ISO8601 date string with explicit timezone, e.g. 2026-05-01T10:00:00Z."
+  }
+);
+var captionOverridesSchema = z3.object({
+  x: z3.string().max(25e3).optional(),
+  linkedin: z3.string().max(25e3).optional(),
+  youtube: z3.string().max(25e3).optional(),
+  instagram: z3.string().max(25e3).optional(),
+  facebook: z3.string().max(25e3).optional(),
+  threads: z3.string().max(25e3).optional(),
+  tiktok: z3.string().max(25e3).optional(),
+  pinterest: z3.string().max(25e3).optional()
+}).strict();
+var captionsSchema = z3.object({
+  canonical: z3.string().max(25e3).nullable().optional(),
+  overrides: captionOverridesSchema.optional()
+}).strict();
+var contentMediaCoverSchema = z3.object({
+  coverMediaId: uuid3.optional(),
+  thumbOffsetMs: z3.number().int().min(0).optional()
+}).strict().nullable();
+var contentMediaSchema = z3.array(
+  z3.object({
+    mediaId: uuid3,
+    order: z3.number().int().min(0).optional(),
+    crops: z3.record(z3.string(), z3.unknown()).optional(),
+    userTags: z3.array(
+      z3.object({
+        username: z3.string().min(1),
+        x: z3.number().min(0).max(1),
+        y: z3.number().min(0).max(1)
+      }).strict()
+    ).optional(),
+    productTags: z3.array(
+      z3.object({
+        productId: z3.string().min(1),
+        productName: z3.string().max(500).optional(),
+        x: z3.number().min(0).max(1).optional(),
+        y: z3.number().min(0).max(1).optional()
+      }).strict()
+    ).optional(),
+    cover: contentMediaCoverSchema.optional()
+  }).strict()
+).max(10);
+var unsupportedSettingsKeys = [
+  "contentTitle",
+  "platformTitles",
+  "selectedChannels",
+  "platformMediaIds",
+  "platformThreadMessages",
+  "platformFirstComments",
+  "reviewDraft",
+  "instagramCoverUrl",
+  "instagramCollaborators",
+  "pinterestCoverUrl",
+  "mediaCrops",
+  "userTags",
+  "productTags",
+  "coverUrl",
+  "thumbnailUrl",
+  "facebookPostType",
+  "youtubePostType",
+  "youtubeThumbnailFileSize"
+];
+var facebookPagePostCtaTypes = [
+  "LEARN_MORE",
+  "SIGN_UP",
+  "DOWNLOAD",
+  "WATCH_MORE",
+  "BOOK_TRAVEL",
+  "LISTEN_MUSIC",
+  "USE_APP",
+  "INSTALL_APP",
+  "NO_BUTTON"
+];
+var threadsReplyControlValues = [
+  "everyone",
+  "accounts_you_follow",
+  "mentioned_only",
+  "parent_post_author_only",
+  "followers_only"
+];
+var settingsSchema = z3.object({
+  collaborators: z3.array(z3.string()).optional(),
+  locationId: z3.string().optional(),
+  facebookLinkUrl: z3.string().optional(),
+  facebookCtaType: z3.enum(facebookPagePostCtaTypes).optional(),
+  facebookLocationId: z3.string().optional(),
+  xCommunityUrl: z3.string().optional(),
+  topicTag: z3.string().optional(),
+  linkAttachment: z3.string().optional(),
+  isGhostPost: z3.boolean().optional(),
+  replyControl: z3.enum(threadsReplyControlValues).optional(),
+  privacy_level: z3.string().optional(),
+  disable_comment: z3.boolean().optional(),
+  disable_duet: z3.boolean().optional(),
+  disable_stitch: z3.boolean().optional(),
+  brand_content_toggle: z3.boolean().optional(),
+  brand_organic_toggle: z3.boolean().optional(),
+  is_aigc: z3.boolean().optional(),
+  tiktok_post_to_drafts: z3.boolean().optional(),
+  photo_cover_index: z3.number().optional(),
+  auto_add_music: z3.boolean().optional(),
+  privacyStatus: z3.enum(["public", "unlisted", "private"]).optional(),
+  categoryId: z3.string().optional(),
+  tags: z3.array(z3.string()).optional(),
+  madeForKids: z3.boolean().optional(),
+  notifySubscribers: z3.boolean().optional(),
+  embeddable: z3.boolean().optional(),
+  license: z3.enum(["youtube", "creativeCommon"]).optional(),
+  boardId: z3.string().optional(),
+  link: z3.string().optional(),
+  altText: z3.string().optional()
+}).strict().superRefine((settings, context) => {
+  for (const key of unsupportedSettingsKeys) {
+    if (Object.prototype.hasOwnProperty.call(settings, key)) {
+      context.addIssue({
+        code: "custom",
+        path: [key],
+        message: `settings.${key} is not a provider setting. Use canonical content fields instead.`
+      });
+    }
+  }
+}).optional();
+var createContentBaseSchema = z3.object({
+  intent: z3.enum(["draft", "schedule", "publish_now"]).default("draft"),
+  integrationId: uuid3,
+  internalTitle: z3.string().max(500).nullable().optional(),
+  publishTitle: z3.string().max(500).nullable().optional(),
+  notes: z3.string().max(1e5).optional(),
+  captions: captionsSchema.optional(),
+  contentMedia: contentMediaSchema.optional(),
+  scheduledAt: isoWithTimezone.optional(),
+  settings: settingsSchema,
+  postType: z3.enum(["post", "reel", "story", "thread"]).optional(),
+  firstComment: z3.string().optional(),
+  shareToFeed: z3.boolean().optional(),
+  pillarIds: z3.array(uuid3).optional(),
+  formatIds: z3.array(uuid3).optional(),
+  labelIds: z3.array(uuid3).optional(),
+  campaignId: uuid3.nullable().optional(),
+  campaignPhaseId: uuid3.nullable().optional(),
+  priority: z3.enum(["urgent", "high", "medium", "low"]).optional(),
+  assigneeIds: z3.array(uuid3).optional(),
+  threadMessages: z3.array(
+    z3.object({
+      captions: captionsSchema,
+      contentMedia: contentMediaSchema.optional()
+    }).strict()
+  ).max(20).optional()
+}).strict();
+var createContentSchema = createContentBaseSchema.superRefine((payload, ctx) => {
+  if (payload.intent === "draft" && payload.scheduledAt !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["scheduledAt"],
+      message: "scheduledAt is only allowed when intent is schedule."
+    });
+  }
+  if (payload.intent === "schedule" && payload.scheduledAt === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["scheduledAt"],
+      message: "scheduledAt is required when intent is schedule."
+    });
+  }
+  if (payload.intent === "publish_now" && payload.scheduledAt !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["scheduledAt"],
+      message: "scheduledAt is not allowed when intent is publish_now."
+    });
+  }
+});
+var updateContentSchema = createContentBaseSchema.omit({ intent: true }).partial().refine((payload) => Object.keys(payload).length > 0, {
+  message: "Update payload must include at least one field."
+});
+var scheduleContentSchema = z3.object({
+  scheduledAt: isoWithTimezone
+});
+var workflowStatusSchema = z3.object({
+  workflowStatus: z3.enum(["idea", "drafting"])
+});
+var updateContentNotesSchema = z3.object({
+  notes: z3.string().max(1e5)
+});
+var updatePublishedCaptionSchema = z3.object({
+  message: z3.string().max(25e3)
+}).strict();
+
+// src/commands/content.ts
+function registerContentCommands(program) {
+  addConnectionOptions(program.command("content:create")).description("Create content from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the content payload.").option("--idempotency-key <key>", "Idempotency key for safe create retries. Generated by default.").option("--yes", 'Confirm immediate publishing when the payload uses intent "publish_now".').action(
+    async (options, command) => {
+      const payload = createContentSchema.parse(await readJsonFile(options.json));
+      if (payload.intent === "publish_now" && !options.yes) {
+        throw new CliError(
+          "content:create requires --yes when intent is publish_now because it queues an external publish.",
+          {
+            code: "INVALID_OPTIONS"
+          }
+        );
+      }
+      const client = createApiClient(resolveConfig(command));
+      const idempotencyKey = options.idempotencyKey?.trim() || `cli-content-create-${randomUUID()}`;
+      writeRawJson(
+        await client.request("POST", `/v1/workspaces/${options.workspace}/content`, {
+          body: payload,
+          headers: {
+            "Idempotency-Key": idempotencyKey
+          }
+        })
+      );
+    }
+  );
+  addConnectionOptions(program.command("content:list")).description("List content for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--status <status>", "Content status: draft, scheduled, sent, or failed.").option("--workflow-status <status>", "Workflow status filter.").option("--workflow-statuses <statuses>", "Comma-separated workflow status filters.").option("--include-review-lifecycle", "Include reviewLifecycle on list items.").option("--review-lifecycle-phase <phase>", "Filter by reviewLifecycle.phase.").option("--review-lifecycle-state <state>", "Filter by reviewLifecycle.state.").option("--review-lifecycle-actor <actor>", "Filter by reviewLifecycle.actor.").option("--review-lifecycle-next-action <action>", "Filter by reviewLifecycle.nextAction.").option("--review-lifecycle-blocks-publishing <boolean>", "Filter by reviewLifecycle.blocksPublishing.").option("--review-lifecycle-blocker <code>", "Filter by reviewLifecycle blocker code.").option("--review-lifecycle-batch <batchId>", "Filter by reviewLifecycle.clientReview.batchId.").option("--review-lifecycle-item <itemId>", "Filter by reviewLifecycle.clientReview.itemId.").option("--integration <id>", "Integration ID filter.").option("--limit <number>", "Page size.").option("--offset <number>", "Page offset.").option("--sort-by <field>", "Sort field.").option("--sort-direction <direction>", "Sort direction.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/content`, {
+        query: {
+          status: options.status,
+          workflowStatus: options.workflowStatus,
+          workflowStatuses: options.workflowStatuses,
+          includeReviewLifecycle: options.includeReviewLifecycle,
+          reviewLifecyclePhase: options.reviewLifecyclePhase,
+          reviewLifecycleState: options.reviewLifecycleState,
+          reviewLifecycleActor: options.reviewLifecycleActor,
+          reviewLifecycleNextAction: options.reviewLifecycleNextAction,
+          reviewLifecycleBlocksPublishing: options.reviewLifecycleBlocksPublishing,
+          reviewLifecycleBlocker: options.reviewLifecycleBlocker,
+          reviewLifecycleBatchId: options.reviewLifecycleBatch,
+          reviewLifecycleItemId: options.reviewLifecycleItem,
+          integrationId: options.integration,
+          limit: options.limit,
+          offset: options.offset,
+          sortBy: options.sortBy,
+          sortDirection: options.sortDirection
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:update")).description("Update a draft or scheduled content item from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", "JSON file containing fields to update.").action(async (options, command) => {
+    const payload = updateContentSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/content/${options.id}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:schedule")).description("Schedule or reschedule a content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--scheduled-at <iso>", "ISO8601 timestamp with explicit timezone.").action(async (options, command) => {
+    const payload = scheduleContentSchema.parse({ scheduledAt: options.scheduledAt });
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/content/${options.id}/schedule`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:intended-time")).description("Set intended publish time for draft or pending approval content without scheduling it.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--scheduled-at <iso>", "ISO8601 timestamp with explicit timezone.").action(async (options, command) => {
+    const payload = scheduleContentSchema.parse({ scheduledAt: options.scheduledAt });
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "PATCH",
+        `/v1/workspaces/${options.workspace}/content/${options.id}/intended-publish-time`,
+        {
+          body: payload
+        }
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:notes")).description("Replace the rich-text notes attached to a content item. Notes are internal and never published.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").option("--notes <html>", "Notes content (rich-text HTML). Pass empty string to clear.").option("--json <file>", 'JSON file with shape { "notes": "..." }. Use this for multi-line content.').action(async (options, command) => {
+    const raw = options.json ? await readJsonFile(options.json) : { notes: options.notes ?? "" };
+    if (options.json && options.notes !== void 0) {
+      throw new CliError("Pass either --notes or --json, not both.");
+    }
+    if (!options.json && options.notes === void 0) {
+      throw new CliError("Must pass either --notes or --json.");
+    }
+    const payload = updateContentNotesSchema.parse(raw);
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/content/${options.id}/notes`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:workflow")).description("Update a content item workflow status. Allowed statuses: idea, drafting (In Progress).").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--status <status>", "Workflow status: idea or drafting (In Progress).").action(async (options, command) => {
+    const payload = workflowStatusSchema.parse({ workflowStatus: options.status });
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/content/${options.id}/workflow-status`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:get")).description("Get one content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/content/${options.id}`));
+  });
+  addConnectionOptions(program.command("content:publish")).description("Publish a draft or scheduled content item now.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").option("--yes", "Confirm immediate publishing.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("content:publish requires --yes because it queues an external publish.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/publish`));
+  });
+  addConnectionOptions(program.command("content:published-caption")).description("Edit the caption on an already-published Facebook content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", 'JSON file containing { "message": "..." }.').option("--yes", "Confirm editing already-published provider content.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError(
+        "content:published-caption requires --yes because it edits already-published provider content.",
+        {
+          code: "INVALID_OPTIONS"
+        }
+      );
+    }
+    const payload = updatePublishedCaptionSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/content/${options.id}/published-caption`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:archive")).description("Archive a published content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/archive`));
+  });
+  addConnectionOptions(program.command("content:restore")).description("Restore an archived content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/restore`));
+  });
+  addConnectionOptions(program.command("content:retry")).description("Retry a failed content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/retry`));
+  });
+  addConnectionOptions(program.command("content:failed-count")).description("Get the failed content count for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/content/failed-count`));
+  });
+  addConnectionOptions(program.command("content:pending-approval-count")).description("Get the pending approval count for a workspace. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/content/pending-approval-count`));
+  });
+  addConnectionOptions(program.command("content:approval-history")).description("List approval history for a workspace. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--limit <number>", "Page size.").option("--cursor <cursor>", "Pagination cursor.").option("--search <text>", "Search approval history.").option("--workflow-path <path>", "Workflow path: all, internal, client, or internal_client.").option("--outcome <outcome>", "Outcome filter.").option("--platform <platform>", "Platform filter.").option("--reviewer <text>", "Reviewer filter.").option("--date-from <iso>", "ISO8601 start date.").option("--date-to <iso>", "ISO8601 end date.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/content/approval-history`, {
+        query: {
+          limit: options.limit,
+          cursor: options.cursor,
+          search: options.search,
+          workflowPath: options.workflowPath,
+          outcome: options.outcome,
+          platform: options.platform,
+          reviewer: options.reviewer,
+          dateFrom: options.dateFrom,
+          dateTo: options.dateTo
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:approval-history:client-batch")).description("Get client batch approval history detail. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--batch <batchId>", "Client review batch ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "GET",
+        `/v1/workspaces/${options.workspace}/content/approval-history/client-batches/${options.batch}`
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:approval-history:internal")).description("Get internal approval history detail. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--record <recordId>", "Approval record ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "GET",
+        `/v1/workspaces/${options.workspace}/content/approval-history/internal/${options.record}`
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:comment-attachments:init")).description(
+    "Initialize an approval comment attachment upload. Requires agency plan and content review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the attachment upload payload.").action(async (options, command) => {
+    const payload = approvalAttachmentInitSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/comment-attachments/init`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:comment-attachments:complete")).description(
+    "Complete an approval comment attachment upload. Requires agency plan and content review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--attachment <attachmentId>", "Attachment ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/comment-attachments/${options.attachment}/complete`
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:comment-attachments:abort")).description(
+    "Abort an approval comment attachment upload. Requires agency plan and content review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--attachment <attachmentId>", "Attachment ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/comment-attachments/${options.attachment}/abort`
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:activity:react")).description("Add a reaction to an approval activity. Requires agency plan and content review comment capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--activity <activityId>", "Activity ID.").requiredOption("--json <file>", "JSON file containing emoji.").action(async (options, command) => {
+    const payload = approvalReactionSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "POST",
+        `/v1/workspaces/${options.workspace}/content/activity/${options.activity}/reactions`,
+        {
+          body: payload
+        }
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:activity:unreact")).description(
+    "Remove a reaction from an approval activity. Requires agency plan and content review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--activity <activityId>", "Activity ID.").requiredOption("--emoji <emoji>", "Reaction emoji to remove.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "DELETE",
+        `/v1/workspaces/${options.workspace}/content/activity/${options.activity}/reactions/${encodeURIComponent(options.emoji)}`
+      )
+    );
+  });
+  addConnectionOptions(program.command("content:request-approval")).description(
+    "Request internal approval for a content item. Requires agency plan and content review request capability; may notify approvers."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", "JSON file containing approverIds and policy.").option("--yes", "Confirm approver notifications.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("content:request-approval requires --yes because it may notify approvers.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const payload = approvalRequestSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/request-approval`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:decision")).description("Submit an internal approval decision. Requires agency plan and content review decision capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", "JSON file containing decision, optional override, and reason.").action(async (options, command) => {
+    const payload = approvalDecisionSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/decision`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:withdraw")).description("Withdraw an internal approval request. Requires agency plan and content review withdraw capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/withdraw`));
+  });
+  addConnectionOptions(program.command("content:resubmit")).description(
+    "Resubmit rejected content for approval. Requires agency plan and content review request capability; may notify approvers."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", "JSON file containing approverIds and policy.").option("--yes", "Confirm approver notifications.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("content:resubmit requires --yes because it may notify approvers.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const payload = approvalRequestSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/resubmit`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:history")).description("Get approval activity history for one content item. Requires agency plan.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/content/${options.id}/history`));
+  });
+  addConnectionOptions(program.command("content:comment")).description(
+    "Add an internal approval comment to one content item. Requires agency plan and content review comment capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").requiredOption("--json <file>", "JSON file containing body or attachmentId.").action(async (options, command) => {
+    const payload = approvalCommentSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/comment`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("content:reopen-client-review")).description("Reopen client review for one content item. Requires agency plan and client review send capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/content/${options.id}/reopen-client-review`)
+    );
+  });
+  addConnectionOptions(program.command("content:delete")).description("Delete a content item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <contentId>", "Content ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    await client.request("DELETE", `/v1/workspaces/${options.workspace}/content/${options.id}`);
+    writeJson({ id: options.id, deleted: true });
+  });
+}
+
+// src/grid-planner-schema.ts
+import { z as z4 } from "zod";
+var uuidV4 = z4.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i, "Expected a UUIDv4 string.");
+var placeholderSettingsSchema = z4.object({
+  title: z4.string().trim().min(1).max(40),
+  color: z4.string().regex(/^#[0-9a-fA-F]{6}$/)
+}).strict();
+var settingsSchema2 = z4.object({
+  aspectRatio: z4.number().min(0.1).max(10).nullable().optional(),
+  placeholder: placeholderSettingsSchema.optional()
+}).strict();
+var gridPlannerCreateSchema = z4.object({
+  integrationId: uuidV4,
+  kind: z4.enum(["visual_only", "linked_post", "placeholder"]),
+  mediaIds: z4.array(uuidV4).min(1).optional(),
+  linkedContentId: uuidV4.optional(),
+  coverMediaId: uuidV4.nullable().optional(),
+  note: z4.string().optional(),
+  position: z4.number().int().min(0).optional(),
+  settings: settingsSchema2.optional()
+}).strict().superRefine((payload, context) => {
+  if (payload.kind === "visual_only" && !payload.mediaIds) {
+    context.addIssue({
+      code: "custom",
+      path: ["mediaIds"],
+      message: "mediaIds is required when kind is visual_only."
+    });
+  }
+  if (payload.kind === "linked_post" && !payload.linkedContentId) {
+    context.addIssue({
+      code: "custom",
+      path: ["linkedContentId"],
+      message: "linkedContentId is required when kind is linked_post."
+    });
+  }
+  if (payload.kind === "placeholder") {
+    if (!payload.settings?.placeholder) {
+      context.addIssue({
+        code: "custom",
+        path: ["settings", "placeholder"],
+        message: "settings.placeholder is required when kind is placeholder."
+      });
+    }
+    if (payload.mediaIds) {
+      context.addIssue({
+        code: "custom",
+        path: ["mediaIds"],
+        message: "mediaIds cannot be set when kind is placeholder."
+      });
+    }
+    if (payload.linkedContentId) {
+      context.addIssue({
+        code: "custom",
+        path: ["linkedContentId"],
+        message: "linkedContentId cannot be set when kind is placeholder."
+      });
+    }
+    if (payload.coverMediaId) {
+      context.addIssue({
+        code: "custom",
+        path: ["coverMediaId"],
+        message: "coverMediaId cannot be set when kind is placeholder."
+      });
+    }
+    if (payload.note) {
+      context.addIssue({
+        code: "custom",
+        path: ["note"],
+        message: "note cannot be set when kind is placeholder."
+      });
+    }
+  }
+  if (payload.mediaIds && new Set(payload.mediaIds).size !== payload.mediaIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["mediaIds"],
+      message: "mediaIds must contain unique UUIDs."
+    });
+  }
+});
+var gridPlannerUpdateSchema = z4.object({
+  integrationId: uuidV4,
+  note: z4.string().nullable().optional(),
+  settings: settingsSchema2.optional()
+}).strict();
+var gridPlannerReorderSchema = z4.object({
+  integrationId: uuidV4,
+  itemIds: z4.array(uuidV4).min(1).optional(),
+  items: z4.array(
+    z4.object({
+      itemId: uuidV4,
+      position: z4.number().int().min(0)
+    }).strict()
+  ).min(1).optional()
+}).strict().refine((payload) => Boolean(payload.itemIds) !== Boolean(payload.items), {
+  path: ["itemIds"],
+  message: "Provide either itemIds or items."
+}).refine((payload) => !payload.itemIds || new Set(payload.itemIds).size === payload.itemIds.length, {
+  path: ["itemIds"],
+  message: "itemIds must contain unique UUIDs."
+}).refine((payload) => !payload.items || new Set(payload.items.map((item) => item.itemId)).size === payload.items.length, {
+  path: ["items"],
+  message: "items must contain unique itemIds."
+}).refine(
+  (payload) => !payload.items || new Set(payload.items.map((item) => item.position)).size === payload.items.length,
+  {
+    path: ["items"],
+    message: "items must contain unique positions."
+  }
+);
+var gridPlannerReplaceMediaSchema = z4.object({
+  integrationId: uuidV4,
+  mediaIds: z4.array(uuidV4).min(1).max(10)
+}).strict().refine((payload) => new Set(payload.mediaIds).size === payload.mediaIds.length, {
+  path: ["mediaIds"],
+  message: "mediaIds must contain unique UUIDs."
+});
+var gridPlannerSetCoverSchema = z4.object({
+  integrationId: uuidV4,
+  mediaId: uuidV4
+}).strict();
+var gridPlannerPromoteSchema = z4.object({
+  integrationId: uuidV4
+}).strict();
+
+// src/commands/grid-planner.ts
+function registerGridPlannerCommands(program) {
+  addConnectionOptions(program.command("grid:list")).description("List grid planner items for one integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--integration <id>", "Integration ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/grid-planner/items`, {
+        query: { integrationId: options.integration }
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:create")).description("Create a grid planner item from a JSON payload file. Requires grid planner manage capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the grid planner item payload.").action(async (options, command) => {
+    const payload = gridPlannerCreateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/grid-planner/items`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:update")).description("Update a grid planner item from a JSON payload file. Requires grid planner manage capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").requiredOption("--json <file>", "JSON file containing integrationId plus fields to update.").action(async (options, command) => {
+    const payload = gridPlannerUpdateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:delete")).description("Delete one grid planner item. Requires grid planner manage capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").option("--yes", "Confirm deleting the grid planner item.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("grid:delete requires --yes because it deletes a planner item.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("DELETE", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}`)
+    );
+  });
+  addConnectionOptions(program.command("grid:reorder")).description(
+    "Reorder all grid planner items for one integration from a JSON payload file. Requires grid planner manage capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing integrationId and the complete itemIds order.").action(async (options, command) => {
+    const payload = gridPlannerReorderSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/grid-planner/items/reorder`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:replace-media")).description(
+    "Replace a visual-only planner item carousel from a JSON payload file. Requires grid planner manage capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").requiredOption("--json <file>", "JSON file containing integrationId and mediaIds.").action(async (options, command) => {
+    const payload = gridPlannerReplaceMediaSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PUT", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}/media`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:set-cover")).description(
+    "Set a visual-only planner item cover media item from a JSON payload file. Requires grid planner manage capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").requiredOption("--json <file>", "JSON file containing integrationId and mediaId.").action(async (options, command) => {
+    const payload = gridPlannerSetCoverSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PUT", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}/cover`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("grid:remove-cover")).description("Remove cover media from a visual-only planner item. Requires grid planner manage capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("DELETE", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}/cover`)
+    );
+  });
+  addConnectionOptions(program.command("grid:promote")).description(
+    "Promote a planner mockup to a draft from a JSON payload file. Requires grid planner manage capability."
+  ).requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--item <itemId>", "Grid planner item ID.").requiredOption("--json <file>", "JSON file containing integrationId.").option("--yes", "Confirm creating a draft and linking the planner item.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError(
+        "grid:promote requires --yes because it creates a content draft and links the planner item.",
+        {
+          code: "INVALID_OPTIONS"
+        }
+      );
+    }
+    const payload = gridPlannerPromoteSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/grid-planner/items/${options.item}/promote`, {
+        body: payload
+      })
+    );
+  });
+}
+
+// src/commands/hashtags.ts
+import { z as z5 } from "zod";
+var hashtagGroupSchema = z5.object({
+  name: z5.string().trim().min(1).max(100),
+  content: z5.string().trim().min(1)
+});
+function registerHashtagCommands(program) {
+  addConnectionOptions(program.command("hashtags:list")).description("List saved hashtag groups for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/hashtags`));
+  });
+  addConnectionOptions(program.command("hashtags:create")).description("Create a hashtag group from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing name and content.").action(async (options, command) => {
+    const payload = hashtagGroupSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/hashtags`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("hashtags:update")).description("Update a hashtag group from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <hashtagGroupId>", "Hashtag group ID.").requiredOption("--json <file>", "JSON file containing name and content.").action(async (options, command) => {
+    const payload = hashtagGroupSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/hashtags/${options.id}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("hashtags:delete")).description("Delete a hashtag group.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <hashtagGroupId>", "Hashtag group ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("DELETE", `/v1/workspaces/${options.workspace}/hashtags/${options.id}`));
+  });
+}
+
+// src/inbox-schema.ts
+import { z as z6 } from "zod";
+var uuid4 = z6.string().uuid();
+var inboxAttachmentSchema = z6.object({
+  type: z6.enum(["image", "video", "audio", "file"]),
+  url: z6.url()
+});
+var inboxReplySchema = z6.object({
+  content: z6.string().max(2e3).optional(),
+  parentMessageId: uuid4.optional(),
+  attachment: inboxAttachmentSchema.optional()
+}).refine((payload) => Boolean(payload.content?.trim() || payload.attachment), {
+  message: "Reply payload must include content or attachment."
+});
+var inboxNoteSchema = z6.object({
+  content: z6.string().min(1).max(5e3)
+});
+var inboxModerateSchema = z6.object({
+  action: z6.enum(["hide", "unhide", "delete"])
+});
+var inboxMarkAllReadSchema = z6.object({
+  platform: z6.enum(["instagram", "facebook", "threads"]).optional(),
+  status: z6.enum(["open", "archived", "all"]).optional(),
+  integrationId: z6.string().min(1).optional(),
+  messageType: z6.enum(["comment", "dm", "review", "mention"]).optional()
+});
+
+// src/commands/inbox.ts
+function registerInboxCommands(program) {
+  addConnectionOptions(program.command("inbox:threads")).description("List inbox threads for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--status <status>", "Thread status: open, archived, or all.").option("--read <state>", "Read state: read, unread, or all.").option("--platform <platform>", "Platform filter.").option("--integration <id>", "Integration ID filter.").option("--message-type <type>", "Message type filter.").option("--search <text>", "Search text.").option("--page <number>", "Page number.").option("--limit <number>", "Page size.").action(
+    async (options, command) => {
+      const client = createApiClient(resolveConfig(command));
+      writeRawJson(
+        await client.request("GET", `/v1/workspaces/${options.workspace}/inbox/threads`, {
+          query: {
+            status: options.status,
+            read: options.read,
+            platform: options.platform,
+            integrationId: options.integration,
+            messageType: options.messageType,
+            search: options.search,
+            page: options.page,
+            limit: options.limit
+          }
+        })
+      );
+    }
+  );
+  addConnectionOptions(program.command("inbox:messages")).description("List messages for an inbox thread.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--thread <threadId>", "Inbox thread ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/inbox/threads/${options.thread}/messages`)
+    );
+  });
+  addConnectionOptions(program.command("inbox:stats")).description("Get inbox stats for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/inbox/stats`));
+  });
+  addConnectionOptions(program.command("inbox:read")).description("Mark an inbox thread as read.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--thread <threadId>", "Inbox thread ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/threads/${options.thread}/read`)
+    );
+  });
+  addConnectionOptions(program.command("inbox:read-all")).description("Mark matching inbox threads as read from a JSON filter payload.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing read-all filters.").option("--yes", "Confirm marking matching threads as read.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("inbox:read-all requires --yes because it can mark many customer messages as read.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const payload = inboxMarkAllReadSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/threads/read-all`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("inbox:unread")).description("Mark an inbox thread as unread.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--thread <threadId>", "Inbox thread ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("DELETE", `/v1/workspaces/${options.workspace}/inbox/threads/${options.thread}/read`)
+    );
+  });
+  addConnectionOptions(program.command("inbox:reply")).description("Reply publicly to an inbox thread. Requires inbox reply capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--thread <threadId>", "Inbox thread ID.").requiredOption("--json <file>", "JSON file containing reply content, parentMessageId, or attachment.").option("--yes", "Confirm sending a public reply.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("inbox:reply requires --yes because it sends a public reply.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const payload = inboxReplySchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/threads/${options.thread}/reply`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("inbox:note")).description("Add an internal note to an inbox thread. Requires inbox note capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--thread <threadId>", "Inbox thread ID.").requiredOption("--json <file>", "JSON file containing note content.").action(async (options, command) => {
+    const payload = inboxNoteSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/threads/${options.thread}/notes`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("inbox:moderate")).description("Moderate a public inbox message. Requires inbox moderate capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--message <messageId>", "Inbox message ID.").requiredOption("--json <file>", "JSON file containing moderation action.").option("--yes", "Confirm moderating public content.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("inbox:moderate requires --yes because it moderates public content.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const payload = inboxModerateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/messages/${options.message}/moderate`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("inbox:retry-message")).description("Retry a failed outgoing inbox message. Requires inbox retry-failed capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--message <messageId>", "Inbox message ID.").option("--yes", "Confirm retrying an external send.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("inbox:retry-message requires --yes because it can retry an external send.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/inbox/messages/${options.message}/retry`)
+    );
+  });
+  addConnectionOptions(program.command("inbox:delete-failed")).description("Delete a failed outgoing inbox message. Requires inbox delete-failed capability.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--message <messageId>", "Inbox message ID.").option("--yes", "Confirm deleting a failed outgoing message.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("inbox:delete-failed requires --yes because it deletes a failed outgoing message.", {
+        code: "INVALID_OPTIONS"
+      });
+    }
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("DELETE", `/v1/workspaces/${options.workspace}/inbox/messages/${options.message}/failed`)
+    );
+  });
+}
+
+// src/commands/integrations.ts
+function registerIntegrationCommands(program) {
+  addConnectionOptions(program.command("integrations:list")).description("List social integrations for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/integrations`));
+  });
+  addConnectionOptions(program.command("integrations:capabilities")).description("Get safe publishing capabilities and dynamic option keys for an integration.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("-i, --integration <id>", "Integration ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request(
+        "GET",
+        `/v1/workspaces/${options.workspace}/integrations/${options.integration}/capabilities`
+      )
+    );
+  });
+  addConnectionOptions(program.command("integrations:options")).description("Fetch safe read-only provider options returned by integrations:capabilities.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("-i, --integration <id>", "Integration ID.").requiredOption("--key <optionKey>", "Option key, for example pinterest-boards or youtube-video-categories.").option("--json <file>", "JSON file containing option input, such as query or regionCode.").action(
+    async (options, command) => {
+      const payload = options.json ? await readJsonFile(options.json) : {};
+      const client = createApiClient(resolveConfig(command));
+      writeRawJson(
+        await client.request(
+          "POST",
+          `/v1/workspaces/${options.workspace}/integrations/${options.integration}/options/${options.key}`,
+          { body: payload }
+        )
+      );
+    }
+  );
+}
+
+// src/media-schema.ts
+import { z as z7 } from "zod";
+var uuid5 = z7.string().uuid();
+var hexColor = z7.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/, "Color must be a hex color.");
+var mediaUpdateSchema = z7.object({
+  filename: z7.string().min(1).max(255).optional(),
+  altText: z7.string().max(500).optional(),
+  isFavorite: z7.boolean().optional(),
+  folderId: uuid5.nullable().optional()
+}).refine((payload) => Object.keys(payload).length > 0, {
+  message: "Media update payload must include at least one field."
+});
+var createMediaFolderSchema = z7.object({
+  name: z7.string().min(1).max(255),
+  parentId: uuid5.optional()
+});
+var updateMediaFolderSchema = z7.object({
+  name: z7.string().min(1).max(255)
+});
+var moveMediaFolderSchema = z7.object({
+  parentId: uuid5.nullable().optional()
+}).refine((payload) => Object.prototype.hasOwnProperty.call(payload, "parentId"), {
+  message: "Folder move payload must include parentId. Use null to move to root."
+});
+var createMediaLabelSchema = z7.object({
+  name: z7.string().min(1).max(50),
+  color: hexColor.optional()
+});
+var updateMediaLabelSchema = z7.object({
+  name: z7.string().min(1).max(50).optional(),
+  color: hexColor.optional()
+}).refine((payload) => Object.keys(payload).length > 0, {
+  message: "Media label update payload must include at least one field."
+});
+var mediaIdsSchema = z7.object({
+  mediaIds: z7.array(uuid5).min(1).max(100)
+});
+var mediaBulkMoveSchema = mediaIdsSchema.extend({
+  folderId: uuid5.nullable().optional()
+});
+var mediaLabelIdsSchema = z7.object({
+  labelIds: z7.array(uuid5).min(1).max(50)
+});
+var mediaBulkLabelSchema = mediaIdsSchema.extend({
+  labelIds: z7.array(uuid5).min(1).max(50)
+});
+
+// src/commands/media.ts
+function registerMediaCommands(program) {
+  addConnectionOptions(program.command("media:list")).description("List media for a workspace.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--folder-id <id>", "Folder ID filter.").option("--root-only", "Only return media in the workspace root folder.").option("--label-ids <ids>", "Comma-separated media label IDs.").option("--type <type>", "Media type: image, video, or gif.").option("--search <text>", "Search media filenames and metadata.").option("--favorite", "Only return favorite media.").option("--used", "Only return media already used by content.").option("--unused", "Only return media not used by content.").option("--state <state>", "Media lifecycle state: active, deleted, or all.").option("--limit <number>", "Page size.").option("--cursor <cursor>", "Pagination cursor.").option("--sort-by <field>", "Sort field.").option("--order <direction>", "Sort direction.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/media`, {
+        query: {
+          folderId: options.folderId,
+          rootOnly: options.rootOnly,
+          labelIds: options.labelIds,
+          type: options.type,
+          search: options.search,
+          isFavorite: options.favorite,
+          isUsed: options.used,
+          isUnused: options.unused,
+          state: options.state,
+          limit: options.limit,
+          cursor: options.cursor,
+          sortBy: options.sortBy,
+          order: options.order
+        }
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:upload")).description("Upload a media file to a workspace.").argument("<file>", "File to upload.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (filePath, options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    const file = await getUploadFileInfo(filePath);
+    writeRawJson(
+      await client.uploadFile(
+        `/v1/workspaces/${options.workspace}/media/upload`,
+        filePath,
+        file.contentType,
+        file.fileSize,
+        file
+      )
+    );
+  });
+  addConnectionOptions(program.command("media:get")).description("Get one media item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/media/${options.id}`));
+  });
+  addConnectionOptions(program.command("media:update")).description("Update one media item from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").requiredOption("--json <file>", "JSON file containing fields to update.").action(async (options, command) => {
+    const payload = mediaUpdateSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/media/${options.id}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:download-url")).description("Create a temporary media download URL.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/media/${options.id}/download-url`));
+  });
+  addConnectionOptions(program.command("media:view-url")).description("Create a temporary media view URL.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/media/${options.id}/view-url`));
+  });
+  addConnectionOptions(program.command("media:archive")).description("Archive one media item.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("POST", `/v1/workspaces/${options.workspace}/media/${options.id}/archive`));
+  });
+  addConnectionOptions(program.command("media:delete")).description("Move one media item to the Bin.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("DELETE", `/v1/workspaces/${options.workspace}/media/${options.id}`));
+  });
+  addConnectionOptions(program.command("media:folders:list")).description("List media folders.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--parent-id <id>", "Parent folder ID, or root for top-level folders.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/media/folders`, {
+        query: { parentId: options.parentId }
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:folders:get")).description("Get one media folder.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <folderId>", "Folder ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/media/folders/${options.id}`));
+  });
+  addConnectionOptions(program.command("media:folders:path")).description("Get the path for one media folder.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <folderId>", "Folder ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/media/folders/${options.id}/path`));
+  });
+  addConnectionOptions(program.command("media:folders:create")).description("Create a media folder from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the folder payload.").action(async (options, command) => {
+    const payload = createMediaFolderSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/folders`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:folders:update")).description("Update a media folder from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <folderId>", "Folder ID.").requiredOption("--json <file>", "JSON file containing fields to update.").action(async (options, command) => {
+    const payload = updateMediaFolderSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/media/folders/${options.id}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:folders:move")).description("Move a media folder from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <folderId>", "Folder ID.").requiredOption("--json <file>", "JSON file containing parentId; use null for root.").action(async (options, command) => {
+    const payload = moveMediaFolderSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/media/folders/${options.id}/move`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:folders:delete")).description("Delete one media folder.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <folderId>", "Folder ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("DELETE", `/v1/workspaces/${options.workspace}/media/folders/${options.id}`));
+  });
+  addConnectionOptions(program.command("media:labels:list")).description("List media labels.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--search <text>", "Search media labels.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/media/labels`, {
+        query: { search: options.search }
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:labels:create")).description("Create a media label from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing the media label payload.").action(async (options, command) => {
+    const payload = createMediaLabelSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/labels`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:labels:update")).description("Update a media label from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <labelId>", "Media label ID.").requiredOption("--json <file>", "JSON file containing fields to update.").action(async (options, command) => {
+    const payload = updateMediaLabelSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("PATCH", `/v1/workspaces/${options.workspace}/media/labels/${options.id}`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:labels:delete")).description("Delete one media label.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <labelId>", "Media label ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("DELETE", `/v1/workspaces/${options.workspace}/media/labels/${options.id}`));
+  });
+  addConnectionOptions(program.command("media:labels:attach")).description("Attach media labels to one media item from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").requiredOption("--json <file>", "JSON file containing labelIds.").action(async (options, command) => {
+    const payload = mediaLabelIdsSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/${options.id}/labels`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:labels:detach")).description("Detach media labels from one media item from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--id <mediaId>", "Media ID.").requiredOption("--json <file>", "JSON file containing labelIds.").action(async (options, command) => {
+    const payload = mediaLabelIdsSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("DELETE", `/v1/workspaces/${options.workspace}/media/${options.id}/labels`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:bulk-archive")).description("Archive media in bulk from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing mediaIds.").action(async (options, command) => {
+    const payload = mediaIdsSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/bulk-archive`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:bulk-move")).description("Move media in bulk from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing mediaIds and optional folderId.").action(async (options, command) => {
+    const payload = mediaBulkMoveSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/bulk-move`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:bulk-label")).description("Attach labels to media in bulk from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing mediaIds and labelIds.").action(async (options, command) => {
+    const payload = mediaBulkLabelSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/bulk-label`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:bulk-unlabel")).description("Detach labels from media in bulk from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing mediaIds and labelIds.").action(async (options, command) => {
+    const payload = mediaBulkLabelSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/bulk-unlabel`, {
+        body: payload
+      })
+    );
+  });
+  addConnectionOptions(program.command("media:bulk-delete")).description("Move media to the Bin in bulk from a JSON payload file.").requiredOption("-w, --workspace <id>", "Workspace ID.").requiredOption("--json <file>", "JSON file containing mediaIds.").option("--yes", "Confirm deletion of the explicit media IDs.").action(async (options, command) => {
+    if (!options.yes) {
+      throw new CliError("media:bulk-delete requires --yes.", { code: "INVALID_OPTIONS" });
+    }
+    const payload = mediaIdsSchema.parse(await readJsonFile(options.json));
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("POST", `/v1/workspaces/${options.workspace}/media/bulk-delete`, {
+        body: payload
+      })
+    );
+  });
+}
+
+// src/commands/taxonomy.ts
+function registerTaxonomyCommands(program) {
+  addConnectionOptions(program.command("taxonomy:labels")).description("List workspace labels usable in content labelIds.").requiredOption("-w, --workspace <id>", "Workspace ID.").option("--search <text>", "Case-insensitive label name search.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(
+      await client.request("GET", `/v1/workspaces/${options.workspace}/labels`, {
+        query: { search: options.search }
+      })
+    );
+  });
+  addConnectionOptions(program.command("taxonomy:pillars")).description("List workspace content pillars usable in content pillarIds.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/pillars`));
+  });
+  addConnectionOptions(program.command("taxonomy:formats")).description("List workspace content formats usable in content formatIds.").requiredOption("-w, --workspace <id>", "Workspace ID.").action(async (options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", `/v1/workspaces/${options.workspace}/formats`));
+  });
+}
+
+// src/commands/workspaces.ts
+function registerWorkspaceCommands(program) {
+  addConnectionOptions(program.command("workspaces:list")).description("List workspaces accessible to the API key.").action(async (_options, command) => {
+    const client = createApiClient(resolveConfig(command));
+    writeRawJson(await client.request("GET", "/v1/workspaces"));
+  });
+}
+
+// src/index.ts
+function isCommanderError(error) {
+  return error instanceof Error && "code" in error && typeof error.code === "string" && "exitCode" in error;
+}
+function readPackageVersion() {
+  try {
+    const packageJson = JSON.parse(readFileSync2(new URL("../package.json", import.meta.url), "utf8"));
+    return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function createProgram() {
+  const program = new Command();
+  program.name("maeve").description("Automate the Maeve public API from the command line.").version(readPackageVersion()).option("--api-url <url>", "Maeve API base URL.").option("--api-key-env <name>", "Name of an environment variable containing a Maeve API key.").option("--api-key <key>", "Maeve API key. Prefer MAEVE_API_KEY for local shells.").exitOverride().configureOutput({
+    writeErr: () => void 0
+  });
+  registerAuthCommands(program);
+  registerWorkspaceCommands(program);
+  registerIntegrationCommands(program);
+  registerMediaCommands(program);
+  registerContentCommands(program);
+  registerClientReviewCommands(program);
+  registerTaxonomyCommands(program);
+  registerHashtagCommands(program);
+  registerAnalyticsCommands(program);
+  registerInboxCommands(program);
+  registerGridPlannerCommands(program);
+  return program;
+}
+async function runCli(argv = process.argv) {
+  const program = createProgram();
+  try {
+    await program.parseAsync(argv);
+  } catch (error) {
+    if (isCommanderError(error)) {
+      if (error.exitCode === 0) {
+        process.exitCode = 0;
+        return;
+      }
+      writeError(
+        new CliError(error.message.replace(/^error:\s*/i, ""), {
+          code: "USAGE_ERROR",
+          details: { commanderCode: error.code }
+        })
+      );
+    } else {
+      writeError(error);
+    }
+    process.exitCode = 1;
+  }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  migrateLegacyCredentialFile();
+  void runCli();
+}
+export {
+  createProgram,
+  runCli
+};