papermark 0.0.1 → 0.2.0

package/dist/index.js

@@ -0,0 +1,2216 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command as Command2 } from "commander";
+
+// src/commands/analytics.ts
+import chalk2 from "chalk";
+
+// src/config.ts
+import { readFileSync } from "fs";
+import Conf from "conf";
+var store = new Conf({
+  projectName: "papermark",
+  configFileMode: 384,
+  defaults: {
+    apiUrl: "https://api.papermark.com"
+  }
+});
+var credentialsFile;
+function readCredentialsFile() {
+  if (credentialsFile !== void 0) return credentialsFile;
+  const path = process.env.PAPERMARK_CREDENTIALS_FILE;
+  if (!path) return credentialsFile = null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed && typeof parsed === "object") {
+      return credentialsFile = {
+        token: typeof parsed.token === "string" ? parsed.token : void 0,
+        apiUrl: typeof parsed.apiUrl === "string" ? parsed.apiUrl : typeof parsed.api_url === "string" ? parsed.api_url : void 0
+      };
+    }
+  } catch (err) {
+    process.stderr.write(
+      `warning: could not read PAPERMARK_CREDENTIALS_FILE (${path}): ${err instanceof Error ? err.message : String(err)}
+`
+    );
+  }
+  return credentialsFile = null;
+}
+function envOr(name) {
+  const v = process.env[name];
+  return v && v.length > 0 ? v : void 0;
+}
+function getToken() {
+  return envOr("PAPERMARK_TOKEN") ?? readCredentialsFile()?.token ?? store.get("token");
+}
+function getTokenSource() {
+  if (envOr("PAPERMARK_TOKEN")) return "env";
+  if (readCredentialsFile()?.token) return "credentials-file";
+  if (store.get("token")) return "config";
+  return "none";
+}
+function setToken(token) {
+  store.set("token", token);
+}
+function clearToken() {
+  store.delete("token");
+}
+function getApiUrl() {
+  return envOr("PAPERMARK_API_URL") ?? readCredentialsFile()?.apiUrl ?? store.get("apiUrl") ?? "https://api.papermark.com";
+}
+function setApiUrl(url) {
+  store.set("apiUrl", url);
+}
+function getAll() {
+  return { token: store.get("token"), apiUrl: store.get("apiUrl") };
+}
+function configPath() {
+  return store.path;
+}
+function deleteKey(key) {
+  store.delete(key);
+}
+
+// src/debug.ts
+var enabled = process.env.PAPERMARK_DEBUG === "1" || process.env.PAPERMARK_DEBUG === "true";
+function debug(category, ...parts) {
+  if (!enabled) return;
+  const line = parts.map((p) => typeof p === "string" ? p : JSON.stringify(p)).join(" ");
+  process.stderr.write(`[papermark:${category}] ${line}
+`);
+}
+
+// src/runtime.ts
+var current = {
+  json: !process.stdout.isTTY,
+  dryRun: false,
+  color: process.stdout.isTTY && !process.env.NO_COLOR
+};
+function setRuntime(patch) {
+  current = { ...current, ...patch };
+}
+function getRuntime() {
+  return current;
+}
+
+// src/client.ts
+var ApiError = class extends Error {
+  code;
+  status;
+  docUrl;
+  details;
+  constructor(status, body) {
+    const message = typeof body === "string" ? body : body.message;
+    super(message);
+    this.status = status;
+    if (typeof body === "string") {
+      this.code = "unknown";
+    } else {
+      this.code = body.code;
+      this.docUrl = body.doc_url;
+      this.details = body.details;
+    }
+  }
+};
+var AuthRequiredError = class extends Error {
+  constructor() {
+    super("No API token found. Run `papermark login` first.");
+    this.name = "AuthRequiredError";
+  }
+};
+var NetworkError = class extends Error {
+  url;
+  cause;
+  constructor(url, cause) {
+    const reason = extractNetworkReason(cause);
+    super(`Network request to ${url} failed: ${reason}`);
+    this.name = "NetworkError";
+    this.url = url;
+    this.cause = cause;
+  }
+};
+function extractNetworkReason(err) {
+  if (err && typeof err === "object" && "cause" in err) {
+    const c = err.cause;
+    if (c && typeof c === "object") {
+      const code = c.code;
+      const msg = c.message;
+      if (code || msg) return `${code ?? ""}${code && msg ? " \u2014 " : ""}${msg ?? ""}`.trim();
+    }
+  }
+  if (err instanceof Error) return err.message;
+  return String(err);
+}
+function buildUrl(path, query) {
+  const base = getApiUrl().replace(/\/$/, "");
+  let fullPath = path.startsWith("/") ? path : `/${path}`;
+  if (base.endsWith("/api") && fullPath.startsWith("/api/")) {
+    fullPath = fullPath.slice(4);
+  }
+  const url = new URL(base + fullPath);
+  if (query) {
+    for (const [k, v] of Object.entries(query)) {
+      if (v !== void 0 && v !== null && v !== "") {
+        url.searchParams.set(k, String(v));
+      }
+    }
+  }
+  return url.toString();
+}
+async function request(path, opts = {}) {
+  const headers = {
+    Accept: "application/json",
+    ...opts.headers ?? {}
+  };
+  if (!opts.anonymous) {
+    const token = getToken();
+    if (token) {
+      headers.Authorization = `Bearer ${token}`;
+    } else if (!getRuntime().dryRun) {
+      throw new AuthRequiredError();
+    } else {
+      headers.Authorization = "Bearer <no-token>";
+    }
+  }
+  let body;
+  if (opts.body !== void 0) {
+    if (opts.body instanceof Uint8Array || opts.body instanceof ArrayBuffer) {
+      body = opts.body;
+    } else {
+      body = JSON.stringify(opts.body);
+      headers["Content-Type"] = "application/json";
+    }
+  }
+  const url = buildUrl(path, opts.query);
+  const method = opts.method ?? (opts.body ? "POST" : "GET");
+  if (getRuntime().dryRun) {
+    const redactedHeaders = { ...headers };
+    if (redactedHeaders.Authorization) {
+      redactedHeaders.Authorization = "Bearer ***redacted***";
+    }
+    process.stderr.write(
+      `[dry-run] ${method} ${url}
+` + Object.entries(redactedHeaders).map(([k, v]) => `[dry-run]   ${k}: ${v}`).join("\n") + (body ? `
+[dry-run] body: ${truncate(String(body), 500)}` : "") + "\n"
+    );
+    return void 0;
+  }
+  debug("http", method, url, body ? "(body)" : "");
+  const started = Date.now();
+  let res;
+  try {
+    res = await fetch(url, { method, headers, body });
+  } catch (err) {
+    debug("http", "network error after", `${Date.now() - started}ms`, String(err));
+    throw new NetworkError(url, err);
+  }
+  debug("http", method, url, `\u2192 ${res.status}`, `(${Date.now() - started}ms)`);
+  if (res.status === 204) return void 0;
+  const text = await res.text();
+  const parsed = text ? safeParseJson(text) : null;
+  if (!res.ok) {
+    if (parsed && typeof parsed === "object" && "error" in parsed) {
+      throw new ApiError(res.status, parsed.error);
+    }
+    const looksLikeHtml = text.trimStart().toLowerCase().startsWith("<");
+    const msg = looksLikeHtml ? `HTTP ${res.status} (server returned HTML, not JSON \u2014 is the dev server healthy?)` : text || `HTTP ${res.status}`;
+    throw new ApiError(res.status, msg);
+  }
+  if (parsed === null && text.trim() !== "") {
+    const looksLikeHtml = text.trimStart().toLowerCase().startsWith("<");
+    const msg = looksLikeHtml ? `HTTP ${res.status} (server returned HTML on a 2xx \u2014 is the API URL pointing at the right host?)` : `HTTP ${res.status} (response was not JSON: ${truncate(text, 200)})`;
+    throw new ApiError(res.status, msg);
+  }
+  return parsed ?? void 0;
+}
+function safeParseJson(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+}
+function truncate(s, n) {
+  return s.length > n ? s.slice(0, n - 1) + "\u2026" : s;
+}
+var api = {
+  // Documents
+  listDocuments: (query) => request("/v1/documents", { query }),
+  getDocument: (id) => request(`/v1/documents/${id}`),
+  searchDocuments: (q, limit) => request("/v1/documents/search", { query: { q, limit } }),
+  updateDocument: (id, body) => request(`/v1/documents/${id}`, { method: "PATCH", body }),
+  deleteDocument: (id) => request(`/v1/documents/${id}`, { method: "DELETE" }),
+  uploadUrl: (body) => request("/v1/documents/upload-url", { method: "POST", body }),
+  createDocument: (body) => request("/v1/documents", { method: "POST", body }),
+  listDocumentVersions: (id) => request(`/v1/documents/${id}/versions`),
+  addDocumentVersion: (id, body) => request(`/v1/documents/${id}/versions`, {
+    method: "POST",
+    body
+  }),
+  getDocumentVersion: (id, vid) => request(`/v1/documents/${id}/versions/${vid}`),
+  promoteDocumentVersion: (id, vid) => request(`/v1/documents/${id}/versions/${vid}`, {
+    method: "PATCH",
+    body: { is_primary: true }
+  }),
+  // Folders
+  listFolders: (query) => request("/v1/folders", { query }),
+  createFolder: (body) => request("/v1/folders", { method: "POST", body }),
+  getFolder: (id) => request(`/v1/folders/${id}`),
+  updateFolder: (id, body) => request(`/v1/folders/${id}`, { method: "PATCH", body }),
+  deleteFolder: (id, opts) => request(`/v1/folders/${id}`, {
+    method: "DELETE",
+    query: opts?.cascade ? { cascade: "true" } : void 0
+  }),
+  moveFolder: (id, body) => request(`/v1/folders/${id}/move`, { method: "POST", body }),
+  // Links
+  listLinks: (query) => request("/v1/links", { query }),
+  getLink: (id) => request(`/v1/links/${id}`),
+  createLink: (body) => request("/v1/links", { method: "POST", body }),
+  updateLink: (id, body) => request(`/v1/links/${id}`, { method: "PATCH", body }),
+  deleteLink: (id) => request(`/v1/links/${id}`, { method: "DELETE" }),
+  // Views
+  listViews: (linkId, query) => request(`/v1/links/${linkId}/views`, { query }),
+  // Datarooms
+  listDatarooms: (query) => request("/v1/datarooms", { query }),
+  getDataroom: (id) => request(`/v1/datarooms/${id}`),
+  createDataroom: (body) => request("/v1/datarooms", { method: "POST", body }),
+  updateDataroom: (id, body) => request(`/v1/datarooms/${id}`, { method: "PATCH", body }),
+  deleteDataroom: (id) => request(`/v1/datarooms/${id}`, { method: "DELETE" }),
+  listDataroomDocuments: (id, query) => request(`/v1/datarooms/${id}/documents`, { query }),
+  attachDataroomDocument: (id, body) => request(`/v1/datarooms/${id}/documents`, {
+    method: "POST",
+    body
+  }),
+  // Dataroom folders
+  listDataroomFolders: (id, query) => request(`/v1/datarooms/${id}/folders`, { query }),
+  createDataroomFolder: (id, body) => request(`/v1/datarooms/${id}/folders`, {
+    method: "POST",
+    body
+  }),
+  getDataroomFolder: (id, fid) => request(`/v1/datarooms/${id}/folders/${fid}`),
+  updateDataroomFolder: (id, fid, body) => request(`/v1/datarooms/${id}/folders/${fid}`, {
+    method: "PATCH",
+    body
+  }),
+  deleteDataroomFolder: (id, fid, opts) => request(`/v1/datarooms/${id}/folders/${fid}`, {
+    method: "DELETE",
+    query: opts?.cascade ? { cascade: "true" } : void 0
+  }),
+  moveDataroomFolder: (id, fid, body) => request(`/v1/datarooms/${id}/folders/${fid}/move`, {
+    method: "POST",
+    body
+  }),
+  // Visitors
+  listVisitors: (query) => request("/v1/visitors", { query }),
+  getVisitor: (id) => request(`/v1/visitors/${id}`),
+  listVisitorViews: (id, query) => request(`/v1/visitors/${id}/views`, { query }),
+  // Analytics
+  documentAnalytics: (id, query) => request(`/v1/analytics/documents/${id}`, { query }),
+  linkAnalytics: (id, query) => request(`/v1/analytics/links/${id}`, { query }),
+  dataroomAnalytics: (id, query) => request(`/v1/analytics/datarooms/${id}`, { query }),
+  viewAnalytics: (id) => request(`/v1/analytics/views/${id}`)
+};
+
+// src/output.ts
+import chalk from "chalk";
+
+// src/exit.ts
+var ExitCode = {
+  Ok: 0,
+  /** Upstream API returned 4xx/5xx that isn't auth or validation. */
+  ApiError: 1,
+  /** No token, expired token, invalid token, missing scope. */
+  AuthError: 2,
+  /** Client-side input validation, or server-side 422. */
+  ValidationError: 3,
+  /** Network/DNS/connection refused, bad URL, etc. */
+  NetworkError: 4,
+  /** Unexpected — bug in the CLI itself. */
+  Internal: 5
+};
+var EXIT_CODE_LEGEND = {
+  [ExitCode.Ok]: "success",
+  [ExitCode.ApiError]: "API error (4xx/5xx)",
+  [ExitCode.AuthError]: "authentication error",
+  [ExitCode.ValidationError]: "validation error",
+  [ExitCode.NetworkError]: "network error",
+  [ExitCode.Internal]: "internal CLI error"
+};
+
+// src/output.ts
+var ValidationError = class extends Error {
+  details;
+  constructor(message, details) {
+    super(message);
+    this.name = "ValidationError";
+    this.details = details;
+  }
+};
+function formatError(err) {
+  if (err instanceof AuthRequiredError) {
+    const message = sanitizeForTerminal(err.message);
+    return {
+      human: chalk.red("\u2717 ") + message,
+      json: {
+        error: {
+          code: "NO_TOKEN",
+          message: err.message,
+          retryable: false,
+          hint: "Run `papermark login` to authenticate."
+        }
+      },
+      exitCode: ExitCode.AuthError
+    };
+  }
+  if (err instanceof NetworkError) {
+    const message = sanitizeForTerminal(err.message);
+    return {
+      human: chalk.red("\u2717 ") + message + chalk.dim(
+        "\n  Hint: check `papermark config show` and your internet connection."
+      ),
+      json: {
+        error: {
+          code: "NETWORK_ERROR",
+          message: err.message,
+          retryable: true,
+          hint: "check `papermark config show` and your internet connection"
+        }
+      },
+      exitCode: ExitCode.NetworkError
+    };
+  }
+  if (err instanceof ValidationError) {
+    const message = sanitizeForTerminal(err.message);
+    return {
+      human: chalk.red("\u2717 ") + message,
+      json: {
+        error: {
+          code: "VALIDATION",
+          message: err.message,
+          retryable: false,
+          ...err.details ? { details: err.details } : {}
+        }
+      },
+      exitCode: ExitCode.ValidationError
+    };
+  }
+  if (err instanceof ApiError) {
+    const hint = hintForApiError(err);
+    const safeMessage = sanitizeForTerminal(err.message);
+    const safeDocUrl = err.docUrl ? sanitizeForTerminal(err.docUrl) : "";
+    const safeDetails = err.details && typeof err.details === "object" ? sanitizeForTerminal(JSON.stringify(err.details)) : "";
+    const docs = safeDocUrl ? chalk.dim(`
+  See:  ${safeDocUrl}`) : "";
+    const hintLine = hint ? chalk.dim(`
+  Hint: ${hint}`) : "";
+    const details = safeDetails ? chalk.dim("\n  " + safeDetails) : "";
+    return {
+      human: chalk.red(`\u2717 [${err.status} ${err.code}] `) + safeMessage + hintLine + docs + details,
+      json: {
+        error: {
+          code: err.code,
+          message: err.message,
+          status: err.status,
+          retryable: isRetryableStatus(err.status),
+          ...hint ? { hint } : {},
+          ...err.docUrl ? { doc_url: err.docUrl } : {},
+          ...err.details ? { details: err.details } : {}
+        }
+      },
+      exitCode: exitCodeForApiError(err)
+    };
+  }
+  const rawMessage = err instanceof Error ? err.message : String(err);
+  return {
+    human: chalk.red("\u2717 ") + sanitizeForTerminal(rawMessage),
+    json: { error: { code: "INTERNAL", message: rawMessage, retryable: false } },
+    exitCode: ExitCode.Internal
+  };
+}
+function isRetryableStatus(status) {
+  if (status === 429) return true;
+  if (status >= 500 && status < 600) return true;
+  return false;
+}
+function hintForApiError(err) {
+  if (err.status === 401) return "Run `papermark login` to re-authenticate.";
+  if (err.status === 403) {
+    return "Token is missing a required scope. Re-login to refresh grants.";
+  }
+  if (err.status === 429) {
+    return "Rate limit exceeded. Check X-RateLimit-* headers and back off.";
+  }
+  if (err.status === 422) return "Check the input shape \u2014 details below.";
+  return void 0;
+}
+function exitCodeForApiError(err) {
+  if (err.status === 401) return ExitCode.AuthError;
+  if (err.status === 403) return ExitCode.AuthError;
+  if (err.status === 422) return ExitCode.ValidationError;
+  return ExitCode.ApiError;
+}
+function die(err) {
+  const fe = formatError(err);
+  if (getRuntime().json) {
+    process.stderr.write(
+      JSON.stringify({ ok: false, error: fe.json.error }) + "\n"
+    );
+  } else {
+    process.stderr.write(fe.human + "\n");
+  }
+  process.exit(fe.exitCode);
+}
+function emit(payload, human) {
+  const rt = getRuntime();
+  if (rt.dryRun) return;
+  if (rt.json) {
+    process.stdout.write(JSON.stringify(wrapSuccess(payload), null, 2) + "\n");
+  } else {
+    process.stdout.write(human() + "\n");
+  }
+}
+function wrapSuccess(payload) {
+  if (payload !== null && typeof payload === "object" && "data" in payload && "next_cursor" in payload && Array.isArray(payload.data)) {
+    const p = payload;
+    return { ok: true, data: p.data, meta: { next_cursor: p.next_cursor } };
+  }
+  return { ok: true, data: payload };
+}
+function table(rows, columns) {
+  if (rows.length === 0) return chalk.dim("(no rows)");
+  const widths = columns.map(
+    (c) => Math.max(c.length, ...rows.map((r) => (r[c] ?? "").length))
+  );
+  const pad = (s, n) => s + " ".repeat(Math.max(0, n - s.length));
+  const header = columns.map((c, i) => chalk.bold(pad(c, widths[i]))).join("  ");
+  const sep = columns.map((_, i) => "\u2500".repeat(widths[i])).join("  ");
+  const body = rows.map(
+    (r) => columns.map((c, i) => pad(r[c] ?? "", widths[i])).join("  ")
+  );
+  return [header, chalk.dim(sep), ...body].join("\n");
+}
+function json(obj) {
+  return JSON.stringify(obj, null, 2);
+}
+function sanitizeForTerminal(input) {
+  return input.replace(/\x1B\[[0-9;?]*[ -/]*[@-~]/g, "").replace(/\x1B\][^\x07\x1B]*(\x07|\x1B\\)/g, "").replace(/[\x00-\x08\x0B-\x1F\x7F]/g, "").replace(/\x1B/g, "").replace(/[\x80-\x9F]/g, "").replace(/[\u202A-\u202E\u2066-\u2069\u200E\u200F]/g, "").replace(/[\u200B-\u200D\u2060]/g, "");
+}
+
+// src/commands/analytics.ts
+function registerAnalyticsCommands(program2) {
+  const analytics = program2.command("analytics").description("Aggregate analytics (Tinybird-backed, tighter rate limit)");
+  analytics.command("document <id>").description(
+    "Document analytics: total views, unique viewers, total read time, per-page average duration."
+  ).option("--since <unix-ms>", "window start (default: 30 days ago)", (v) => Number(v)).option("--until <unix-ms>", "window end (default: now)", (v) => Number(v)).option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const stats = await api.documentAnalytics(id, {
+          since: opts.since,
+          until: opts.until
+        });
+        emit(stats, () => formatDocumentAnalytics(stats));
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  analytics.command("link <id>").description("Aggregate analytics for a single share link.").option("--since <unix-ms>", "window start (default: 30 days ago)", (v) => Number(v)).option("--until <unix-ms>", "window end (default: now)", (v) => Number(v)).option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const stats = await api.linkAnalytics(id, {
+          since: opts.since,
+          until: opts.until
+        });
+        emit(stats, () => formatLinkAnalytics(stats));
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  analytics.command("dataroom <id>").description("Aggregate analytics for a dataroom (alias of `papermark dr stats`).").option("--since <unix-ms>", "window start (default: 30 days ago)", (v) => Number(v)).option("--until <unix-ms>", "window end (default: now)", (v) => Number(v)).option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const stats = await api.dataroomAnalytics(id, {
+          since: opts.since,
+          until: opts.until
+        });
+        emit(stats, () => formatDataroomAnalytics(stats));
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  analytics.command("view <id>").description(
+    "Per-view breakdown: page-by-page time spent, total duration, viewer geo + client."
+  ).option("--json", "output raw JSON").action(async (id, opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const stats = await api.viewAnalytics(id);
+      emit(stats, () => json(stats));
+    } catch (err) {
+      die(err);
+    }
+  });
+}
+function formatDocumentAnalytics(stats) {
+  const minutes = Math.round(stats.total_duration_seconds / 60);
+  const lines = [
+    `${chalk2.bold("Document:")}       ${stats.document_id}`,
+    `${chalk2.bold("Total views:")}    ${stats.total_views}`,
+    `${chalk2.bold("Unique viewers:")} ${stats.unique_viewers}`,
+    `${chalk2.bold("Total read time:")} ${minutes} min (${stats.total_duration_seconds.toFixed(1)} s)`,
+    chalk2.dim(`Window: ${stats.since.slice(0, 10)} \u2192 ${stats.until.slice(0, 10)}`)
+  ];
+  if (stats.avg_page_duration_seconds.length > 0) {
+    const rows = stats.avg_page_duration_seconds.map((p) => ({
+      page: String(p.page_number),
+      avg_seconds: p.avg_duration_seconds.toFixed(1)
+    }));
+    lines.push("", chalk2.bold("Per-page average duration:"));
+    lines.push(table(rows, ["page", "avg_seconds"]));
+  }
+  return lines.join("\n");
+}
+function formatLinkAnalytics(stats) {
+  const minutes = Math.round(stats.total_duration_seconds / 60);
+  return [
+    `${chalk2.bold("Link:")}           ${stats.link_id}`,
+    `${chalk2.bold("Total views:")}    ${stats.total_views}`,
+    `${chalk2.bold("Unique viewers:")} ${stats.unique_viewers}`,
+    `${chalk2.bold("Total read time:")} ${minutes} min (${stats.total_duration_seconds.toFixed(1)} s)`,
+    chalk2.dim(`Window: ${stats.since.slice(0, 10)} \u2192 ${stats.until.slice(0, 10)}`)
+  ].join("\n");
+}
+function formatDataroomAnalytics(stats) {
+  const minutes = Math.round(stats.total_duration_seconds / 60);
+  return [
+    `${chalk2.bold("Dataroom:")}       ${stats.dataroom_id}`,
+    `${chalk2.bold("Total views:")}    ${stats.total_views}`,
+    `${chalk2.bold("Unique viewers:")} ${stats.unique_viewers}`,
+    `${chalk2.bold("Total read time:")} ${minutes} min (${stats.total_duration_seconds.toFixed(1)} s)`,
+    chalk2.dim(`Window: ${stats.since.slice(0, 10)} \u2192 ${stats.until.slice(0, 10)}`)
+  ].join("\n");
+}
+
+// src/commands/auth.ts
+import chalk3 from "chalk";
+import { Command } from "commander";
+import ora from "ora";
+
+// src/oauth.ts
+import * as oauth from "oauth4webapi";
+import open from "open";
+var CLIENT_ID = "papermark-cli";
+var DEFAULT_SCOPES = [
+  "openid",
+  "offline_access",
+  "documents.read",
+  "documents.write",
+  "links.read",
+  "links.write",
+  "datarooms.read",
+  "datarooms.write",
+  "analytics.read",
+  "visitors.read"
+];
+function deriveIssuer(apiUrl = getApiUrl()) {
+  const url = new URL(apiUrl);
+  if (url.pathname === "/api" || url.pathname === "/api/") {
+    return new URL(`${url.origin}`);
+  }
+  if (url.hostname.startsWith("api.")) {
+    return new URL(`${url.protocol}//${url.host.replace(/^api\./, "app.")}`);
+  }
+  return new URL(url.origin);
+}
+async function discover(issuer) {
+  const response = await oauth.discoveryRequest(issuer, {
+    algorithm: "oidc",
+    ...allowHttpIfLocal(issuer)
+  });
+  return oauth.processDiscoveryResponse(issuer, response);
+}
+function allowHttpIfLocal(u) {
+  const isLocal = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname.endsWith(".local"));
+  return isLocal ? { [oauth.allowInsecureRequests]: true } : {};
+}
+async function requestDeviceAuthorization(as, scopes) {
+  if (!as.device_authorization_endpoint) {
+    throw new Error(
+      "Authorization server does not advertise a device authorization endpoint."
+    );
+  }
+  const body = new URLSearchParams({
+    client_id: CLIENT_ID,
+    scope: scopes.join(" ")
+  });
+  const json2 = await postFormJson(
+    as.device_authorization_endpoint,
+    body,
+    "device authorization"
+  );
+  return json2;
+}
+async function postFormJson(endpoint, body, what) {
+  let res;
+  try {
+    res = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body
+    });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(
+      `${what}: network request to ${endpoint} failed (${reason}). Check connectivity and that the OAuth server is reachable.`
+    );
+  }
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = text ? JSON.parse(text) : null;
+  } catch {
+    parsed = null;
+  }
+  if (!res.ok) {
+    if (parsed) {
+      const e = new Error(
+        `${what} failed: ${res.status} ${JSON.stringify(parsed)}`
+      );
+      e.body = parsed;
+      throw e;
+    }
+    const snippet = text ? text.slice(0, 200) : "(empty body)";
+    throw new Error(
+      `${what} failed: HTTP ${res.status} (non-JSON response: ${snippet})`
+    );
+  }
+  if (!parsed) {
+    throw new Error(
+      `${what} succeeded but returned a non-JSON body \u2014 is the endpoint correct? URL: ${endpoint}`
+    );
+  }
+  return parsed;
+}
+async function pollForToken(as, deviceCode, {
+  interval = 5,
+  expiresIn = 600,
+  onTick
+} = {}) {
+  if (!as.token_endpoint) throw new Error("No token_endpoint in discovery");
+  const deadline = Date.now() + expiresIn * 1e3;
+  let wait = Math.max(interval, 1);
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, wait * 1e3));
+    onTick?.();
+    const body = new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: CLIENT_ID
+    });
+    let parsed;
+    try {
+      parsed = await postFormJson(as.token_endpoint, body, "token request");
+    } catch (err) {
+      const errBody = err.body;
+      const errCode = errBody?.error;
+      if (errCode === "authorization_pending") continue;
+      if (errCode === "slow_down") {
+        wait += 5;
+        continue;
+      }
+      throw err;
+    }
+    return parsed;
+  }
+  throw new Error("Device code expired before authorization completed.");
+}
+async function tryOpenBrowser(url) {
+  try {
+    await open(url);
+  } catch {
+  }
+}
+
+// src/commands/auth.ts
+function registerAuthCommands(program2) {
+  program2.command("login").description("Sign in to Papermark via the browser (OAuth device flow)").option(
+    "--token <token>",
+    "paste an existing API token non-interactively (skip OAuth)"
+  ).option(
+    "--scopes <list>",
+    "comma-separated scopes to request (defaults to read+write on documents/links plus analytics.read)"
+  ).option("--no-browser", "do not auto-open a browser; print the URL only").action(
+    async (opts) => {
+      try {
+        if (opts.token) {
+          return await loginWithToken(opts.token);
+        }
+        const scopes = opts.scopes ? opts.scopes.split(/[\s,]+/).filter(Boolean) : DEFAULT_SCOPES;
+        return await loginWithDeviceFlow(scopes, {
+          openBrowser: opts.browser !== false
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  program2.command("logout").description("Remove the stored API token").action(() => {
+    clearToken();
+    emit({ removed: true }, () => chalk3.green("\u2713") + " Token removed.");
+  });
+  program2.command("whoami").description("Show the active token and API URL").action(() => {
+    const token = getToken();
+    if (!token) {
+      die(new AuthRequiredError());
+    }
+    const partial = `${token.slice(0, 11)}...${token.slice(-4)}`;
+    emit(
+      {
+        apiUrl: getApiUrl(),
+        token: partial,
+        source: getTokenSource(),
+        config: configPath()
+      },
+      () => [
+        `${chalk3.bold("API URL:")} ${getApiUrl()}`,
+        `${chalk3.bold("Token:  ")} ${partial}`,
+        `${chalk3.bold("Source: ")} ${getTokenSource()}`,
+        `${chalk3.bold("Config: ")} ${configPath()}`
+      ].join("\n")
+    );
+  });
+  program2.command("auth").description("Auth helpers (export, set, status)").addCommand(buildAuthExport()).addCommand(buildAuthSet());
+}
+function buildAuthExport() {
+  return new Command("export").description(
+    "Print current credentials as JSON. Useful for CI: redirect into a file and set PAPERMARK_CREDENTIALS_FILE."
+  ).option(
+    "--unmasked",
+    "include the full token (default: mask to first-6 + last-4 chars)"
+  ).action((opts) => {
+    const token = getToken();
+    if (!token) {
+      die(new AuthRequiredError());
+    }
+    const payload = {
+      token: opts.unmasked ? token : `${token.slice(0, 8)}***${token.slice(-4)}`,
+      apiUrl: getApiUrl(),
+      source: getTokenSource()
+    };
+    process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
+    if (!opts.unmasked) {
+      process.stderr.write(
+        chalk3.dim(
+          "Token is masked. Pass --unmasked to include the full value (e.g. for writing to a secrets file).\n"
+        )
+      );
+    }
+  });
+}
+function buildAuthSet() {
+  return new Command("set").description(
+    "Set credentials from stdin. Pipes a token (or JSON blob with {token, apiUrl}) into the CLI's config without leaving a tempfile on disk or exposing the value via `ps` / shell history. Ideal for CI runners pulling from a secret manager."
+  ).option(
+    "--stdin",
+    "read the token (or JSON blob with --json) from stdin until EOF"
+  ).option(
+    "--json",
+    "interpret stdin as a JSON object of shape {token, apiUrl?} instead of a bare token"
+  ).action(async (opts) => {
+    if (!opts.stdin) {
+      die(
+        new ValidationError(
+          "auth set currently requires --stdin. Pipe the token via stdin."
+        )
+      );
+    }
+    if (process.stdin.isTTY) {
+      die(
+        new ValidationError(
+          "stdin is a TTY \u2014 pipe the token in (e.g. `op read op://vault/papermark | papermark auth set --stdin`)."
+        )
+      );
+    }
+    const raw = await readStdin();
+    if (!raw.trim()) {
+      die(
+        new ValidationError(
+          "No data on stdin. Pipe a token, or exit with Ctrl-D."
+        )
+      );
+    }
+    let token;
+    let apiUrl;
+    if (opts.json) {
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch (parseErr) {
+        die(
+          new ValidationError("stdin was not valid JSON.", {
+            parseError: parseErr instanceof Error ? parseErr.message : String(parseErr)
+          })
+        );
+      }
+      if (!parsed || typeof parsed !== "object") {
+        die(
+          new ValidationError(
+            'Expected a JSON object like {"token":"..."}.'
+          )
+        );
+      }
+      const p = parsed;
+      if (typeof p.token !== "string" || !p.token) {
+        die(
+          new ValidationError('JSON is missing a non-empty "token" field.')
+        );
+      }
+      token = p.token;
+      if (typeof p.apiUrl === "string") apiUrl = p.apiUrl;
+      else if (typeof p.api_url === "string") apiUrl = p.api_url;
+    } else {
+      token = raw.trim();
+    }
+    const prevToken = getToken();
+    const prevApiUrl = getApiUrl();
+    setToken(token);
+    if (apiUrl) setApiUrl(apiUrl);
+    try {
+      await api.listDocuments({ limit: 1 });
+    } catch (err) {
+      if (prevToken) setToken(prevToken);
+      else clearToken();
+      if (apiUrl) setApiUrl(prevApiUrl);
+      die(err);
+    }
+    const partial = `${token.slice(0, 8)}***${token.slice(-4)}`;
+    emit(
+      { token: partial, source: getTokenSource(), config: configPath() },
+      () => chalk3.green("\u2713") + ` Token stored (${partial}). Config: ${chalk3.dim(configPath())}`
+    );
+  });
+}
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    process.stdin.on("data", (c) => chunks.push(c));
+    process.stdin.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    process.stdin.on("error", reject);
+  });
+}
+async function loginWithToken(token) {
+  const prevToken = getToken();
+  setToken(token.trim());
+  try {
+    await api.listDocuments({ limit: 1 });
+  } catch (err) {
+    if (prevToken) setToken(prevToken);
+    else clearToken();
+    if (err instanceof NetworkError) {
+      writeErrorWithHint(
+        err,
+        `
+  Current API URL: ${getApiUrl()}
+  If you're running Papermark locally, point the CLI at it:
+    papermark config set api-url http://localhost:3000/api`
+      );
+    }
+    throw err;
+  }
+  emit(
+    { apiUrl: getApiUrl(), config: configPath() },
+    () => chalk3.green("\u2713") + ` Logged in at ${chalk3.bold(getApiUrl())}. Config: ${chalk3.dim(configPath())}`
+  );
+}
+function writeErrorWithHint(err, hint) {
+  const fe = formatError(err);
+  if (getRuntime().json) {
+    process.stderr.write(
+      JSON.stringify({ ok: false, error: fe.json.error }) + "\n"
+    );
+  } else {
+    process.stderr.write(fe.human + chalk3.dim(hint) + "\n");
+  }
+  process.exit(fe.exitCode);
+}
+async function loginWithDeviceFlow(scopes, { openBrowser }) {
+  const issuer = deriveIssuer();
+  const issuerDisplay = issuer.toString().replace(/\/$/, "");
+  const discoverSpinner = ora(`Contacting ${issuerDisplay}`).start();
+  let as;
+  try {
+    as = await discover(issuer);
+  } catch (err) {
+    discoverSpinner.fail();
+    writeErrorWithHint(
+      err,
+      `
+  Fetched ${issuerDisplay}/.well-known/openid-configuration.
+  If this isn't a Papermark deployment, paste an API token instead:
+    papermark login --token pm_live_xxx`
+    );
+  }
+  discoverSpinner.succeed(`Discovered ${as.issuer}`);
+  const authSpinner = ora("Requesting device authorization").start();
+  let auth;
+  try {
+    auth = await requestDeviceAuthorization(as, scopes);
+  } catch (err) {
+    authSpinner.fail();
+    throw err;
+  }
+  authSpinner.succeed("Got a user code");
+  const target = auth.verification_uri_complete ?? auth.verification_uri;
+  console.log("");
+  console.log("  " + chalk3.bold("Open this URL in your browser:"));
+  console.log("    " + chalk3.cyan(target));
+  console.log("  " + chalk3.bold("And enter this code if prompted:"));
+  console.log("    " + chalk3.bold(chalk3.yellow(auth.user_code)));
+  console.log("");
+  if (openBrowser) {
+    await tryOpenBrowser(target);
+  }
+  const pollSpinner = ora("Waiting for you to approve in the browser\u2026").start();
+  let token;
+  try {
+    token = await pollForToken(as, auth.device_code, {
+      interval: auth.interval ?? 5,
+      expiresIn: auth.expires_in
+    });
+  } catch (err) {
+    pollSpinner.fail();
+    throw err;
+  }
+  pollSpinner.succeed("Access token granted");
+  const prevToken = getToken();
+  setToken(token.access_token);
+  try {
+    await api.listDocuments({ limit: 1 });
+  } catch (err) {
+    if (prevToken) setToken(prevToken);
+    else clearToken();
+    throw err;
+  }
+  const expiresIn = token.expires_in ?? null;
+  const expiryLabel = formatExpiry(expiresIn);
+  emit(
+    {
+      apiUrl: getApiUrl(),
+      config: configPath(),
+      ...token.scope ? { scopes: token.scope.split(" ") } : {},
+      ...expiresIn != null ? { expires_in: expiresIn } : {}
+    },
+    () => {
+      const lines = [
+        chalk3.green("\u2713") + ` Logged in at ${chalk3.bold(getApiUrl())}. Config: ${chalk3.dim(configPath())}`
+      ];
+      if (token.scope) lines.push(chalk3.dim(`  Scopes: ${token.scope}`));
+      if (expiryLabel) {
+        lines.push(
+          chalk3.dim(
+            `  Please note: this key will expire after ${expiryLabel}, at which point you'll need to re-authenticate.`
+          )
+        );
+      }
+      return lines.join("\n");
+    }
+  );
+}
+function formatExpiry(expiresInSeconds) {
+  if (expiresInSeconds == null) return null;
+  const days = Math.round(expiresInSeconds / 86400);
+  if (days >= 2) return `${days} days`;
+  const hours = Math.round(expiresInSeconds / 3600);
+  if (hours >= 2) return `${hours} hours`;
+  return `${expiresInSeconds}s`;
+}
+
+// src/commands/config.ts
+import chalk4 from "chalk";
+var KNOWN_KEYS = ["api-url"];
+function isKnown(key) {
+  return KNOWN_KEYS.includes(key);
+}
+function registerConfigCommands(program2) {
+  const cfg = program2.command("config").description("Manage CLI configuration");
+  cfg.command("get [key]").description("Print one or all config values").action((key) => {
+    const all = getAll();
+    if (!key) {
+      console.log(`${chalk4.dim("# " + configPath())}`);
+      console.log(`api-url  ${all.apiUrl ?? ""}`);
+      console.log(`token    ${all.token ? "(set)" : "(not set)"}`);
+      return;
+    }
+    if (!isKnown(key)) return die(new Error(`Unknown key: ${key}`));
+    if (key === "api-url") console.log(all.apiUrl ?? "");
+  });
+  cfg.command("set <key> <value>").description(`Set a config value. Known keys: ${KNOWN_KEYS.join(", ")}`).action((key, value) => {
+    if (!isKnown(key)) return die(new Error(`Unknown key: ${key}`));
+    if (key === "api-url") setApiUrl(value);
+    console.log(chalk4.green("\u2713") + ` ${key} = ${value}`);
+  });
+  cfg.command("unset <key>").description("Clear a config value").action((key) => {
+    if (!isKnown(key)) return die(new Error(`Unknown key: ${key}`));
+    if (key === "api-url") deleteKey("apiUrl");
+    console.log(chalk4.green("\u2713") + ` ${key} unset`);
+  });
+}
+
+// src/commands/datarooms.ts
+import chalk5 from "chalk";
+function registerDataroomsCommands(program2) {
+  const dr = program2.command("datarooms").alias("dr").description("Manage datarooms");
+  dr.command("list").description("List datarooms").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("-q, --query <substring>", "filter by dataroom name").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDatarooms({
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          query: opts.query
+        });
+        emit(res, () => {
+          const rows = res.data.map((d) => ({
+            id: d.pid,
+            name: truncate2(d.name, 30),
+            docs: String(d.document_count),
+            folders: String(d.folder_count),
+            created: d.created.slice(0, 10)
+          }));
+          const out = table(rows, ["id", "name", "docs", "folders", "created"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("get <id>").description(
+    "Fetch one dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).action(async (id) => {
+    try {
+      const room = await api.getDataroom(id);
+      emit(room, () => json(room));
+    } catch (err) {
+      die(err);
+    }
+  });
+  dr.command("create").description("Create a new (empty) dataroom").requiredOption("-n, --name <name>", "dataroom name").option(
+    "--internal-name <slug>",
+    "private alias visible only to your team"
+  ).option("-d, --description <text>", "human-readable description").action(
+    async (opts) => {
+      try {
+        const room = await api.createDataroom({
+          name: opts.name,
+          internal_name: opts.internalName,
+          description: opts.description
+        });
+        emit(
+          room,
+          () => chalk5.green("\u2713") + ` Dataroom created: ${chalk5.bold(room.pid)}
+` + json(room)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("update <id>").description(
+    "Update a dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).option("-n, --name <name>").option("--internal-name <slug>", "set or clear (use empty string)").option("-d, --description <text>", "set or clear (use empty string)").option("--bulk-download <on|off>", "allow or block bulk download").action(
+    async (id, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.internalName !== void 0)
+          body.internal_name = opts.internalName === "" ? null : opts.internalName;
+        if (opts.description !== void 0)
+          body.description = opts.description === "" ? null : opts.description;
+        const tri = (v, flag) => {
+          if (v === void 0) return void 0;
+          const norm = v.toLowerCase();
+          if (norm === "on") return true;
+          if (norm === "off") return false;
+          throw new Error(
+            `Invalid value for ${flag}: ${JSON.stringify(v)} (expected "on" or "off").`
+          );
+        };
+        const bulk = tri(opts.bulkDownload, "--bulk-download");
+        if (bulk !== void 0) body.allow_bulk_download = bulk;
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one field to update (e.g. --name, --description, --bulk-download off)."
+          );
+        }
+        const room = await api.updateDataroom(id, body);
+        emit(
+          room,
+          () => chalk5.green("\u2713") + ` Dataroom updated: ${chalk5.bold(room.pid)}
+` + json(room)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("links <id>").description(
+    "List share links scoped to a dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listLinks({
+          dataroom_id: id,
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((l) => ({
+            id: l.id,
+            name: truncate2(l.name ?? "", 30),
+            url: truncate2(l.url, 45),
+            password: l.is_password_protected ? "yes" : "",
+            expires: l.expires_at ? l.expires_at.slice(0, 10) : ""
+          }));
+          const out = table(rows, ["id", "name", "url", "password", "expires"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("viewers <id>").description(
+    "List persistent visitors (Viewer rows) tied to a dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--email <email>", "filter to a specific email (exact match)").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listVisitors({
+          dataroom_id: id,
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          email: opts.email
+        });
+        emit(res, () => {
+          const rows = res.data.map((v) => ({
+            id: v.id,
+            email: sanitizeForTerminal(v.email),
+            verified: v.verified ? "yes" : "",
+            views: String(v.total_views),
+            last_view: v.last_viewed_at?.slice(0, 10) ?? ""
+          }));
+          const out = table(rows, ["id", "email", "verified", "views", "last_view"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("stats <id>").alias("analytics").description(
+    "Aggregate analytics for a dataroom: total views, unique viewers, total read time. Backed by Tinybird \u2014 subject to a stricter rate limit. `id` accepts the internal cuid or the `dr_...` public id."
+  ).option(
+    "--since <unix-ms>",
+    "window start (default: 30 days ago)",
+    (v) => Number(v)
+  ).option(
+    "--until <unix-ms>",
+    "window end (default: now)",
+    (v) => Number(v)
+  ).option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const stats = await api.dataroomAnalytics(id, {
+          since: opts.since,
+          until: opts.until
+        });
+        emit(stats, () => {
+          const minutes = Math.round(stats.total_duration_seconds / 60);
+          return [
+            `${chalk5.bold("Dataroom:")}        ${stats.dataroom_id}`,
+            `${chalk5.bold("Total views:")}    ${stats.total_views}`,
+            `${chalk5.bold("Unique viewers:")} ${stats.unique_viewers}`,
+            `${chalk5.bold("Total read time:")} ${minutes} min (${stats.total_duration_seconds.toFixed(1)} s)`,
+            chalk5.dim(
+              `Window: ${stats.since.slice(0, 10)} \u2192 ${stats.until.slice(0, 10)}`
+            )
+          ].join("\n");
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("delete <id>").description(
+    "Delete a dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).action(async (id) => {
+    try {
+      const deleted = await api.deleteDataroom(id);
+      emit(
+        deleted,
+        () => chalk5.green("\u2713") + ` Dataroom ${id} deleted.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  dr.command("attach <id>").description(
+    "Attach an existing document to a dataroom. The document stays in the team library; this just adds it to the dataroom contents."
+  ).requiredOption("--document <id>", "document id to attach").option(
+    "--folder-id <fid>",
+    "place under a specific dataroom folder (must belong to the same dataroom)"
+  ).action(
+    async (id, opts) => {
+      try {
+        const item = await api.attachDataroomDocument(id, {
+          document_id: opts.document,
+          folder_id: opts.folderId
+        });
+        emit(
+          item,
+          () => chalk5.green("\u2713") + ` Attached document ${chalk5.bold(item.document_id)} as item ${chalk5.bold(item.id)}.
+` + json(item)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  const drFolders = dr.command("folders").description("Manage folders inside a dataroom");
+  drFolders.command("list <id>").description("List folders in a dataroom").option(
+    "--parent <fid>",
+    "restrict to direct children of this folder (use 'root' for top-level)"
+  ).option("-l, --limit <n>", "max results (1-100)", "50").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomFolders(id, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          parent_id: opts.parent
+        });
+        emit(res, () => {
+          const rows = res.data.map((f) => ({
+            id: f.id,
+            name: truncate2(f.name, 30),
+            path: truncate2(f.path, 40),
+            docs: String(f.document_count),
+            children: String(f.child_folder_count)
+          }));
+          const out = table(rows, ["id", "name", "path", "docs", "children"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drFolders.command("create <id>").description("Create a folder inside a dataroom").requiredOption("-n, --name <name>", "folder name").option("--parent <fid>", "parent folder id (omit for dataroom root)").option("--icon <icon>", "icon name (e.g. folder, briefcase, lock)").option("--color <color>", "color token (gray, red, orange, yellow, green, blue, black)").action(
+    async (id, opts) => {
+      try {
+        const f = await api.createDataroomFolder(id, {
+          name: opts.name,
+          parent_id: opts.parent ?? null,
+          icon: opts.icon,
+          color: opts.color
+        });
+        emit(
+          f,
+          () => chalk5.green("\u2713") + ` Dataroom folder created: ${chalk5.bold(f.id)}
+` + json(f)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drFolders.command("get <id> <fid>").description("Fetch one dataroom folder").action(async (id, fid) => {
+    try {
+      const f = await api.getDataroomFolder(id, fid);
+      emit(f, () => json(f));
+    } catch (err) {
+      die(err);
+    }
+  });
+  drFolders.command("update <id> <fid>").description("Update a dataroom folder").option("-n, --name <name>").option("--icon <icon>", "icon name (empty string to clear)").option("--color <color>", "color token (empty string to clear)").action(
+    async (id, fid, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.icon !== void 0)
+          body.icon = opts.icon === "" ? null : opts.icon;
+        if (opts.color !== void 0)
+          body.color = opts.color === "" ? null : opts.color;
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one of --name, --icon, --color to update."
+          );
+        }
+        const f = await api.updateDataroomFolder(id, fid, body);
+        emit(
+          f,
+          () => chalk5.green("\u2713") + ` Dataroom folder updated: ${chalk5.bold(f.id)}
+` + json(f)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drFolders.command("delete <id> <fid>").description("Delete a dataroom folder").option(
+    "--cascade",
+    "also delete nested folders + dataroom-document attachments",
+    false
+  ).action(
+    async (id, fid, opts) => {
+      try {
+        const deleted = await api.deleteDataroomFolder(id, fid, {
+          cascade: opts.cascade
+        });
+        emit(
+          deleted,
+          () => chalk5.green("\u2713") + ` Dataroom folder ${fid} deleted.`
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drFolders.command("move <id> <fid>").description("Move a dataroom folder under a different parent").option(
+    "--parent <fid>",
+    "target parent folder id; pass empty string for the dataroom root"
+  ).action(
+    async (id, fid, opts) => {
+      try {
+        if (opts.parent === void 0) {
+          throw new Error(
+            "Pass --parent <fid> (use empty string to move to the root)."
+          );
+        }
+        const parent_id = opts.parent === "" ? null : opts.parent;
+        const f = await api.moveDataroomFolder(id, fid, { parent_id });
+        emit(
+          f,
+          () => chalk5.green("\u2713") + ` Folder moved. New path: ${chalk5.bold(f.path)}
+` + json(f)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  dr.command("documents <id>").description(
+    "List documents inside a dataroom. `id` accepts the internal cuid or the `dr_...` public id."
+  ).option("-l, --limit <n>", "max results (1-100)", "50").option("-c, --cursor <id>", "pagination cursor").option("--folder <id>", "restrict to a folder").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomDocuments(id, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          folder_id: opts.folder
+        });
+        emit(res, () => {
+          const rows = res.data.map((it) => ({
+            id: it.id,
+            document: truncate2(it.document_name, 32),
+            folder: truncate2(it.folder_path ?? "/", 64),
+            type: it.content_type ?? "",
+            pages: it.num_pages?.toString() ?? ""
+          }));
+          const out = table(rows, ["id", "document", "folder", "type", "pages"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+}
+function truncate2(s, n) {
+  const clean = sanitizeForTerminal(s);
+  return clean.length > n ? clean.slice(0, n - 1) + "\u2026" : clean;
+}
+
+// src/commands/doctor.ts
+import chalk6 from "chalk";
+function registerDoctorCommand(program2) {
+  program2.command("doctor").description(
+    "Run health checks against the CLI config + Papermark API. Returns a `checks` array (JSON) and a non-zero exit if anything fails \u2014 useful as a CI preflight before running real commands."
+  ).action(async () => {
+    const checks = [];
+    const token = getToken();
+    checks.push({
+      name: "auth.present",
+      ok: Boolean(token),
+      detail: token ? `token found (source: ${getTokenSource()})` : "no token configured",
+      hint: token ? void 0 : "Run `papermark login` or set PAPERMARK_TOKEN."
+    });
+    const apiUrl = getApiUrl();
+    checks.push({
+      name: "config.api_url",
+      ok: Boolean(apiUrl),
+      detail: apiUrl
+    });
+    if (token) {
+      try {
+        await api.listDocuments({ limit: 1 });
+        checks.push({
+          name: "api.reachable",
+          ok: true,
+          detail: `GET /v1/documents?limit=1 \u2192 200 at ${apiUrl}`
+        });
+        checks.push({
+          name: "api.auth",
+          ok: true,
+          detail: "token accepted"
+        });
+      } catch (err) {
+        if (err instanceof NetworkError) {
+          checks.push({
+            name: "network.api",
+            ok: false,
+            detail: err.message,
+            hint: "Check your internet connection and the configured api-url."
+          });
+        } else if (err instanceof ApiError) {
+          const authIssue = err.status === 401 || err.status === 403;
+          checks.push({
+            name: "api.reachable",
+            ok: true,
+            detail: `HTTP ${err.status} ${err.code}: ${err.message}`
+          });
+          checks.push({
+            name: "api.auth",
+            ok: !authIssue,
+            detail: authIssue ? `Token rejected: HTTP ${err.status} ${err.code}` : `non-auth API error: HTTP ${err.status} ${err.code}`,
+            hint: authIssue ? "Run `papermark login` to refresh." : void 0
+          });
+        } else {
+          checks.push({
+            name: "api.reachable",
+            ok: false,
+            detail: err instanceof Error ? err.message : String(err)
+          });
+        }
+      }
+    } else {
+      checks.push({
+        name: "api.reachable",
+        ok: false,
+        detail: "skipped (no token)"
+      });
+    }
+    const allOk = checks.every((c) => c.ok);
+    emit({ ok: allOk, checks }, () => {
+      const lines = checks.map((c) => {
+        const glyph = c.ok ? chalk6.green("\u2713") : chalk6.red("\u2717");
+        const hint = c.hint ? chalk6.dim(`
+   Hint: ${c.hint}`) : "";
+        return `${glyph} ${chalk6.bold(c.name)}  ${chalk6.dim(c.detail)}${hint}`;
+      });
+      const footer = allOk ? chalk6.green("\nAll checks passed.") : chalk6.red("\nOne or more checks failed.");
+      return lines.join("\n") + footer;
+    });
+    if (!allOk) {
+      const anyNetworkFailure = checks.some(
+        (c) => !c.ok && c.name.startsWith("network")
+      );
+      const anyAuthFailure = checks.some(
+        (c) => !c.ok && (c.name.startsWith("auth") || c.name === "api.auth")
+      );
+      process.exit(
+        anyNetworkFailure ? ExitCode.NetworkError : anyAuthFailure ? ExitCode.AuthError : ExitCode.ApiError
+      );
+    }
+  });
+}
+
+// src/commands/documents.ts
+import { createReadStream } from "fs";
+import { stat } from "fs/promises";
+import { basename } from "path";
+import { Readable } from "stream";
+import chalk7 from "chalk";
+import { lookup as lookupMimeType } from "mime-types";
+import ora2 from "ora";
+function registerDocumentsCommands(program2) {
+  const docs = program2.command("documents").alias("doc").description("Manage documents");
+  docs.command("list").description("List documents").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON (same as --json on the root command)").action(async (opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const res = await api.listDocuments({
+        limit: opts.limit ? Number(opts.limit) : void 0,
+        cursor: opts.cursor
+      });
+      emit(res, () => {
+        const rows = res.data.map((d) => ({
+          id: d.id,
+          name: truncate3(d.name, 40),
+          type: d.type ?? "",
+          pages: d.num_pages?.toString() ?? "",
+          created: d.created.slice(0, 10)
+        }));
+        const out = table(rows, ["id", "name", "type", "pages", "created"]);
+        return res.next_cursor ? out + chalk7.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+      });
+    } catch (err) {
+      die(err);
+    }
+  });
+  docs.command("get <id>").description("Fetch one document").action(async (id) => {
+    try {
+      const doc = await api.getDocument(id);
+      emit(doc, () => json(doc));
+    } catch (err) {
+      die(err);
+    }
+  });
+  docs.command("search <query>").description("Search documents by name").option("-l, --limit <n>", "max results (1-100)", "25").option("--json", "output raw JSON (same as --json on the root command)").action(async (query, opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const res = await api.searchDocuments(
+        query,
+        opts.limit ? Number(opts.limit) : void 0
+      );
+      emit(res, () => {
+        const rows = res.data.map((d) => ({
+          id: d.id,
+          name: truncate3(d.name, 40),
+          type: d.type ?? "",
+          created: d.created.slice(0, 10)
+        }));
+        return table(rows, ["id", "name", "type", "created"]);
+      });
+    } catch (err) {
+      die(err);
+    }
+  });
+  docs.command("update <id>").description("Rename a document or move it to a different team-library folder").option("-n, --name <name>", "new document name").option("--folder-id <id>", "move into folder id (use empty string for root)").action(
+    async (id, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.folderId !== void 0) {
+          body.folder_id = opts.folderId === "" ? null : opts.folderId;
+        }
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one of --name or --folder-id to update."
+          );
+        }
+        const doc = await api.updateDocument(id, body);
+        emit(
+          doc,
+          () => chalk7.green("\u2713") + ` Document updated: ${chalk7.bold(doc.id)}
+` + json(doc)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  docs.command("delete <id>").description("Delete a document").action(async (id) => {
+    try {
+      const deleted = await api.deleteDocument(id);
+      emit(
+        deleted,
+        () => chalk7.green("\u2713") + ` Document ${id} deleted.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  docs.command("upload <file>").description("Upload a local file and create a document").option("-n, --name <name>", "override document name (default: filename)").option("--link", "also create a default share link for this document").option("--folder-id <id>", "place in folder by id (create folders via `papermark folders create`)").action(
+    async (filePath, opts) => {
+      const spinner = ora2();
+      try {
+        const stats = await stat(filePath);
+        if (!stats.isFile()) throw new Error(`${filePath} is not a file.`);
+        const fileName = opts.name ?? basename(filePath);
+        const contentType = lookupMimeType(filePath) || "application/octet-stream";
+        spinner.start("Requesting upload URL");
+        const upload = await api.uploadUrl({
+          fileName,
+          contentType,
+          contentLength: stats.size
+        });
+        spinner.succeed("Got presigned URL");
+        spinner.start(`Uploading ${humanSize(stats.size)}`);
+        const fileStream = Readable.toWeb(createReadStream(filePath));
+        const putRes = await fetch(upload.upload_url, {
+          method: "PUT",
+          headers: {
+            ...upload.required_headers,
+            "Content-Length": String(stats.size)
+          },
+          body: fileStream,
+          duplex: "half"
+        });
+        if (!putRes.ok) {
+          const errText = await putRes.text().catch(() => "");
+          throw new Error(
+            `Upload failed: HTTP ${putRes.status} ${putRes.statusText}${errText ? "\n" + errText.slice(0, 500) : ""}`
+          );
+        }
+        spinner.succeed("Uploaded to storage");
+        spinner.start("Creating document");
+        const doc = await api.createDocument({
+          name: fileName,
+          upload_id: upload.upload_id,
+          folder_id: opts.folderId,
+          create_link: opts.link ?? false
+        });
+        spinner.succeed(`Document created: ${chalk7.bold(doc.id)}`);
+        let link = null;
+        let linkWarning = null;
+        if (opts.link) {
+          try {
+            const links = await api.listLinks({
+              document_id: doc.id,
+              limit: 1
+            });
+            link = links.data[0] ?? null;
+            if (!link) {
+              linkWarning = "--link was set but no link was returned. Try `papermark links list --document " + doc.id + "`.";
+            }
+          } catch (warnErr) {
+            linkWarning = `Document created, but listing the share link failed: ${warnErr instanceof Error ? warnErr.message : String(warnErr)}`;
+          }
+          if (linkWarning) {
+            process.stderr.write(chalk7.yellow("! ") + linkWarning + "\n");
+          }
+        }
+        emit({ document: doc, link }, () => {
+          const blocks = [json(doc)];
+          if (link) {
+            blocks.push(
+              chalk7.green("\u2713") + " Share link: " + chalk7.bold(link.url)
+            );
+          }
+          return blocks.join("\n");
+        });
+      } catch (err) {
+        spinner.fail();
+        die(err);
+      }
+    }
+  );
+  const versions = docs.command("versions").description("Manage document versions");
+  versions.command("list <id>").description("List versions of a document, primary first").option("--json", "output raw JSON").action(async (id, opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const res = await api.listDocumentVersions(id);
+      emit(res, () => {
+        const rows = res.data.map((v) => ({
+          id: v.id,
+          version: String(v.version_number),
+          primary: v.is_primary ? "\u2605" : "",
+          type: v.type ?? "",
+          pages: v.num_pages?.toString() ?? "",
+          size: v.file_size !== null ? humanSize(v.file_size) : "",
+          created: v.created.slice(0, 10)
+        }));
+        return table(rows, [
+          "id",
+          "version",
+          "primary",
+          "type",
+          "pages",
+          "size",
+          "created"
+        ]);
+      });
+    } catch (err) {
+      die(err);
+    }
+  });
+  versions.command("get <id> <vid>").description("Fetch a single document version").action(async (id, vid) => {
+    try {
+      const v = await api.getDocumentVersion(id, vid);
+      emit(v, () => json(v));
+    } catch (err) {
+      die(err);
+    }
+  });
+  versions.command("add <id> <file>").description("Upload a new version of an existing document").action(async (id, filePath) => {
+    const spinner = ora2();
+    try {
+      const stats = await stat(filePath);
+      if (!stats.isFile()) throw new Error(`${filePath} is not a file.`);
+      const fileName = basename(filePath);
+      const contentType = lookupMimeType(filePath) || "application/octet-stream";
+      spinner.start("Requesting upload URL");
+      const upload = await api.uploadUrl({
+        fileName,
+        contentType,
+        contentLength: stats.size
+      });
+      spinner.succeed("Got presigned URL");
+      spinner.start(`Uploading ${humanSize(stats.size)}`);
+      const fileStream = Readable.toWeb(createReadStream(filePath));
+      const putRes = await fetch(upload.upload_url, {
+        method: "PUT",
+        headers: {
+          ...upload.required_headers,
+          "Content-Length": String(stats.size)
+        },
+        body: fileStream,
+        duplex: "half"
+      });
+      if (!putRes.ok) {
+        const errText = await putRes.text().catch(() => "");
+        throw new Error(
+          `Upload failed: HTTP ${putRes.status} ${putRes.statusText}${errText ? "\n" + errText.slice(0, 500) : ""}`
+        );
+      }
+      spinner.succeed("Uploaded to storage");
+      spinner.start("Adding version");
+      const v = await api.addDocumentVersion(id, { upload_id: upload.upload_id });
+      spinner.succeed(`Version ${v.version_number} added: ${chalk7.bold(v.id)}`);
+      emit(v, () => json(v));
+    } catch (err) {
+      spinner.fail();
+      die(err);
+    }
+  });
+  versions.command("promote <id> <vid>").description("Promote a version to primary").action(async (id, vid) => {
+    try {
+      const v = await api.promoteDocumentVersion(id, vid);
+      emit(
+        v,
+        () => chalk7.green("\u2713") + ` Version ${v.version_number} promoted to primary.
+` + json(v)
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+}
+function truncate3(s, n) {
+  const clean = sanitizeForTerminal(s);
+  return clean.length > n ? clean.slice(0, n - 1) + "\u2026" : clean;
+}
+function humanSize(bytes) {
+  const units = ["B", "KB", "MB", "GB"];
+  let n = bytes;
+  let i = 0;
+  while (n >= 1024 && i < units.length - 1) {
+    n /= 1024;
+    i++;
+  }
+  return `${n.toFixed(i === 0 ? 0 : 1)}${units[i]}`;
+}
+
+// src/commands/folders.ts
+import chalk8 from "chalk";
+function registerFoldersCommands(program2) {
+  const folders = program2.command("folders").description("Manage team-library folders");
+  folders.command("list").description("List folders in the team library").option(
+    "--parent <id>",
+    "restrict to direct children of this folder (use 'root' for top-level)"
+  ).option("-l, --limit <n>", "max results (1-100)", "50").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listFolders({
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          parent_id: opts.parent
+        });
+        emit(res, () => {
+          const rows = res.data.map((f) => ({
+            id: f.id,
+            name: truncate4(f.name, 30),
+            path: truncate4(f.path, 40),
+            docs: String(f.document_count),
+            children: String(f.child_folder_count)
+          }));
+          const out = table(rows, ["id", "name", "path", "docs", "children"]);
+          return res.next_cursor ? out + chalk8.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  folders.command("create").description("Create a folder in the team library").requiredOption("-n, --name <name>", "folder name").option("--parent <id>", "parent folder id (omit for library root)").option("--icon <icon>", "icon name (e.g. folder, briefcase, lock)").option("--color <color>", "color token (gray, red, orange, yellow, green, blue, black)").action(
+    async (opts) => {
+      try {
+        const f = await api.createFolder({
+          name: opts.name,
+          parent_id: opts.parent ?? null,
+          icon: opts.icon,
+          color: opts.color
+        });
+        emit(
+          f,
+          () => chalk8.green("\u2713") + ` Folder created: ${chalk8.bold(f.id)}
+` + json(f)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  folders.command("get <id>").description("Fetch one folder").action(async (id) => {
+    try {
+      const f = await api.getFolder(id);
+      emit(f, () => json(f));
+    } catch (err) {
+      die(err);
+    }
+  });
+  folders.command("update <id>").description("Update a folder").option("-n, --name <name>").option("--icon <icon>", "icon name (empty string to clear)").option("--color <color>", "color token (empty string to clear)").action(
+    async (id, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.icon !== void 0)
+          body.icon = opts.icon === "" ? null : opts.icon;
+        if (opts.color !== void 0)
+          body.color = opts.color === "" ? null : opts.color;
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one of --name, --icon, --color to update."
+          );
+        }
+        const f = await api.updateFolder(id, body);
+        emit(
+          f,
+          () => chalk8.green("\u2713") + ` Folder updated: ${chalk8.bold(f.id)}
+` + json(f)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  folders.command("delete <id>").description("Delete a folder").option(
+    "--cascade",
+    "also delete nested folders and every document inside them",
+    false
+  ).action(async (id, opts) => {
+    try {
+      const deleted = await api.deleteFolder(id, { cascade: opts.cascade });
+      emit(
+        deleted,
+        () => chalk8.green("\u2713") + ` Folder ${id} deleted.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  folders.command("move <id>").description("Move a folder under a different parent").option(
+    "--parent <id>",
+    "target parent folder id; pass empty string to move to the library root"
+  ).action(async (id, opts) => {
+    try {
+      if (opts.parent === void 0) {
+        throw new Error(
+          "Pass --parent <id> (use empty string to move to the root)."
+        );
+      }
+      const parent_id = opts.parent === "" ? null : opts.parent;
+      const f = await api.moveFolder(id, { parent_id });
+      emit(
+        f,
+        () => chalk8.green("\u2713") + ` Folder moved. New path: ${chalk8.bold(f.path)}
+` + json(f)
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+}
+function truncate4(s, n) {
+  const clean = sanitizeForTerminal(s);
+  return clean.length > n ? clean.slice(0, n - 1) + "\u2026" : clean;
+}
+
+// src/commands/links.ts
+import chalk9 from "chalk";
+function registerLinksCommands(program2) {
+  const links = program2.command("links").description("Manage share links");
+  links.command("list").description("List share links").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--document <id>", "filter by document id").option("--dataroom <id>", "filter by dataroom id").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listLinks({
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          document_id: opts.document,
+          dataroom_id: opts.dataroom
+        });
+        emit(res, () => {
+          const rows = res.data.map((l) => ({
+            id: l.id,
+            name: truncate5(l.name ?? "", 30),
+            url: truncate5(l.url, 45),
+            password: l.is_password_protected ? "yes" : "",
+            expires: l.expires_at ? l.expires_at.slice(0, 10) : ""
+          }));
+          const out = table(rows, ["id", "name", "url", "password", "expires"]);
+          return res.next_cursor ? out + chalk9.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  links.command("get <id>").description("Fetch one share link").action(async (id) => {
+    try {
+      const link = await api.getLink(id);
+      emit(link, () => json(link));
+    } catch (err) {
+      die(err);
+    }
+  });
+  links.command("create").description("Create a share link for a document or dataroom").option("--document <id>", "document id").option("--dataroom <id>", "dataroom id").option("-n, --name <name>", "link name").option("--expires <iso-date>", "expiration date (ISO 8601)").option("--password <pw>", "require a password to view").option("--email-protected", "require email before viewing", false).option("--allow-download", "allow viewer to download the file", false).action(
+    async (opts) => {
+      try {
+        if (!opts.document && !opts.dataroom) {
+          throw new Error("Either --document <id> or --dataroom <id> is required.");
+        }
+        const link = await api.createLink({
+          document_id: opts.document,
+          dataroom_id: opts.dataroom,
+          name: opts.name,
+          expires_at: opts.expires,
+          password: opts.password,
+          email_protected: opts.emailProtected,
+          allow_download: opts.allowDownload
+        });
+        emit(
+          link,
+          () => chalk9.green("\u2713") + " Link created\n" + chalk9.bold("URL: ") + link.url + "\n" + json(link)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  links.command("update <id>").description("Update an existing share link").option("-n, --name <name>").option("--expires <iso-date>", "expiration date (ISO 8601), or empty string to clear").option("--password <pw>", "set a password (empty string to clear)").option("--email-protected <on|off>").option("--email-authenticated <on|off>").option("--allow-download <on|off>").option(
+    "--allow-list <items>",
+    "comma-separated email/domain allow list (e.g. '@acme.com,bob@x.com')"
+  ).option("--deny-list <items>", "comma-separated email/domain deny list").option("--watermark <on|off>", "enable watermark overlay").option("--screenshot-protection <on|off>", "blur on screenshot").action(
+    async (id, opts) => {
+      try {
+        const tri = (v, flag) => {
+          if (v === void 0) return void 0;
+          const norm = v.toLowerCase();
+          if (norm === "on") return true;
+          if (norm === "off") return false;
+          throw new Error(
+            `Invalid value for ${flag}: ${JSON.stringify(v)} (expected "on" or "off").`
+          );
+        };
+        const list = (v) => v === void 0 ? void 0 : v === "" ? [] : v.split(",").map((s) => s.trim()).filter(Boolean);
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.expires !== void 0)
+          body.expires_at = opts.expires === "" ? null : opts.expires;
+        if (opts.password !== void 0)
+          body.password = opts.password === "" ? null : opts.password;
+        const ep = tri(opts.emailProtected, "--email-protected");
+        if (ep !== void 0) body.email_protected = ep;
+        const ea = tri(opts.emailAuthenticated, "--email-authenticated");
+        if (ea !== void 0) body.email_authenticated = ea;
+        const ad = tri(opts.allowDownload, "--allow-download");
+        if (ad !== void 0) body.allow_download = ad;
+        const al = list(opts.allowList);
+        if (al !== void 0) body.allow_list = al;
+        const dl = list(opts.denyList);
+        if (dl !== void 0) body.deny_list = dl;
+        const wm = tri(opts.watermark, "--watermark");
+        if (wm !== void 0) body.enable_watermark = wm;
+        const sp = tri(opts.screenshotProtection, "--screenshot-protection");
+        if (sp !== void 0) body.enable_screenshot_protection = sp;
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one field to update (e.g. --name, --expires, --password)."
+          );
+        }
+        const link = await api.updateLink(id, body);
+        emit(
+          link,
+          () => chalk9.green("\u2713") + ` Link updated: ${chalk9.bold(link.id)}
+` + json(link)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  links.command("delete <id>").description("Revoke a share link").action(async (id) => {
+    try {
+      const deleted = await api.deleteLink(id);
+      emit(
+        deleted,
+        () => chalk9.green("\u2713") + ` Link ${id} revoked.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+}
+function truncate5(s, n) {
+  const clean = sanitizeForTerminal(s);
+  return clean.length > n ? clean.slice(0, n - 1) + "\u2026" : clean;
+}
+
+// src/commands/views.ts
+import chalk10 from "chalk";
+function registerViewsCommands(program2) {
+  const views = program2.command("views").description("Read link view analytics");
+  views.command("list").description("List views for a share link").requiredOption("--link <id>", "link id").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON (same as --json on the root command)").action(
+    async (opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listViews(opts.link, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((v) => ({
+            id: v.id,
+            viewer: sanitizeForTerminal(v.viewer_email ?? ""),
+            type: v.view_type ?? "",
+            viewed: v.viewed_at.replace("T", " ").slice(0, 16),
+            downloaded: v.downloaded_at ? v.downloaded_at.slice(0, 10) : ""
+          }));
+          const out = table(rows, ["id", "viewer", "type", "viewed", "downloaded"]);
+          return res.next_cursor ? out + chalk10.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+}
+
+// src/commands/visitors.ts
+import chalk11 from "chalk";
+function registerVisitorsCommands(program2) {
+  const visitors = program2.command("visitors").description("Manage persistent visitors (Viewer rows)");
+  visitors.command("list").description("List visitors").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--email <email>", "exact email match (case-insensitive)").option("--dataroom <id>", "filter by dataroom id").option("--json", "output raw JSON").action(
+    async (opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listVisitors({
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor,
+          email: opts.email,
+          dataroom_id: opts.dataroom
+        });
+        emit(res, () => {
+          const rows = res.data.map((v) => ({
+            id: v.id,
+            email: sanitizeForTerminal(v.email),
+            verified: v.verified ? "yes" : "",
+            views: String(v.total_views),
+            last_view: v.last_viewed_at?.slice(0, 10) ?? ""
+          }));
+          const out = table(rows, ["id", "email", "verified", "views", "last_view"]);
+          return res.next_cursor ? out + chalk11.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  visitors.command("get <id>").description("Fetch one visitor").action(async (id) => {
+    try {
+      const v = await api.getVisitor(id);
+      emit(v, () => json(v));
+    } catch (err) {
+      die(err);
+    }
+  });
+  visitors.command("views <id>").description("List view events tied to a visitor").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listVisitorViews(id, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((v) => ({
+            id: v.id,
+            link: v.link_id,
+            type: v.view_type,
+            viewed: v.viewed_at.replace("T", " ").slice(0, 16),
+            downloaded: v.downloaded_at ? v.downloaded_at.slice(0, 10) : ""
+          }));
+          const out = table(rows, ["id", "link", "type", "viewed", "downloaded"]);
+          return res.next_cursor ? out + chalk11.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+}
+
+// src/index.ts
+var program = new Command2();
+program.name("papermark").description("Papermark CLI \u2014 manage documents, links, and views").version("0.1.0").option(
+  "--json",
+  "emit machine-readable JSON on stdout (auto-enabled when piped)"
+).option(
+  "--dry-run",
+  "print the HTTP request that would be sent and exit (token redacted)"
+).option("--no-color", "disable ANSI color (same as NO_COLOR=1)").hook("preAction", (thisCommand) => {
+  const opts = thisCommand.opts();
+  setRuntime({
+    json: Boolean(opts.json) || !process.stdout.isTTY,
+    dryRun: Boolean(opts.dryRun),
+    color: opts.color !== false && !process.env.NO_COLOR
+  });
+});
+registerAuthCommands(program);
+registerDoctorCommand(program);
+registerDocumentsCommands(program);
+registerFoldersCommands(program);
+registerLinksCommands(program);
+registerViewsCommands(program);
+registerDataroomsCommands(program);
+registerVisitorsCommands(program);
+registerAnalyticsCommands(program);
+registerConfigCommands(program);
+program.parseAsync(process.argv);
+//# sourceMappingURL=index.js.map