thinkwork-cli 0.7.0 → 0.8.1

package/dist/cli.js

@@ -32,6 +32,45 @@ function saveCliConfig(next, pathOverride) {
   const merged = { ...loadCliConfig(pathOverride), ...next };
   writeFileSync(path2, JSON.stringify(merged, null, 2) + "\n");
 }
+function saveStageSession(stage, session, pathOverride) {
+  const current = loadCliConfig(pathOverride);
+  const sessions = { ...current.sessions ?? {}, [stage]: session };
+  saveCliConfig({ sessions }, pathOverride);
+}
+function loadStageSession(stage, pathOverride) {
+  return loadCliConfig(pathOverride).sessions?.[stage] ?? null;
+}
+function clearStageSession(stage, pathOverride) {
+  const current = loadCliConfig(pathOverride);
+  if (!current.sessions?.[stage]) return;
+  const { [stage]: _removed, ...rest } = current.sessions;
+  saveCliConfig({ sessions: rest }, pathOverride);
+}
+
+// src/lib/output.ts
+import chalk from "chalk";
+var jsonMode = false;
+function setJsonMode(enabled) {
+  jsonMode = Boolean(enabled);
+}
+function isJsonMode() {
+  return jsonMode;
+}
+function printJson(value) {
+  if (!jsonMode) return;
+  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+function printKeyValue(pairs) {
+  if (jsonMode) return;
+  const width = Math.max(...pairs.map(([k]) => k.length));
+  for (const [k, v] of pairs) {
+    const label = chalk.dim(k.padEnd(width) + "  ");
+    console.log(`  ${label}${v ?? chalk.dim("\u2014")}`);
+  }
+}
+function logStderr(message) {
+  process.stderr.write(message + "\n");
+}
 
 // src/config.ts
 var VALID_COMPONENTS = ["foundation", "data", "app", "all"];
@@ -169,7 +208,7 @@ async function ensureInit(cwd) {
 }
 
 // src/ui.ts
-import chalk from "chalk";
+import chalk2 from "chalk";
 import ora from "ora";
 var TIER_LABELS = {
   foundation: "Foundation",
@@ -178,75 +217,175 @@ var TIER_LABELS = {
 };
 function printHeader(command, stage, identity) {
   console.log("");
-  console.log(chalk.bold.cyan("  \u2B21 Thinkwork") + chalk.dim(` \u2014 ${command}`));
-  console.log(chalk.dim(`  Stage: ${chalk.white(stage)}`));
+  console.log(chalk2.bold.cyan("  \u2B21 Thinkwork") + chalk2.dim(` \u2014 ${command}`));
+  console.log(chalk2.dim(`  Stage: ${chalk2.white(stage)}`));
   if (identity) {
-    console.log(chalk.dim(`  AWS:   ${chalk.white(identity.account)} / ${chalk.white(identity.region)}`));
+    console.log(chalk2.dim(`  AWS:   ${chalk2.white(identity.account)} / ${chalk2.white(identity.region)}`));
   }
   console.log("");
 }
 function printTierHeader(tier, index, total) {
   const label = TIER_LABELS[tier] ?? tier;
-  const progress = chalk.dim(`[${index + 1}/${total}]`);
-  console.log(`  ${progress} ${chalk.bold(label)}`);
+  const progress = chalk2.dim(`[${index + 1}/${total}]`);
+  console.log(`  ${progress} ${chalk2.bold(label)}`);
 }
 function printSuccess(message) {
   console.log(`
-  ${chalk.green("\u2713")} ${chalk.bold(message)}`);
+  ${chalk2.green("\u2713")} ${chalk2.bold(message)}`);
 }
 function printError(message) {
   console.log(`
-  ${chalk.red("\u2717")} ${chalk.bold.red(message)}`);
+  ${chalk2.red("\u2717")} ${chalk2.bold.red(message)}`);
 }
 function printWarning(message) {
-  console.log(`  ${chalk.yellow("\u26A0")} ${message}`);
+  console.log(`  ${chalk2.yellow("\u26A0")} ${message}`);
 }
 function printSummary(command, stage, tiers, startTime) {
   const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
   console.log("");
-  console.log(chalk.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(`  ${chalk.bold("Command:")}  ${command}`);
-  console.log(`  ${chalk.bold("Stage:")}    ${stage}`);
-  console.log(`  ${chalk.bold("Tiers:")}    ${tiers.map((t) => TIER_LABELS[t] ?? t).join(" \u2192 ")}`);
-  console.log(`  ${chalk.bold("Time:")}     ${elapsed}s`);
-  console.log(chalk.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk2.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(`  ${chalk2.bold("Command:")}  ${command}`);
+  console.log(`  ${chalk2.bold("Stage:")}    ${stage}`);
+  console.log(`  ${chalk2.bold("Tiers:")}    ${tiers.map((t) => TIER_LABELS[t] ?? t).join(" \u2192 ")}`);
+  console.log(`  ${chalk2.bold("Time:")}     ${elapsed}s`);
+  console.log(chalk2.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
 }
 
-// src/commands/plan.ts
-function registerPlanCommand(program2) {
-  program2.command("plan").description("Run terraform plan for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
-    const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+// src/lib/resolve-stage.ts
+import { select } from "@inquirer/prompts";
+
+// src/aws-discovery.ts
+import { execSync as execSync2 } from "child_process";
+function runAws(cmd) {
+  try {
+    return execSync2(`aws ${cmd}`, {
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function listDeployedStages(region) {
+  const raw = runAws(
+    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
+  );
+  if (!raw) return [];
+  try {
+    const functions = JSON.parse(raw);
+    const stages = /* @__PURE__ */ new Set();
+    for (const fn of functions) {
+      const m = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
+      if (m) stages.add(m[1]);
     }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
+    return [...stages].sort();
+  } catch {
+    return [];
+  }
+}
+function getApiEndpoint(stage, region) {
+  const raw = runAws(
+    `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
+  );
+  return raw && raw !== "None" ? raw : null;
+}
+function getApiAuthSecretFromLambda(stage, region) {
+  const raw = runAws(
+    `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
+  );
+  return raw && raw !== "None" ? raw : null;
+}
+
+// src/lib/interactive.ts
+function isCancellation(err) {
+  return err instanceof Error && err.name === "ExitPromptError";
+}
+function isInteractive() {
+  return Boolean(process.stdin.isTTY);
+}
+function requireTty(label) {
+  if (!isInteractive()) {
+    printError(
+      `${label} is required. Pass it as a flag or re-run in an interactive terminal.`
+    );
+    process.exit(1);
+  }
+}
+
+// src/lib/resolve-stage.ts
+async function resolveStage(opts = {}) {
+  const region = opts.region ?? "us-east-1";
+  const validate = opts.validate ?? true;
+  const raw = opts.flag ?? process.env.THINKWORK_STAGE ?? loadCliConfig().defaultStage ?? await pickStage(region);
+  if (!raw) {
+    printError(
+      "No stage specified. Pass `--stage <name>`, set THINKWORK_STAGE, or run `thinkwork login --stage <name>`."
+    );
+    process.exit(1);
+  }
+  if (validate) {
+    const check = validateStage(raw);
+    if (!check.valid) {
+      printError(check.error);
       process.exit(1);
     }
-    const identity = getAwsIdentity();
-    printHeader("plan", opts.stage, identity);
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "plan",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Plan failed for ${tier} (exit ${code})`);
-        process.exit(code);
+  }
+  return raw;
+}
+async function pickStage(region) {
+  const stages = listDeployedStages(region);
+  if (stages.length === 0) {
+    printError(
+      `No Thinkwork deployments found in ${region}. Run \`thinkwork list\` or pass --region.`
+    );
+    process.exit(1);
+  }
+  if (stages.length === 1) {
+    console.log(`  Using the only deployed stage: ${stages[0]}`);
+    return stages[0];
+  }
+  requireTty("Stage");
+  return await select({
+    message: "Which stage?",
+    choices: stages.map((s) => ({ name: s, value: s })),
+    loop: false
+  });
+}
+
+// src/commands/plan.ts
+function registerPlanCommand(program2) {
+  program2.command("plan").description("Run terraform plan for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
+    const startTime = Date.now();
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
+      }
+      const identity = getAwsIdentity();
+      printHeader("plan", stage, identity);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, ["plan", `-var=stage=${stage}`]);
+        if (code !== 0) {
+          printError(`Plan failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Plan complete");
+      printSummary("plan", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Plan complete");
-    printSummary("plan", opts.stage, tiers, startTime);
   });
 }
 
@@ -267,131 +406,129 @@ async function confirm(message) {
 
 // src/commands/deploy.ts
 function registerDeployCommand(program2) {
-  program2.command("deploy").description("Run terraform apply for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
+  program2.command("deploy").description("Run terraform apply for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
     const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    const identity = getAwsIdentity();
-    printHeader("deploy", opts.stage, identity);
-    if (!identity) {
-      printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
-    }
-    if (isProdLike(opts.stage) && !opts.yes) {
-      const ok = await confirm(
-        `  Stage "${opts.stage}" is production-like. Deploy?`
-      );
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
       }
-    } else if (!opts.yes) {
-      const ok = await confirm(`  Deploy to stage "${opts.stage}"?`);
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
+      const identity = getAwsIdentity();
+      printHeader("deploy", stage, identity);
+      if (!identity) {
+        printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
       }
-    }
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "apply",
-        "-auto-approve",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Deploy failed for ${tier} (exit ${code})`);
-        process.exit(code);
+      if (isProdLike(stage) && !opts.yes) {
+        const ok = await confirm(`  Stage "${stage}" is production-like. Deploy?`);
+        if (!ok) {
+          console.log("  Aborted.");
+          process.exit(0);
+        }
+      } else if (!opts.yes) {
+        const ok = await confirm(`  Deploy to stage "${stage}"?`);
+        if (!ok) {
+          console.log("  Aborted.");
+          process.exit(0);
+        }
+      }
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, [
+          "apply",
+          "-auto-approve",
+          `-var=stage=${stage}`
+        ]);
+        if (code !== 0) {
+          printError(`Deploy failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Deploy complete");
+      printSummary("deploy", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Deploy complete");
-    printSummary("deploy", opts.stage, tiers, startTime);
   });
 }
 
 // src/commands/destroy.ts
 function registerDestroyCommand(program2) {
-  program2.command("destroy").description("Run terraform destroy for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
+  program2.command("destroy").description("Run terraform destroy for a stage. Prompts for stage in a TTY when omitted; always requires a destructive confirmation.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").option("-y, --yes", "Skip interactive confirmation (for CI)").action(async (opts) => {
     const startTime = Date.now();
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    const identity = getAwsIdentity();
-    printHeader("destroy", opts.stage, identity);
-    if (!identity) {
-      printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
-    }
-    if (isProdLike(opts.stage)) {
-      printWarning(`Stage "${opts.stage}" is production-like.`);
-      if (!opts.yes) {
-        const ok = await confirm(
-          `  Type 'y' to confirm destruction of stage "${opts.stage}":`
-        );
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
+      }
+      const identity = getAwsIdentity();
+      printHeader("destroy", stage, identity);
+      if (!identity) {
+        printWarning("Could not resolve AWS identity. Is the AWS CLI configured?");
+      }
+      if (isProdLike(stage)) {
+        printWarning(`Stage "${stage}" is production-like.`);
+        if (!opts.yes) {
+          const ok = await confirm(`  Type 'y' to confirm destruction of stage "${stage}":`);
+          if (!ok) {
+            console.log("  Aborted.");
+            process.exit(0);
+          }
+        }
+        console.log(`  Proceeding with destroy of "${stage}" (--yes provided).`);
+      } else if (!opts.yes) {
+        const ok = await confirm(`  Destroy stage "${stage}"?`);
         if (!ok) {
           console.log("  Aborted.");
           process.exit(0);
         }
       }
-      console.log(`  Proceeding with destroy of "${opts.stage}" (--yes provided).`);
-    } else if (!opts.yes) {
-      const ok = await confirm(`  Destroy stage "${opts.stage}"?`);
-      if (!ok) {
-        console.log("  Aborted.");
-        process.exit(0);
-      }
-    }
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component).reverse();
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, [
-        "destroy",
-        "-auto-approve",
-        `-var=stage=${opts.stage}`
-      ]);
-      if (code !== 0) {
-        printError(`Destroy failed for ${tier} (exit ${code})`);
-        process.exit(code);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component).reverse();
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, [
+          "destroy",
+          "-auto-approve",
+          `-var=stage=${stage}`
+        ]);
+        if (code !== 0) {
+          printError(`Destroy failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+      printSuccess("Destroy complete");
+      printSummary("destroy", stage, tiers, startTime);
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printSuccess("Destroy complete");
-    printSummary("destroy", opts.stage, tiers, startTime);
   });
 }
 
 // src/commands/doctor.ts
-import chalk2 from "chalk";
-import { execSync as execSync2 } from "child_process";
+import chalk3 from "chalk";
+import { execSync as execSync3 } from "child_process";
 function checkAwsCli() {
   return {
     name: "AWS CLI installed",
     run: () => {
       try {
-        const v = execSync2("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
+        const v = execSync3("aws --version", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }).trim();
         return { pass: true, detail: v.split(" ")[0] ?? v };
       } catch {
         return { pass: false, detail: "aws CLI not found. Install: https://aws.amazon.com/cli/" };
@@ -404,7 +541,7 @@ function checkTerraformCli() {
     name: "Terraform CLI installed",
     run: () => {
       try {
-        const v = execSync2("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
+        const v = execSync3("terraform version -json", { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] });
         const parsed = JSON.parse(v);
         return { pass: true, detail: `v${parsed.terraform_version}` };
       } catch {
@@ -430,7 +567,7 @@ function checkBedrockAccess() {
     name: "Bedrock model access",
     run: () => {
       try {
-        execSync2(
+        execSync3(
           "aws bedrock get-foundation-model --model-identifier anthropic.claude-3-haiku-20240307-v1:0 --output json --region us-east-1",
           { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
         );
@@ -445,13 +582,15 @@ function checkBedrockAccess() {
   };
 }
 function registerDoctorCommand(program2) {
-  program2.command("doctor").description("Check AWS account prerequisites for a Thinkwork deployment").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").action((opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  program2.command("doctor").description("Check AWS account prerequisites for a Thinkwork deployment. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").action(async (opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    printHeader("doctor", opts.stage);
+    printHeader("doctor", stage);
     const checks = [
       checkAwsCli(),
       checkTerraformCli(),
@@ -461,17 +600,17 @@ function registerDoctorCommand(program2) {
     let allPass = true;
     for (const check of checks) {
       const result = check.run();
-      const icon = result.pass ? chalk2.green("\u2713") : chalk2.red("\u2717");
-      const detail = result.pass ? chalk2.dim(result.detail) : chalk2.yellow(result.detail);
+      const icon = result.pass ? chalk3.green("\u2713") : chalk3.red("\u2717");
+      const detail = result.pass ? chalk3.dim(result.detail) : chalk3.yellow(result.detail);
       console.log(`  ${icon} ${check.name}  ${detail}`);
       if (!result.pass) allPass = false;
     }
     if (allPass) {
       console.log(`
-  ${chalk2.green.bold("All checks passed.")}`);
+  ${chalk3.green.bold("All checks passed.")}`);
     } else {
       console.log(`
-  ${chalk2.yellow.bold("Some checks failed.")} Fix the issues above before deploying.`);
+  ${chalk3.yellow.bold("Some checks failed.")} Fix the issues above before deploying.`);
     }
     process.exit(allPass ? 0 : 1);
   });
@@ -479,38 +618,39 @@ function registerDoctorCommand(program2) {
 
 // src/commands/outputs.ts
 function registerOutputsCommand(program2) {
-  program2.command("outputs").description("Show terraform outputs for a stage").option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
-    }
-    const compCheck = validateComponent(opts.component);
-    if (!compCheck.valid) {
-      printError(compCheck.error);
-      process.exit(1);
-    }
-    printHeader("outputs", opts.stage);
-    const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const tiers = expandComponent(opts.component);
-    for (let i = 0; i < tiers.length; i++) {
-      const tier = tiers[i];
-      printTierHeader(tier, i, tiers.length);
-      const cwd = resolveTierDir(terraformDir, opts.stage, tier);
-      await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
-      const code = await runTerraform(cwd, ["output"]);
-      if (code !== 0) {
-        printError(`Outputs failed for ${tier} (exit ${code})`);
-        process.exit(code);
+  program2.command("outputs").description("Show terraform outputs for a stage. Prompts for stage in a TTY when omitted.").option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage").option("-c, --component <tier>", "Component tier (foundation|data|app|all)", "all").action(async (opts) => {
+    try {
+      const stage = await resolveStage({ flag: opts.stage });
+      const compCheck = validateComponent(opts.component);
+      if (!compCheck.valid) {
+        printError(compCheck.error);
+        process.exit(1);
+      }
+      printHeader("outputs", stage);
+      const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
+      const tiers = expandComponent(opts.component);
+      for (let i = 0; i < tiers.length; i++) {
+        const tier = tiers[i];
+        printTierHeader(tier, i, tiers.length);
+        const cwd = resolveTierDir(terraformDir, stage, tier);
+        await ensureInit(cwd);
+        await ensureWorkspace(cwd, stage);
+        const code = await runTerraform(cwd, ["output"]);
+        if (code !== 0) {
+          printError(`Outputs failed for ${tier} (exit ${code})`);
+          process.exit(code);
+        }
       }
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
   });
 }
 
 // src/commands/config.ts
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync4 } from "fs";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 
 // src/environments.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, readFileSync as readFileSync2, readdirSync } from "fs";
@@ -604,20 +744,20 @@ function registerConfigCommand(program2) {
         process.exit(1);
       }
       console.log("");
-      console.log(chalk3.bold.cyan(`  \u2B21 ${env.stage}`));
-      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log(`  ${chalk3.bold("Region:")}          ${env.region}`);
-      console.log(`  ${chalk3.bold("Account:")}         ${env.accountId}`);
-      console.log(`  ${chalk3.bold("Database:")}        ${env.databaseEngine}`);
-      console.log(`  ${chalk3.bold("Memory:")}          managed (always on)${env.enableHindsight ? " + hindsight" : ""}`);
-      console.log(`  ${chalk3.bold("Terraform dir:")}   ${env.terraformDir}`);
-      console.log(`  ${chalk3.bold("Created:")}         ${env.createdAt}`);
-      console.log(`  ${chalk3.bold("Updated:")}         ${env.updatedAt}`);
-      console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(chalk4.bold.cyan(`  \u2B21 ${env.stage}`));
+      console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(`  ${chalk4.bold("Region:")}          ${env.region}`);
+      console.log(`  ${chalk4.bold("Account:")}         ${env.accountId}`);
+      console.log(`  ${chalk4.bold("Database:")}        ${env.databaseEngine}`);
+      console.log(`  ${chalk4.bold("Memory:")}          managed (always on)${env.enableHindsight ? " + hindsight" : ""}`);
+      console.log(`  ${chalk4.bold("Terraform dir:")}   ${env.terraformDir}`);
+      console.log(`  ${chalk4.bold("Created:")}         ${env.createdAt}`);
+      console.log(`  ${chalk4.bold("Updated:")}         ${env.updatedAt}`);
+      console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       const tfvarsPath = `${env.terraformDir}/terraform.tfvars`;
       if (existsSync4(tfvarsPath)) {
         console.log("");
-        console.log(chalk3.dim("  terraform.tfvars:"));
+        console.log(chalk4.dim("  terraform.tfvars:"));
         const content = readFileSync3(tfvarsPath, "utf-8");
         for (const line of content.split("\n")) {
           if (line.trim() && !line.trim().startsWith("#")) {
@@ -631,7 +771,7 @@ function registerConfigCommand(program2) {
               /^(google_oauth_client_secret\s*=\s*)".*"/,
               '$1"********"'
             );
-            console.log(`  ${chalk3.dim(masked)}`);
+            console.log(`  ${chalk4.dim(masked)}`);
           }
         }
       }
@@ -642,33 +782,35 @@ function registerConfigCommand(program2) {
     if (envs.length === 0) {
       console.log("");
       console.log("  No environments found.");
-      console.log(`  Run ${chalk3.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log(`  Run ${chalk4.cyan("thinkwork init -s <stage>")} to create one.`);
       console.log("");
       return;
     }
     console.log("");
-    console.log(chalk3.bold("  Environments"));
-    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk4.bold("  Environments"));
+    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     for (const env of envs) {
-      const memBadge = env.enableHindsight ? chalk3.magenta("managed+hindsight") : chalk3.dim("managed");
-      const dbBadge = env.databaseEngine === "rds-postgres" ? chalk3.yellow("rds") : chalk3.dim("aurora");
+      const memBadge = env.enableHindsight ? chalk4.magenta("managed+hindsight") : chalk4.dim("managed");
+      const dbBadge = env.databaseEngine === "rds-postgres" ? chalk4.yellow("rds") : chalk4.dim("aurora");
       console.log(
-        `  ${chalk3.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
+        `  ${chalk4.bold.cyan(env.stage.padEnd(16))}${env.region.padEnd(14)}${env.accountId.padEnd(16)}${dbBadge.padEnd(20)}${memBadge}`
       );
     }
-    console.log(chalk3.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(chalk3.dim(`  ${envs.length} environment(s)`));
+    console.log(chalk4.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk4.dim(`  ${envs.length} environment(s)`));
     console.log("");
-    console.log(`  Show details: ${chalk3.cyan("thinkwork config list -s <stage>")}`);
+    console.log(`  Show details: ${chalk4.cyan("thinkwork config list -s <stage>")}`);
     console.log("");
   });
-  config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight)").requiredOption("-s, --stage <name>", "Deployment stage").action((key, opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  config.command("get <key>").description("Get a configuration value (e.g. enable-hindsight). Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").action(async (key, opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
-    const tfvarsPath = resolveTfvarsPath(opts.stage);
+    const tfvarsPath = resolveTfvarsPath(stage);
     const tfKey = key.replace(/-/g, "_");
     const value = readTfVar(tfvarsPath, tfKey);
     if (value === null) {
@@ -677,11 +819,13 @@ function registerConfigCommand(program2) {
       console.log(`  ${key} = ${value}`);
     }
   });
-  config.command("set <key> <value>").description("Set a configuration value and optionally deploy").requiredOption("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  config.command("set <key> <value>").description("Set a configuration value and optionally deploy. Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("--apply", "Run terraform apply after changing the value").action(async (key, value, opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
     let tfKey = key.replace(/-/g, "_");
     let tfValue = value;
@@ -699,13 +843,13 @@ function registerConfigCommand(program2) {
       process.exit(1);
     }
     const identity = getAwsIdentity();
-    printHeader("config set", opts.stage, identity);
-    const tfvarsPath = resolveTfvarsPath(opts.stage);
+    printHeader("config set", stage, identity);
+    const tfvarsPath = resolveTfvarsPath(stage);
     const oldValue = readTfVar(tfvarsPath, tfKey);
     setTfVar(tfvarsPath, tfKey, tfValue);
     console.log(`  ${tfKey}: ${oldValue ?? "(unset)"} \u2192 ${tfValue}`);
     if (opts.apply) {
-      const tfDir = resolveTerraformDir(opts.stage);
+      const tfDir = resolveTerraformDir(stage);
       if (!tfDir) {
         printError("Cannot find terraform directory. Run `thinkwork init` first.");
         process.exit(1);
@@ -713,11 +857,11 @@ function registerConfigCommand(program2) {
       console.log("");
       console.log("  Applying configuration change...");
       await ensureInit(tfDir);
-      await ensureWorkspace(tfDir, opts.stage);
+      await ensureWorkspace(tfDir, stage);
       const code = await runTerraform(tfDir, [
         "apply",
         "-auto-approve",
-        `-var=stage=${opts.stage}`
+        `-var=stage=${stage}`
       ]);
       if (code !== 0) {
         printError(`Deploy failed (exit ${code})`);
@@ -757,18 +901,20 @@ function runScript(scriptPath, args) {
   });
 }
 function registerBootstrapCommand(program2) {
-  program2.command("bootstrap").description("Seed workspace defaults, skill catalog, and per-tenant files for a stage").requiredOption("-s, --stage <name>", "Deployment stage").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
-    if (!stageCheck.valid) {
-      printError(stageCheck.error);
-      process.exit(1);
+  program2.command("bootstrap").description("Seed workspace defaults, skill catalog, and per-tenant files for a stage. Prompts for stage in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").action(async (opts) => {
+    let stage;
+    try {
+      stage = await resolveStage({ flag: opts.stage });
+    } catch (err) {
+      if (isCancellation(err)) return;
+      throw err;
     }
     const identity = getAwsIdentity();
-    printHeader("bootstrap", opts.stage, identity);
+    printHeader("bootstrap", stage, identity);
     const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-    const cwd = resolveTierDir(terraformDir, opts.stage, "app");
+    const cwd = resolveTierDir(terraformDir, stage, "app");
     await ensureInit(cwd);
-    await ensureWorkspace(cwd, opts.stage);
+    await ensureWorkspace(cwd, stage);
     let bucket;
     let dbEndpoint;
     let dbPassword;
@@ -776,8 +922,8 @@ function registerBootstrapCommand(program2) {
       bucket = await getTerraformOutput(cwd, "bucket_name");
       dbEndpoint = await getTerraformOutput(cwd, "db_cluster_endpoint");
       const secretArn = await getTerraformOutput(cwd, "db_secret_arn");
-      const { execSync: execSync10 } = await import("child_process");
-      const secretJson = execSync10(
+      const { execSync: execSync11 } = await import("child_process");
+      const secretJson = execSync11(
         `aws secretsmanager get-secret-value --secret-id "${secretArn}" --query SecretString --output text`,
         { encoding: "utf-8" }
       ).trim();
@@ -790,7 +936,7 @@ function registerBootstrapCommand(program2) {
     const databaseUrl = `postgresql://thinkwork_admin:${encodeURIComponent(dbPassword)}@${dbEndpoint}:5432/thinkwork?sslmode=no-verify`;
     const repoRoot = resolve(terraformDir);
     const scriptPath = resolve(repoRoot, "scripts/bootstrap-workspace.sh");
-    const code = await runScript(scriptPath, [opts.stage, bucket, databaseUrl]);
+    const code = await runScript(scriptPath, [stage, bucket, databaseUrl]);
     if (code !== 0) {
       printError(`Bootstrap failed (exit ${code})`);
       process.exit(code);
@@ -800,10 +946,10 @@ function registerBootstrapCommand(program2) {
 }
 
 // src/commands/login.ts
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import { createInterface as createInterface2 } from "readline";
-import { select, Separator } from "@inquirer/prompts";
-import chalk5 from "chalk";
+import { select as select2, Separator } from "@inquirer/prompts";
+import chalk7 from "chalk";
 
 // src/aws-profiles.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
@@ -882,14 +1028,14 @@ function listAwsProfiles() {
 }
 
 // src/prerequisites.ts
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import { mkdirSync as mkdirSync3, createWriteStream, chmodSync } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir4, platform, arch } from "os";
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 function run(cmd, opts) {
   try {
-    return execSync3(cmd, {
+    return execSync4(cmd, {
       encoding: "utf-8",
       timeout: 3e4,
       stdio: opts?.silent ? ["pipe", "pipe", "pipe"] : void 0
@@ -906,12 +1052,12 @@ function hasBrew() {
 }
 async function ensureAwsCli() {
   if (isInstalled("aws")) return true;
-  console.log(`  ${chalk4.yellow("\u2192")} AWS CLI not found. Installing...`);
+  console.log(`  ${chalk5.yellow("\u2192")} AWS CLI not found. Installing...`);
   const os = platform();
   if (os === "darwin" && hasBrew()) {
     const result = run("brew install awscli");
     if (result !== null && isInstalled("aws")) {
-      console.log(`  ${chalk4.green("\u2713")} AWS CLI installed via Homebrew`);
+      console.log(`  ${chalk5.green("\u2713")} AWS CLI installed via Homebrew`);
       return true;
     }
   }
@@ -926,7 +1072,7 @@ async function ensureAwsCli() {
       run(`"${tmpDir}/aws/install" --install-dir "${homedir4()}/.thinkwork/aws-cli" --bin-dir "${homedir4()}/.local/bin" --update`);
       process.env.PATH = `${homedir4()}/.local/bin:${process.env.PATH}`;
       if (isInstalled("aws")) {
-        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
+        console.log(`  ${chalk5.green("\u2713")} AWS CLI installed to ~/.local/bin/aws`);
         return true;
       }
     } catch {
@@ -941,24 +1087,24 @@ async function ensureAwsCli() {
       run(`curl -sL "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o "${pkgPath}"`);
       run(`installer -pkg "${pkgPath}" -target CurrentUserHomeDirectory 2>/dev/null || sudo installer -pkg "${pkgPath}" -target /`);
       if (isInstalled("aws")) {
-        console.log(`  ${chalk4.green("\u2713")} AWS CLI installed`);
+        console.log(`  ${chalk5.green("\u2713")} AWS CLI installed`);
         return true;
       }
     } catch {
     }
   }
-  console.log(`  ${chalk4.red("\u2717")} Could not auto-install AWS CLI.`);
-  console.log(`    Install manually: ${chalk4.cyan("https://aws.amazon.com/cli/")}`);
+  console.log(`  ${chalk5.red("\u2717")} Could not auto-install AWS CLI.`);
+  console.log(`    Install manually: ${chalk5.cyan("https://aws.amazon.com/cli/")}`);
   return false;
 }
 async function ensureTerraform() {
   if (isInstalled("terraform")) return true;
-  console.log(`  ${chalk4.yellow("\u2192")} Terraform not found. Installing...`);
+  console.log(`  ${chalk5.yellow("\u2192")} Terraform not found. Installing...`);
   const os = platform();
   if ((os === "darwin" || os === "linux") && hasBrew()) {
     const result = run("brew install hashicorp/tap/terraform");
     if (result !== null && isInstalled("terraform")) {
-      console.log(`  ${chalk4.green("\u2713")} Terraform installed via Homebrew`);
+      console.log(`  ${chalk5.green("\u2713")} Terraform installed via Homebrew`);
       return true;
     }
   }
@@ -980,17 +1126,17 @@ async function ensureTerraform() {
       process.env.PATH = `${binDir}:${process.env.PATH}`;
     }
     if (isInstalled("terraform")) {
-      console.log(`  ${chalk4.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
+      console.log(`  ${chalk5.green("\u2713")} Terraform ${tfVersion} installed to ~/.local/bin/terraform`);
       return true;
     }
   } catch {
   }
-  console.log(`  ${chalk4.red("\u2717")} Could not auto-install Terraform.`);
-  console.log(`    Install manually: ${chalk4.cyan("https://developer.hashicorp.com/terraform/install")}`);
+  console.log(`  ${chalk5.red("\u2717")} Could not auto-install Terraform.`);
+  console.log(`    Install manually: ${chalk5.cyan("https://developer.hashicorp.com/terraform/install")}`);
   return false;
 }
 async function ensurePrerequisites() {
-  console.log(chalk4.dim("  Checking prerequisites...\n"));
+  console.log(chalk5.dim("  Checking prerequisites...\n"));
   const awsOk = await ensureAwsCli();
   const tfOk = await ensureTerraform();
   if (awsOk && tfOk) {
@@ -998,33 +1144,356 @@ async function ensurePrerequisites() {
     return true;
   }
   console.log("");
-  console.log(`  ${chalk4.red("Missing prerequisites.")} Install them and try again.`);
+  console.log(`  ${chalk5.red("Missing prerequisites.")} Install them and try again.`);
   return false;
 }
 
-// src/commands/login.ts
-function ask(prompt2) {
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
-    rl.question(prompt2, (answer) => {
-      rl.close();
-      resolve3(answer.trim());
-    });
-  });
+// src/cognito-discovery.ts
+import { execSync as execSync5 } from "child_process";
+function runAws2(cmd) {
+  try {
+    return execSync5(`aws ${cmd}`, {
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
 }
-function verifyProfile(profile) {
+function tryTerraformOutput(stage) {
+  const tfRoot = resolveTerraformDir(stage);
+  if (!tfRoot) return null;
+  let cwd;
   try {
-    const raw = execSync4(
-      `aws sts get-caller-identity --profile ${profile} --output json`,
-      { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
-    );
-    const parsed = JSON.parse(raw);
-    return { account: parsed.Account, arn: parsed.Arn };
+    cwd = resolveTierDir(tfRoot, stage, "foundation");
   } catch {
     return null;
   }
+  const read = (key) => {
+    try {
+      return execSync5(`terraform output -raw ${key}`, {
+        cwd,
+        encoding: "utf-8",
+        timeout: 15e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      }).trim();
+    } catch {
+      return null;
+    }
+  };
+  const userPoolId = read("user_pool_id") ?? void 0;
+  const clientId = read("admin_client_id") ?? void 0;
+  const domain = read("auth_domain") ?? void 0;
+  return { userPoolId, clientId, domain };
 }
-function describeType(type) {
+function tryAwsDiscovery(stage, region) {
+  const listRaw = runAws2(
+    `cognito-idp list-user-pools --max-results 60 --region ${region} --output json`
+  );
+  if (!listRaw) return {};
+  const poolList = JSON.parse(listRaw);
+  const pool = poolList.UserPools.find(
+    (p) => (
+      // `foundation/cognito/main.tf`:93 pattern
+      p.Name === `thinkwork-${stage}-user-pool` || p.Name === `thinkwork-${stage}-users`
+    )
+  );
+  if (!pool) return {};
+  const clientsRaw = runAws2(
+    `cognito-idp list-user-pool-clients --user-pool-id ${pool.Id} --region ${region} --output json`
+  );
+  let clientId;
+  if (clientsRaw) {
+    const clients = JSON.parse(clientsRaw);
+    const admin = clients.UserPoolClients.find(
+      (c) => c.ClientName === "ThinkworkAdmin"
+    );
+    clientId = admin?.ClientId;
+  }
+  const domain = `thinkwork-${stage}`;
+  return { userPoolId: pool.Id, clientId, domain };
+}
+function discoverCognitoConfig(stage, region) {
+  const fromTf = tryTerraformOutput(stage) ?? {};
+  const fromAws = tryAwsDiscovery(stage, region);
+  const userPoolId = fromTf.userPoolId ?? fromAws.userPoolId;
+  const clientId = fromTf.clientId ?? fromAws.clientId;
+  const domain = fromTf.domain ?? fromAws.domain;
+  if (!userPoolId || !clientId || !domain) return null;
+  return {
+    userPoolId,
+    clientId,
+    domain,
+    domainUrl: `https://${domain}.auth.${region}.amazoncognito.com`,
+    region
+  };
+}
+
+// src/cognito-oauth.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+import { spawn as spawn3 } from "child_process";
+import chalk6 from "chalk";
+var CLI_LOOPBACK_PORT = 42010;
+var CALLBACK_PATH = "/callback";
+var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+async function loginWithCognito(opts) {
+  const port = opts.port ?? CLI_LOOPBACK_PORT;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const redirectUri = `http://127.0.0.1:${port}${CALLBACK_PATH}`;
+  const state = randomBytes(16).toString("hex");
+  const authorizeUrl = buildAuthorizeUrl(opts.cognito, redirectUri, state);
+  const code = await waitForCallbackCode({
+    port,
+    expectedState: state,
+    timeoutMs,
+    onListening: () => {
+      logStderr("");
+      logStderr(`  ${chalk6.cyan("Opening browser to sign in\u2026")}`);
+      logStderr(`  ${chalk6.dim("If it doesn't open automatically, visit:")}`);
+      logStderr(`  ${chalk6.dim(authorizeUrl)}`);
+      logStderr("");
+      if (opts.openBrowser !== false) {
+        (opts.launchBrowser ?? openInBrowser)(authorizeUrl);
+      }
+    }
+  });
+  return exchangeCodeForTokens(opts.cognito, redirectUri, code);
+}
+function buildAuthorizeUrl(cognito, redirectUri, state) {
+  const params = new URLSearchParams({
+    client_id: cognito.clientId,
+    response_type: "code",
+    scope: "openid email profile",
+    redirect_uri: redirectUri,
+    state
+  });
+  return `${cognito.domainUrl}/oauth2/authorize?${params.toString()}`;
+}
+function waitForCallbackCode(opts) {
+  return new Promise((resolve3, reject) => {
+    const server = createServer((req, res) => handleRequest(req, res));
+    let finished = false;
+    const finish = (err, code) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      const closer = server;
+      closer.closeAllConnections?.();
+      server.close(() => {
+        if (err) reject(err);
+        else resolve3(code);
+      });
+    };
+    const timer = setTimeout(() => {
+      finish(
+        new Error(
+          `Timed out waiting for sign-in after ${Math.round(opts.timeoutMs / 1e3)}s. Cancel with Ctrl+C and retry.`
+        )
+      );
+    }, opts.timeoutMs);
+    function handleRequest(req, res) {
+      if (!req.url) return;
+      const parsed = new URL(req.url, `http://127.0.0.1:${opts.port}`);
+      if (parsed.pathname !== CALLBACK_PATH) {
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("Not found. Return to your CLI and close this tab.");
+        return;
+      }
+      const code = parsed.searchParams.get("code");
+      const state = parsed.searchParams.get("state");
+      const error = parsed.searchParams.get("error");
+      if (error) {
+        const desc = parsed.searchParams.get("error_description") || error;
+        res.writeHead(400, { "content-type": "text/html; charset=utf-8" });
+        res.end(renderErrorPage(desc));
+        finish(new Error(`Cognito returned an error: ${desc}`));
+        return;
+      }
+      if (!code || !state) {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("Missing code or state.");
+        finish(new Error("Cognito callback missing code or state parameter."));
+        return;
+      }
+      if (state !== opts.expectedState) {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("State mismatch.");
+        finish(
+          new Error(
+            "OAuth state parameter didn't match \u2014 possible CSRF or stale tab. Retry `thinkwork login`."
+          )
+        );
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8", connection: "close" });
+      res.end(renderSuccessPage());
+      finish(null, code);
+    }
+    server.on("error", (err) => {
+      if (err.code === "EADDRINUSE") {
+        finish(
+          new Error(
+            `Port ${opts.port} is in use. Stop the conflicting process (another \`thinkwork login\`?) and retry.`
+          )
+        );
+      } else {
+        finish(err);
+      }
+    });
+    server.listen(opts.port, "127.0.0.1", () => {
+      opts.onListening?.();
+    });
+  });
+}
+async function exchangeCodeForTokens(cognito, redirectUri, code) {
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    client_id: cognito.clientId,
+    code,
+    redirect_uri: redirectUri
+  });
+  const res = await fetch(`${cognito.domainUrl}/oauth2/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(
+      `Token exchange failed (HTTP ${res.status}): ${text || "no body"}`
+    );
+  }
+  const json = await res.json();
+  return {
+    idToken: json.id_token,
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresAt: Math.floor(Date.now() / 1e3) + json.expires_in
+  };
+}
+async function refreshCognitoTokens(cognito, refreshToken) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: cognito.clientId,
+    refresh_token: refreshToken
+  });
+  const res = await fetch(`${cognito.domainUrl}/oauth2/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString()
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(
+      `Token refresh failed (HTTP ${res.status}): ${text || "no body"}`
+    );
+  }
+  const json = await res.json();
+  return {
+    idToken: json.id_token,
+    accessToken: json.access_token,
+    expiresAt: Math.floor(Date.now() / 1e3) + json.expires_in
+  };
+}
+function decodeIdToken(idToken) {
+  const parts = idToken.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Malformed id_token (expected 3 parts).");
+  }
+  const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+  const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
+  const json = Buffer.from(padded, "base64").toString("utf-8");
+  return JSON.parse(json);
+}
+function openInBrowser(url) {
+  const platform2 = process.platform;
+  const cmd = platform2 === "darwin" ? "open" : platform2 === "win32" ? "cmd" : "xdg-open";
+  const args = platform2 === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    spawn3(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+function renderSuccessPage() {
+  return `<!doctype html>
+<html><head><meta charset="utf-8"><title>Thinkwork \u2014 signed in</title>
+<style>
+  body { font-family: -apple-system, system-ui, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+  .card { padding: 2rem 3rem; background: #171717; border: 1px solid #262626; border-radius: 12px; text-align: center; max-width: 28rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
+  p { color: #a3a3a3; margin: 0; line-height: 1.5; }
+  .check { color: #10b981; font-size: 2rem; }
+</style>
+</head><body>
+<div class="card">
+  <div class="check">\u2713</div>
+  <h1>Signed in to Thinkwork</h1>
+  <p>You can close this tab and return to your terminal.</p>
+</div>
+</body></html>`;
+}
+function renderErrorPage(message) {
+  return `<!doctype html>
+<html><head><meta charset="utf-8"><title>Thinkwork \u2014 sign-in error</title>
+<style>
+  body { font-family: -apple-system, system-ui, sans-serif; background: #0a0a0a; color: #e5e5e5; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+  .card { padding: 2rem 3rem; background: #171717; border: 1px solid #262626; border-radius: 12px; text-align: center; max-width: 28rem; }
+  h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
+  p { color: #fca5a5; margin: 0; line-height: 1.5; }
+  code { display: block; margin-top: 1rem; padding: 0.75rem; background: #0a0a0a; border-radius: 6px; color: #a3a3a3; text-align: left; white-space: pre-wrap; word-break: break-word; font-size: 0.875rem; }
+</style>
+</head><body>
+<div class="card">
+  <h1>Sign-in failed</h1>
+  <p>Return to your terminal for details.</p>
+  <code>${escapeHtml(message)}</code>
+</div>
+</body></html>`;
+}
+function escapeHtml(s) {
+  return s.replace(/[&<>"']/g, (c) => {
+    switch (c) {
+      case "&":
+        return "&amp;";
+      case "<":
+        return "&lt;";
+      case ">":
+        return "&gt;";
+      case '"':
+        return "&quot;";
+      case "'":
+        return "&#39;";
+      default:
+        return c;
+    }
+  });
+}
+
+// src/commands/login.ts
+function ask(prompt) {
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve3) => {
+    rl.question(prompt, (answer) => {
+      rl.close();
+      resolve3(answer.trim());
+    });
+  });
+}
+function verifyProfile(profile) {
+  try {
+    const raw = execSync6(
+      `aws sts get-caller-identity --profile ${profile} --output json`,
+      { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
+    );
+    const parsed = JSON.parse(raw);
+    return { account: parsed.Account, arn: parsed.Arn };
+  } catch {
+    return null;
+  }
+}
+function describeType(type) {
   switch (type) {
     case "keys":
       return "access keys";
@@ -1044,7 +1513,7 @@ async function pickProfile(profiles) {
     return { kind: "cancel" };
   }
   const choices = profiles.map((p) => ({
-    name: `${p.name}  ${chalk5.dim(`(${describeType(p.type)})`)}`,
+    name: `${p.name}  ${chalk7.dim(`(${describeType(p.type)})`)}`,
     value: { kind: "existing", name: p.name }
   }));
   choices.push(new Separator());
@@ -1059,7 +1528,7 @@ async function pickProfile(profiles) {
     description: "Run `aws sso login` against the configured SSO profile."
   });
   try {
-    const picked = await select({
+    const picked = await select2({
       message: "Pick an AWS profile for Thinkwork:",
       choices,
       loop: false,
@@ -1091,15 +1560,15 @@ async function runKeyEntry(targetProfile) {
   const region = await ask("  Default region [us-east-1]: ");
   const finalRegion = region || "us-east-1";
   try {
-    execSync4(
+    execSync6(
       `aws configure set aws_access_key_id "${accessKeyId}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
-    execSync4(
+    execSync6(
       `aws configure set aws_secret_access_key "${secretAccessKey}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
-    execSync4(
+    execSync6(
       `aws configure set region "${finalRegion}" --profile ${targetProfile}`,
       { stdio: "pipe" }
     );
@@ -1113,7 +1582,7 @@ function runSsoLogin(targetProfile) {
   console.log("  Launching AWS SSO login...");
   console.log("");
   try {
-    execSync4(`aws sso login --profile ${targetProfile}`, { stdio: "inherit" });
+    execSync6(`aws sso login --profile ${targetProfile}`, { stdio: "inherit" });
     return true;
   } catch {
     printError(
@@ -1122,7 +1591,7 @@ function runSsoLogin(targetProfile) {
     return false;
   }
 }
-function finalize(profile, mode) {
+function finalizeAws(profile, mode) {
   const identity = getAwsIdentity();
   if (!identity) {
     printError(
@@ -1142,119 +1611,371 @@ function finalize(profile, mode) {
     `  (\`thinkwork list\`, \`thinkwork deploy\`, \u2026) will use it automatically.`
   );
   console.log(
-    chalk5.dim(
+    chalk7.dim(
       `  Override per-command with --profile <other>, or unset with \`rm ~/.thinkwork/config.json\`.`
     )
   );
 }
+async function bootstrapUserAndTenant(stage, region, idToken) {
+  const baseUrl = getApiEndpoint(stage, region);
+  if (!baseUrl) return null;
+  const url = `${baseUrl.replace(/\/+$/, "")}/graphql`;
+  const query = `mutation BootstrapLogin {
+    bootstrapUser {
+      tenant { id slug name }
+    }
+  }`;
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        Authorization: idToken
+      },
+      body: JSON.stringify({ query })
+    });
+    if (!res.ok) return null;
+    const json = await res.json();
+    const tenant = json.data?.bootstrapUser?.tenant;
+    if (!tenant) return null;
+    return {
+      tenantId: tenant.id,
+      tenantSlug: tenant.slug,
+      tenantName: tenant.name
+    };
+  } catch {
+    return null;
+  }
+}
+async function doCognitoLogin(opts) {
+  printHeader("login", opts.stage);
+  const cognito = discoverCognitoConfig(opts.stage, opts.region);
+  if (!cognito) {
+    printError(
+      `Could not find a Cognito user pool for stage "${opts.stage}" in ${opts.region}. Is the stack deployed?`
+    );
+    process.exit(1);
+  }
+  console.log(`  User pool:     ${cognito.userPoolId}`);
+  console.log(`  Client:        ${cognito.clientId}`);
+  console.log(`  Hosted UI:     ${cognito.domainUrl}`);
+  console.log(`  Callback port: ${opts.port}`);
+  try {
+    const tokens = await loginWithCognito({
+      cognito,
+      port: opts.port,
+      openBrowser: !opts.noBrowser
+    });
+    const claims = decodeIdToken(tokens.idToken);
+    const bootstrap = await bootstrapUserAndTenant(
+      opts.stage,
+      opts.region,
+      tokens.idToken
+    );
+    saveStageSession(opts.stage, {
+      kind: "cognito",
+      idToken: tokens.idToken,
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt,
+      userPoolId: cognito.userPoolId,
+      userPoolClientId: cognito.clientId,
+      cognitoDomain: cognito.domain,
+      region: cognito.region,
+      principalId: claims.sub,
+      email: claims.email,
+      tenantId: bootstrap?.tenantId,
+      tenantSlug: bootstrap?.tenantSlug
+    });
+    saveCliConfig({ defaultStage: opts.stage });
+    printSuccess(`Signed in to ${opts.stage} as ${claims.email ?? claims.sub}`);
+    if (bootstrap) {
+      console.log(
+        `  Tenant: ${bootstrap.tenantName} (slug: ${bootstrap.tenantSlug})`
+      );
+    } else {
+      printWarning(
+        "Signed in, but could not resolve a default tenant. Commands will prompt or require --tenant <slug> until one is cached."
+      );
+    }
+    console.log("");
+    console.log(
+      chalk7.dim(
+        `  Token expires: ${new Date(tokens.expiresAt * 1e3).toISOString()}. Refreshed automatically.`
+      )
+    );
+  } catch (err) {
+    if (isCancellation(err)) {
+      console.log("");
+      console.log("  Cancelled.");
+      return;
+    }
+    printError(
+      `Sign-in failed: ${err instanceof Error ? err.message : String(err)}`
+    );
+    process.exit(1);
+  }
+}
+async function doApiKeyLogin(opts) {
+  printHeader("login", opts.stage);
+  const baseUrl = getApiEndpoint(opts.stage, opts.region);
+  if (!baseUrl) {
+    printError(
+      `Cannot discover API endpoint for stage "${opts.stage}" in ${opts.region}. Is the stack deployed?`
+    );
+    process.exit(1);
+  }
+  saveStageSession(opts.stage, {
+    kind: "api-key",
+    authSecret: opts.apiKey,
+    tenantId: opts.tenantId,
+    tenantSlug: opts.tenantSlug
+  });
+  saveCliConfig({ defaultStage: opts.stage });
+  printSuccess(`Stored api-key session for stage "${opts.stage}"`);
+  if (opts.tenantSlug) {
+    console.log(`  Default tenant: ${opts.tenantSlug}`);
+  } else {
+    printWarning(
+      "No tenant cached. Commands will require --tenant <slug> or THINKWORK_TENANT."
+    );
+  }
+}
 function registerLoginCommand(program2) {
   program2.command("login").description(
-    "Configure AWS credentials for Thinkwork. Picks from existing ~/.aws profiles by default; falls back to new keys or SSO."
+    "Sign in. Without --stage: configure AWS credentials (for deploy / destroy). With --stage <s>: sign in to that stack's Cognito / API and cache a session for API-backed commands."
   ).option(
     "--profile <name>",
     "AWS profile name to configure (used when entering new keys or SSO)",
     "thinkwork"
-  ).option("--sso", "Skip the picker and go straight to SSO login").option("--keys", "Skip the picker and go straight to access-key entry").addHelpText(
+  ).option("--sso", "Skip the picker and go straight to SSO login").option("--keys", "Skip the picker and go straight to access-key entry").option(
+    "-s, --stage <name>",
+    "Sign in to a deployed stack instead of configuring AWS credentials"
+  ).option(
+    "-r, --region <region>",
+    "AWS region for the stack (defaults to us-east-1)",
+    "us-east-1"
+  ).option(
+    "--api-key <secret>",
+    "Non-interactive path: store the api_auth_secret as the session for --stage <s>. Skips the browser."
+  ).option(
+    "--tenant <slug>",
+    "Cache this tenant slug on the session (used with --api-key, or to override the tenant chosen by bootstrapUser)."
+  ).option(
+    "--port <number>",
+    `Loopback port for Cognito OAuth callback. Must match a registered callback URL. Defaults to ${CLI_LOOPBACK_PORT}.`,
+    String(CLI_LOOPBACK_PORT)
+  ).option(
+    "--no-browser",
+    "Don't attempt to open the browser automatically \u2014 print the URL instead."
+  ).addHelpText(
     "after",
     `
 Examples:
-  # Interactive picker \u2014 lists profiles from ~/.aws, verifies the one you pick,
-  # and saves it as your Thinkwork default.
+  # Configure AWS credentials (profile picker) \u2014 used before deploy/destroy/list.
   $ thinkwork login
 
-  # Skip the picker, enter fresh access keys into a named profile
-  $ thinkwork login --keys --profile thinkwork
+  # Sign in to a deployed stack with Cognito (opens your browser, supports Google SSO).
+  $ thinkwork login --stage dev
+
+  # Non-interactive CI login against prod using the api_auth_secret.
+  $ thinkwork login --stage prod --api-key "$THINKWORK_API_KEY" --tenant acme
 
-  # Skip the picker, log in via AWS SSO
+  # Print the URL instead of auto-opening (useful over SSH).
+  $ thinkwork login --stage dev --no-browser
+
+  # AWS SSO (no stage)
   $ thinkwork login --sso --profile work-sso
 
-After login, commands resolve the AWS profile in this order:
-  1. --profile <name>            (per-command override)
-  2. $AWS_PROFILE env var
-  3. defaultProfile from ~/.thinkwork/config.json  (set by this command)
+How the session is stored:
+  ~/.thinkwork/config.json gains \`sessions["<stage>"]\` with either a Cognito
+  id/refresh token pair or the api-key secret + tenant. Subsequent commands
+  resolve auth from this file; Cognito tokens are refreshed transparently.
+
+Registered callback URL:
+  The Cognito admin client must list \`http://127.0.0.1:${CLI_LOOPBACK_PORT}/callback\` in its
+  callback URLs. The default terraform module already does \u2014 if you deployed
+  before that default existed, run \`terraform apply\` in the foundation tier
+  to pick it up. Or use \`--api-key\` to skip the browser entirely.
 `
-  ).action(async (opts) => {
-    printHeader("login", opts.profile);
-    const awsOk = await ensureAwsCli();
-    if (!awsOk) process.exit(1);
-    if (opts.sso) {
-      if (!runSsoLogin(opts.profile)) process.exit(1);
-      process.env.AWS_PROFILE = opts.profile;
-      finalize(opts.profile, "SSO");
-      return;
-    }
-    if (opts.keys) {
-      if (!await runKeyEntry(opts.profile)) process.exit(1);
-      process.env.AWS_PROFILE = opts.profile;
-      finalize(opts.profile, "access keys");
-      return;
-    }
-    const profiles = listAwsProfiles();
-    if (profiles.length === 0) {
-      console.log("");
-      console.log(chalk5.dim("  No AWS profiles found in ~/.aws/."));
-      console.log(
-        chalk5.dim("  Falling through to access-key entry for a new profile.")
-      );
-      if (!await runKeyEntry(opts.profile)) process.exit(1);
-      process.env.AWS_PROFILE = opts.profile;
-      finalize(opts.profile, "access keys");
-      return;
-    }
-    const choice = await pickProfile(profiles);
-    if (choice.kind === "cancel") {
+  ).action(
+    async (opts) => {
+      if (opts.stage) {
+        const check = validateStage(opts.stage);
+        if (!check.valid) {
+          printError(check.error);
+          process.exit(1);
+        }
+        if (opts.apiKey) {
+          await doApiKeyLogin({
+            stage: opts.stage,
+            region: opts.region,
+            apiKey: opts.apiKey,
+            tenantSlug: opts.tenant
+          });
+          return;
+        }
+        const port = Number.parseInt(opts.port, 10);
+        if (!Number.isFinite(port) || port < 1 || port > 65535) {
+          printError(`Invalid --port value: "${opts.port}".`);
+          process.exit(1);
+        }
+        await doCognitoLogin({
+          stage: opts.stage,
+          region: opts.region,
+          port,
+          noBrowser: opts.browser === false
+        });
+        return;
+      }
+      printHeader("login", opts.profile);
+      const awsOk = await ensureAwsCli();
+      if (!awsOk) process.exit(1);
+      if (opts.sso) {
+        if (!runSsoLogin(opts.profile)) process.exit(1);
+        process.env.AWS_PROFILE = opts.profile;
+        finalizeAws(opts.profile, "SSO");
+        return;
+      }
+      if (opts.keys) {
+        if (!await runKeyEntry(opts.profile)) process.exit(1);
+        process.env.AWS_PROFILE = opts.profile;
+        finalizeAws(opts.profile, "access keys");
+        return;
+      }
+      const profiles = listAwsProfiles();
+      if (profiles.length === 0) {
+        console.log("");
+        console.log(chalk7.dim("  No AWS profiles found in ~/.aws/."));
+        console.log(
+          chalk7.dim("  Falling through to access-key entry for a new profile.")
+        );
+        if (!await runKeyEntry(opts.profile)) process.exit(1);
+        process.env.AWS_PROFILE = opts.profile;
+        finalizeAws(opts.profile, "access keys");
+        return;
+      }
+      const choice = await pickProfile(profiles);
+      if (choice.kind === "cancel") {
+        console.log("");
+        console.log(chalk7.dim("  Cancelled. No changes made."));
+        return;
+      }
+      if (choice.kind === "keys") {
+        if (!await runKeyEntry(opts.profile)) process.exit(1);
+        process.env.AWS_PROFILE = opts.profile;
+        finalizeAws(opts.profile, "access keys");
+        return;
+      }
+      if (choice.kind === "sso") {
+        if (!runSsoLogin(opts.profile)) process.exit(1);
+        process.env.AWS_PROFILE = opts.profile;
+        finalizeAws(opts.profile, "SSO");
+        return;
+      }
+      const picked = choice.name;
       console.log("");
-      console.log(chalk5.dim("  Cancelled. No changes made."));
-      return;
-    }
-    if (choice.kind === "keys") {
-      if (!await runKeyEntry(opts.profile)) process.exit(1);
-      process.env.AWS_PROFILE = opts.profile;
-      finalize(opts.profile, "access keys");
-      return;
-    }
-    if (choice.kind === "sso") {
-      if (!runSsoLogin(opts.profile)) process.exit(1);
-      process.env.AWS_PROFILE = opts.profile;
-      finalize(opts.profile, "SSO");
-      return;
+      console.log(`  Verifying "${picked}"...`);
+      const identity = verifyProfile(picked);
+      if (!identity) {
+        printError(
+          `Could not authenticate with profile "${picked}". If it's an SSO profile, try \`aws sso login --profile ${picked}\` first.`
+        );
+        process.exit(1);
+      }
+      process.env.AWS_PROFILE = picked;
+      finalizeAws(picked, "existing profile");
     }
-    const picked = choice.name;
-    console.log("");
-    console.log(`  Verifying "${picked}"...`);
-    const identity = verifyProfile(picked);
-    if (!identity) {
+  );
+}
+
+// src/commands/logout.ts
+import { select as select3 } from "@inquirer/prompts";
+function registerLogoutCommand(program2) {
+  program2.command("logout").description(
+    "Forget a stored session. Touches only ~/.thinkwork/config.json; your AWS profile and Cognito pool are untouched."
+  ).option("-s, --stage <name>", "Stage whose session to forget").option("--all", "Forget every stage's session").addHelpText(
+    "after",
+    `
+Examples:
+  # Forget the session for one stage
+  $ thinkwork logout --stage dev
+
+  # Forget every saved session (doesn't affect your AWS profile)
+  $ thinkwork logout --all
+
+  # Pick interactively
+  $ thinkwork logout
+`
+  ).action(async (opts) => {
+    try {
+      if (opts.all) {
+        saveCliConfig({ sessions: {}, defaultStage: void 0 });
+        printHeader("logout", "(all stages)");
+        printSuccess("Cleared every saved stack session.");
+        return;
+      }
+      let stage = opts.stage;
+      if (!stage) {
+        const config2 = loadCliConfig();
+        const keys = Object.keys(config2.sessions ?? {});
+        if (keys.length === 0) {
+          printSuccess("No sessions stored \u2014 nothing to forget.");
+          return;
+        }
+        if (keys.length === 1) {
+          stage = keys[0];
+          console.log(`  Only one session stored: ${stage}`);
+        } else {
+          requireTty("Stage");
+          stage = await select3({
+            message: "Forget which stage's session?",
+            choices: keys.map((s) => ({ name: s, value: s })),
+            loop: false
+          });
+        }
+      }
+      clearStageSession(stage);
+      const config = loadCliConfig();
+      if (config.defaultStage === stage) {
+        saveCliConfig({ defaultStage: void 0 });
+      }
+      printHeader("logout", stage);
+      printSuccess(`Forgot session for "${stage}".`);
+    } catch (err) {
+      if (isCancellation(err)) {
+        console.log("  Cancelled.");
+        return;
+      }
       printError(
-        `Could not authenticate with profile "${picked}". If it's an SSO profile, try \`aws sso login --profile ${picked}\` first.`
+        `Logout failed: ${err instanceof Error ? err.message : String(err)}`
       );
       process.exit(1);
     }
-    process.env.AWS_PROFILE = picked;
-    finalize(picked, "existing profile");
   });
 }
 
 // src/commands/init.ts
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4, cpSync } from "fs";
 import { resolve as resolve2, join as join5, dirname as dirname2 } from "path";
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { fileURLToPath } from "url";
 import { createInterface as createInterface3 } from "readline";
-import chalk6 from "chalk";
+import chalk8 from "chalk";
 var __dirname = dirname2(fileURLToPath(import.meta.url));
-function ask2(prompt2, defaultVal = "") {
+function ask2(prompt, defaultVal = "") {
   const rl = createInterface3({ input: process.stdin, output: process.stdout });
-  const suffix = defaultVal ? chalk6.dim(` [${defaultVal}]`) : "";
+  const suffix = defaultVal ? chalk8.dim(` [${defaultVal}]`) : "";
   return new Promise((resolve3) => {
-    rl.question(`  ${prompt2}${suffix}: `, (answer) => {
+    rl.question(`  ${prompt}${suffix}: `, (answer) => {
       rl.close();
       resolve3(answer.trim() || defaultVal);
     });
   });
 }
-function choose(prompt2, options, defaultVal) {
-  const optStr = options.map((o) => o === defaultVal ? chalk6.bold(o) : chalk6.dim(o)).join(" / ");
-  return ask2(`${prompt2} (${optStr})`, defaultVal);
+function choose(prompt, options, defaultVal) {
+  const optStr = options.map((o) => o === defaultVal ? chalk8.bold(o) : chalk8.dim(o)).join(" / ");
+  return ask2(`${prompt} (${optStr})`, defaultVal);
 }
 function generateSecret(length = 32) {
   const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
@@ -1321,14 +2042,34 @@ function buildTfvars(config) {
   return lines.join("\n");
 }
 function registerInitCommand(program2) {
-  program2.command("init").description("Initialize a new Thinkwork environment").requiredOption("-s, --stage <name>", "Stage name (e.g. dev, staging, prod)").option("-d, --dir <path>", "Target directory", ".").option("--defaults", "Skip interactive prompts, use all defaults").action(async (opts) => {
-    const stageCheck = validateStage(opts.stage);
+  program2.command("init").description("Initialize a new Thinkwork environment. Prompts for a stage name in a TTY when omitted (init creates a stage \u2014 the picker isn't applicable here).").option("-s, --stage <name>", "Stage name (e.g. dev, staging, prod)").option("-d, --dir <path>", "Target directory", ".").option("--defaults", "Skip interactive prompts, use all defaults").action(async (opts) => {
+    let stage = opts.stage;
+    if (!stage) {
+      if (!process.stdin.isTTY) {
+        printError("Stage name is required. Pass -s <name> or re-run in an interactive terminal.");
+        process.exit(1);
+      }
+      const { input: input3 } = await import("@inquirer/prompts");
+      try {
+        stage = await input3({
+          message: "Stage name (e.g. dev, staging, prod):",
+          validate: (v) => validateStage(v).error ?? true
+        });
+      } catch (err) {
+        if (err instanceof Error && err.name === "ExitPromptError") {
+          console.log("  Cancelled.");
+          return;
+        }
+        throw err;
+      }
+    }
+    const stageCheck = validateStage(stage);
     if (!stageCheck.valid) {
       printError(stageCheck.error);
       process.exit(1);
     }
     const identity = getAwsIdentity();
-    printHeader("init", opts.stage, identity);
+    printHeader("init", stage, identity);
     const prereqsOk = await ensurePrerequisites();
     if (!prereqsOk) {
       process.exit(1);
@@ -1350,10 +2091,10 @@ function registerInitCommand(program2) {
       console.log("");
     }
     const config = {
-      stage: opts.stage,
+      stage,
       account_id: identity.account,
       db_password: generateSecret(24),
-      api_auth_secret: `tw-${opts.stage}-${generateSecret(16)}`
+      api_auth_secret: `tw-${stage}-${generateSecret(16)}`
     };
     if (opts.defaults) {
       config.region = identity.region !== "unknown" ? identity.region : "us-east-1";
@@ -1364,21 +2105,21 @@ function registerInitCommand(program2) {
       config.admin_url = "http://localhost:5174";
       config.mobile_scheme = "thinkwork";
     } else {
-      console.log(chalk6.bold("  Configure your Thinkwork environment\n"));
+      console.log(chalk8.bold("  Configure your Thinkwork environment\n"));
       const defaultRegion = identity.region !== "unknown" ? identity.region : "us-east-1";
       config.region = await ask2("AWS Region", defaultRegion);
       console.log("");
-      console.log(chalk6.dim("  \u2500\u2500 Database \u2500\u2500"));
+      console.log(chalk8.dim("  \u2500\u2500 Database \u2500\u2500"));
       config.database_engine = await choose("Database engine", ["aurora-serverless", "rds-postgres"], "aurora-serverless");
       console.log("");
-      console.log(chalk6.dim("  \u2500\u2500 Memory \u2500\u2500"));
-      console.log(chalk6.dim("  AgentCore managed memory is always on (automatic retention)."));
-      console.log(chalk6.dim("  Hindsight is an optional add-on: ECS Fargate service for"));
-      console.log(chalk6.dim("  semantic + entity-graph retrieval (~$75/mo)."));
+      console.log(chalk8.dim("  \u2500\u2500 Memory \u2500\u2500"));
+      console.log(chalk8.dim("  AgentCore managed memory is always on (automatic retention)."));
+      console.log(chalk8.dim("  Hindsight is an optional add-on: ECS Fargate service for"));
+      console.log(chalk8.dim("  semantic + entity-graph retrieval (~$75/mo)."));
       const hindsightAnswer = await ask2("Enable Hindsight long-term memory add-on? (y/N)", "N");
       config.enable_hindsight = hindsightAnswer.toLowerCase() === "y" ? "true" : "false";
       console.log("");
-      console.log(chalk6.dim("  \u2500\u2500 Auth \u2500\u2500"));
+      console.log(chalk8.dim("  \u2500\u2500 Auth \u2500\u2500"));
       const useGoogle = await ask2("Enable Google OAuth login? (y/N)", "N");
       if (useGoogle.toLowerCase() === "y") {
         config.google_oauth_client_id = await ask2("Google OAuth Client ID");
@@ -1388,13 +2129,13 @@ function registerInitCommand(program2) {
         config.google_oauth_client_secret = "";
       }
       console.log("");
-      console.log(chalk6.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
+      console.log(chalk8.dim("  \u2500\u2500 Frontend URLs \u2500\u2500"));
       config.admin_url = await ask2("Admin UI URL", "http://localhost:5174");
       config.mobile_scheme = await ask2("Mobile app URL scheme", "thinkwork");
       console.log("");
-      console.log(chalk6.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
-      console.log(chalk6.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
-      console.log(chalk6.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
+      console.log(chalk8.dim("  \u2500\u2500 Secrets (auto-generated) \u2500\u2500"));
+      console.log(chalk8.dim(`  DB password:     ${config.db_password.slice(0, 8)}...`));
+      console.log(chalk8.dim(`  API auth secret: ${config.api_auth_secret.slice(0, 16)}...`));
     }
     console.log("");
     console.log("  Scaffolding Terraform modules...");
@@ -1599,22 +2340,22 @@ output "agentcore_memory_id" {
 }
 `);
     }
-    console.log(`  Wrote ${chalk6.cyan(tfDir + "/")}`);
+    console.log(`  Wrote ${chalk8.cyan(tfDir + "/")}`);
     console.log("");
-    console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-    console.log(`  ${chalk6.bold("Stage:")}           ${config.stage}`);
-    console.log(`  ${chalk6.bold("Region:")}          ${config.region}`);
-    console.log(`  ${chalk6.bold("Account:")}         ${config.account_id}`);
-    console.log(`  ${chalk6.bold("Database:")}        ${config.database_engine}`);
-    console.log(`  ${chalk6.bold("Memory:")}          managed (always on)${config.enable_hindsight === "true" ? " + hindsight" : ""}`);
-    console.log(`  ${chalk6.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
-    console.log(`  ${chalk6.bold("Directory:")}       ${tfDir}`);
-    console.log(chalk6.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(`  ${chalk8.bold("Stage:")}           ${config.stage}`);
+    console.log(`  ${chalk8.bold("Region:")}          ${config.region}`);
+    console.log(`  ${chalk8.bold("Account:")}         ${config.account_id}`);
+    console.log(`  ${chalk8.bold("Database:")}        ${config.database_engine}`);
+    console.log(`  ${chalk8.bold("Memory:")}          managed (always on)${config.enable_hindsight === "true" ? " + hindsight" : ""}`);
+    console.log(`  ${chalk8.bold("Google OAuth:")}    ${config.google_oauth_client_id ? "enabled" : "disabled"}`);
+    console.log(`  ${chalk8.bold("Directory:")}       ${tfDir}`);
+    console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     console.log("\n  Initializing Terraform...\n");
     try {
-      execSync5("terraform init", { cwd: tfDir, stdio: "inherit" });
+      execSync7("terraform init", { cwd: tfDir, stdio: "inherit" });
     } catch {
-      printWarning("Terraform init failed. Run `thinkwork doctor -s " + opts.stage + "` to check prerequisites.");
+      printWarning("Terraform init failed. Run `thinkwork doctor -s " + stage + "` to check prerequisites.");
       return;
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -1628,27 +2369,27 @@ output "agentcore_memory_id" {
       createdAt: now,
       updatedAt: now
     });
-    printSuccess(`Environment "${opts.stage}" initialized`);
+    printSuccess(`Environment "${stage}" initialized`);
     console.log("");
     console.log("  Next steps:");
-    console.log(`    ${chalk6.cyan("1.")} thinkwork plan -s ${opts.stage}        ${chalk6.dim("# Review infrastructure plan")}`);
-    console.log(`    ${chalk6.cyan("2.")} thinkwork deploy -s ${opts.stage}       ${chalk6.dim("# Deploy to AWS (~5 min)")}`);
-    console.log(`    ${chalk6.cyan("3.")} thinkwork bootstrap -s ${opts.stage}    ${chalk6.dim("# Seed workspace files + skills")}`);
-    console.log(`    ${chalk6.cyan("4.")} thinkwork outputs -s ${opts.stage}      ${chalk6.dim("# Show API URL, Cognito IDs, etc.")}`);
+    console.log(`    ${chalk8.cyan("1.")} thinkwork plan -s ${stage}        ${chalk8.dim("# Review infrastructure plan")}`);
+    console.log(`    ${chalk8.cyan("2.")} thinkwork deploy -s ${stage}       ${chalk8.dim("# Deploy to AWS (~5 min)")}`);
+    console.log(`    ${chalk8.cyan("3.")} thinkwork bootstrap -s ${stage}    ${chalk8.dim("# Seed workspace files + skills")}`);
+    console.log(`    ${chalk8.cyan("4.")} thinkwork outputs -s ${stage}      ${chalk8.dim("# Show API URL, Cognito IDs, etc.")}`);
     console.log("");
   });
 }
 
 // src/commands/status.ts
-import { execSync as execSync6 } from "child_process";
-import chalk7 from "chalk";
+import { execSync as execSync8 } from "child_process";
+import chalk9 from "chalk";
 function link(url, label) {
   const text = label || url;
   return `\x1B]8;;${url}\x1B\\${text}\x1B]8;;\x1B\\`;
 }
-function runAws(cmd) {
+function runAws3(cmd) {
   try {
-    return execSync6(`aws ${cmd}`, {
+    return execSync8(`aws ${cmd}`, {
       encoding: "utf-8",
       timeout: 15e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -1659,7 +2400,7 @@ function runAws(cmd) {
 }
 function discoverAwsStages(region) {
   const stages = /* @__PURE__ */ new Map();
-  const raw = runAws(
+  const raw = runAws3(
     `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
   );
   if (!raw) return stages;
@@ -1674,38 +2415,38 @@ function discoverAwsStages(region) {
   for (const [stage, info] of stages) {
     const count = functions.filter((f) => f.startsWith(`thinkwork-${stage}-`)).length;
     info.lambdaCount = count;
-    const apiRaw = runAws(
+    const apiRaw = runAws3(
       `apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`
     );
     if (apiRaw && apiRaw !== "None") info.apiEndpoint = apiRaw;
-    const appsyncRaw = runAws(
+    const appsyncRaw = runAws3(
       `appsync list-graphql-apis --region ${region} --query "graphqlApis[?name=='thinkwork-${stage}-subscriptions'].uris.REALTIME|[0]" --output text`
     );
     if (appsyncRaw && appsyncRaw !== "None") info.appsyncUrl = appsyncRaw;
-    const appsyncApiRaw = runAws(
+    const appsyncApiRaw = runAws3(
       `appsync list-graphql-apis --region ${region} --query "graphqlApis[?name=='thinkwork-${stage}-subscriptions'].uris.GRAPHQL|[0]" --output text`
     );
     if (appsyncApiRaw && appsyncApiRaw !== "None") info.appsyncApiUrl = appsyncApiRaw;
-    const acRaw = runAws(
+    const acRaw = runAws3(
       `lambda get-function --function-name thinkwork-${stage}-agentcore --region ${region} --query "Configuration.State" --output text 2>/dev/null`
     );
     info.agentcoreStatus = acRaw || "not deployed";
-    const bucketRaw = runAws(
+    const bucketRaw = runAws3(
       `s3api head-bucket --bucket thinkwork-${stage}-storage --region ${region} 2>/dev/null && echo "exists"`
     );
     info.bucketName = bucketRaw ? `thinkwork-${stage}-storage` : void 0;
-    const ecsRaw = runAws(
+    const ecsRaw = runAws3(
       `ecs describe-services --cluster thinkwork-${stage}-cluster --services thinkwork-${stage}-hindsight --region ${region} --query "services[0].runningCount" --output text 2>/dev/null`
     );
     if (ecsRaw && ecsRaw !== "None" && ecsRaw !== "0") {
       info.hindsightEnabled = true;
-      const albRaw = runAws(
+      const albRaw = runAws3(
         `elbv2 describe-load-balancers --region ${region} --query "LoadBalancers[?contains(LoadBalancerName, 'tw-${stage}-hindsight')].DNSName|[0]" --output text`
       );
       if (albRaw && albRaw !== "None") {
         info.hindsightEndpoint = `http://${albRaw}`;
         try {
-          const health = execSync6(`curl -s --max-time 3 http://${albRaw}/health`, { encoding: "utf-8" }).trim();
+          const health = execSync8(`curl -s --max-time 3 http://${albRaw}/health`, { encoding: "utf-8" }).trim();
           info.hindsightHealth = health.includes("healthy") ? "healthy" : "unhealthy";
         } catch {
           info.hindsightHealth = "unreachable";
@@ -1714,15 +2455,15 @@ function discoverAwsStages(region) {
     } else {
       info.hindsightEnabled = false;
     }
-    const dbRaw = runAws(
+    const dbRaw = runAws3(
       `rds describe-db-clusters --region ${region} --query "DBClusters[?starts_with(DBClusterIdentifier, 'thinkwork-${stage}')].Endpoint|[0]" --output text`
     );
     if (dbRaw && dbRaw !== "None") info.dbEndpoint = dbRaw;
-    const ecrRaw = runAws(
+    const ecrRaw = runAws3(
       `ecr describe-repositories --region ${region} --query "repositories[?repositoryName=='thinkwork-${stage}-agentcore'].repositoryUri|[0]" --output text`
     );
     if (ecrRaw && ecrRaw !== "None") info.ecrUrl = ecrRaw;
-    const cfJson = runAws(
+    const cfJson = runAws3(
       `cloudfront list-distributions --query "DistributionList.Items[?contains(Origins.Items[0].DomainName, 'thinkwork-${stage}-')].{Origin:Origins.Items[0].DomainName,Domain:DomainName}" --output json`
     );
     if (cfJson) {
@@ -1739,33 +2480,33 @@ function discoverAwsStages(region) {
   return stages;
 }
 function printStageDetail(info) {
-  console.log(chalk7.bold.cyan(`  \u2B21 ${info.stage}`));
-  console.log(chalk7.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(`  ${chalk7.bold("Source:")}          ${info.source === "both" ? "AWS + local config" : info.source === "aws" ? "AWS (no local config)" : "local only (not in AWS)"}`);
-  console.log(`  ${chalk7.bold("Region:")}          ${info.region}`);
-  console.log(`  ${chalk7.bold("Account:")}         ${info.accountId}`);
-  console.log(`  ${chalk7.bold("Lambda fns:")}      ${info.lambdaCount || "\u2014"}`);
-  console.log(`  ${chalk7.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
-  console.log(`  ${chalk7.bold("Memory:")}          managed (always on)`);
+  console.log(chalk9.bold.cyan(`  \u2B21 ${info.stage}`));
+  console.log(chalk9.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(`  ${chalk9.bold("Source:")}          ${info.source === "both" ? "AWS + local config" : info.source === "aws" ? "AWS (no local config)" : "local only (not in AWS)"}`);
+  console.log(`  ${chalk9.bold("Region:")}          ${info.region}`);
+  console.log(`  ${chalk9.bold("Account:")}         ${info.accountId}`);
+  console.log(`  ${chalk9.bold("Lambda fns:")}      ${info.lambdaCount || "\u2014"}`);
+  console.log(`  ${chalk9.bold("AgentCore:")}       ${info.agentcoreStatus || "unknown"}`);
+  console.log(`  ${chalk9.bold("Memory:")}          managed (always on)`);
   const hindsightLabel = info.hindsightEnabled === void 0 ? "unknown" : info.hindsightEnabled ? info.hindsightHealth || "running" : "disabled";
-  console.log(`  ${chalk7.bold("Hindsight:")}       ${hindsightLabel}`);
-  if (info.bucketName) console.log(`  ${chalk7.bold("S3 bucket:")}       ${info.bucketName}`);
-  if (info.dbEndpoint) console.log(`  ${chalk7.bold("Database:")}        ${info.dbEndpoint}`);
-  if (info.ecrUrl) console.log(`  ${chalk7.bold("ECR:")}             ${info.ecrUrl}`);
+  console.log(`  ${chalk9.bold("Hindsight:")}       ${hindsightLabel}`);
+  if (info.bucketName) console.log(`  ${chalk9.bold("S3 bucket:")}       ${info.bucketName}`);
+  if (info.dbEndpoint) console.log(`  ${chalk9.bold("Database:")}        ${info.dbEndpoint}`);
+  if (info.ecrUrl) console.log(`  ${chalk9.bold("ECR:")}             ${info.ecrUrl}`);
   console.log("");
-  console.log(chalk7.bold("  URLs:"));
+  console.log(chalk9.bold("  URLs:"));
   if (info.adminUrl) console.log(`    Admin:     ${link(info.adminUrl)}`);
   if (info.docsUrl) console.log(`    Docs:      ${link(info.docsUrl)}`);
   if (info.apiEndpoint) console.log(`    API:       ${link(info.apiEndpoint)}`);
   if (info.appsyncApiUrl) console.log(`    AppSync:   ${link(info.appsyncApiUrl)}`);
   if (info.appsyncUrl) console.log(`    WebSocket: ${link(info.appsyncUrl)}`);
   if (info.hindsightEndpoint) console.log(`    Hindsight: ${link(info.hindsightEndpoint)}`);
-  console.log(chalk7.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(chalk9.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   const local = loadEnvironment(info.stage);
   if (local) {
-    console.log(chalk7.dim(`  Terraform dir: ${local.terraformDir}`));
+    console.log(chalk9.dim(`  Terraform dir: ${local.terraformDir}`));
   } else {
-    console.log(chalk7.dim(`  No local config. Run: thinkwork init -s ${info.stage}`));
+    console.log(chalk9.dim(`  No local config. Run: thinkwork init -s ${info.stage}`));
   }
   console.log("");
 }
@@ -1802,7 +2543,7 @@ and AgentCore for per-stage detail.
       printError("AWS credentials not configured. Run `thinkwork login` first.");
       process.exit(1);
     }
-    console.log(chalk7.dim("  Scanning AWS account for Thinkwork deployments...\n"));
+    console.log(chalk9.dim("  Scanning AWS account for Thinkwork deployments...\n"));
     const awsStages = discoverAwsStages(opts.region);
     const localEnvs = listEnvironments();
     const merged = /* @__PURE__ */ new Map();
@@ -1837,7 +2578,7 @@ and AgentCore for per-stage detail.
     }
     if (merged.size === 0) {
       console.log("  No Thinkwork environments found.");
-      console.log(`  Run ${chalk7.cyan("thinkwork init -s <stage>")} to create one.`);
+      console.log(`  Run ${chalk9.cyan("thinkwork init -s <stage>")} to create one.`);
       console.log("");
       return;
     }
@@ -1848,55 +2589,16 @@ and AgentCore for per-stage detail.
 }
 
 // src/commands/mcp.ts
-import chalk8 from "chalk";
+import chalk10 from "chalk";
 
 // src/api-client.ts
 import { readFileSync as readFileSync5, existsSync as existsSync8 } from "fs";
-import { execSync as execSync8 } from "child_process";
-
-// src/aws-discovery.ts
-import { execSync as execSync7 } from "child_process";
-function runAws2(cmd) {
-  try {
-    return execSync7(`aws ${cmd}`, {
-      encoding: "utf-8",
-      timeout: 15e3,
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-function listDeployedStages(region) {
-  const raw = runAws2(
-    `lambda list-functions --region ${region} --query "Functions[?starts_with(FunctionName, 'thinkwork-')].FunctionName" --output json`
-  );
-  if (!raw) return [];
-  try {
-    const functions = JSON.parse(raw);
-    const stages = /* @__PURE__ */ new Set();
-    for (const fn of functions) {
-      const m = fn.match(/^thinkwork-(.+?)-api-graphql-http$/);
-      if (m) stages.add(m[1]);
-    }
-    return [...stages].sort();
-  } catch {
-    return [];
-  }
-}
-function getApiAuthSecretFromLambda(stage, region) {
-  const raw = runAws2(
-    `lambda get-function-configuration --function-name thinkwork-${stage}-api-tenants --region ${region} --query "Environment.Variables.API_AUTH_SECRET" --output text`
-  );
-  return raw && raw !== "None" ? raw : null;
-}
-
-// src/api-client.ts
-function readTfVar2(tfvarsPath, key) {
-  if (!existsSync8(tfvarsPath)) return null;
-  const content = readFileSync5(tfvarsPath, "utf-8");
-  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
-  return match ? match[1] : null;
+import { execSync as execSync9 } from "child_process";
+function readTfVar2(tfvarsPath, key) {
+  if (!existsSync8(tfvarsPath)) return null;
+  const content = readFileSync5(tfvarsPath, "utf-8");
+  const match = content.match(new RegExp(`^${key}\\s*=\\s*"([^"]*)"`, "m"));
+  return match ? match[1] : null;
 }
 function resolveTfvarsPath2(stage) {
   const tfDir = resolveTerraformDir(stage);
@@ -1908,9 +2610,9 @@ function resolveTfvarsPath2(stage) {
   const cwd = resolveTierDir(terraformDir, stage, "app");
   return `${cwd}/terraform.tfvars`;
 }
-function getApiEndpoint(stage, region) {
+function getApiEndpoint2(stage, region) {
   try {
-    const raw = execSync8(
+    const raw = execSync9(
       `aws apigatewayv2 get-apis --region ${region} --query "Items[?Name=='thinkwork-${stage}-api'].ApiEndpoint|[0]" --output text`,
       { encoding: "utf-8", timeout: 15e3, stdio: ["pipe", "pipe", "pipe"] }
     ).trim();
@@ -1953,7 +2655,7 @@ function resolveApiConfig(stage, regionOverride) {
   const tfAuthSecret = readTfVar2(tfvarsPath, "api_auth_secret");
   const tfRegion = readTfVar2(tfvarsPath, "region");
   const region = regionOverride || tfRegion || "us-east-1";
-  const apiUrl = getApiEndpoint(stage, region);
+  const apiUrl = getApiEndpoint2(stage, region);
   if (!apiUrl) {
     printError(
       `Cannot discover API endpoint for stage "${stage}" in ${region}. Is the stack deployed?`
@@ -1970,108 +2672,232 @@ function resolveApiConfig(stage, regionOverride) {
   return { apiUrl, authSecret };
 }
 
+// src/lib/resolve-tenant.ts
+import { select as select4 } from "@inquirer/prompts";
+async function resolveTenant(opts) {
+  const override = opts.flag ?? process.env.THINKWORK_TENANT;
+  if (override) {
+    const cached = loadStageSession(opts.stage);
+    if (cached && cached.tenantSlug === override) {
+      return { slug: override, id: cached.tenantId };
+    }
+    return { slug: override };
+  }
+  const session = loadStageSession(opts.stage);
+  if (session?.tenantSlug) {
+    return { slug: session.tenantSlug, id: session.tenantId };
+  }
+  if (!opts.listTenants) {
+    printError(
+      `No tenant resolved for stage "${opts.stage}". Pass --tenant <slug>, set THINKWORK_TENANT, or re-run \`thinkwork login --stage ${opts.stage}\`.`
+    );
+    process.exit(1);
+  }
+  const tenants = await opts.listTenants();
+  if (tenants.length === 0) {
+    printError(
+      "No tenants available. You may need to be invited to a workspace first."
+    );
+    process.exit(1);
+  }
+  if (tenants.length === 1) {
+    const only = tenants[0];
+    console.log(`  Using the only tenant: ${only.name} (${only.slug})`);
+    cacheTenant(opts.stage, only);
+    return { slug: only.slug, id: only.id };
+  }
+  requireTty("Tenant");
+  const slug = await select4({
+    message: "Which tenant?",
+    choices: tenants.map((t) => ({
+      name: `${t.name}  (slug: ${t.slug})`,
+      value: t.slug
+    })),
+    loop: false
+  });
+  const picked = tenants.find((t) => t.slug === slug);
+  cacheTenant(opts.stage, picked);
+  return { slug: picked.slug, id: picked.id };
+}
+function cacheTenant(stage, tenant) {
+  const session = loadStageSession(stage);
+  if (!session) return;
+  saveStageSession(stage, { ...session, tenantId: tenant.id, tenantSlug: tenant.slug });
+}
+
+// src/lib/resolve-tenant-rest.ts
+async function resolveTenantRest(opts) {
+  return resolveTenant({
+    flag: opts.flag,
+    stage: opts.stage,
+    listTenants: async () => {
+      const list = await apiFetch(
+        opts.apiUrl,
+        opts.authSecret,
+        "/api/tenants"
+      );
+      return list;
+    }
+  });
+}
+
 // src/commands/mcp.ts
+async function resolveMcpContext(opts) {
+  const stage = await resolveStage({ flag: opts.stage });
+  const api = resolveApiConfig(stage);
+  if (!api) process.exit(1);
+  const tenant = await resolveTenantRest({
+    flag: opts.tenant,
+    stage,
+    apiUrl: api.apiUrl,
+    authSecret: api.authSecret
+  });
+  return { stage, api, tenant };
+}
 function registerMcpCommand(program2) {
   const mcp = program2.command("mcp").description("Manage MCP servers for your tenant");
-  mcp.command("list").description("List registered MCP servers").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("mcp list", opts.stage);
+  mcp.command("list").alias("ls").description("List registered MCP servers. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Interactive \u2014 picks stage + tenant from the deployed ones
+  $ thinkwork mcp list
+
+  # Scriptable
+  $ thinkwork mcp list -s dev -t acme
+  $ thinkwork mcp list -s prod -t acme --json | jq '.[].slug'
+`
+  ).action(async (opts) => {
     try {
-      const { servers } = await apiFetch(api.apiUrl, api.authSecret, "/api/skills/mcp-servers", {}, { "x-tenant-slug": opts.tenant });
+      const { stage, api, tenant } = await resolveMcpContext(opts);
+      printHeader("mcp list", stage);
+      const { servers } = await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        "/api/skills/mcp-servers",
+        {},
+        { "x-tenant-slug": tenant.slug }
+      );
       if (!servers || servers.length === 0) {
-        console.log(chalk8.dim("  No MCP servers registered."));
+        console.log(chalk10.dim("  No MCP servers registered."));
         return;
       }
       console.log("");
       for (const s of servers) {
-        const status = s.enabled ? chalk8.green("enabled") : chalk8.dim("disabled");
+        const status = s.enabled ? chalk10.green("enabled") : chalk10.dim("disabled");
         const authLabel = s.authType === "per_user_oauth" ? `OAuth (${s.oauthProvider})` : s.authType === "tenant_api_key" ? "API Key" : "none";
-        console.log(`  ${chalk8.bold(s.name)}  ${chalk8.dim(s.slug)}  ${status}`);
+        console.log(`  ${chalk10.bold(s.name)}  ${chalk10.dim(s.slug)}  ${status}`);
         console.log(`    URL:       ${s.url}`);
         console.log(`    Transport: ${s.transport}`);
         console.log(`    Auth:      ${authLabel}`);
-        if (s.tools?.length) {
-          console.log(`    Tools:     ${s.tools.length} cached`);
-        }
+        if (s.tools?.length) console.log(`    Tools:     ${s.tools.length} cached`);
         console.log("");
       }
     } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  mcp.command("add <name>").description("Register an MCP server").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").requiredOption("--url <url>", "MCP server URL").option("--transport <type>", "Transport type (streamable-http|sse)", "streamable-http").option("--auth-type <type>", "Auth type (none|tenant_api_key|per_user_oauth)", "none").option("--api-key <token>", "API key (for tenant_api_key auth)").option("--oauth-provider <name>", "OAuth provider name (for per_user_oauth auth)").action(async (name, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    const body = {
-      name,
-      url: opts.url,
-      transport: opts.transport
-    };
-    if (opts.authType !== "none") body.authType = opts.authType;
-    if (opts.apiKey) body.apiKey = opts.apiKey;
-    if (opts.oauthProvider) body.oauthProvider = opts.oauthProvider;
-    try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, "/api/skills/mcp-servers", {
-        method: "POST",
-        body: JSON.stringify(body)
-      }, { "x-tenant-slug": opts.tenant });
-      printSuccess(`MCP server "${name}" ${result.created ? "registered" : "updated"} (slug: ${result.slug})`);
-    } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("remove <id>").description("Remove an MCP server").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (id, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  mcp.command("add [name]").description("Register an MCP server. Prompts for missing fields in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--url <url>", "MCP server URL").option("--transport <type>", "Transport type (streamable-http|sse)", "streamable-http").option("--auth-type <type>", "Auth type (none|tenant_api_key|per_user_oauth)", "none").option("--api-key <token>", "API key (for tenant_api_key auth)").option("--oauth-provider <name>", "OAuth provider name (for per_user_oauth auth)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive \u2014 prompts for name, URL, and auth
+  $ thinkwork mcp add
+
+  # Scripted \u2014 API-key auth
+  $ thinkwork mcp add my-tools --url https://mcp.example.com/crm \\
+      --auth-type tenant_api_key --api-key sk-abc -s dev -t acme
+
+  # OAuth connector (users connect from the mobile app)
+  $ thinkwork mcp add lastmile --url https://mcp-dev.lastmile-tei.com/crm \\
+      --auth-type per_user_oauth --oauth-provider lastmile -s dev -t acme
+`
+  ).action(
+    async (nameArg, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { stage, api, tenant } = await resolveMcpContext(opts);
+        let name = nameArg;
+        if (!name) {
+          if (!process.stdin.isTTY) {
+            printError("Name is required. Pass it as a positional arg.");
+            process.exit(1);
+          }
+          name = await input3({ message: "Server name:" });
+        }
+        let url = opts.url;
+        if (!url) {
+          if (!process.stdin.isTTY) {
+            printError("--url is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          url = await input3({
+            message: "MCP server URL:",
+            validate: (v) => v.startsWith("http://") || v.startsWith("https://") ? true : "URL must start with http:// or https://"
+          });
+        }
+        const body = { name, url, transport: opts.transport };
+        if (opts.authType !== "none") body.authType = opts.authType;
+        if (opts.apiKey) body.apiKey = opts.apiKey;
+        if (opts.oauthProvider) body.oauthProvider = opts.oauthProvider;
+        printHeader("mcp add", stage);
+        const result = await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          "/api/skills/mcp-servers",
+          { method: "POST", body: JSON.stringify(body) },
+          { "x-tenant-slug": tenant.slug }
+        );
+        printSuccess(
+          `MCP server "${name}" ${result.created ? "registered" : "updated"} (slug: ${result.slug})`
+        );
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  );
+  mcp.command("remove <id>").alias("rm").description("Remove an MCP server. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (id, opts) => {
     try {
-      await apiFetch(api.apiUrl, api.authSecret, `/api/skills/mcp-servers/${id}`, {
-        method: "DELETE"
-      }, { "x-tenant-slug": opts.tenant });
-      printSuccess(`MCP server removed.`);
+      const { api, tenant } = await resolveMcpContext(opts);
+      await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        `/api/skills/mcp-servers/${id}`,
+        { method: "DELETE" },
+        { "x-tenant-slug": tenant.slug }
+      );
+      printSuccess("MCP server removed.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("test <id>").description("Test connection and discover tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (id, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("mcp test", opts.stage);
+  mcp.command("test <id>").description("Test connection and discover tools. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (id, opts) => {
     try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, `/api/skills/mcp-servers/${id}/test`, {
-        method: "POST"
-      }, { "x-tenant-slug": opts.tenant });
+      const { stage, api, tenant } = await resolveMcpContext(opts);
+      printHeader("mcp test", stage);
+      const result = await apiFetch(
+        api.apiUrl,
+        api.authSecret,
+        `/api/skills/mcp-servers/${id}/test`,
+        { method: "POST" },
+        { "x-tenant-slug": tenant.slug }
+      );
       if (result.ok) {
         printSuccess("Connection successful.");
         if (result.tools?.length) {
-          console.log(chalk8.bold(`
+          console.log(chalk10.bold(`
   Discovered tools (${result.tools.length}):
 `));
           for (const t of result.tools) {
-            console.log(`    ${chalk8.cyan(t.name)}${t.description ? chalk8.dim(` - ${t.description}`) : ""}`);
+            console.log(
+              `    ${chalk10.cyan(t.name)}${t.description ? chalk10.dim(` - ${t.description}`) : ""}`
+            );
           }
           console.log("");
         } else {
@@ -2082,165 +2908,200 @@ function registerMcpCommand(program2) {
         process.exit(1);
       }
     } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  mcp.command("assign <mcpServerId>").description("Assign an MCP server to an agent").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--agent <id>", "Agent ID").action(async (mcpServerId, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    try {
-      const result = await apiFetch(api.apiUrl, api.authSecret, `/api/skills/agents/${opts.agent}/mcp-servers`, {
-        method: "POST",
-        body: JSON.stringify({ mcpServerId })
-      });
-      printSuccess(`MCP server assigned to agent. (${result.created ? "new" : "updated"})`);
-    } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  mcp.command("unassign <mcpServerId>").description("Remove an MCP server from an agent").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--agent <id>", "Agent ID").action(async (mcpServerId, opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  mcp.command("assign <mcpServerId>").description("Assign an MCP server to an agent. Prompts for stage/agent when omitted in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
+    async (mcpServerId, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { api } = await resolveMcpContext(opts);
+        let agent = opts.agent;
+        if (!agent) {
+          if (!process.stdin.isTTY) {
+            printError("--agent is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          agent = await input3({ message: "Agent ID:" });
+        }
+        const result = await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          `/api/skills/agents/${agent}/mcp-servers`,
+          { method: "POST", body: JSON.stringify({ mcpServerId }) }
+        );
+        printSuccess(`MCP server assigned to agent. (${result.created ? "new" : "updated"})`);
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    try {
-      await apiFetch(api.apiUrl, api.authSecret, `/api/skills/agents/${opts.agent}/mcp-servers/${mcpServerId}`, {
-        method: "DELETE"
-      });
-      printSuccess("MCP server unassigned from agent.");
-    } catch (err) {
-      printError(err.message);
-      process.exit(1);
+  );
+  mcp.command("unassign <mcpServerId>").description("Remove an MCP server from an agent. Prompts for stage/agent when omitted in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent ID").action(
+    async (mcpServerId, opts) => {
+      try {
+        const { input: input3 } = await import("@inquirer/prompts");
+        const { api } = await resolveMcpContext(opts);
+        let agent = opts.agent;
+        if (!agent) {
+          if (!process.stdin.isTTY) {
+            printError("--agent is required. Pass it as a flag.");
+            process.exit(1);
+          }
+          agent = await input3({ message: "Agent ID:" });
+        }
+        await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          `/api/skills/agents/${agent}/mcp-servers/${mcpServerId}`,
+          { method: "DELETE" }
+        );
+        printSuccess("MCP server unassigned from agent.");
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-  });
+  );
 }
 
 // src/commands/tools.ts
-import { createInterface as createInterface4 } from "readline";
-import chalk9 from "chalk";
-function prompt(question) {
-  const rl = createInterface4({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve3) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolve3(answer.trim());
-    });
-  });
-}
+import { select as select5, password } from "@inquirer/prompts";
+import chalk11 from "chalk";
 var TOOL_PROVIDERS = {
   "web-search": ["exa", "serpapi"]
 };
+async function resolveCtx(opts) {
+  const stage = await resolveStage({ flag: opts.stage });
+  const api = resolveApiConfig(stage);
+  if (!api) process.exit(1);
+  const tenant = await resolveTenantRest({
+    flag: opts.tenant,
+    stage,
+    apiUrl: api.apiUrl,
+    authSecret: api.authSecret
+  });
+  return { stage, api, tenant };
+}
 function registerToolsCommand(program2) {
   const tools = program2.command("tools").description("Configure built-in agent tools (web_search, \u2026) for your tenant");
-  tools.command("list").description("List configured built-in tools").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("tools list", opts.stage);
+  tools.command("list").alias("ls").description("List configured built-in tools. Prompts for stage/tenant in a TTY when omitted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Interactive \u2014 picks stage + tenant
+  $ thinkwork tools list
+
+  # Scripted
+  $ thinkwork tools list -s dev -t acme
+  $ thinkwork tools list --json | jq '.[] | .toolSlug'
+`
+  ).action(async (opts) => {
     try {
+      const { stage, api, tenant } = await resolveCtx(opts);
+      printHeader("tools list", stage);
       const { tools: rows } = await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools",
         {},
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       if (!rows || rows.length === 0) {
-        console.log(chalk9.dim("  No built-in tools configured."));
-        console.log(chalk9.dim("  Try: thinkwork tools web-search set --tenant <slug> -s <stage>"));
+        console.log(chalk11.dim("  No built-in tools configured."));
+        console.log(chalk11.dim("  Try: thinkwork tools web-search set"));
         return;
       }
       console.log("");
       for (const r of rows) {
-        const status = r.enabled ? chalk9.green("enabled") : chalk9.dim("disabled");
-        const key = r.hasSecret ? chalk9.green("yes") : chalk9.red("no");
-        const provider = r.provider ?? chalk9.dim("\u2014");
-        console.log(`  ${chalk9.bold(r.toolSlug)}  ${status}`);
+        const status = r.enabled ? chalk11.green("enabled") : chalk11.dim("disabled");
+        const key = r.hasSecret ? chalk11.green("yes") : chalk11.red("no");
+        const provider = r.provider ?? chalk11.dim("\u2014");
+        console.log(`  ${chalk11.bold(r.toolSlug)}  ${status}`);
         console.log(`    Provider:  ${provider}`);
         console.log(`    Has key:   ${key}`);
-        if (r.lastTestedAt) {
-          console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
-        }
+        if (r.lastTestedAt) console.log(`    Tested:    ${new Date(r.lastTestedAt).toLocaleString()}`);
         console.log("");
       }
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
   const webSearch = tools.command("web-search").description("Configure the web_search built-in tool");
-  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    let provider = opts.provider;
-    if (!provider) {
-      provider = (await prompt(`Provider [${TOOL_PROVIDERS["web-search"].join("/")}]: `)).toLowerCase();
-    }
-    if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
-      printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
-      process.exit(1);
-    }
-    let apiKey = opts.key;
-    if (!apiKey) {
-      apiKey = await prompt(`${provider} API key: `);
-    }
-    if (!apiKey) {
-      printError("API key is required");
-      process.exit(1);
-    }
-    try {
-      await apiFetch(
-        api.apiUrl,
-        api.authSecret,
-        "/api/skills/builtin-tools/web-search",
-        {
-          method: "PUT",
-          body: JSON.stringify({ provider, apiKey, enabled: true })
-        },
-        { "x-tenant-slug": opts.tenant }
-      );
-      printSuccess(`web_search configured with provider=${provider}, enabled=true`);
-      printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
-    } catch (err) {
-      printError(err.message);
-      process.exit(1);
-    }
-  });
-  webSearch.command("test").description("Test the stored web_search provider + key against the provider API").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
+  webSearch.command("set").description("Set or update web_search provider + API key (enables the tool). Prompts when flags are missing in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--provider <name>", `Provider (${TOOL_PROVIDERS["web-search"].join("|")})`).option("--key <key>", "API key (will prompt hidden if omitted)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive \u2014 stage/tenant picker, provider picker, hidden key prompt
+  $ thinkwork tools web-search set
+
+  # Scripted (secret from env)
+  $ thinkwork tools web-search set -s dev -t acme --provider exa --key "$EXA_KEY"
+`
+  ).action(
+    async (opts) => {
+      try {
+        const { api, tenant } = await resolveCtx(opts);
+        let provider = opts.provider;
+        if (!provider) {
+          if (!process.stdin.isTTY) {
+            printError(`--provider is required. One of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+            process.exit(1);
+          }
+          provider = await select5({
+            message: "Provider:",
+            choices: TOOL_PROVIDERS["web-search"].map((p) => ({ name: p, value: p })),
+            loop: false
+          });
+        }
+        if (!TOOL_PROVIDERS["web-search"].includes(provider)) {
+          printError(`provider must be one of: ${TOOL_PROVIDERS["web-search"].join(", ")}`);
+          process.exit(1);
+        }
+        let apiKey = opts.key;
+        if (!apiKey) {
+          if (!process.stdin.isTTY) {
+            printError("--key is required. Pass it as a flag or pipe via env.");
+            process.exit(1);
+          }
+          apiKey = await password({ message: `${provider} API key:`, mask: "*" });
+        }
+        if (!apiKey) {
+          printError("API key is required");
+          process.exit(1);
+        }
+        await apiFetch(
+          api.apiUrl,
+          api.authSecret,
+          "/api/skills/builtin-tools/web-search",
+          { method: "PUT", body: JSON.stringify({ provider, apiKey, enabled: true }) },
+          { "x-tenant-slug": tenant.slug }
+        );
+        printSuccess(`web_search configured with provider=${provider}, enabled=true`);
+        printWarning("Run `thinkwork tools web-search test` to verify connectivity.");
+      } catch (err) {
+        if (isCancellation(err)) return;
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+      }
     }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
-    printHeader("tools web-search test", opts.stage);
+  );
+  webSearch.command("test").description("Test the stored web_search provider + key against the provider API.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { stage, api, tenant } = await resolveCtx(opts);
+      printHeader("tools web-search test", stage);
       const result = await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search/test",
         { method: "POST", body: "{}" },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       if (result.ok) {
         printSuccess(`${result.provider}: ${result.resultCount} result(s) returned.`);
@@ -2249,63 +3110,54 @@ function registerToolsCommand(program2) {
         process.exit(1);
       }
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  webSearch.command("disable").description("Disable web_search without deleting the stored key").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  webSearch.command("disable").description("Disable web_search without deleting the stored key.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { api, tenant } = await resolveCtx(opts);
       await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search",
         { method: "PUT", body: JSON.stringify({ enabled: false }) },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       printSuccess("web_search disabled.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
-  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key)").requiredOption("-s, --stage <name>", "Deployment stage").requiredOption("--tenant <slug>", "Tenant slug").action(async (opts) => {
-    const check = validateStage(opts.stage);
-    if (!check.valid) {
-      printError(check.error);
-      process.exit(1);
-    }
-    const api = resolveApiConfig(opts.stage);
-    if (!api) process.exit(1);
+  webSearch.command("clear").description("Remove web_search config entirely (deletes stored key).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(async (opts) => {
     try {
+      const { api, tenant } = await resolveCtx(opts);
       await apiFetch(
         api.apiUrl,
         api.authSecret,
         "/api/skills/builtin-tools/web-search",
         { method: "DELETE" },
-        { "x-tenant-slug": opts.tenant }
+        { "x-tenant-slug": tenant.slug }
       );
       printSuccess("web_search configuration cleared.");
     } catch (err) {
-      printError(err.message);
+      if (isCancellation(err)) return;
+      printError(err instanceof Error ? err.message : String(err));
       process.exit(1);
     }
   });
 }
 
 // src/commands/update.ts
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 import { realpathSync } from "fs";
-import chalk10 from "chalk";
+import chalk12 from "chalk";
 function getLatestVersion() {
   try {
-    return execSync9("npm view thinkwork-cli version", {
+    return execSync10("npm view thinkwork-cli version", {
       encoding: "utf-8",
       timeout: 1e4,
       stdio: ["pipe", "pipe", "pipe"]
@@ -2316,7 +3168,7 @@ function getLatestVersion() {
 }
 function detectInstallMethod() {
   try {
-    const which = execSync9("which thinkwork", {
+    const which = execSync10("which thinkwork", {
       encoding: "utf-8",
       timeout: 5e3,
       stdio: ["pipe", "pipe", "pipe"]
@@ -2344,28 +3196,28 @@ function compareVersions(a, b) {
 function registerUpdateCommand(program2) {
   program2.command("update").description("Check for and install CLI updates").option("--check", "Only check for updates, don't install").action(async (opts) => {
     printHeader("update", "", null);
-    console.log(`  Current version: ${chalk10.bold(VERSION)}`);
+    console.log(`  Current version: ${chalk12.bold(VERSION)}`);
     const latest = getLatestVersion();
     if (!latest) {
-      console.log(chalk10.yellow("  Could not check npm registry for updates."));
+      console.log(chalk12.yellow("  Could not check npm registry for updates."));
       return;
     }
-    console.log(`  Latest version:  ${chalk10.bold(latest)}`);
+    console.log(`  Latest version:  ${chalk12.bold(latest)}`);
     console.log("");
     const cmp = compareVersions(VERSION, latest);
     if (cmp >= 0) {
-      console.log(chalk10.green("  \u2713 You're on the latest version."));
+      console.log(chalk12.green("  \u2713 You're on the latest version."));
       console.log("");
       return;
     }
-    console.log(chalk10.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
+    console.log(chalk12.cyan(`  Update available: ${VERSION} \u2192 ${latest}`));
     console.log("");
     if (opts.check) {
       const method2 = detectInstallMethod();
       if (method2 === "homebrew") {
-        console.log(`  Run: ${chalk10.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
+        console.log(`  Run: ${chalk12.cyan("brew upgrade thinkwork-ai/tap/thinkwork")}`);
       } else {
-        console.log(`  Run: ${chalk10.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
+        console.log(`  Run: ${chalk12.cyan(`npm install -g thinkwork-cli@${latest}`)}`);
       }
       console.log("");
       return;
@@ -2373,27 +3225,27 @@ function registerUpdateCommand(program2) {
     const method = detectInstallMethod();
     const cmd = method === "homebrew" ? "brew upgrade thinkwork-ai/tap/thinkwork" : `npm install -g thinkwork-cli@${latest}`;
     console.log(`  Installing via ${method}...`);
-    console.log(chalk10.dim(`  $ ${cmd}`));
+    console.log(chalk12.dim(`  $ ${cmd}`));
     console.log("");
     try {
-      execSync9(cmd, { stdio: "inherit", timeout: 12e4 });
+      execSync10(cmd, { stdio: "inherit", timeout: 12e4 });
       console.log("");
-      console.log(chalk10.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
+      console.log(chalk12.green(`  \u2713 Upgraded to thinkwork-cli@${latest}`));
     } catch {
       console.log("");
-      console.log(chalk10.red(`  Failed to upgrade. Try manually:`));
-      console.log(`    ${chalk10.cyan(cmd)}`);
+      console.log(chalk12.red(`  Failed to upgrade. Try manually:`));
+      console.log(`    ${chalk12.cyan(cmd)}`);
     }
     console.log("");
   });
 }
 
 // src/commands/user.ts
-import { spawn as spawn3 } from "child_process";
-import { input, select as select2 } from "@inquirer/prompts";
+import { spawn as spawn4 } from "child_process";
+import { input as input2, select as select6 } from "@inquirer/prompts";
 function getTerraformOutput2(cwd, key) {
   return new Promise((resolve3, reject) => {
-    const proc = spawn3("terraform", ["output", "-raw", key], {
+    const proc = spawn4("terraform", ["output", "-raw", key], {
       cwd,
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -2425,7 +3277,7 @@ function runAwsCognitoReset(userPoolId, username, region) {
       "json"
     ];
     if (region) args.push("--region", region);
-    const proc = spawn3("aws", args, { stdio: ["ignore", "pipe", "pipe"] });
+    const proc = spawn4("aws", args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     proc.stdout.on("data", (d) => stdout += d);
@@ -2433,10 +3285,7 @@ function runAwsCognitoReset(userPoolId, username, region) {
     proc.on("close", (code) => resolve3({ code: code ?? 1, stdout, stderr }));
   });
 }
-function isCancellation(err) {
-  return err instanceof Error && err.name === "ExitPromptError";
-}
-function requireTty(label) {
+function requireTty2(label) {
   if (!process.stdin.isTTY) {
     printError(
       `${label} is required. Pass it as a flag or re-run in an interactive terminal.`
@@ -2445,14 +3294,14 @@ function requireTty(label) {
   }
 }
 async function promptEmail() {
-  requireTty("Email");
-  return await input({
+  requireTty2("Email");
+  return await input2({
     message: "Email address of the person to invite:",
     validate: (v) => v.trim().includes("@") ? true : "That doesn't look like an email."
   });
 }
 async function promptStage(region) {
-  requireTty("Stage");
+  requireTty2("Stage");
   const stages = listDeployedStages(region);
   if (stages.length === 0) {
     printError(
@@ -2464,14 +3313,14 @@ async function promptStage(region) {
     console.log(`  Using the only deployed stage: ${stages[0]}`);
     return stages[0];
   }
-  return await select2({
+  return await select6({
     message: "Which stage?",
     choices: stages.map((s) => ({ name: s, value: s })),
     loop: false
   });
 }
 async function promptTenant(apiUrl, authSecret) {
-  requireTty("Tenant");
+  requireTty2("Tenant");
   const list = await apiFetch(apiUrl, authSecret, "/api/tenants");
   if (!list || list.length === 0) {
     printError(
@@ -2483,7 +3332,7 @@ async function promptTenant(apiUrl, authSecret) {
     console.log(`  Using the only tenant: ${list[0].name} (${list[0].slug})`);
     return list[0].slug;
   }
-  return await select2({
+  return await select6({
     message: "Which tenant?",
     choices: list.map((t) => ({
       name: `${t.name}  (slug: ${t.slug})`,
@@ -2494,7 +3343,7 @@ async function promptTenant(apiUrl, authSecret) {
 }
 async function promptOptionalName() {
   if (!process.stdin.isTTY) return void 0;
-  const answer = await input({
+  const answer = await input2({
     message: "Display name (optional, press Enter to skip):",
     default: ""
   });
@@ -2502,7 +3351,7 @@ async function promptOptionalName() {
 }
 async function promptRole() {
   if (!process.stdin.isTTY) return "member";
-  return await select2({
+  return await select6({
     message: "Role:",
     choices: [
       { name: "member \u2014 regular access", value: "member" },
@@ -2624,15 +3473,18 @@ Agents / scripts that pass all flags stay non-interactive.
     }
   );
   user.command("reset-password <email>").description(
-    "Trigger Cognito's forgot-password flow for a user (admin-initiated). Sends them a verification code email."
-  ).option("-p, --profile <name>", "AWS profile").requiredOption("-s, --stage <name>", "Deployment stage (e.g. dev, prod)").option(
+    "Trigger Cognito's forgot-password flow for a user (admin-initiated). Prompts for stage in a TTY when omitted."
+  ).option("-p, --profile <name>", "AWS profile").option("-s, --stage <name>", "Deployment stage (e.g. dev, prod)").option(
     "-r, --region <name>",
     "AWS region (defaults to AWS CLI default / AWS_REGION)"
   ).addHelpText(
     "after",
     `
 Examples:
-  # Admin-triggered password reset \u2014 works even if the account is locked
+  # Fully interactive \u2014 picks stage from the deployed ones
+  $ thinkwork user reset-password alice@example.com
+
+  # Scripted
   $ thinkwork user reset-password alice@example.com -s dev
 
   # Target a specific AWS profile + region
@@ -2645,10 +3497,12 @@ FORCE_CHANGE_PASSWORD or has been disabled.
 `
   ).action(
     async (email, opts) => {
-      const stageCheck = validateStage(opts.stage);
-      if (!stageCheck.valid) {
-        printError(stageCheck.error);
-        process.exit(1);
+      let stage;
+      try {
+        stage = await resolveStage({ flag: opts.stage, region: opts.region });
+      } catch (err) {
+        if (isCancellation(err)) return;
+        throw err;
       }
       if (!email || !email.includes("@")) {
         printError(
@@ -2656,11 +3510,11 @@ FORCE_CHANGE_PASSWORD or has been disabled.
         );
         process.exit(1);
       }
-      printHeader("user reset-password", opts.stage);
+      printHeader("user reset-password", stage);
       const terraformDir = process.env.THINKWORK_TERRAFORM_DIR || process.cwd();
-      const cwd = resolveTierDir(terraformDir, opts.stage, "app");
+      const cwd = resolveTierDir(terraformDir, stage, "app");
       await ensureInit(cwd);
-      await ensureWorkspace(cwd, opts.stage);
+      await ensureWorkspace(cwd, stage);
       let userPoolId;
       try {
         userPoolId = await getTerraformOutput2(cwd, "user_pool_id");
@@ -2704,27 +3558,904 @@ FORCE_CHANGE_PASSWORD or has been disabled.
   );
 }
 
-// src/cli.ts
-var program = new Command();
-program.name("thinkwork").description(
-  "Thinkwork CLI \u2014 deploy, manage, and interact with your Thinkwork stack"
-).version(VERSION, "-v, --version", "Print the CLI version").option(
-  "-p, --profile <name>",
-  "AWS profile to use (sets AWS_PROFILE for Terraform and AWS CLI)"
-);
-program.hook("preAction", (_thisCommand, actionCommand) => {
-  const explicit = actionCommand.opts().profile ?? program.opts().profile;
-  if (explicit) {
-    process.env.AWS_PROFILE = explicit;
-    return;
-  }
-  if (process.env.AWS_PROFILE) return;
-  const fallback = loadCliConfig().defaultProfile;
-  if (fallback) process.env.AWS_PROFILE = fallback;
+// src/commands/me.ts
+import { gql } from "@urql/core";
+
+// src/lib/gql-client.ts
+import {
+  Client,
+  cacheExchange,
+  fetchExchange
+} from "@urql/core";
+
+// src/lib/resolve-auth.ts
+var REFRESH_WINDOW_SECONDS = 5 * 60;
+async function resolveAuth(opts) {
+  const region = opts.region ?? "us-east-1";
+  const session = loadStageSession(opts.stage);
+  if (session?.kind === "cognito") {
+    const fresh = await ensureCognitoFresh(opts.stage, session, region);
+    return cognitoAuth(fresh);
+  }
+  if (opts.requireCognito) {
+    printError(
+      `Stage "${opts.stage}" has no Cognito session. Run \`thinkwork login --stage ${opts.stage}\` (not --api-key \u2014 this command needs a user identity).`
+    );
+    process.exit(1);
+  }
+  if (session?.kind === "api-key") {
+    return apiKeyAuth(session);
+  }
+  const api = resolveApiConfig(opts.stage, region);
+  if (!api) process.exit(1);
+  return {
+    mode: "api-key",
+    headers: {
+      Authorization: `Bearer ${api.authSecret}`
+    }
+  };
+}
+function cognitoAuth(session) {
+  return {
+    mode: "cognito",
+    headers: {
+      // graphql-http Lambda reads the id_token from `Authorization` (no
+      // `Bearer ` prefix per admin's fetchOptions). Keep the same shape.
+      Authorization: session.idToken
+    },
+    principalId: session.principalId,
+    tenantId: session.tenantId,
+    tenantSlug: session.tenantSlug
+  };
+}
+function apiKeyAuth(session) {
+  const headers = {
+    Authorization: `Bearer ${session.authSecret}`
+  };
+  if (session.tenantId) headers["x-tenant-id"] = session.tenantId;
+  return {
+    mode: "api-key",
+    headers,
+    tenantId: session.tenantId,
+    tenantSlug: session.tenantSlug
+  };
+}
+async function ensureCognitoFresh(stage, session, region) {
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const safeUntil = session.expiresAt - REFRESH_WINDOW_SECONDS;
+  if (nowSeconds < safeUntil) return session;
+  const cognito = discoverCognitoConfig(stage, region) ?? {
+    userPoolId: session.userPoolId,
+    clientId: session.userPoolClientId,
+    domain: session.cognitoDomain,
+    domainUrl: `https://${session.cognitoDomain}.auth.${session.region}.amazoncognito.com`,
+    region: session.region
+  };
+  try {
+    const refreshed = await refreshCognitoTokens(cognito, session.refreshToken);
+    const next = {
+      ...session,
+      idToken: refreshed.idToken,
+      accessToken: refreshed.accessToken,
+      expiresAt: refreshed.expiresAt
+    };
+    saveStageSession(stage, next);
+    return next;
+  } catch (err) {
+    printError(
+      `Session refresh failed for stage "${stage}": ${err instanceof Error ? err.message : String(err)}. Run \`thinkwork login --stage ${stage}\` to sign in again.`
+    );
+    process.exit(1);
+  }
+}
+
+// src/lib/gql-client.ts
+async function getGqlClient(opts) {
+  const region = opts.region ?? "us-east-1";
+  const baseUrl = getApiEndpoint(opts.stage, region);
+  if (!baseUrl) {
+    printError(
+      `Cannot discover API endpoint for stage "${opts.stage}" in ${region}. Is the stack deployed?`
+    );
+    process.exit(1);
+  }
+  const url = `${baseUrl.replace(/\/+$/, "")}/graphql`;
+  const auth = await resolveAuth({ stage: opts.stage, region });
+  const client = new Client({
+    url,
+    exchanges: [cacheExchange, fetchExchange],
+    fetchOptions: () => ({
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        ...auth.headers
+      }
+    }),
+    // CLI calls are short-lived and we want server truth on every run —
+    // bypass the in-memory cache to avoid stale reads between quick commands.
+    requestPolicy: "network-only"
+  });
+  return {
+    client,
+    url,
+    tenantId: auth.tenantId,
+    tenantSlug: auth.tenantSlug
+  };
+}
+
+// src/commands/me.ts
+var ME_QUERY = gql`
+  query CliMe {
+    me {
+      id
+      email
+      name
+      tenantId
+    }
+  }
+`;
+function registerMeCommand(program2) {
+  program2.command("me").description(
+    "Print the identity behind the current session for a stage. Use after `thinkwork login` to verify everything works, or as a scriptable introspection (`--json | jq`)."
+  ).option("-s, --stage <name>", "Stage to introspect (defaults to the saved default stage)").option("-r, --region <region>", "AWS region", "us-east-1").addHelpText(
+    "after",
+    `
+Examples:
+  # Check who you're signed in as on the default stage
+  $ thinkwork me
+
+  # Explicit stage
+  $ thinkwork me --stage prod
+
+  # Machine-readable \u2014 pipe to jq
+  $ thinkwork me --stage dev --json | jq .tenantSlug
+`
+  ).action(async (opts) => {
+    const stage = await resolveStage({ flag: opts.stage, region: opts.region });
+    const session = loadStageSession(stage);
+    if (!session) {
+      printError(
+        `Not signed in to stage "${stage}". Run \`thinkwork login --stage ${stage}\`.`
+      );
+      process.exit(1);
+    }
+    if (!isJsonMode()) printHeader("me", stage);
+    const { client, tenantSlug } = await getGqlClient({ stage, region: opts.region });
+    let me = null;
+    try {
+      const res = await client.query(ME_QUERY, {}).toPromise();
+      if (res.error) throw res.error;
+      me = res.data?.me ?? null;
+    } catch (err) {
+      printError(
+        `me query failed: ${err instanceof Error ? err.message : String(err)}`
+      );
+      process.exit(1);
+    }
+    if (isJsonMode()) {
+      printJson({
+        stage,
+        mode: session.kind,
+        user: me,
+        tenant: { id: me?.tenantId, slug: tenantSlug }
+      });
+      return;
+    }
+    printKeyValue([
+      ["Stage", stage],
+      ["Mode", session.kind],
+      ["User ID", me?.id],
+      ["Email", me?.email ?? (session.kind === "cognito" ? session.email : void 0)],
+      ["Name", me?.name ?? void 0],
+      ["Tenant ID", me?.tenantId ?? session.tenantId],
+      ["Tenant slug", tenantSlug ?? session.tenantSlug]
+    ]);
+  });
+}
+
+// src/lib/stub.ts
+import chalk13 from "chalk";
+var ROADMAP_URL = "https://github.com/thinkwork-ai/thinkwork/blob/main/apps/cli/README.md#roadmap";
+function notYetImplemented(commandPath, phase) {
+  const label = chalk13.yellow(`\u29D7 not yet implemented`);
+  const line = chalk13.bold(`thinkwork ${commandPath}`);
+  process.stderr.write(
+    `
+  ${label}: ${line} ships in Phase ${phase}.
+  ${chalk13.dim(`See the roadmap: ${ROADMAP_URL}`)}
+
+`
+  );
+  process.exit(2);
+}
+
+// src/commands/thread.ts
+function registerThreadCommand(program2) {
+  const thread = program2.command("thread").alias("threads").description(
+    "Create, list, update, and comment on threads (tasks, chats, bugs, questions) in a tenant."
+  );
+  thread.command("list").alias("ls").description("List threads in a tenant with optional filters.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--status <status>", "Filter: BACKLOG | TODO | IN_PROGRESS | IN_REVIEW | BLOCKED | DONE | CANCELLED").option("--priority <p>", "Filter: LOW | MEDIUM | HIGH | URGENT").option("--assignee <id>", "Filter by assignee (user or agent ID). Use `me` to match the caller.").option("--agent <id>", "Filter threads worked on by a specific agent").option("--search <q>", "Full-text search over title/body").option("--limit <n>", "Max rows (default 50)", "50").option("--archived", "Include archived threads").addHelpText(
+    "after",
+    `
+Examples:
+  # Open work on the default stage/tenant
+  $ thinkwork thread list --status IN_PROGRESS
+
+  # Pipe to jq
+  $ thinkwork thread list --json | jq '.[] | select(.priority=="URGENT")'
+
+  # Everything assigned to me
+  $ thinkwork thread list --assignee me
+`
+  ).action(() => notYetImplemented("thread list", 1));
+  thread.command("get <idOrNumber>").description("Fetch one thread by ID or by its tenant-scoped issue number.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread get thr-abc123
+  $ thinkwork thread get 42                 # by issue number
+  $ thinkwork thread get 42 --json | jq .assignee
+`
+  ).action(() => notYetImplemented("thread get", 1));
+  thread.command("create [title]").description("Create a new thread. Prompts for missing fields when running in a TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--type <type>", "TASK | CHAT | BUG | QUESTION", "TASK").option("--priority <p>", "LOW | MEDIUM | HIGH | URGENT", "MEDIUM").option("--assignee <id>", "Assign on create (user or agent ID)").option("--body <text>", "Description body (markdown)").option("--due <iso>", "Due date as ISO-8601").option("--label <name...>", "Attach label(s) by name (repeatable)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive \u2014 walkthrough prompts for title, type, priority, assignee.
+  $ thinkwork thread create
+
+  # Scripted
+  $ thinkwork thread create "Investigate latency spike" \\
+      --priority HIGH --assignee agt-obs-1 --label ops --label oncall
+
+  # Mix: pass the title, prompt for the rest.
+  $ thinkwork thread create "Investigate latency spike"
+`
+  ).action(() => notYetImplemented("thread create", 1));
+  thread.command("update <id>").description("Update a thread's title, status, priority, assignee, labels, or due date.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--title <t>", "Rename").option("--status <s>", "Move to a new status").option("--priority <p>", "LOW | MEDIUM | HIGH | URGENT").option("--assignee <id>", "Reassign (user or agent ID)").option("--due <iso>", "Due date").option("--body <text>", "Replace description body").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread update thr-abc --status IN_REVIEW
+  $ thinkwork thread update thr-abc --assignee agt-ops --priority URGENT
+`
+  ).action(() => notYetImplemented("thread update", 1));
+  thread.command("close <id>").description("Mark a thread DONE. Shortcut for `thread update <id> --status DONE`.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--comment <text>", "Add a closing comment").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread close thr-abc
+  $ thinkwork thread close thr-abc --comment "fixed in #124"
+`
+  ).action(() => notYetImplemented("thread close", 1));
+  thread.command("reopen <id>").description("Move a thread from DONE/CANCELLED back to TODO.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("thread reopen", 1));
+  thread.command("checkout <id>").description("Claim a thread so an agent can work it (locks other agents out).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent to check it out to (defaults to the caller)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread checkout thr-abc --agent agt-fixer
+`
+  ).action(() => notYetImplemented("thread checkout", 1));
+  thread.command("release <id>").description("Release a checked-out thread, optionally moving it to a new status.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--status <s>", "Status to release into").action(() => notYetImplemented("thread release", 1));
+  thread.command("comment <id> [content]").description("Add a comment to a thread. Prompts for content if omitted and TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--file <path>", "Read comment content from a file (markdown)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread comment thr-abc "Looks good, shipping"
+  $ thinkwork thread comment thr-abc --file /tmp/review.md
+  $ thinkwork thread comment thr-abc            # prompts interactively
+`
+  ).action(() => notYetImplemented("thread comment", 1));
+  thread.command("label <assign|remove> <threadId> <labelId>").description("Attach or detach a label on a thread. Labels are managed via `thinkwork label`.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork thread label assign thr-abc lbl-ops
+  $ thinkwork thread label remove thr-abc lbl-ops
+`
+  ).action(() => notYetImplemented("thread label", 1));
+  thread.command("escalate <id>").description("Escalate a thread to another agent (carries context, records actor).").option("--to-agent <id>", "Agent to escalate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--reason <text>", "Reason note (appears in activity log)").action(() => notYetImplemented("thread escalate", 1));
+  thread.command("delegate <id>").description("Delegate ownership to another agent without the 'escalation' semantics.").option("--to-agent <id>", "Agent to delegate to").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("thread delegate", 1));
+  thread.command("delete <id>").description("Permanently delete a thread (not just close). Requires confirmation.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip the confirmation prompt").addHelpText(
+    "after",
+    `
+Examples:
+  # Prompts 'Are you sure?'
+  $ thinkwork thread delete thr-abc
+
+  # Scripted / destructive-no-prompt
+  $ thinkwork thread delete thr-abc --yes
+`
+  ).action(() => notYetImplemented("thread delete", 1));
+}
+
+// src/commands/message.ts
+function registerMessageCommand(program2) {
+  const msg = program2.command("message").alias("messages").alias("msg").description("Send and list messages inside a thread.");
+  msg.command("send <threadId> [content]").description("Send a message to a thread. Prompts for content if omitted and TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--file <path>", "Read message content from a file").option("--as-agent <id>", "Send as a specific agent (api-key auth only)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork message send thr-abc "Investigating now"
+  $ thinkwork message send thr-abc --file notes.md
+  $ thinkwork message send thr-abc                    # interactive
+`
+  ).action(() => notYetImplemented("message send", 1));
+  msg.command("list <threadId>").alias("ls").description("List messages in a thread (paginated).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max messages to return", "50").option("--cursor <c>", "Pagination cursor from a previous page").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork message list thr-abc
+  $ thinkwork message list thr-abc --limit 10 --json | jq '.[].author'
+`
+  ).action(() => notYetImplemented("message list", 1));
+}
+
+// src/commands/label.ts
+function registerLabelCommand(program2) {
+  const label = program2.command("label").alias("labels").description("Manage tenant-wide thread labels (tags).");
+  label.command("list").alias("ls").description("List all labels in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("label list", 1));
+  label.command("create [name]").description("Create a new label. Prompts for missing fields in TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--color <hex>", "Label color as a hex string (e.g. #10b981)").option("--description <text>", "What the label is for").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork label create ops --color "#10b981"
+  $ thinkwork label create                     # interactive
+`
+  ).action(() => notYetImplemented("label create", 1));
+  label.command("update <id>").description("Rename or recolor an existing label.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--color <hex>").option("--description <text>").action(() => notYetImplemented("label update", 1));
+  label.command("delete <id>").description("Delete a label. Any thread assignments are removed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip the confirmation prompt").action(() => notYetImplemented("label delete", 1));
+}
+
+// src/commands/inbox.ts
+function registerInboxCommand(program2) {
+  const inbox = program2.command("inbox").description("View and act on approval requests routed to you or your workspace.");
+  inbox.command("list").alias("ls").description("List inbox items, optionally filtered by status.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option(
+    "--status <s>",
+    "PENDING | APPROVED | REJECTED | REVISION_REQUESTED | EXPIRED | CANCELLED (default: PENDING)",
+    "PENDING"
+  ).option("--entity-type <type>", "Filter by entity type (thread, agent, artifact, \u2026)").option("--entity-id <id>", "Filter by entity ID").option("--mine", "Only items routed to the caller").addHelpText(
+    "after",
+    `
+Examples:
+  # What's waiting for me to approve?
+  $ thinkwork inbox list --mine
+
+  # All pending approvals in the tenant
+  $ thinkwork inbox list
+
+  # Closed items for audit
+  $ thinkwork inbox list --status APPROVED --json
+`
+  ).action(() => notYetImplemented("inbox list", 1));
+  inbox.command("get <id>").description("Fetch one inbox item with its comments, links, and history.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox get", 1));
+  inbox.command("approve <id>").description("Approve an inbox item. Downstream agents resume.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--notes <text>", "Approval notes (stored on the decision)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork inbox approve ibx-abc
+  $ thinkwork inbox approve ibx-abc --notes "Budget confirmed."
+`
+  ).action(() => notYetImplemented("inbox approve", 1));
+  inbox.command("reject <id>").description("Reject an inbox item. Downstream agents stop.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--notes <text>", "Rejection reason").action(() => notYetImplemented("inbox reject", 1));
+  inbox.command("request-revision <id>").description("Ask for changes \u2014 the agent gets the item back with your notes.").option("--notes <text>", "What needs to change").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox request-revision", 1));
+  inbox.command("resubmit <id>").description("Resubmit a revised inbox item for approval.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--notes <text>", "What changed").action(() => notYetImplemented("inbox resubmit", 1));
+  inbox.command("cancel <id>").description("Cancel a pending approval request (originator or admin).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("inbox cancel", 1));
+  inbox.command("comment <id> [content]").description("Add a comment to an inbox item without deciding on it yet.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--file <path>", "Read comment body from a file").action(() => notYetImplemented("inbox comment", 1));
+}
+
+// src/commands/agent.ts
+function registerAgentCommand(program2) {
+  const agent = program2.command("agent").alias("agents").description("Manage agents \u2014 create, configure, inspect, budget, and key-rotate.");
+  agent.command("list").alias("ls").description("List agents in a tenant. Cognito users see paired agents; admins see all.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--status <s>", "IDLE | BUSY | OFFLINE | ERROR").option("--type <t>", "Filter by agent type (HUMAN_PAIR, TEAM_AGENT, SUB_AGENT, \u2026)").option("--include-system", "Include internal system agents").option("--all", "Admin-only: list every agent in the tenant (not just paired ones)").addHelpText(
+    "after",
+    `
+Examples:
+  # Agents you're paired with
+  $ thinkwork agent list
+
+  # Tenant-wide (admin only)
+  $ thinkwork agent list --all
+
+  # Offline agents only, as JSON
+  $ thinkwork agent list --status OFFLINE --json
+`
+  ).action(() => notYetImplemented("agent list", 2));
+  agent.command("get <id>").description("Fetch one agent with its skills, capabilities, budget, and recent activity.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent get", 2));
+  agent.command("create [name]").description("Create a new agent. Prompts walkthrough for missing fields in TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--template <id>", "Clone from an existing template (strongly recommended)").option("--role <role>", "Role description shown to users").option("--type <type>", "TEAM_AGENT | SUB_AGENT | HUMAN_PAIR").option("--parent <agentId>", "Parent agent (for SUB_AGENT)").option("--reports-to <agentId>", "Reporting manager (for org-chart display)").option("--system-prompt <text>", "Raw system-prompt override (use with care)").option("--system-prompt-file <path>", "Load the system prompt from a file").option("--model <id>", "Model ID override (see `thinkwork config models`)").addHelpText(
+    "after",
+    `
+Examples:
+  # Fully interactive
+  $ thinkwork agent create
+
+  # From a template (recommended)
+  $ thinkwork agent create "Ops Analyst" --template tpl-ops-analyst
+
+  # Scripted, raw system prompt
+  $ thinkwork agent create "Bot" --role "on-call summarizer" \\
+      --type TEAM_AGENT --model claude-sonnet-4-6 \\
+      --system-prompt-file prompts/bot.md
+`
+  ).action(() => notYetImplemented("agent create", 2));
+  agent.command("update <id>").description("Update any mutable agent field.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--role <r>").option("--type <t>").option("--parent <agentId>").option("--reports-to <agentId>").option("--system-prompt <text>").option("--system-prompt-file <path>").option("--model <id>").action(() => notYetImplemented("agent update", 2));
+  agent.command("delete <id>").description("Archive (soft-delete) an agent. Existing threads stay; no new work routed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("agent delete", 2));
+  agent.command("status <id> <status>").description("Manually set agent status. Useful to pause/resume.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork agent status agt-ops IDLE
+  $ thinkwork agent status agt-ops OFFLINE
+`
+  ).action(() => notYetImplemented("agent status", 2));
+  agent.command("unpause <id>").description("Resume an agent paused by a budget policy trigger.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent unpause", 2));
+  const capabilities = agent.command("capabilities").alias("cap").description("Toggle built-in capabilities (email inbox, web search, etc.).");
+  capabilities.command("set <agentId>").description("Enable/disable capabilities on an agent.").option("--capability <name>", "Capability name (email, web-search, file-upload, \u2026)").option("--enabled", "Enable (default if flag present)").option("--disabled", "Disable").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent capabilities set", 2));
+  const skills = agent.command("skills").description("Attach or configure MCP-backed skills on an agent.");
+  skills.command("set <agentId>").description("Enable/disable/configure a skill for an agent.").option("--skill <id>", "Skill ID (see `thinkwork skill list`)").option("--enabled", "Enable").option("--disabled", "Disable").option("--config <json>", "Inline JSON config for the skill").option("--rate-limit <rps>", "Rate limit in requests/sec").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent skills set", 2));
+  const budget = agent.command("budget").description("Per-agent spend caps \u2014 pause or alert when exceeded.");
+  budget.command("set <agentId>").description("Set or update an agent's budget policy.").option("--limit-usd <amount>", "USD ceiling for the window").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent budget set", 2));
+  budget.command("clear <agentId>").description("Remove an agent's budget policy (falls back to tenant-wide).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent budget clear", 2));
+  const apiKey = agent.command("api-key").description("Agent API keys \u2014 service-to-service credentials tied to one agent.");
+  apiKey.command("list <agentId>").description("List API keys for an agent (metadata only; plaintext shown on create).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent api-key list", 2));
+  apiKey.command("create <agentId>").description("Generate a new API key. The plaintext is printed once \u2014 save it.").option("--name <n>", "Human label for the key (e.g. 'GitHub Actions')").option("--expires <iso>", "Expiration (ISO-8601). Omit for no expiry.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork agent api-key create agt-ops --name "GitHub Actions"
+  $ thinkwork agent api-key create agt-ops --name "nightly" --expires 2026-12-31T00:00:00Z --json
+`
+  ).action(() => notYetImplemented("agent api-key create", 2));
+  apiKey.command("revoke <keyId>").description("Revoke an API key. Subsequent calls return 401.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("agent api-key revoke", 2));
+  const email = agent.command("email").description("Inbound email addresses \u2014 let an agent receive email + optionally reply.");
+  email.command("enable <agentId>").description("Enable inbound email for an agent.").option("--local-part <x>", "Custom localpart (e.g. ops@)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent email enable", 2));
+  email.command("disable <agentId>").description("Disable inbound email for an agent.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("agent email disable", 2));
+  email.command("allowlist <agentId> <senders...>").description("Replace the allowlist of sender email addresses for an agent.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork agent email allowlist agt-ops oncall@example.com pagerduty@example.com
+`
+  ).action(() => notYetImplemented("agent email allowlist", 2));
+  const version = agent.command("version").description("Agent configuration version history.");
+  version.command("list <agentId>").description("List version snapshots of an agent's config (prompt, model, skills, \u2026).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max versions", "20").action(() => notYetImplemented("agent version list", 2));
+  version.command("rollback <agentId> <versionId>").description("Restore an agent to a prior version. Creates a new version pointing at the old config.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("agent version rollback", 2));
+}
+
+// src/commands/template.ts
+function registerTemplateCommand(program2) {
+  const tpl = program2.command("template").alias("templates").description("Manage agent templates \u2014 reusable configs you spawn agents from.");
+  tpl.command("list").alias("ls").description("List templates in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("template list", 2));
+  tpl.command("get <id>").description("Fetch one template with its linked agents.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("template get", 2));
+  tpl.command("create [name]").description("Create a new template from a set of config defaults.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--from-agent <id>", "Clone config from an existing agent").option("--system-prompt-file <path>", "Prompt markdown path").option("--model <id>", "Default model").option("--description <text>", "What this template is for").addHelpText(
+    "after",
+    `
+Examples:
+  # Capture an existing agent's config as a template
+  $ thinkwork template create "Ops Analyst" --from-agent agt-ops-1
+
+  # Fresh template
+  $ thinkwork template create --system-prompt-file prompts/ops.md --model claude-sonnet-4-6
+`
+  ).action(() => notYetImplemented("template create", 2));
+  tpl.command("update <id>").description("Update a template. Linked agents are NOT auto-synced \u2014 use `template sync-*`.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--system-prompt-file <path>").option("--model <id>").option("--description <text>").action(() => notYetImplemented("template update", 2));
+  tpl.command("delete <id>").description("Delete a template. Linked agents are unaffected; they just stop being in sync.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("template delete", 2));
+  tpl.command("diff <templateId> <agentId>").description("Show what would change if we synced <agentId> to <templateId>.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("template diff", 2));
+  tpl.command("sync-agent <templateId> <agentId>").description("Apply template changes to one linked agent.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("template sync-agent", 2));
+  tpl.command("sync-all <templateId>").description("Apply template changes to every linked agent. Requires confirmation.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").addHelpText(
+    "after",
+    `
+Examples:
+  # Preview first
+  $ thinkwork template diff tpl-ops agt-ops-1
+
+  # Apply to one agent
+  $ thinkwork template sync-agent tpl-ops agt-ops-1
+
+  # Apply to every linked agent
+  $ thinkwork template sync-all tpl-ops
+`
+  ).action(() => notYetImplemented("template sync-all", 2));
+}
+
+// src/commands/tenant.ts
+function registerTenantCommand(program2) {
+  const tenant = program2.command("tenant").alias("tenants").description("Manage tenants (workspaces) \u2014 create, rename, and configure plans / defaults.");
+  tenant.command("list").alias("ls").description("List tenants the caller can see.").option("-s, --stage <name>", "Deployment stage").action(() => notYetImplemented("tenant list", 2));
+  tenant.command("get <idOrSlug>").description("Fetch one tenant by ID or slug.").option("-s, --stage <name>", "Deployment stage").action(() => notYetImplemented("tenant get", 2));
+  tenant.command("create [name]").description("Create a new tenant. The caller becomes its first owner.").option("-s, --stage <name>", "Deployment stage").option("--slug <slug>", "URL-safe slug (lowercase, hyphens). Generated from name if omitted.").option("--plan <plan>", "Plan tier (free, team, enterprise, \u2026)", "team").option("--issue-prefix <prefix>", "Issue-number prefix for thread numbers (e.g. ACME)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork tenant create "Acme Corp" --slug acme --plan team
+`
+  ).action(() => notYetImplemented("tenant create", 2));
+  tenant.command("update <id>").description("Update tenant name, plan, or issue-prefix.").option("-s, --stage <name>", "Deployment stage").option("--name <n>").option("--plan <plan>").option("--issue-prefix <prefix>").action(() => notYetImplemented("tenant update", 2));
+  const settings = tenant.command("settings").description("Tenant-wide defaults \u2014 model, budget, auto-close, feature flags.");
+  settings.command("get [tenant]").description("Print the current TenantSettings (human) or the full object (--json).").option("-s, --stage <name>", "Deployment stage").action(() => notYetImplemented("tenant settings get", 2));
+  settings.command("set [tenant]").description("Set one or more TenantSettings fields. Each --<field> flag is independent.").option("-s, --stage <name>", "Deployment stage").option("--default-model <id>").option("--monthly-budget-usd <n>").option("--max-agents <n>").option("--auto-close-after-days <n>").option("--feature <key=value...>", "Toggle a feature flag (repeatable)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork tenant settings set --default-model claude-sonnet-4-6
+  $ thinkwork tenant settings set --monthly-budget-usd 5000 --feature hindsight=true
+`
+  ).action(() => notYetImplemented("tenant settings set", 2));
+}
+
+// src/commands/member.ts
+function registerMemberCommand(program2) {
+  const mem = program2.command("member").alias("members").description("List and manage tenant members (users + agents with access).");
+  mem.command("list").alias("ls").description("List every member of the current tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--principal-type <t>", "Filter: USER | AGENT").option("--role <r>", "Filter by role (member, admin, owner)").action(() => notYetImplemented("member list", 2));
+  mem.command("invite [email]").description("Invite a user by email. GraphQL path (sends invite email, creates Cognito user).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--role <role>", "member | admin | owner", "member").option("--name <n>", "Optional display name").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork member invite alice@example.com --role admin
+  $ thinkwork member invite                                  # interactive
+`
+  ).action(() => notYetImplemented("member invite", 2));
+  mem.command("update <memberId>").description("Change a member's role or status.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--role <r>").option("--status <s>", "active | suspended").action(() => notYetImplemented("member update", 2));
+  mem.command("remove <memberId>").description("Remove a member from the tenant. The underlying Cognito user is NOT deleted.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("member remove", 2));
+}
+
+// src/commands/team.ts
+function registerTeamCommand(program2) {
+  const team = program2.command("team").alias("teams").description("Manage teams within a tenant.");
+  team.command("list").alias("ls").description("List teams in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team list", 2));
+  team.command("get <id>").description("Fetch one team with its members and agents.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team get", 2));
+  team.command("create [name]").description("Create a new team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--description <text>").option("--budget-usd <n>", "Optional sub-budget").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork team create "Ops" --description "24/7 on-call" --budget-usd 2000
+`
+  ).action(() => notYetImplemented("team create", 2));
+  team.command("update <id>").description("Update team name, description, status, or budget.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--status <s>", "active | archived").option("--budget-usd <n>").action(() => notYetImplemented("team update", 2));
+  team.command("delete <id>").description("Delete (archive) a team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("team delete", 2));
+  team.command("add-agent <teamId> <agentId>").description("Add an agent to a team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team add-agent", 2));
+  team.command("remove-agent <teamId> <agentId>").description("Remove an agent from a team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team remove-agent", 2));
+  team.command("add-user <teamId> <userId>").description("Add a user to a team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team add-user", 2));
+  team.command("remove-user <teamId> <userId>").description("Remove a user from a team.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("team remove-user", 2));
+}
+
+// src/commands/kb.ts
+function registerKbCommand(program2) {
+  const kb = program2.command("kb").alias("knowledge-base").description("Manage knowledge bases (RAG stores) and attach them to agents.");
+  kb.command("list").alias("ls").description("List knowledge bases in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("kb list", 2));
+  kb.command("get <id>").description("Fetch one knowledge base with its S3 source + sync status.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("kb get", 2));
+  kb.command("create [name]").description("Create a new knowledge base. Interactive prompts for missing fields.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--s3-uri <uri>", "S3 source location (s3://bucket/prefix)").option("--description <text>").option("--embedding-model <id>", "Bedrock embedding model ID").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork kb create "Runbooks" --s3-uri s3://ops-docs/runbooks
+  $ thinkwork kb create                                  # interactive
+`
+  ).action(() => notYetImplemented("kb create", 2));
+  kb.command("update <id>").description("Update knowledge base metadata (name, description). Source changes need re-create.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").action(() => notYetImplemented("kb update", 2));
+  kb.command("delete <id>").description("Delete a knowledge base. Embeddings + index are destroyed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("kb delete", 2));
+  kb.command("sync <id>").description("Re-embed from S3. Idempotent; safe to re-run.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--wait", "Block until the sync finishes").action(() => notYetImplemented("kb sync", 2));
+  kb.command("attach <kbId>").description("Attach a knowledge base to an agent.").option("--agent <id>", "Agent ID").option("--config <json>", "Retrieval config (topK, score threshold, \u2026)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork kb attach kb-runbooks --agent agt-oncall
+  $ thinkwork kb attach kb-runbooks --agent agt-oncall --config '{"topK":5}'
+`
+  ).action(() => notYetImplemented("kb attach", 2));
+  kb.command("detach <kbId>").description("Detach a knowledge base from an agent.").option("--agent <id>", "Agent ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("kb detach", 2));
+}
+
+// src/commands/routine.ts
+function registerRoutineCommand(program2) {
+  const routine = program2.command("routine").alias("routines").description("Manage routines \u2014 saved workflows, their triggers, and past runs.");
+  routine.command("list").alias("ls").description("List routines in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Filter by agent").option("--team <id>", "Filter by team").option("--status <s>", "ACTIVE | PAUSED | ARCHIVED").action(() => notYetImplemented("routine list", 3));
+  routine.command("get <id>").description("Fetch one routine with its triggers and recent runs.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("routine get", 3));
+  routine.command("create [name]").description("Create a new routine. Walkthrough for missing fields in TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent that runs the routine").option("--team <id>", "Team to route runs to (instead of a single agent)").option("--description <text>").option("--config <json>", "Inline routine config JSON").option("--config-file <path>", "Load routine config from a JSON file").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork routine create "Nightly digest" --agent agt-editor --config-file routines/digest.json
+  $ thinkwork routine create                        # interactive walkthrough
+`
+  ).action(() => notYetImplemented("routine create", 3));
+  routine.command("update <id>").description("Update a routine.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--status <s>", "ACTIVE | PAUSED | ARCHIVED").option("--agent <id>").option("--team <id>").option("--config-file <path>").action(() => notYetImplemented("routine update", 3));
+  routine.command("delete <id>").description("Delete a routine. Past runs and triggers are removed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("routine delete", 3));
+  routine.command("trigger <id>").description("Trigger a routine run now (ad-hoc, outside its scheduled cadence).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--wait", "Block until the run finishes, then print result").option("--input <json>", "Optional input payload").action(() => notYetImplemented("routine trigger", 3));
+  const run2 = routine.command("run").description("Inspect routine run history.");
+  run2.command("list <routineId>").alias("ls").description("List recent runs of a routine.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows", "25").option("--cursor <c>", "Pagination cursor").action(() => notYetImplemented("routine run list", 3));
+  run2.command("get <runId>").description("Fetch one run with its step outputs.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("routine run get", 3));
+  const trigger = routine.command("trigger-config").description("Manage a routine's triggers (cron, webhook, event).");
+  trigger.command("set <routineId>").description("Set or replace a trigger for a routine.").option("--type <t>", "CRON | WEBHOOK | EVENT").option("--schedule <cron>", "Cron expression (for CRON triggers)").option("--event <name>", "Event name (for EVENT triggers)").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork routine trigger-config set rtn-digest --type CRON --schedule "0 9 * * *"
+`
+  ).action(() => notYetImplemented("routine trigger-config set", 3));
+  trigger.command("delete <triggerId>").description("Remove a trigger.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("routine trigger-config delete", 3));
+}
+
+// src/commands/scheduled-job.ts
+function registerScheduledJobCommand(program2) {
+  const job = program2.command("scheduled-job").alias("cron").description("Manage AWS-Scheduler-backed recurring agent jobs (wakeups on a cadence).");
+  job.command("list").alias("ls").description("List scheduled jobs for the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Filter by agent").option("--routine <id>", "Filter by routine").option("--enabled <bool>", "true | false").action(() => notYetImplemented("scheduled-job list", 3));
+  job.command("get <id>").description("Fetch one scheduled job.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("scheduled-job get", 3));
+  job.command("create [name]").description("Create a new scheduled job. Supports cron() or rate() schedules.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Agent to wake up").option("--routine <id>", "Or: routine to trigger").option("--schedule <expr>", "EventBridge schedule (cron(\u2026) or rate(\u2026))").option("--timezone <tz>", "IANA timezone (default: UTC)", "UTC").option("--payload <json>", "Payload to pass to the agent/routine").option("--disabled", "Create in disabled state (enable later with update)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork scheduled-job create "Daily ops digest" \\
+      --agent agt-editor --schedule "cron(0 9 * * ? *)" --timezone America/New_York
+
+  # rate() \u2014 note rate means "every N time from creation", NOT wall-clock.
+  $ thinkwork scheduled-job create "Hourly check" --agent agt-check --schedule "rate(1 hour)"
+`
+  ).action(() => notYetImplemented("scheduled-job create", 3));
+  job.command("update <id>").description("Update a scheduled job's schedule, payload, or enabled state.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--schedule <expr>").option("--timezone <tz>").option("--payload <json>").option("--enable").option("--disable").action(() => notYetImplemented("scheduled-job update", 3));
+  job.command("delete <id>").description("Delete a scheduled job. The underlying EventBridge rule is removed.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("scheduled-job delete", 3));
+  job.command("run <id>").description("Trigger a scheduled job immediately (ad-hoc; ignores the schedule).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--wait", "Block until the run completes").action(() => notYetImplemented("scheduled-job run", 3));
+}
+
+// src/commands/turn.ts
+function registerTurnCommand(program2) {
+  const turn = program2.command("turn").alias("turns").description("Inspect and cancel agent invocations (thread turns).");
+  turn.command("list").alias("ls").description("List recent thread turns across the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--agent <id>", "Filter by agent").option("--routine <id>", "Filter by routine").option("--trigger <id>", "Filter by trigger ID").option("--thread <id>", "Filter by thread").option("--status <s>", "QUEUED | RUNNING | SUCCEEDED | FAILED | CANCELLED").option("--limit <n>", "Max rows", "50").addHelpText(
+    "after",
+    `
+Examples:
+  # What's running right now?
+  $ thinkwork turn list --status RUNNING
+
+  # Recent failures for one agent
+  $ thinkwork turn list --agent agt-ops --status FAILED --limit 20
+`
+  ).action(() => notYetImplemented("turn list", 3));
+  turn.command("get <id>").description("Fetch one thread turn with its event stream.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("turn get", 3));
+  turn.command("cancel <id>").description("Cancel an in-progress thread turn. No-op if already finished.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("turn cancel", 3));
+}
+
+// src/commands/wakeup.ts
+function registerWakeupCommand(program2) {
+  const wake = program2.command("wakeup").alias("wakeups").description("View and create agent wakeup requests (deferred/enqueued invocations).");
+  wake.command("list").alias("ls").description("List queued wakeups in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("wakeup list", 3));
+  wake.command("create").description("Queue a wakeup for an agent (ad-hoc or deferred).").option("--agent <id>", "Target agent").option("--thread <id>", "Thread to operate on (optional)").option("--delay-seconds <n>", "Wait N seconds before firing", "0").option("--payload <json>", "Optional input payload").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork wakeup create --agent agt-ops --thread thr-abc
+  $ thinkwork wakeup create --agent agt-ops --delay-seconds 900   # fire in 15 min
+`
+  ).action(() => notYetImplemented("wakeup create", 3));
+}
+
+// src/commands/webhook.ts
+function registerWebhookCommand(program2) {
+  const wh = program2.command("webhook").alias("webhooks").description("Manage inbound webhooks that dispatch to agents or routines.");
+  wh.command("list").alias("ls").description("List webhooks in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--enabled <bool>", "true | false").option("--target-type <t>", "AGENT | ROUTINE").action(() => notYetImplemented("webhook list", 3));
+  wh.command("get <id>").description("Fetch one webhook including its secret prefix + rate limit.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("webhook get", 3));
+  wh.command("create [name]").description("Create a new webhook. The full secret is printed once.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--target-type <t>", "AGENT | ROUTINE").option("--target-id <id>", "ID of the agent or routine").option("--rate-limit <rpm>", "Max requests per minute").option("--allowed-ips <csv>", "Restrict to a CIDR list").option("--disabled", "Create in disabled state").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork webhook create "GitHub PR opened" \\
+      --target-type AGENT --target-id agt-reviewer --rate-limit 30
+
+  # CI use \u2014 capture the secret on create
+  $ thinkwork webhook create "CI" --target-type ROUTINE --target-id rtn-ci --json | jq -r .secret
+`
+  ).action(() => notYetImplemented("webhook create", 3));
+  wh.command("update <id>").description("Update a webhook's target, rate limit, or enabled state.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--target-type <t>").option("--target-id <id>").option("--rate-limit <rpm>").option("--allowed-ips <csv>").option("--enable").option("--disable").action(() => notYetImplemented("webhook update", 3));
+  wh.command("delete <id>").description("Delete a webhook (its URL stops working immediately).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("webhook delete", 3));
+  wh.command("test <id>").description("Send a synthetic payload to the webhook and print the resulting run ID.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--payload <json>").action(() => notYetImplemented("webhook test", 3));
+  wh.command("rotate <id>").description("Generate a new secret for an existing webhook. Old secret is invalidated.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("webhook rotate", 3));
+  wh.command("deliveries <id>").description("Show recent delivery attempts (success/failure, response status).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--limit <n>", "Max rows", "25").action(() => notYetImplemented("webhook deliveries", 3));
+}
+
+// src/commands/connector.ts
+function registerConnectorCommand(program2) {
+  const conn = program2.command("connector").alias("connectors").description("Manage third-party integrations (Slack, GitHub, Linear, \u2026).");
+  conn.command("list").alias("ls").description("List available connectors and which are enabled for this tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--enabled-only", "Only show tenant-enabled connectors").action(() => notYetImplemented("connector list", 3));
+  conn.command("get <slug>").description("Fetch one connector with its config schema + current status.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("connector get", 3));
+  conn.command("enable <slug>").description("Enable a connector. Opens the OAuth flow in your browser when required.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--config <json>", "Inline config JSON (for API-key style connectors)").option("--config-file <path>", "Load config from a file").addHelpText(
+    "after",
+    `
+Examples:
+  # OAuth connector (Slack)
+  $ thinkwork connector enable slack
+
+  # API-key connector (inline)
+  $ thinkwork connector enable linear --config '{"apiKey":"lin_\u2026"}'
+`
+  ).action(() => notYetImplemented("connector enable", 3));
+  conn.command("disable <slug>").description("Disable a connector. Stored credentials are cleared.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("connector disable", 3));
+  conn.command("test <slug>").description("Round-trip the connector's credentials against its API. Prints pass/fail + latency.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("connector test", 3));
+}
+
+// src/commands/skill.ts
+function registerSkillCommand(program2) {
+  const skill = program2.command("skill").alias("skills").description("Browse the catalog, install, upgrade, or publish custom skills.");
+  skill.command("catalog").description("Browse the public skill catalog (not tenant-scoped).").option("-s, --stage <name>", "Deployment stage").option("--search <q>", "Filter by keyword").option("--tag <t>", "Filter by tag").action(() => notYetImplemented("skill catalog", 3));
+  skill.command("list").alias("ls").description("List skills installed / published in the current tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--custom-only", "Only show tenant-owned custom skills").action(() => notYetImplemented("skill list", 3));
+  skill.command("install <slug>").description("Install a public skill into the tenant. Idempotent.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--version <v>", "Pin to a specific version (default: latest)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork skill install web-search
+  $ thinkwork skill install pagerduty --version 1.4.2
+`
+  ).action(() => notYetImplemented("skill install", 3));
+  skill.command("upgrade <slug>").description("Upgrade an installed skill to the latest catalog version.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("skill upgrade", 3));
+  skill.command("create [slug]").description("Publish a custom tenant-scoped skill (walkthrough for missing fields in TTY).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>", "Path to the MCP server manifest JSON").option("--endpoint <url>", "MCP server HTTP/SSE endpoint").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork skill create my-skill --manifest-file ./skills/my-skill.json
+  $ thinkwork skill create                                   # interactive
+`
+  ).action(() => notYetImplemented("skill create", 3));
+  skill.command("update <slug>").description("Update a custom skill's manifest, endpoint, or description.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--description <text>").option("--manifest-file <path>").option("--endpoint <url>").action(() => notYetImplemented("skill update", 3));
+  skill.command("delete <slug>").description("Delete a custom skill. Public catalog skills are uninstalled via this too.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("skill delete", 3));
+}
+
+// src/commands/memory.ts
+function registerMemoryCommand(program2) {
+  const memory = program2.command("memory").description("Inspect, search, and edit an agent's memory records and graph.");
+  memory.command("list").alias("ls").description("List memory records for an agent in a namespace.").option("--agent <id>", "Agent (assistant) ID").option(
+    "--namespace <ns>",
+    "Memory namespace (semantic | preferences | episodes | reflections)",
+    "semantic"
+  ).option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory list", 4));
+  memory.command("search").description("Search an agent's memory by query string.").option("--agent <id>", "Agent (assistant) ID").option("--query <q>", "Search query").option("--strategy <s>", "Retrieval strategy (semantic | keyword | hybrid)", "semantic").option("--limit <n>", "Max results", "10").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork memory search --agent agt-ops --query "escalation procedure"
+  $ thinkwork memory search --agent agt-ops --query "p0 runbook" --strategy hybrid --json
+`
+  ).action(() => notYetImplemented("memory search", 4));
+  memory.command("get <recordId>").description("Fetch one memory record in full.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory get", 4));
+  memory.command("update <recordId>").description("Replace a memory record's content.").option("--content <text>", "New content").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory update", 4));
+  memory.command("delete <recordId>").description("Remove a memory record.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("memory delete", 4));
+  memory.command("graph").description("Print the agent's memory graph (summary in human mode; full JSON with --json).").option("--agent <id>", "Agent (assistant) ID").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("memory graph", 4));
+}
+
+// src/commands/recipe.ts
+function registerRecipeCommand(program2) {
+  const recipe = program2.command("recipe").alias("recipes").description("Manage saved MCP tool invocations (parameterized one-click actions).");
+  recipe.command("list").alias("ls").description("List recipes in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--thread <id>", "Filter by thread scope").option("--agent <id>", "Filter by agent scope").option("--limit <n>", "Max rows", "25").action(() => notYetImplemented("recipe list", 4));
+  recipe.command("get <id>").description("Fetch one recipe.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("recipe get", 4));
+  recipe.command("create [name]").description("Save a new recipe. Walkthrough for missing fields in TTY.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--tool <slug>", "MCP tool slug").option("--params <json>", "Default parameters").option("--scope <s>", "tenant | agent | thread", "tenant").option("--agent <id>", "Required if --scope=agent").option("--thread <id>", "Required if --scope=thread").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork recipe create "Create PagerDuty incident" \\
+      --tool pagerduty.create_incident --params '{"urgency":"high"}'
+`
+  ).action(() => notYetImplemented("recipe create", 4));
+  recipe.command("update <id>").description("Update a recipe's name, tool, or default params.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--name <n>").option("--tool <slug>").option("--params <json>").action(() => notYetImplemented("recipe update", 4));
+  recipe.command("delete <id>").description("Delete a recipe.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("recipe delete", 4));
+}
+
+// src/commands/artifact.ts
+function registerArtifactCommand(program2) {
+  const art = program2.command("artifact").alias("artifacts").description("List and fetch agent-produced artifacts (notes, reports, data-views, plans, drafts).");
+  art.command("list").alias("ls").description("List artifacts in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--thread <id>", "Filter by thread").option("--agent <id>", "Filter by producing agent").option(
+    "--type <t>",
+    "DATA_VIEW | NOTE | REPORT | PLAN | DRAFT | DIGEST"
+  ).option("--status <s>", "DRAFT | FINAL | SUPERSEDED").option("--limit <n>", "Max rows", "25").option("--cursor <c>", "Pagination cursor").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork artifact list --agent agt-editor --type REPORT
+  $ thinkwork artifact list --thread thr-abc --json
+`
+  ).action(() => notYetImplemented("artifact list", 4));
+  art.command("get <id>").description("Fetch one artifact. Human mode prints a preview; --json returns the full content.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--raw", "Print only the markdown body to stdout (for piping to pandoc / bat / less)").action(() => notYetImplemented("artifact get", 4));
+}
+
+// src/commands/cost.ts
+function registerCostCommand(program2) {
+  const cost = program2.command("cost").description("Spend reports \u2014 totals, per-agent, per-model, and daily series.");
+  cost.command("summary").description("Total spend for the tenant over an optional date range.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--from <iso>", "Start date (ISO-8601)").option("--to <iso>", "End date (ISO-8601)").addHelpText(
+    "after",
+    `
+Examples:
+  # MTD spend
+  $ thinkwork cost summary
+
+  # Specific window
+  $ thinkwork cost summary --from 2026-04-01 --to 2026-04-30 --json
+`
+  ).action(() => notYetImplemented("cost summary", 5));
+  cost.command("by-agent").description("Spend broken down by agent.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--from <iso>").option("--to <iso>").option("--sort <field>", "cost | requests (default cost)", "cost").action(() => notYetImplemented("cost by-agent", 5));
+  cost.command("by-model").description("Spend broken down by model ID (tokens + cost).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--from <iso>").option("--to <iso>").action(() => notYetImplemented("cost by-model", 5));
+  cost.command("series").description("Daily cost series.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--days <n>", "Days of history", "30").action(() => notYetImplemented("cost series", 5));
+}
+
+// src/commands/budget.ts
+function registerBudgetCommand(program2) {
+  const budget = program2.command("budget").alias("budgets").description("Manage budget policies (tenant-wide or per-agent) and inspect current status.");
+  budget.command("list").alias("ls").description("List budget policies in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("budget list", 5));
+  budget.command("status").description("Show each budget's current spend vs. limit.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").action(() => notYetImplemented("budget status", 5));
+  budget.command("upsert").description("Create or update a budget policy.").option("--limit-usd <amount>", "USD ceiling for the window").option("--scope <s>", "tenant | agent", "tenant").option("--agent <id>", "Required if --scope=agent").option("--window <w>", "daily | weekly | monthly", "monthly").option("--action <a>", "PAUSE | ALERT", "PAUSE").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Tenant-wide $5k/month pause
+  $ thinkwork budget upsert --limit-usd 5000 --window monthly --action PAUSE
+
+  # Per-agent alert-only
+  $ thinkwork budget upsert --scope agent --agent agt-ops --limit-usd 500 --action ALERT
+`
+  ).action(() => notYetImplemented("budget upsert", 5));
+  budget.command("delete <id>").description("Remove a budget policy.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("-y, --yes", "Skip confirmation").action(() => notYetImplemented("budget delete", 5));
+}
+
+// src/commands/performance.ts
+function registerPerformanceCommand(program2) {
+  const perf = program2.command("performance").alias("perf").description("Observability: per-agent invocations, errors, p95 latency, and cost.");
+  perf.command("agents").description("Performance summary for every agent in the tenant.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--from <iso>").option("--to <iso>").option("--sort <f>", "cost | errors | latency | requests", "errors").action(() => notYetImplemented("performance agents", 5));
+  perf.command("agent <id>").description("Performance detail for one agent (including daily time-series).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--days <n>", "Time-series history", "14").action(() => notYetImplemented("performance agent", 5));
+}
+
+// src/commands/trace.ts
+function registerTraceCommand(program2) {
+  const trace = program2.command("trace").description("Inspect LLM invocations (traces) for a thread or turn.");
+  trace.command("thread <threadId>").description("All LLM invocations across every turn of one thread.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--since <iso>").action(() => notYetImplemented("trace thread", 5));
+  trace.command("turn <turnId>").description("LLM invocations for a single thread-turn (verbose \u2014 prompt + response + metadata).").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").option("--raw", "Print raw prompts + responses as a JSON array (useful for piping)").addHelpText(
+    "after",
+    `
+Examples:
+  $ thinkwork trace turn ttn-abc --json | jq '.[].model'
+  $ thinkwork trace turn ttn-abc --raw | jq '.[].response'
+`
+  ).action(() => notYetImplemented("trace turn", 5));
+}
+
+// src/commands/dashboard.ts
+function registerDashboardCommand(program2) {
+  program2.command("dashboard").alias("overview").description("One-screen snapshot of the tenant \u2014 agents, open threads, approvals, spend.").option("-s, --stage <name>", "Deployment stage").option("-t, --tenant <slug>", "Tenant slug").addHelpText(
+    "after",
+    `
+Examples:
+  # Print the dashboard for the default tenant
+  $ thinkwork dashboard
+
+  # Check a specific stage
+  $ thinkwork dashboard --stage prod
+`
+  ).action(() => notYetImplemented("dashboard", 5));
+}
+
+// src/cli.ts
+var program = new Command();
+program.name("thinkwork").description(
+  "Thinkwork CLI \u2014 deploy, manage, and interact with your Thinkwork stack"
+).version(VERSION, "-v, --version", "Print the CLI version").option(
+  "-p, --profile <name>",
+  "AWS profile to use (sets AWS_PROFILE for Terraform and AWS CLI)"
+).option(
+  "--json",
+  "Emit machine-readable JSON on stdout. Warnings/spinners stay on stderr."
+);
+program.hook("preAction", (_thisCommand, actionCommand) => {
+  const explicit = actionCommand.opts().profile ?? program.opts().profile;
+  if (explicit) {
+    process.env.AWS_PROFILE = explicit;
+  } else if (!process.env.AWS_PROFILE) {
+    const fallback = loadCliConfig().defaultProfile;
+    if (fallback) process.env.AWS_PROFILE = fallback;
+  }
+  const jsonGlobal = Boolean(program.opts().json);
+  const jsonLocal = Boolean(actionCommand.opts().json);
+  setJsonMode(jsonGlobal || jsonLocal);
 });
 registerLoginCommand(program);
+registerLogoutCommand(program);
 registerInitCommand(program);
 registerDoctorCommand(program);
+registerMeCommand(program);
 registerPlanCommand(program);
 registerDeployCommand(program);
 registerBootstrapCommand(program);
@@ -2736,4 +4467,34 @@ registerMcpCommand(program);
 registerToolsCommand(program);
 registerUpdateCommand(program);
 registerUserCommand(program);
+registerThreadCommand(program);
+registerMessageCommand(program);
+registerLabelCommand(program);
+registerInboxCommand(program);
+registerAgentCommand(program);
+registerTemplateCommand(program);
+registerTenantCommand(program);
+registerMemberCommand(program);
+registerTeamCommand(program);
+registerKbCommand(program);
+registerRoutineCommand(program);
+registerScheduledJobCommand(program);
+registerTurnCommand(program);
+registerWakeupCommand(program);
+registerWebhookCommand(program);
+registerConnectorCommand(program);
+registerSkillCommand(program);
+registerMemoryCommand(program);
+registerRecipeCommand(program);
+registerArtifactCommand(program);
+registerCostCommand(program);
+registerBudgetCommand(program);
+registerPerformanceCommand(program);
+registerTraceCommand(program);
+registerDashboardCommand(program);
+for (const cmd of program.commands) {
+  if (!cmd.options.some((o) => o.long === "--json")) {
+    cmd.option("--json", "Emit machine-readable JSON on stdout.");
+  }
+}
 program.parse();