tracksiy 0.0.0-stage → 0.1.0

package/dist/tracksiy.mjs

@@ -0,0 +1,3053 @@
+#!/usr/bin/env node
+
+// src/commands/auth.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/version.ts
+var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var USER_AGENT = `tracksiy-cli/${VERSION} (node ${process.versions.node}; ${process.platform})`;
+
+// src/core/errors.ts
+var EXIT = {
+  ok: 0,
+  internal: 1,
+  usage: 2,
+  auth: 3,
+  notFound: 4,
+  invalid: 5,
+  rateLimited: 6,
+  network: 7,
+  server: 8,
+  unsupported: 9,
+  checkFailed: 10
+};
+var EXIT_MEANINGS = {
+  0: "success",
+  1: "internal error in the CLI itself",
+  2: "usage error: unknown command, flag or bad value; nothing was sent",
+  3: "authentication or authorization failed (no token, expired, or missing scope)",
+  4: "not found (organization, project, issue, token, monitor...)",
+  5: "the server rejected the request as invalid or conflicting",
+  6: "rate limited; retry after the advertised delay",
+  7: "network error or timeout; the request may not have reached the server",
+  8: "server error (5xx)",
+  9: "the server does not support this command yet (older server)",
+  10: "the command ran but the check it performs did not pass (e.g. health not ok, integration not verified, wait timed out)"
+};
+var CliError = class extends Error {
+  code;
+  exit;
+  hint;
+  status;
+  details;
+  constructor(code, message, opts = {}) {
+    super(message);
+    this.code = code;
+    this.exit = opts.exit ?? EXIT.internal;
+    this.hint = opts.hint;
+    this.status = opts.status;
+    this.details = opts.details;
+  }
+  toJSON() {
+    const out = { code: this.code, message: this.message };
+    if (this.hint) out.hint = this.hint;
+    if (this.status !== void 0) out.status = this.status;
+    if (this.details !== void 0) out.details = this.details;
+    return out;
+  }
+};
+function usageError(code, message, hint) {
+  return new CliError(`usage.${code}`, message, { exit: EXIT.usage, hint });
+}
+var CheckFailed = class extends CliError {
+  data;
+  constructor(message, data, hint) {
+    super("check.failed", message, { exit: EXIT.checkFailed, hint });
+    this.data = data;
+  }
+};
+function toCliError(err) {
+  if (err instanceof CliError) return err;
+  const message = err instanceof Error ? err.message : String(err);
+  return new CliError("internal.unexpected", message, {
+    exit: EXIT.internal,
+    hint: "This is a bug in the CLI. Re-run with --verbose and report it."
+  });
+}
+
+// src/core/http.ts
+var API_PREFIX = "/api/agent/v1/";
+var seg = (value) => encodeURIComponent(String(value));
+var IDEMPOTENT = /* @__PURE__ */ new Set(["GET", "HEAD", "PUT", "DELETE", "OPTIONS"]);
+var RETRY_STATUS = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+var MAX_ATTEMPTS = 3;
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var Api = class {
+  url;
+  hasToken;
+  opts;
+  indexCache;
+  constructor(opts) {
+    this.opts = opts;
+    this.url = opts.url;
+    this.hasToken = Boolean(opts.token);
+  }
+  get base() {
+    return this.url + API_PREFIX;
+  }
+  async get(path, query, opts = {}) {
+    return (await this.request("GET", path, { ...opts, query })).data;
+  }
+  async send(method, path, body, opts = {}) {
+    return (await this.request(method, path, { ...opts, body })).data;
+  }
+  buildUrl(path, query) {
+    const target = new URL(path.startsWith("/") ? this.url + path : this.base + path);
+    for (const [key, value] of Object.entries(query ?? {})) {
+      if (value === void 0 || value === null || value === "") continue;
+      if (Array.isArray(value)) for (const v of value) target.searchParams.append(key, String(v));
+      else target.searchParams.set(key, String(value));
+    }
+    return target.toString();
+  }
+  async request(method, path, opts = {}) {
+    const url = this.buildUrl(path, opts.query);
+    const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
+    const useAuth = opts.auth !== false;
+    if (useAuth && this.opts.token) headers.Authorization = `Bearer ${this.opts.token}`;
+    let body;
+    if (opts.form) body = opts.form;
+    else if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    const retry = opts.retry ?? IDEMPOTENT.has(method);
+    const doFetch = this.opts.fetch ?? fetch;
+    for (let attempt = 1; ; attempt++) {
+      const started = Date.now();
+      if (this.opts.verbose) this.opts.log(`-> ${method} ${url}`);
+      let res;
+      try {
+        res = await doFetch(url, { method, headers, body, signal: AbortSignal.timeout(opts.timeoutMs ?? this.opts.timeoutMs) });
+      } catch (err) {
+        const mapped = networkError(err, url, opts.timeoutMs ?? this.opts.timeoutMs);
+        if (retry && attempt < MAX_ATTEMPTS) {
+          if (this.opts.verbose) this.opts.log(`   ${mapped.code}; retrying`);
+          await sleep(backoff(attempt));
+          continue;
+        }
+        throw mapped;
+      }
+      if (this.opts.verbose) this.opts.log(`<- ${res.status} (${Date.now() - started} ms)`);
+      if (retry && RETRY_STATUS.has(res.status) && attempt < MAX_ATTEMPTS) {
+        const wait = retryAfter(res.headers) ?? backoff(attempt);
+        if (wait <= 3e4) {
+          await res.arrayBuffer().catch(() => void 0);
+          await sleep(wait);
+          continue;
+        }
+      }
+      const data = await readBody(res);
+      const ok = opts.accept ? opts.accept.includes(res.status) : res.ok;
+      if (ok) return { status: res.status, data, headers: res.headers };
+      throw await this.httpError(method, path, res, data);
+    }
+  }
+  /** The server's own list of endpoints and scopes. No token needed. */
+  index() {
+    this.indexCache ??= this.get("", void 0, { auth: false }).then(
+      (d) => d.endpoints ?? []
+    );
+    return this.indexCache;
+  }
+  async findEndpoint(method, path) {
+    let entries;
+    try {
+      entries = await this.index();
+    } catch {
+      return null;
+    }
+    const wanted = new URL(path.startsWith("/") ? this.url + path : this.base + path).pathname.replace(/\/+$/, "");
+    return entries.find((e) => {
+      if (e.method !== method) return false;
+      const pattern = e.path.replace(/\/+$/, "").replace(/[.*+?^$()|[\]\\]/g, "\\$&").replace(/\{[^}]+\}/g, "[^/]+");
+      return new RegExp(`^${pattern}$`).test(wanted);
+    });
+  }
+  async httpError(method, path, res, data) {
+    const status2 = res.status;
+    const message = describeBody(data) || `${method} ${path} failed with HTTP ${status2}`;
+    const details = typeof data === "object" && data !== null ? data : void 0;
+    if (status2 === 401) {
+      return new CliError("auth.unauthenticated", message, {
+        exit: EXIT.auth,
+        status: status2,
+        hint: this.hasToken ? "The token was rejected: it may be expired, revoked or for another server. Check it with `tracksiy auth status`." : "No token. Set TRACKSIY_TOKEN, pass --token, or run `tracksiy auth login --with-token < token.txt`."
+      });
+    }
+    if (status2 === 403) {
+      const entry = await this.findEndpoint(method, path);
+      const scopes = entry?.scopes?.length ? ` It needs one of: ${entry.scopes.join(", ")}.` : "";
+      return new CliError("auth.forbidden", message, {
+        exit: EXIT.auth,
+        status: status2,
+        hint: `The token is valid but not allowed to do this.${scopes} A restricted token also cannot reach projects outside its list.`,
+        details
+      });
+    }
+    if (status2 === 404) {
+      const entry = await this.findEndpoint(method, path);
+      if (entry === void 0) {
+        return new CliError("server.unsupported", `${this.url} does not have ${method} ${path.split("?")[0]}.`, {
+          exit: EXIT.unsupported,
+          status: status2,
+          hint: "The server is older than this CLI. Upgrade the server, or use a CLI version that matches it."
+        });
+      }
+      return new CliError("not_found", message, {
+        exit: EXIT.notFound,
+        status: status2,
+        hint: "Check the organization/project slugs (`tracksiy orgs list`) and the id. A project-restricted token sees other projects as not found.",
+        details
+      });
+    }
+    if (status2 === 429) {
+      const wait = retryAfter(res.headers);
+      return new CliError("rate_limited", message, {
+        exit: EXIT.rateLimited,
+        status: status2,
+        hint: wait ? `Retry after ${Math.ceil(wait / 1e3)} s.` : "Retry later.",
+        details: { retryAfterSeconds: wait ? Math.ceil(wait / 1e3) : null }
+      });
+    }
+    if (status2 >= 500) {
+      return new CliError("server.error", message, {
+        exit: EXIT.server,
+        status: status2,
+        hint: "The server failed. `tracksiy health` shows whether the platform itself is healthy; if it keeps happening, tell the Tracksiy team: `tracksiy support` says how."
+      });
+    }
+    return new CliError(status2 === 409 ? "request.conflict" : "request.invalid", message, {
+      exit: EXIT.invalid,
+      status: status2,
+      details
+    });
+  }
+};
+async function readBody(res) {
+  if (res.status === 204) return null;
+  const text = await res.text();
+  if (!text) return null;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text.length > 2e3 ? text.slice(0, 2e3) + "..." : text;
+  }
+}
+function describeBody(data) {
+  if (typeof data === "string") return data.trim().startsWith("<") ? "" : data.trim();
+  if (!data || typeof data !== "object") return "";
+  const d = data;
+  const detail = d.detail ?? d.message ?? d.error;
+  if (typeof detail === "string") return detail;
+  if (Array.isArray(detail)) {
+    return detail.map((item) => {
+      if (typeof item === "string") return item;
+      const loc = Array.isArray(item?.loc) ? item.loc.filter((p) => p !== "body" && p !== "payload").join(".") : "";
+      return loc ? `${loc}: ${item?.msg ?? JSON.stringify(item)}` : item?.msg ?? JSON.stringify(item);
+    }).join("; ");
+  }
+  if (detail && typeof detail === "object") return JSON.stringify(detail);
+  return "";
+}
+function networkError(err, url, timeoutMs) {
+  const e = err;
+  if (e?.name === "TimeoutError" || e?.name === "AbortError") {
+    return new CliError("network.timeout", `No response from ${new URL(url).host} within ${timeoutMs / 1e3} s.`, {
+      exit: EXIT.network,
+      hint: "Raise --timeout, or check that the server is reachable."
+    });
+  }
+  const code = e?.cause?.code;
+  return new CliError("network.unreachable", `Cannot reach ${new URL(url).host}: ${code ?? e?.cause?.message ?? e?.message}`, {
+    exit: EXIT.network,
+    hint: "Check --url / TRACKSIY_URL and the network. The request did not reach the server."
+  });
+}
+function backoff(attempt) {
+  return 500 * 2 ** (attempt - 1) + Math.floor(Math.random() * 250);
+}
+function retryAfter(headers) {
+  const raw = headers.get("retry-after");
+  if (!raw) return void 0;
+  const seconds = Number(raw);
+  if (Number.isFinite(seconds)) return seconds * 1e3;
+  const date = Date.parse(raw);
+  return Number.isFinite(date) ? Math.max(0, date - Date.now()) : void 0;
+}
+
+// src/core/config.ts
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { mkdir, writeFile, chmod, rename } from "node:fs/promises";
+var DEFAULT_URL = "https://tracksiy.com";
+var PROJECT_FILE = ".tracksiy.json";
+function configPath(env = process.env) {
+  if (env.TRACKSIY_CONFIG) return resolve(env.TRACKSIY_CONFIG);
+  const base = env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "tracksiy", "config.json");
+}
+function readUserConfig(path) {
+  if (!existsSync(path)) return { hosts: {} };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return { defaultUrl: parsed.defaultUrl, hosts: parsed.hosts ?? {} };
+  } catch (err) {
+    throw new CliError("config.unreadable", `Cannot parse ${path}: ${err.message}`, {
+      exit: EXIT.usage,
+      hint: `Fix or delete ${path}, then run \`tracksiy auth login\` again.`
+    });
+  }
+}
+async function writeUserConfig(path, cfg) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const tmp = `${path}.${process.pid}.tmp`;
+  await writeFile(tmp, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+  await chmod(tmp, 384);
+  await rename(tmp, path);
+}
+function findProjectFile(start) {
+  let dir = resolve(start);
+  for (; ; ) {
+    const candidate = join(dir, PROJECT_FILE);
+    if (existsSync(candidate)) {
+      try {
+        return { path: candidate, data: JSON.parse(readFileSync(candidate, "utf8")) };
+      } catch (err) {
+        throw new CliError("config.bad_project_file", `Cannot parse ${candidate}: ${err.message}`, {
+          exit: EXIT.usage,
+          hint: `It should look like {"org": "my-org", "project": "my-project"}.`
+        });
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function normalizeUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw.includes("://") ? raw : `https://${raw}`);
+  } catch {
+    throw usageError("bad_url", `Not a URL: ${raw}`, "Pass the server root, e.g. --url https://tracksiy.com");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw usageError("bad_url", `Unsupported scheme ${url.protocol} in ${raw}`);
+  }
+  let path = url.pathname.replace(/\/+$/, "");
+  path = path.replace(/\/api\/agent\/v1$/, "").replace(/\/api$/, "");
+  return `${url.protocol}//${url.host}${path}`;
+}
+function isLoopback(url) {
+  const host = new URL(url).hostname;
+  return host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
+}
+function resolveConfig(globals, env = process.env, cwd = process.cwd()) {
+  const path = configPath(env);
+  const user = readUserConfig(path);
+  const pf = findProjectFile(cwd);
+  let url;
+  let urlSource;
+  if (globals.url) [url, urlSource] = [globals.url, "--url"];
+  else if (env.TRACKSIY_URL) [url, urlSource] = [env.TRACKSIY_URL, "TRACKSIY_URL"];
+  else if (pf?.data.url) [url, urlSource] = [pf.data.url, pf.path];
+  else if (user.defaultUrl) [url, urlSource] = [user.defaultUrl, path];
+  else [url, urlSource] = [DEFAULT_URL, "default"];
+  url = normalizeUrl(url);
+  const host = user.hosts[url] ?? {};
+  const out = {
+    url,
+    urlSource,
+    configPath: path,
+    timeoutMs: (globals.timeout ?? (Number(env.TRACKSIY_TIMEOUT) || 30)) * 1e3,
+    verbose: Boolean(globals.verbose),
+    quiet: Boolean(globals.quiet)
+  };
+  if (pf) out.projectFile = pf.path;
+  if (globals.token) [out.token, out.tokenSource] = [globals.token, "--token"];
+  else if (env.TRACKSIY_TOKEN) [out.token, out.tokenSource] = [env.TRACKSIY_TOKEN, "TRACKSIY_TOKEN"];
+  else if (host.token) [out.token, out.tokenSource] = [host.token, path];
+  if (out.token && url.startsWith("http:") && !isLoopback(url) && env.TRACKSIY_ALLOW_INSECURE !== "1") {
+    throw new CliError("config.insecure_url", `Refusing to send a token over plain HTTP to ${url}.`, {
+      exit: EXIT.usage,
+      hint: "Use https, a loopback address, or set TRACKSIY_ALLOW_INSECURE=1 if you really mean it."
+    });
+  }
+  if (globals.org) [out.org, out.orgSource] = [globals.org, "--org"];
+  else if (env.TRACKSIY_ORG) [out.org, out.orgSource] = [env.TRACKSIY_ORG, "TRACKSIY_ORG"];
+  else if (pf?.data.org) [out.org, out.orgSource] = [pf.data.org, pf.path];
+  else if (host.org) [out.org, out.orgSource] = [host.org, path];
+  if (globals.project) [out.project, out.projectSource] = [globals.project, "--project"];
+  else if (env.TRACKSIY_PROJECT) [out.project, out.projectSource] = [env.TRACKSIY_PROJECT, "TRACKSIY_PROJECT"];
+  else if (pf?.data.project) [out.project, out.projectSource] = [pf.data.project, pf.path];
+  if (out.project?.includes("/")) {
+    const [org, project2] = out.project.split("/", 2);
+    if (out.org && out.orgSource === "--org" && out.org !== org) {
+      throw usageError("conflict", `--org ${out.org} conflicts with --project ${out.project}`);
+    }
+    [out.org, out.orgSource] = [org, out.projectSource];
+    out.project = project2;
+  }
+  return out;
+}
+
+// src/core/output.ts
+function resolveFormat(globals, env, isTTY) {
+  if (globals.json) return "json";
+  if (globals.format) return globals.format;
+  if (env.TRACKSIY_FORMAT === "json" || env.TRACKSIY_FORMAT === "text") return env.TRACKSIY_FORMAT;
+  return isTTY ? "text" : "json";
+}
+function buildTree(paths) {
+  const root = {};
+  for (const path of paths) {
+    const segs = path.split(".").filter(Boolean);
+    let node = root;
+    segs.forEach((seg2, i) => {
+      if (i === segs.length - 1) node[seg2] = true;
+      else {
+        const next = node[seg2];
+        if (next === true) return;
+        node = node[seg2] = next ?? {};
+      }
+    });
+  }
+  return root;
+}
+function project(value, tree) {
+  if (Array.isArray(value)) return value.map((v) => project(v, tree));
+  if (!value || typeof value !== "object") return value;
+  const src = value;
+  const out = {};
+  for (const [key, sub] of Object.entries(tree)) {
+    if (!(key in src)) continue;
+    out[key] = sub === true ? src[key] : project(src[key], sub);
+  }
+  return out;
+}
+function selectFields(data, paths) {
+  if (!paths?.length) return data;
+  return project(data, buildTree(paths));
+}
+var processWriter = {
+  stdout: (s) => process.stdout.write(s),
+  stderr: (s) => process.stderr.write(s)
+};
+function printSuccess(w, format, data, spec, input, select) {
+  const shown = selectFields(data, select);
+  if (format === "json") {
+    w.stdout(JSON.stringify({ ok: true, data: shown ?? null }) + "\n");
+    return;
+  }
+  const text = !select?.length && spec?.text ? spec.text(shown, input) : renderText(shown);
+  if (text) w.stdout(text.endsWith("\n") ? text : text + "\n");
+}
+function printError(w, format, err, spec, input = {}, select) {
+  const data = err instanceof CheckFailed ? selectFields(err.data, select) : void 0;
+  if (format === "json") {
+    const out = { ok: false, error: err.toJSON() };
+    if (data !== void 0) out.data = data;
+    w.stdout(JSON.stringify(out) + "\n");
+    return;
+  }
+  if (data !== void 0) {
+    const text = !select?.length && spec?.text ? spec.text(data, input) : renderText(data);
+    if (text) w.stdout(text.endsWith("\n") ? text : text + "\n");
+  }
+  w.stderr(`error [${err.code}]: ${err.message}
+`);
+  if (err.hint) w.stderr(`hint: ${err.hint}
+`);
+}
+var width = () => Math.max(60, Math.min(process.stdout.columns || 120, 200));
+function scalar(v) {
+  if (v === null || v === void 0) return "-";
+  if (typeof v === "string") return v;
+  if (typeof v === "number" || typeof v === "boolean") return String(v);
+  if (Array.isArray(v)) return v.every((x) => typeof x !== "object" || x === null) ? v.join(", ") : `[${v.length}]`;
+  return JSON.stringify(v);
+}
+var isScalar = (v) => v === null || typeof v !== "object" || Array.isArray(v) && v.every((x) => typeof x !== "object" || x === null);
+function ago(iso) {
+  if (typeof iso !== "string") return "-";
+  const t = Date.parse(iso);
+  if (!Number.isFinite(t)) return iso;
+  const s = Math.round((Date.now() - t) / 1e3);
+  const abs = Math.abs(s);
+  const unit = abs < 60 ? `${abs}s` : abs < 3600 ? `${Math.round(abs / 60)}m` : abs < 86400 ? `${Math.round(abs / 3600)}h` : `${Math.round(abs / 86400)}d`;
+  return s >= 0 ? `${unit} ago` : `in ${unit}`;
+}
+function table(rows, columns2) {
+  if (!rows.length) return "(none)";
+  const cols = (columns2 ?? Object.keys(rows[0]).filter((k) => isScalar(rows[0][k])).slice(0, 7)).map(
+    (c) => typeof c === "string" ? [c, (r) => r[c]] : c
+  );
+  const cells = rows.map((r) => cols.map(([, get2]) => scalar(get2(r)).replace(/\s+/g, " ")));
+  const widths = cols.map(([name], i) => Math.max(name.length, ...cells.map((row) => row[i].length)));
+  const max = width();
+  const total = () => widths.reduce((a, b) => a + b, 0) + 2 * (widths.length - 1);
+  while (total() > max) {
+    const i = widths.indexOf(Math.max(...widths));
+    if (widths[i] <= 12) break;
+    widths[i]--;
+  }
+  const fit = (s, n) => s.length > n ? s.slice(0, Math.max(1, n - 1)) + "\u2026" : s.padEnd(n);
+  const line = (vals) => vals.map((v, i) => fit(v, widths[i])).join("  ").trimEnd();
+  return [line(cols.map(([n]) => n.toUpperCase())), ...cells.map(line)].join("\n");
+}
+function kv(obj, keys) {
+  const entries = (keys ?? Object.keys(obj)).filter((k) => k in obj && isScalar(obj[k]));
+  const pad = Math.max(0, ...entries.map((k) => k.length));
+  return entries.map((k) => `${k.padEnd(pad)}  ${scalar(obj[k])}`).join("\n");
+}
+function renderText(data) {
+  if (data === null || data === void 0) return "";
+  if (typeof data !== "object") return String(data);
+  if (Array.isArray(data)) {
+    if (data.every((x) => x && typeof x === "object" && !Array.isArray(x))) return table(data);
+    return data.map(scalar).join("\n");
+  }
+  const obj = data;
+  const parts = [];
+  const head = kv(obj);
+  if (head) parts.push(head);
+  for (const [key, value] of Object.entries(obj)) {
+    if (isScalar(value)) continue;
+    if (Array.isArray(value)) {
+      parts.push(`
+${key}:`);
+      parts.push(value.length && value.every((x) => x && typeof x === "object") ? table(value) : value.map(scalar).join("\n") || "(none)");
+    } else {
+      const inner = kv(value);
+      if (inner) parts.push(`
+${key}:
+${inner.replace(/^/gm, "  ")}`);
+    }
+  }
+  return parts.join("\n");
+}
+
+// src/commands/auth.ts
+async function organizations(api2) {
+  try {
+    return await api2.get("organizations");
+  } catch (err) {
+    if (err instanceof CliError && err.code === "server.unsupported") return null;
+    throw err;
+  }
+}
+var login = {
+  path: ["auth", "login"],
+  summary: "Check a token against the server and save it for this server (file mode 0600).",
+  description: "The token comes from --with-token (stdin), --token or TRACKSIY_TOKEN. Agents usually skip this and set TRACKSIY_TOKEN instead; login is for a machine that should remember it.",
+  context: "none",
+  auth: false,
+  effect: "write",
+  idempotent: true,
+  mcp: false,
+  flags: {
+    "with-token": { type: "boolean", description: "Read the token from stdin (keeps it out of shell history and process lists)." }
+  },
+  examples: [
+    { command: "tracksiy auth login --with-token < token.txt", description: "Save a token for https://tracksiy.com." },
+    { command: "echo $TOKEN | tracksiy auth login --with-token --url https://errors.example.com --org acme", description: "Another server, with a default organization." }
+  ],
+  output: "{url, token{id, label, scopes, projects, expires}, organizations[], defaultOrg, savedTo}",
+  async run(ctx) {
+    let token = ctx.input.withToken ? readFileSync2(0, "utf8").trim() : void 0;
+    if (!token && (ctx.config.tokenSource === "--token" || ctx.config.tokenSource === "TRACKSIY_TOKEN")) token = ctx.config.token;
+    if (!token) throw usageError("missing_token", "No token given.", "Pipe it in with --with-token, or pass --token / set TRACKSIY_TOKEN.");
+    const api2 = new Api({ url: ctx.config.url, token, timeoutMs: ctx.config.timeoutMs, verbose: ctx.config.verbose, log: ctx.log });
+    const self2 = await api2.get("tokens/self");
+    const orgs2 = await organizations(api2);
+    let org = ctx.config.orgSource === "--org" || ctx.config.orgSource === "TRACKSIY_ORG" ? ctx.config.org : void 0;
+    if (!org && orgs2?.length === 1) org = orgs2[0].slug;
+    if (org && orgs2 && !orgs2.some((o) => o.slug === org)) {
+      throw usageError("unknown_org", `This token cannot see organization ${org}.`, `Visible: ${orgs2.map((o) => o.slug).join(", ") || "none"}`);
+    }
+    const cfg = readUserConfig(ctx.config.configPath);
+    cfg.hosts[ctx.config.url] = { token, org, tokenLabel: self2.label, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    cfg.defaultUrl = ctx.config.url;
+    await writeUserConfig(ctx.config.configPath, cfg);
+    return { url: ctx.config.url, token: self2, organizations: orgs2, defaultOrg: org ?? null, savedTo: ctx.config.configPath };
+  }
+};
+var status = {
+  path: ["auth", "status"],
+  aliases: [["whoami"]],
+  summary: "Which server, which token (and where each came from), which organizations and defaults are in effect.",
+  context: "none",
+  effect: "read",
+  output: "{url, urlSource, tokenSource, token{id, label, scopes, projects, expires, expiresInSeconds}, organizations[], defaults{org, orgSource, project, projectSource, projectFile}}",
+  text: (d) => `${kv({ url: d.url, "url from": d.urlSource, "token from": d.tokenSource, token: `${d.token?.label} (#${d.token?.id})`, scopes: d.token?.scopes, projects: d.token?.projects?.length ? d.token.projects : "all", expires: d.token?.expires ?? "never" })}
+
+${table(d.organizations ?? [], ["slug", "name", ["projects", (r) => (r.projects ?? []).length]])}
+
+${kv({ org: `${d.defaults.org ?? "-"} (${d.defaults.orgSource ?? "auto"})`, project: `${d.defaults.project ?? "-"} (${d.defaults.projectSource ?? "auto"})` })}`,
+  async run(ctx) {
+    const token = await ctx.api.get("tokens/self");
+    const orgs2 = await organizations(ctx.api);
+    return {
+      url: ctx.config.url,
+      urlSource: ctx.config.urlSource,
+      tokenSource: ctx.config.tokenSource,
+      token,
+      organizations: orgs2,
+      defaults: {
+        org: ctx.config.org ?? (orgs2?.length === 1 ? orgs2[0].slug : null),
+        orgSource: ctx.config.orgSource ?? null,
+        project: ctx.config.project ?? null,
+        projectSource: ctx.config.projectSource ?? null,
+        projectFile: ctx.config.projectFile ?? null
+      }
+    };
+  }
+};
+var logout = {
+  path: ["auth", "logout"],
+  summary: "Forget the saved token for this server. Does not revoke it (use `tokens delete`).",
+  context: "none",
+  auth: false,
+  effect: "write",
+  idempotent: true,
+  mcp: false,
+  async run(ctx) {
+    const cfg = readUserConfig(ctx.config.configPath);
+    const had = Boolean(cfg.hosts[ctx.config.url]?.token);
+    if (cfg.hosts[ctx.config.url]) delete cfg.hosts[ctx.config.url].token;
+    await writeUserConfig(ctx.config.configPath, cfg);
+    if (ctx.config.tokenSource === "TRACKSIY_TOKEN") ctx.log("note: TRACKSIY_TOKEN is still set in this environment.");
+    return { url: ctx.config.url, removed: had, savedTo: ctx.config.configPath };
+  }
+};
+function missingToken(url) {
+  return new CliError("auth.missing_token", `No token for ${url}.`, {
+    exit: EXIT.auth,
+    hint: "Set TRACKSIY_TOKEN, pass --token, or run `tracksiy auth login --with-token < token.txt`. Tokens are created in the dashboard (Profile > Auth tokens) or with `tracksiy tokens create`."
+  });
+}
+var auth_default = [login, status, logout];
+
+// src/commands/_util.ts
+async function projectPath(ctx, suffix = "") {
+  const { org, project: project2 } = await ctx.project();
+  return `projects/${seg(org)}/${seg(project2)}${suffix ? `/${suffix}` : ""}`;
+}
+async function orgPath(ctx, suffix = "") {
+  const org = await ctx.org();
+  return `organizations/${seg(org)}${suffix ? `/${suffix}` : ""}`;
+}
+var UNITS = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
+function since(value, flag = "since") {
+  if (value === void 0 || value === null || value === "") return void 0;
+  const s = String(value).trim();
+  const m = /^(\d+)\s*([smhdw])$/.exec(s);
+  if (m) return new Date(Date.now() - Number(m[1]) * UNITS[m[2]] * 1e3).toISOString();
+  if (s === "now" || /^now\s*-\s*\d+\s*[mhd]$/.test(s)) return s;
+  if (Number.isFinite(Date.parse(s))) return s;
+  throw usageError("bad_value", `--${flag} expects a duration like 24h / 7d or an ISO time, got ${JSON.stringify(s)}`);
+}
+var TIME = "<24h|7d|iso>";
+function requireYes(ctx, what) {
+  if (ctx.input.yes) return;
+  const how = ctx.surface === "mcp" ? 'Call again with "yes": true to confirm.' : "Re-run with --yes to confirm.";
+  throw new CliError("confirmation.required", `${what} ${how}`, {
+    exit: EXIT.usage,
+    hint: ctx.surface === "mcp" ? 'Pass "yes": true to confirm.' : "Add --yes. Nothing was changed."
+  });
+}
+var YES = {
+  yes: { type: "boolean", description: "Confirm a destructive action. Without it nothing is changed." }
+};
+function rate(value, flag) {
+  const m = /^(\d+)\s*\/\s*(\d+)\s*s?$/.exec(String(value));
+  if (!m) throw usageError("bad_value", `--${flag} expects <count>/<seconds>, e.g. 100/60; got ${JSON.stringify(value)}`);
+  return { count: Number(m[1]), windowSeconds: Number(m[2]) };
+}
+function compact(obj) {
+  return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0));
+}
+
+// src/commands/fleet.ts
+var orgs = {
+  path: ["orgs", "list"],
+  aliases: [["orgs"]],
+  summary: "Organizations this token can see, each with the projects it may reach.",
+  context: "none",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations" },
+  output: "[{slug, name, projects:[{slug, name, platform}]}]",
+  text: (d) => table(d, ["slug", "name", ["projects", (r) => (r.projects ?? []).map((p) => p.slug).join(", ")]]),
+  async run(ctx) {
+    return ctx.api.get("organizations");
+  }
+};
+var projects = {
+  path: ["projects", "list"],
+  aliases: [["projects"]],
+  summary: "Projects of the organization that this token may reach.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations" },
+  output: "[{slug, name, platform}]",
+  async run(ctx) {
+    const org = await ctx.org();
+    const all = await ctx.api.get("organizations");
+    const found = all.find((o) => o.slug === org);
+    if (!found) throw usageError("unknown_org", `This token cannot see organization ${org}.`, `Visible: ${all.map((o) => o.slug).join(", ") || "none"}`);
+    return found.projects ?? [];
+  }
+};
+var overview = {
+  path: ["overview"],
+  summary: "The whole fleet in one call: per-project issues, volume trend, silence, monitors and alert coverage.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations/{org}/overview" },
+  flags: { hours: { type: "integer", value: "<n>", description: "Window in hours (default 24), compared with the window before it." } },
+  examples: [{ command: "tracksiy overview --select totals,projects.slug,projects.newIssues", description: "Fleet totals and new issues per project." }],
+  output: "{organization, window, totals{projects, unresolved, newIssues, events, monitorsDown, projectsWithoutAlerts, projectsSilent, ...}, projects[...], orphanMonitors[...], notes[]}",
+  text: (d) => `${kv(d.totals ?? {})}
+
+${table(d.projects ?? [], [
+    "slug",
+    ["open", (r) => r.issues && typeof r.issues === "object" ? r.issues.unresolved : r.issues],
+    ["new", (r) => r.newIssues],
+    ["events", (r) => r.events],
+    ["trend", (r) => r.changeRatio == null ? "-" : `${r.changeRatio > 0 ? "+" : ""}${Math.round(r.changeRatio * 100)}%`],
+    ["last event", (r) => ago(r.lastEvent)],
+    ["receiving", (r) => r.receiving]
+  ])}${(d.notes ?? []).length ? `
+
+${d.notes.join("\n")}` : ""}`,
+  async run(ctx) {
+    return ctx.api.get(await orgPath(ctx, "overview"), { hours: ctx.input.hours });
+  }
+};
+var changes = {
+  path: ["changes"],
+  summary: "What changed since a point in time: new issues, monitors going down or up, new releases.",
+  description: "Built for polling: pass the returned `cursor` as --since next time and nothing is seen twice.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations/{org}/changes" },
+  flags: {
+    since: { type: "string", value: `${TIME}|<cursor>`, default: "24h", description: "Start of the window, or the cursor from the previous call. Default 24h." },
+    limit: { type: "integer", value: "<n>", description: "Maximum items per list." }
+  },
+  examples: [{ command: "tracksiy changes --since 1h", description: "Anything new in the last hour." }],
+  output: "{since, until, cursor, newIssues[], monitorTransitions[], newReleases[], truncated{}, notes[]}",
+  text: (d) => [
+    `since ${d.since} (next cursor: ${d.cursor})`,
+    `
+new issues:
+${table(d.newIssues ?? [], ["project", "id", "level", "count", "title"])}`,
+    `
+monitor transitions:
+${table(d.monitorTransitions ?? [], ["project", "name", ["state", (r) => r.wentDown ? "DOWN" : "up"], ["at", (r) => ago(r.at)], "reason"])}`,
+    `
+new releases:
+${table(d.newReleases ?? [], ["project", "version", "surface", ["at", (r) => ago(r.at)]])}`
+  ].join("\n"),
+  async run(ctx) {
+    const raw = String(ctx.input.since);
+    const value = /^\d+\s*[smhdw]$/.test(raw) ? since(raw) : raw;
+    return ctx.api.get(await orgPath(ctx, "changes"), { since: value, limit: ctx.input.limit });
+  }
+};
+var health = {
+  path: ["health"],
+  summary: "Can the platform itself be believed right now? Exit code 10 when any check fails.",
+  context: "none",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/health" },
+  examples: [{ command: "tracksiy health --quiet || echo 'do not trust the numbers'", description: "Gate a report on platform health." }],
+  output: "{generatedAt, ok, checks:[{name, ok, status, detail}], numbers}",
+  text: (d) => `ok: ${d.ok}
+${table(d.checks ?? [], ["name", "status", "detail"])}`,
+  async run(ctx) {
+    const data = await ctx.api.get("health");
+    if (data && data.ok === false) {
+      const failing = (data.checks ?? []).filter((c) => c.ok === false).map((c) => c.name);
+      throw new CheckFailed(`Platform health is not ok: ${failing.join(", ") || "see checks"}.`, data);
+    }
+    return data;
+  }
+};
+var monitorsList = {
+  path: ["monitors", "list"],
+  aliases: [["monitors"]],
+  summary: "Every monitor of the organization with its state, including monitors no project owns.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations/{org}/monitors" },
+  flags: {
+    status: { type: "string", enum: ["all", "up", "down", "never"], description: "Filter by state. Default all." },
+    type: { type: "string", enum: ["heartbeat", "get", "ping", "ssl", "ingest"], description: "Only this monitor type." }
+  },
+  output: "{summary{total, up, down, never, unalertable}, monitors:[{id, name, project, monitorType, url, upNow, lastCheck, overdue, alertable, checkInUrl}], notes[]}",
+  text: (d) => `${kv(d.summary ?? {})}
+
+${table(d.monitors ?? [], [
+    "name",
+    "project",
+    "monitorType",
+    ["up", (r) => r.upNow == null ? "never" : r.upNow],
+    ["last check", (r) => ago(r.lastCheck)],
+    ["alertable", (r) => r.alertable]
+  ])}`,
+  async run(ctx) {
+    return ctx.api.get(await orgPath(ctx, "monitors"), { status: ctx.input.status, type: ctx.input.type });
+  }
+};
+var monitorsDeclare = {
+  path: ["monitors", "declare"],
+  summary: "Declare monitors for a project up front, idempotently: heartbeats for jobs, HTTP checks, TLS, ingest silence.",
+  description: 'Each --heartbeat/--get/--ping/--ssl/--ingest adds one monitor. Re-running with the same slugs updates them in place. For full control pass --body with {"monitors": [...]}.',
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/monitors" },
+  flags: {
+    heartbeat: { type: "list", value: "<slug>[:<interval-seconds>]", description: "A job that must check in at least this often (default 86400 s)." },
+    get: { type: "list", value: "<slug>=<url>", description: "HTTP GET check expecting 200." },
+    ping: { type: "list", value: "<slug>=<url>", description: "Reachability check." },
+    ssl: { type: "list", value: "<slug>=<url>", description: "TLS certificate check (expiry is reported on every check)." },
+    ingest: { type: "list", value: "<slug>[:<surface>]", description: "Alert when this project (or surface) stops sending events." },
+    interval: { type: "integer", value: "<seconds>", description: "Interval for --get/--ping/--ssl/--ingest monitors." },
+    body: { type: "json", value: "<json|@file|->", description: "Raw request body; overrides the shorthand flags." }
+  },
+  examples: [
+    { command: "tracksiy monitors declare --heartbeat nightly-backup:93600 --get site=https://example.com", description: "A backup heartbeat and a homepage check." }
+  ],
+  output: "Server result per monitor, including check-in URLs for heartbeats.",
+  async run(ctx) {
+    const i = ctx.input;
+    let body = i.body;
+    if (!body) {
+      const monitors = [];
+      for (const h of i.heartbeat ?? []) {
+        const [slug, interval] = String(h).split(":");
+        monitors.push(compact({ slug, type: "heartbeat", intervalSeconds: interval ? Number(interval) : void 0 }));
+      }
+      for (const type of ["get", "ping", "ssl"]) {
+        for (const item of i[type] ?? []) {
+          const eq = String(item).indexOf("=");
+          if (eq < 1) throw usageError("bad_value", `--${type} expects <slug>=<url>, got ${JSON.stringify(item)}`);
+          monitors.push(compact({ slug: item.slice(0, eq), type, url: item.slice(eq + 1), intervalSeconds: i.interval }));
+        }
+      }
+      for (const item of i.ingest ?? []) {
+        const [slug, surface] = String(item).split(":");
+        monitors.push(compact({ slug, type: "ingest", surface, intervalSeconds: i.interval }));
+      }
+      if (!monitors.length) throw usageError("missing_flag", "Nothing to declare.", "Add --heartbeat, --get, --ping, --ssl, --ingest, or --body.");
+      body = { monitors };
+    }
+    return ctx.api.send("POST", await projectPath(ctx, "monitors"), body);
+  }
+};
+var monitorsDelete = {
+  path: ["monitors", "delete"],
+  summary: "Remove one of a project's monitors by the slug it was declared with.",
+  context: "project",
+  effect: "destructive",
+  idempotent: true,
+  endpoint: { method: "DELETE", path: "/api/agent/v1/projects/{org}/{project}/monitors/{monitor_slug}" },
+  args: [{ name: "slug", required: true, description: "The monitor's slug." }],
+  flags: { type: { type: "string", enum: ["heartbeat", "get", "ping", "ssl", "ingest"], description: "Disambiguate when two monitors share a slug." }, ...YES },
+  async run(ctx) {
+    requireYes(ctx, `This deletes monitor ${ctx.input.slug} and its history.`);
+    return ctx.api.send("DELETE", await projectPath(ctx, `monitors/${seg(ctx.input.slug)}${ctx.input.type ? `?type=${seg(ctx.input.type)}` : ""}`));
+  }
+};
+var performance = {
+  path: ["performance"],
+  summary: "Is this project slow, and did it get slower? Transactions compared with the previous window, plus uptime.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/performance" },
+  flags: {
+    since: { type: "string", value: TIME, description: "Window start (default: server's, 24h)." },
+    op: { type: "string", value: "<op>", description: "Only this operation, e.g. http.server." },
+    sort: { type: "string", value: "<key>", description: "Order (server default: slower first)." },
+    limit: { type: "integer", value: "<n>", description: "How many transactions." }
+  },
+  output: "{since, until, transactions:[{transaction, op, current{...}, previous{...}, changeRatio, slower}], uptime[...], blindSpots[...]}",
+  text: (d) => `${table(d.transactions ?? [], [
+    "transaction",
+    "op",
+    ["p95 ms", (r) => r.current?.p95Ms ?? r.current?.p95 ?? "-"],
+    ["count", (r) => r.current?.count ?? "-"],
+    ["change", (r) => r.changeRatio == null ? "-" : `${r.changeRatio > 0 ? "+" : ""}${Math.round(r.changeRatio * 100)}%`],
+    ["slower", (r) => r.slower]
+  ])}${(d.uptime ?? []).length ? `
+
+uptime:
+${table(d.uptime, ["name", "url", "upNow", "avgResponseMs", "downChecks"])}` : ""}`,
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "performance"), {
+      since: since(ctx.input.since),
+      op: ctx.input.op,
+      sort: ctx.input.sort,
+      limit: ctx.input.limit
+    });
+  }
+};
+var fleet_default = [orgs, projects, overview, changes, health, monitorsList, monitorsDeclare, monitorsDelete, performance];
+
+// src/commands/issues.ts
+var FILTERS = {
+  status: { type: "string", enum: ["unresolved", "resolved", "ignored", "regressed", "all"], description: "Issue status. Server default: unresolved." },
+  level: { type: "string", enum: ["sample", "debug", "info", "warning", "error", "fatal"], description: "Only this level." },
+  environment: { type: "string", value: "<name>", description: "Only events from this environment, e.g. production." },
+  tag: { type: "string", value: "<key:value>", description: "Tag filter, e.g. surface:web or release:app@1.2.0." },
+  query: { type: "string", value: "<text>", description: "Free text against the title (* is a wildcard) and the search index." },
+  since: { type: "string", value: TIME, description: "Last seen at or after this (lastSeenSince)." },
+  until: { type: "string", value: TIME, description: "Last seen before this (lastSeenBefore)." },
+  "first-seen-since": { type: "string", value: TIME, description: "First seen at or after this: new issues only." },
+  "first-seen-until": { type: "string", value: TIME, description: "First seen before this." }
+};
+function filterQuery(input) {
+  return compact({
+    status: input.status,
+    level: input.level,
+    environment: input.environment,
+    tag: input.tag,
+    query: input.query,
+    lastSeenSince: since(input.since),
+    lastSeenBefore: since(input.until, "until"),
+    firstSeenSince: since(input.firstSeenSince, "first-seen-since"),
+    firstSeenBefore: since(input.firstSeenUntil, "first-seen-until")
+  });
+}
+var issueRows = (issues) => table(issues ?? [], [
+  "id",
+  ["level", (r) => r.level],
+  ["count", (r) => r.count],
+  ["last seen", (r) => ago(r.lastSeen)],
+  ["status", (r) => r.regressedAt && r.status === "unresolved" ? "regressed" : r.status],
+  ["title", (r) => r.title]
+]);
+var list = {
+  path: ["issues", "list"],
+  aliases: [["issues"]],
+  summary: "Recent issues of a project, newest activity first, with the frames that matter inlined.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/issues" },
+  flags: {
+    ...FILTERS,
+    sort: { type: "string", enum: ["lastSeen", "firstSeen", "count"], description: "Order. Default lastSeen." },
+    limit: { type: "integer", value: "<n>", description: "How many issues (server default 25)." },
+    frames: { type: "integer", value: "<n>", description: "In-app stack frames inlined per issue (default 3, 0 for none)." }
+  },
+  examples: [
+    { command: "tracksiy issues list --since 24h", description: "Unresolved issues seen in the last day." },
+    { command: "tracksiy issues list --status regressed --select issues.id,issues.title", description: "Only regressions, only ids and titles." },
+    { command: "tracksiy issues list --first-seen-since 2h --environment production", description: "What is new in production." }
+  ],
+  output: "{project, issueCount, total, hasMore, issues:[{id, shortId, title, culprit, level, status, count, firstSeen, lastSeen, regressedAt, timesRegressed, permalink, frames?}]}",
+  text: (d) => `${d.issueCount ?? d.issues?.length ?? 0} of ${d.total ?? "?"} issues${d.hasMore ? " (more: raise --limit)" : ""}
+${issueRows(d.issues)}`,
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "issues"), {
+      ...filterQuery(ctx.input),
+      sort: ctx.input.sort,
+      limit: ctx.input.limit,
+      frames: ctx.input.frames
+    });
+  }
+};
+var view = {
+  path: ["issues", "view"],
+  summary: "One issue in enough depth to act on: latest event, stack frames, tags, recent volume.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/issues/{issue_id}" },
+  args: [{ name: "id", required: true, description: "Issue id (numeric, from `issues list`)." }],
+  flags: { frames: { type: "integer", value: "<n>", description: "How many frames to include." } },
+  examples: [{ command: "tracksiy issues view 4812", description: "Everything needed to start fixing issue 4812." }],
+  output: "{id, title, culprit, level, status, count, firstSeen, lastSeen, latestEvent{release, environment, exceptionType, exceptionValue, contexts}, frames[{filename, function, lineno, contextLine, inApp}], tags[], eventsLast24h, eventsLast7d, permalink}",
+  text: (d) => {
+    const head = kv(d, ["id", "shortId", "title", "culprit", "level", "status", "count", "eventsLast24h", "eventsLast7d", "firstSeen", "lastSeen", "regressedAt", "permalink"]);
+    const ev = d.latestEvent ? `
+latest event:
+${kv(d.latestEvent, ["release", "environment", "exceptionType", "exceptionValue", "transaction", "platform"]).replace(/^/gm, "  ")}` : "";
+    const frames = (d.frames ?? []).map((f) => `  ${f.inApp ? "*" : " "} ${f.filename ?? f.module ?? "?"}:${f.lineno ?? "?"} in ${f.function ?? "?"}${f.contextLine ? `
+      ${String(f.contextLine).trim()}` : ""}`).join("\n");
+    return `${head}${ev}${frames ? `
+frames (* = in app):
+${frames}` : ""}`;
+  },
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, `issues/${encodeURIComponent(ctx.input.id)}`), { frames: ctx.input.frames });
+  }
+};
+function statusCommand(name, status2, summary) {
+  return {
+    path: ["issues", name],
+    summary,
+    context: "project",
+    effect: "write",
+    idempotent: true,
+    endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/issues/{issue_id}/status" },
+    args: [{ name: "ids", required: true, variadic: true, description: "One or more issue ids." }],
+    examples: [{ command: `tracksiy issues ${name} 4812 4813`, description: `Mark two issues ${status2}.` }],
+    output: "One id: the issue's new state. Several: {matched, changed, ids, dryRun:false}.",
+    async run(ctx) {
+      const ids = ctx.input.ids;
+      for (const id of ids) if (!/^\d+$/.test(id)) throw usageError("bad_value", `Issue ids are numeric; got ${JSON.stringify(id)}`);
+      if (ids.length === 1) return ctx.api.send("POST", await projectPath(ctx, `issues/${ids[0]}/status`), { status: status2 });
+      return ctx.api.send("POST", await projectPath(ctx, "issues/status"), { status: status2, ids: ids.map(Number), dryRun: false });
+    }
+  };
+}
+var resolve2 = statusCommand("resolve", "resolved", "Mark issues resolved. A new event on a resolved issue reopens it as a regression.");
+var ignore = statusCommand("ignore", "ignored", "Mark issues ignored: they stop alerting until unignored.");
+var unresolve = statusCommand("unresolve", "unresolved", "Reopen issues.");
+var bulk = {
+  path: ["issues", "bulk-status"],
+  summary: "Change the status of every issue matching a filter. Dry run unless --apply.",
+  description: "Without --apply the server only reports what would change. Select issues with --ids, with the same filters as `issues list`, or with --all.",
+  context: "project",
+  effect: "write",
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/issues/status" },
+  flags: {
+    to: { type: "string", required: true, enum: ["resolved", "ignored", "unresolved"], description: "New status." },
+    ids: { type: "list", value: "<id,...>", description: "Exactly these issues." },
+    ...FILTERS,
+    all: { type: "boolean", description: "Every issue of the project (required when no other selector is given)." },
+    apply: { type: "boolean", description: "Actually change them. Default is a dry run." }
+  },
+  examples: [
+    { command: "tracksiy issues bulk-status --to resolved --until 30d", description: "Preview resolving everything not seen for 30 days." },
+    { command: "tracksiy issues bulk-status --to resolved --until 30d --apply", description: "Do it." }
+  ],
+  output: "{dryRun, matched, changed, ids, ...} as reported by the server.",
+  async run(ctx) {
+    const filter = filterQuery(ctx.input);
+    const hasFilter = Object.keys(filter).length > 0;
+    const body = compact({
+      status: ctx.input.to,
+      ids: ctx.input.ids?.map(Number),
+      filter: hasFilter ? filter : void 0,
+      all: ctx.input.all || void 0,
+      dryRun: !ctx.input.apply
+    });
+    return ctx.api.send("POST", await projectPath(ctx, "issues/status"), body);
+  }
+};
+var issues_default = [list, view, resolve2, ignore, unresolve, bulk];
+
+// src/commands/projects.ts
+var create = {
+  path: ["projects", "create"],
+  summary: "Everything a new app needs in one idempotent call: the project, an ingest key per surface, an upload token, and the next steps.",
+  description: "Safe to re-run: an existing project is returned as it is (created: false). The response holds secrets (ingest keys, the upload token) -- store them, do not print them into logs.",
+  context: "org",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "POST", path: "/api/agent/v1/organizations/{org}/projects" },
+  args: [{ name: "name", required: true, description: "Project name; its slug is derived from it." }],
+  flags: {
+    platform: { type: "string", value: "<platform>", description: "e.g. php-laravel, javascript-react, node, python-django, android, apple-ios, react-native." },
+    team: { type: "string", value: "<slug>", description: "Team that owns it (default: the organization's first team)." },
+    surfaces: { type: "list", value: "<name,...>", description: "One ingest key per surface (server default backend,web,mobile)." },
+    "same-host": { type: "boolean", description: "The app runs on the Tracksiy host: use the loopback ingest address." }
+  },
+  examples: [{ command: "tracksiy projects create shop --platform php-laravel --surfaces backend,web", description: "A Laravel app with a browser frontend." }],
+  output: "{created, project{organization, slug, name, platform}, dsns[{surface, dsn, publicKey, shipsInPublicArtifact, loopbackDsn}], sourcemapToken, onboardingUrl, mustRead[], nextSteps[]}",
+  text: (d) => `${d.created ? "created" : "already existed"}: ${d.project?.organization}/${d.project?.slug}
+
+ingest keys:
+${table(d.dsns ?? [], ["surface", "dsn", "shipsInPublicArtifact"])}${d.sourcemapToken ? `
+
+upload token: ${d.sourcemapToken} (scopes ${(d.sourcemapTokenScopes ?? []).join(",")})` : ""}
+
+next:
+${(d.nextSteps ?? []).map((s, n) => `${n + 1}. ${s.action} -- ${s.why}`).join("\n")}`,
+  async run(ctx) {
+    return ctx.api.send(
+      "POST",
+      await orgPath(ctx, "projects"),
+      compact({ name: ctx.input.name, platform: ctx.input.platform, team: ctx.input.team, surfaces: ctx.input.surfaces, sameHost: ctx.input.sameHost })
+    );
+  }
+};
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+var verify = {
+  path: ["projects", "verify"],
+  aliases: [["verify"]],
+  summary: "Did the integration actually work? Checks events, releases, environments, source maps, privacy and alerting. Exit 10 if not.",
+  description: "By default only `events_received` must pass. --strict requires every check to pass (an `unknown` check is not a pass). --wait polls until it passes or the time runs out -- use it right after deploying the SDK.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/integration" },
+  flags: {
+    wait: { type: "integer", value: "<seconds>", description: "Keep checking every 5 s for up to this long." },
+    strict: { type: "boolean", description: "Every check must pass, not only events_received." },
+    require: { type: "list", value: "<check,...>", description: "These checks must pass (names from the checks list)." }
+  },
+  examples: [
+    { command: "tracksiy projects verify --wait 120", description: "Wait up to two minutes for the first event." },
+    { command: "tracksiy projects verify --strict --select checks", description: "The full integration report card." }
+  ],
+  output: "{receiving, firstEvent, lastEvent, releases, environments, sourceMaps{}, surfaces[], privacy{}, checks[{name, ok, status, detail}], verified, failing[]}",
+  text: (d) => `${kv({ verified: d.verified, receiving: d.receiving, firstEvent: d.firstEvent, lastEvent: d.lastEvent, failing: d.failing })}
+
+${table(d.checks ?? [], ["name", "status", "detail"])}`,
+  async run(ctx) {
+    const path = await projectPath(ctx, "integration");
+    const required = ctx.input.require ?? ["events_received"];
+    const deadline = Date.now() + (ctx.input.wait ?? 0) * 1e3;
+    for (; ; ) {
+      const data = await ctx.api.get(path);
+      const checks = data?.checks ?? [];
+      const passes = (c) => c.status === "pass" || c.status == null && c.ok === true;
+      const failing = ctx.input.strict ? checks.filter((c) => !passes(c)).map((c) => c.name) : required.filter((n) => {
+        const c = checks.find((x) => x.name === n);
+        return !c || !passes(c);
+      });
+      const unknownNames = ctx.input.require ? required.filter((n) => !checks.some((c) => c.name === n)) : [];
+      if (unknownNames.length) throw usageError("bad_value", `Unknown check(s): ${unknownNames.join(", ")}`, `Known: ${checks.map((c) => c.name).join(", ")}`);
+      const result = { ...data, verified: failing.length === 0, failing };
+      if (result.verified) return result;
+      if (Date.now() >= deadline) {
+        throw new CheckFailed(`Integration not verified: ${failing.join(", ")}.`, result, checks.find((c) => failing.includes(c.name))?.detail);
+      }
+      ctx.log(`waiting: ${failing.join(", ")} not passing yet`);
+      await sleep2(Math.min(5e3, Math.max(0, deadline - Date.now())));
+    }
+  }
+};
+var onboarding = {
+  path: ["onboarding"],
+  summary: "What to know before integrating an app. No token needed.",
+  context: "none",
+  auth: false,
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/onboarding" },
+  output: "{steps:[{id, phase, severity, title, detail, action}], markdown}",
+  text: (d) => d.markdown ?? JSON.stringify(d, null, 2),
+  async run(ctx) {
+    return ctx.api.get("onboarding", void 0, { auth: false });
+  }
+};
+var projects_default = [create, verify, onboarding];
+
+// src/commands/alerts.ts
+var RECIPIENT_TYPES = ["email", "webhook", "discord", "googlechat", "telegram"];
+var DECLARE = {
+  recipient: {
+    type: "list",
+    value: "email|<type>:<url>",
+    description: `Who is told. Repeatable. \`email\` alone reaches the members of the project's teams; webhook, discord, googlechat and telegram take a URL: \`<type>:<url>\` (telegram: the Bot API sendMessage URL with chat_id).`
+  },
+  delivery: { type: "string", enum: ["immediate", "digest"], description: "For --recipient: send each alert now, or batch into the digest hours. Default immediate." },
+  "new-issue": { type: "boolean", description: "Alert on every new issue (default true). --no-new-issue to turn off." },
+  threshold: { type: "string", value: "<events>/<minutes>", description: "Also alert when an issue gets this many events in this many minutes, e.g. 50/10." },
+  uptime: { type: "boolean", description: "Alert when this project's monitors go down (default true)." },
+  "replace-recipients": { type: "boolean", description: "Make the recipient list exactly this one (default: add to it)." },
+  body: { type: "json", value: "<json|@file|->", description: "Raw request body; overrides the other flags." }
+};
+function recipients(list5, delivery) {
+  return (list5 ?? []).map((raw) => {
+    const i = raw.indexOf(":");
+    const type = i > 0 ? raw.slice(0, i) : raw;
+    if (!RECIPIENT_TYPES.includes(type)) {
+      throw usageError("bad_value", `--recipient type must be one of ${RECIPIENT_TYPES.join(", ")}; got ${JSON.stringify(type)}`, "Format: email, or <type>:<url>, e.g. webhook:https://hooks.example.com/x");
+    }
+    const target = i > 0 ? raw.slice(i + 1) : void 0;
+    if (type === "email") {
+      if (target) throw usageError("bad_value", `--recipient ${raw}: an email recipient takes no address.`, "Use --recipient email: it reaches the members of the teams this project belongs to.");
+      return compact({ type, delivery });
+    }
+    if (!target) throw usageError("bad_value", `--recipient ${raw} has no target`, `Format: ${type}:<url>`);
+    return compact({ type, url: target, delivery });
+  });
+}
+function threshold(value) {
+  if (value === void 0) return void 0;
+  const m = /^(\d+)\s*\/\s*(\d+)$/.exec(String(value));
+  if (!m) throw usageError("bad_value", `--threshold expects <events>/<minutes>, e.g. 50/10; got ${JSON.stringify(value)}`);
+  return { events: Number(m[1]), minutes: Number(m[2]) };
+}
+function declareBody(i) {
+  if (i.body) return i.body;
+  return compact({
+    recipients: i.recipient ? recipients(i.recipient, i.delivery) : void 0,
+    newIssue: i.newIssue,
+    threshold: threshold(i.threshold),
+    uptime: i.uptime,
+    replaceRecipients: i.replaceRecipients
+  });
+}
+var rulesText = (d) => `${kv(d.coverage ?? {})}
+
+rules:
+${table(d.rules ?? [], [
+  "name",
+  ["agent", (r) => r.managedByAgent],
+  ["new issue", (r) => r.newIssue],
+  ["threshold", (r) => r.threshold ? `${r.threshold.events}/${r.threshold.minutes}m` : "-"],
+  ["uptime", (r) => r.uptime],
+  ["recipients", (r) => (r.recipients ?? []).map((x) => `${x.type}${x.delivery === "digest" ? "(digest)" : ""}`).join(", ")]
+])}${(d.notes ?? []).length ? `
+
+${d.notes.join("\n")}` : ""}`;
+var get = {
+  path: ["alerts", "get"],
+  aliases: [["alerts"]],
+  summary: "Who is told when this project breaks, and whether that can actually happen.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/alerts" },
+  output: "{rules[], coverage{newIssue, threshold, uptime, recipientCount, monitors}, engine{intervalSeconds, lastRunAt}, recentNotifications[], notes[]}",
+  text: rulesText,
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "alerts"));
+  }
+};
+var set = {
+  path: ["alerts", "set"],
+  summary: "Declare the project's alerting idempotently. Then prove it with `alerts test`.",
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PUT", path: "/api/agent/v1/projects/{org}/{project}/alerts" },
+  flags: DECLARE,
+  examples: [
+    { command: "tracksiy alerts set --recipient email --threshold 50/10", description: "Email the project's team on new issues, on bursts, and on downtime." },
+    { command: "tracksiy alerts set --recipient 'telegram:https://api.telegram.org/bot<token>/sendMessage?chat_id=<id>' --delivery digest", description: "Telegram, batched into the digest hours." }
+  ],
+  output: "The stored alerting state, same shape as `alerts get`.",
+  text: rulesText,
+  async run(ctx) {
+    return ctx.api.send("PUT", await projectPath(ctx, "alerts"), declareBody(ctx.input));
+  }
+};
+var test = {
+  path: ["alerts", "test"],
+  summary: "Send a test message through every recipient and report each delivery. Exit code 10 if any failed.",
+  context: "project",
+  effect: "write",
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/alerts/test" },
+  output: "Per-recipient delivery results with ok/status/error.",
+  async run(ctx) {
+    const data = await ctx.api.send("POST", await projectPath(ctx, "alerts/test"));
+    const results = data?.results ?? [];
+    if (!results.length) {
+      throw new CheckFailed("This project has no recipients, so nobody would be told.", data, "Declare one with `tracksiy alerts set --recipient <type>:<target>`.");
+    }
+    const failed = results.filter((r) => r && r.ok === false);
+    if (failed.length) {
+      throw new CheckFailed(`${failed.length || "Some"} recipient(s) did not receive the test message.`, data, "Fix or replace the failing recipients with `tracksiy alerts set`.");
+    }
+    return data;
+  }
+};
+var coverage = {
+  path: ["alerts", "coverage"],
+  summary: "For the whole organization: which projects can alert, which cannot, and through what.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations/{org}/alerts/coverage" },
+  output: "{projects[{project, rules, recipientCount, newIssue, threshold, uptime, monitors}], projectsWithoutRules[], monitorsWithoutProject[], recipientsByType{}, engine{}, notes[]}",
+  text: (d) => `${table(d.projects ?? [], ["project", "rules", "recipientCount", "newIssue", "threshold", "uptime"])}
+
+without rules: ${(d.projectsWithoutRules ?? []).join(", ") || "none"}`,
+  async run(ctx) {
+    return ctx.api.get(await orgPath(ctx, "alerts/coverage"));
+  }
+};
+var defaults = {
+  path: ["alerts", "defaults"],
+  summary: "Apply one alerting declaration to many projects at once (by default only where none exists).",
+  context: "org",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PUT", path: "/api/agent/v1/organizations/{org}/alerts/defaults" },
+  flags: {
+    ...DECLARE,
+    projects: { type: "list", value: "<slug,...>", description: "Which projects (default every project: *)." },
+    "only-where-missing": { type: "boolean", description: "Skip projects that already have a rule (default true)." }
+  },
+  examples: [{ command: "tracksiy alerts defaults --recipient email", description: "Every project without alerting emails its team." }],
+  async run(ctx) {
+    const body = ctx.input.body ?? compact({ ...declareBody(ctx.input), projects: ctx.input.projects, onlyWhereMissing: ctx.input.onlyWhereMissing });
+    return ctx.api.send("PUT", await orgPath(ctx, "alerts/defaults"), body);
+  }
+};
+var settingsGet = {
+  path: ["alerts", "settings"],
+  summary: "When digest-mode recipients are told, and whether the last digests went out.",
+  context: "org",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/organizations/{org}/alerts/settings" },
+  output: "{digest{hours, timezone, effectiveHours, nextAt, lastSentAt, recipients, pendingItems}, recentDigests[], notes[]}",
+  text: (d) => `${kv(d.digest ?? {})}
+
+recent digests:
+${table(d.recentDigests ?? [], [["sent", (r) => ago(r.sentAt)], "type", "ok", "itemCount", "error"])}`,
+  async run(ctx) {
+    return ctx.api.get(await orgPath(ctx, "alerts/settings"));
+  }
+};
+var settingsSet = {
+  path: ["alerts", "settings", "set"],
+  summary: "Declare the digest hours and timezone.",
+  context: "org",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PUT", path: "/api/agent/v1/organizations/{org}/alerts/settings" },
+  flags: {
+    hours: { type: "list", value: "<h,...>", description: "Hours of the day (0-23) a digest is sent, e.g. 11,14,17." },
+    timezone: { type: "string", value: "<iana>", description: "IANA timezone, e.g. Europe/Istanbul." }
+  },
+  examples: [{ command: "tracksiy alerts settings set --hours 9,13,18 --timezone Europe/Istanbul", description: "Three digests a day, Istanbul time." }],
+  async run(ctx) {
+    const hours = ctx.input.hours?.map((h) => {
+      const n = Number(h);
+      if (!Number.isInteger(n) || n < 0 || n > 23) throw usageError("bad_value", `--hours: ${h} is not an hour 0-23`);
+      return n;
+    });
+    if (!hours && !ctx.input.timezone) throw usageError("missing_flag", "Nothing to set.", "Pass --hours and/or --timezone.");
+    return ctx.api.send("PUT", await orgPath(ctx, "alerts/settings"), { digest: compact({ hours, timezone: ctx.input.timezone }) });
+  }
+};
+var alerts_default = [get, set, test, coverage, defaults, settingsGet, settingsSet];
+
+// src/commands/keys.ts
+var list2 = {
+  path: ["keys", "list"],
+  aliases: [["keys"]],
+  summary: "Every ingest key of the project: its surface, whether ingest accepts it, its rate limit and volume.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/keys" },
+  output: "{keys:[{name, publicKey, isActive, rateLimit, dsn, created, eventsLast24h}], notes[]}",
+  text: (d) => table(d.keys ?? [], [
+    "name",
+    "isActive",
+    ["rate limit", (r) => r.rateLimit ? `${r.rateLimit.count}/${r.rateLimit.windowSeconds}s` : "none"],
+    ["24h", (r) => r.eventsLast24h],
+    "dsn"
+  ]),
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "keys"));
+  }
+};
+var set2 = {
+  path: ["keys", "set"],
+  summary: "Declare one ingest key's state: active or not, and its rate limit.",
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PUT", path: "/api/agent/v1/projects/{org}/{project}/keys/{name}" },
+  args: [{ name: "name", required: true, description: "Key name, which is also its surface (backend, web, mobile...)." }],
+  flags: {
+    active: { type: "boolean", description: "Accept events with this key (--no-active to stop ingest from it)." },
+    "rate-limit": { type: "string", value: "<count>/<seconds>", description: "Maximum events per window, e.g. 600/60." },
+    "no-rate-limit": { type: "boolean", description: "Remove the rate limit." }
+  },
+  examples: [{ command: "tracksiy keys set web --rate-limit 600/60", description: "Cap the browser key at 600 events a minute." }],
+  async run(ctx) {
+    const i = ctx.input;
+    const body = compact({
+      isActive: i.active,
+      // Explicit null removes the limit; omitted leaves it as it is.
+      rateLimit: i.noRateLimit ? null : i.rateLimit !== void 0 ? rate(i.rateLimit, "rate-limit") : void 0
+    });
+    return ctx.api.send("PUT", await projectPath(ctx, `keys/${seg(i.name)}`), body);
+  }
+};
+var rotate = {
+  path: ["keys", "rotate"],
+  summary: "Replace an ingest key with a new one of the same name and limit; the old one stops being accepted.",
+  description: "Every app sending with the old key must be redeployed with the new DSN, or its events are dropped.",
+  context: "project",
+  effect: "destructive",
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/keys/{name}/rotate" },
+  args: [{ name: "name", required: true, description: "Key name." }],
+  flags: YES,
+  async run(ctx) {
+    requireYes(ctx, `Rotating key ${ctx.input.name} cuts off every app still using the old one.`);
+    return ctx.api.send("POST", await projectPath(ctx, `keys/${seg(ctx.input.name)}/rotate`));
+  }
+};
+var keys_default = [list2, set2, rotate];
+
+// src/commands/releases.ts
+var list3 = {
+  path: ["releases", "list"],
+  aliases: [["releases"]],
+  summary: "What did the last deploys break? Recent releases with their events, issues and the issues they introduced.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/releases" },
+  flags: {
+    since: { type: "string", value: TIME, description: "Only releases seen since then." },
+    limit: { type: "integer", value: "<n>", description: "How many releases (server default 10)." }
+  },
+  output: "{releases:[{version, surface, previousVersion, firstEvent, lastEvent, events, issues, newIssueCount, newIssues[]}], note}",
+  text: (d) => table(d.releases ?? [], ["version", "surface", ["first event", (r) => ago(r.firstEvent)], "events", "issues", ["new issues", (r) => r.newIssueCount]]),
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "releases"), { since: since(ctx.input.since), limit: ctx.input.limit });
+  }
+};
+var health2 = {
+  path: ["releases", "health"],
+  summary: "Is the app crashing for its users, and did the last release make it worse? Crash-free sessions and users per release.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/release-health" },
+  flags: {
+    since: { type: "string", value: TIME, description: "Window start." },
+    environment: { type: "string", value: "<name>", description: "Only this environment." },
+    limit: { type: "integer", value: "<n>", description: "How many releases." }
+  },
+  output: "{receivingSessions, releases:[{version, environment, sessions, crashed, crashFreeSessionsPct, crashFreeUsersPct, ...}], clientReports[], checks[], notes[]}",
+  text: (d) => `receiving sessions: ${d.receivingSessions}
+${table(d.releases ?? [], ["version", "environment", "sessions", "crashed", ["crash-free %", (r) => r.crashFreeSessionsPct], ["users crash-free %", (r) => r.crashFreeUsersPct]])}`,
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "release-health"), {
+      since: since(ctx.input.since),
+      environment: ctx.input.environment,
+      limit: ctx.input.limit
+    });
+  }
+};
+var declare = {
+  path: ["releases", "declare"],
+  aliases: [["releases", "create"]],
+  summary: "Create or update a release idempotently: its commit, URL, and when it was released. Run it from the deploy.",
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PUT", path: "/api/agent/v1/projects/{org}/{project}/releases/{version}" },
+  scopes: ["project:releases", "project:write", "project:admin"],
+  args: [{ name: "version", required: true, description: "The release name the SDK reports, e.g. shop@1.4.2 or shop@<git-sha>." }],
+  flags: {
+    ref: { type: "string", value: "<commit>", description: "Commit or tag it was built from." },
+    url: { type: "string", value: "<url>", description: "Link to the release (changelog, CI run)." },
+    released: { type: "boolean", description: "Mark it released now (if not already). --no-released clears it." },
+    "released-at": { type: "string", value: "<iso>", description: "Mark it released at this time." }
+  },
+  examples: [
+    { command: "tracksiy releases declare shop@$(git rev-parse --short HEAD) --ref $(git rev-parse HEAD) --released", description: "From a deploy script." }
+  ],
+  output: "{version, ref, url, released, created, projects[], artifacts}",
+  async run(ctx) {
+    const i = ctx.input;
+    if (i.released !== void 0 && i.releasedAt) throw usageError("conflict", "Pass --released or --released-at, not both.");
+    if (i.releasedAt && !Number.isFinite(Date.parse(i.releasedAt))) throw usageError("bad_value", `--released-at is not a time: ${i.releasedAt}`);
+    return ctx.api.send("PUT", await projectPath(ctx, `releases/${seg(i.version)}`), compact({ ref: i.ref, url: i.url, released: i.releasedAt ?? i.released }));
+  }
+};
+var releases_default = [list3, health2, declare];
+
+// src/commands/artifacts.ts
+import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+
+// src/lib/sourcemaps.ts
+import { createHash } from "node:crypto";
+import { existsSync as existsSync2 } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { dirname as dirname2, join as join2, relative, resolve as resolve3, sep } from "node:path";
+var JS = /\.(m?js|cjs)$/i;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".svn", ".hg"]);
+async function walk(dir) {
+  const out = [];
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    const full = join2(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) out.push(...await walk(full));
+    } else if (entry.isFile()) out.push(full);
+  }
+  return out.sort();
+}
+function sourceMappingUrl(code) {
+  const re = /^[ \t]*\/\/[#@][ \t]*sourceMappingURL=([^\s'"]+)[ \t]*$/gm;
+  let last;
+  for (let m = re.exec(code); m; m = re.exec(code)) last = m[1];
+  return last;
+}
+function debugIdInCode(code) {
+  const re = /^[ \t]*\/\/# debugId=([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})[ \t]*$/gm;
+  let last;
+  for (let m = re.exec(code); m; m = re.exec(code)) last = m[1];
+  return last?.toLowerCase();
+}
+function debugIdInMap(json) {
+  try {
+    const m = JSON.parse(json);
+    const id = m.debugId ?? m.debug_id;
+    return typeof id === "string" ? id.toLowerCase() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function debugIdFor(content) {
+  const h = createHash("sha256").update(content).digest();
+  h[6] = h[6] & 15 | 64;
+  h[8] = h[8] & 63 | 128;
+  const hex = h.subarray(0, 16).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function snippet(id) {
+  return `;!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&((e._tracksiyDebugIds=e._tracksiyDebugIds||{})[n]="${id}",(e._sentryDebugIds=e._sentryDebugIds||{})[n]="${id}")}catch(e){}}();`;
+}
+function injectCode(code, id) {
+  const lines = code.split("\n");
+  let at = lines.length;
+  while (at > 0 && lines[at - 1].trim() === "") at--;
+  if (at > 0 && /^[ \t]*\/\/[#@][ \t]*sourceMappingURL=/.test(lines[at - 1])) at--;
+  const before = lines.slice(0, at);
+  const after = lines.slice(at);
+  const result = [...before, snippet(id), `//# debugId=${id}`, ...after].join("\n");
+  return result.endsWith("\n") ? result : result + "\n";
+}
+function injectMap(json, id) {
+  const map = JSON.parse(json);
+  map.debugId = id;
+  map.debug_id = id;
+  return JSON.stringify(map);
+}
+async function findPairs(paths) {
+  const pairs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    const abs = resolve3(p);
+    const st = await stat(abs).catch(() => void 0);
+    if (!st) throw new Error(`No such file or directory: ${p}`);
+    const root = st.isDirectory() ? abs : dirname2(abs);
+    const files = st.isDirectory() ? await walk(abs) : [abs];
+    for (const js of files.filter((f) => JS.test(f))) {
+      if (seen.has(js)) continue;
+      seen.add(js);
+      const code = await readFile(js, "utf8");
+      const url = sourceMappingUrl(code);
+      let map;
+      if (url && !url.startsWith("data:")) {
+        const candidate = resolve3(dirname2(js), decodeURIComponent(url.split(/[?#]/)[0]));
+        if (existsSync2(candidate)) map = candidate;
+      }
+      if (!map && existsSync2(`${js}.map`)) map = `${js}.map`;
+      pairs.push({ js, map, root });
+    }
+  }
+  return pairs;
+}
+function artifactName(file, root, prefix) {
+  const rel = relative(root, file).split(sep).join("/");
+  const p = prefix.endsWith("/") ? prefix : `${prefix}/`;
+  return `${p}${rel}`;
+}
+
+// src/lib/chunks.ts
+import { createHash as createHash2 } from "node:crypto";
+var sha1 = (data) => createHash2("sha1").update(data).digest("hex");
+function manifestFor(files, chunkSize) {
+  const chunks = /* @__PURE__ */ new Map();
+  const manifest = files.map((f) => {
+    const ids = [];
+    for (let off = 0; off < f.data.length || off === 0 && f.data.length === 0; off += chunkSize) {
+      const piece = f.data.subarray(off, off + chunkSize);
+      const id = sha1(piece);
+      chunks.set(id, piece);
+      ids.push(id);
+      if (f.data.length === 0) break;
+    }
+    const entry = { name: f.name, kind: f.kind, sha1: sha1(f.data), size: f.data.length, chunks: ids };
+    if (f.debugId) entry.debugId = f.debugId;
+    if (f.sourcemap) entry.sourcemap = f.sourcemap;
+    return entry;
+  });
+  return { manifest, chunks };
+}
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+var UPLOAD_TIMEOUT_MS = 12e4;
+async function uploadArtifacts(ctx, files, opts) {
+  const { org, project: project2 } = await ctx.project();
+  const api2 = ctx.api;
+  const options = await api2.get(`organizations/${seg(org)}/chunks`);
+  const chunkSize = options.chunkSize ?? 8 * 1024 * 1024;
+  const perRequest = options.maxChunksPerRequest ?? 1;
+  const maxRequest = options.maxRequestSize ?? chunkSize;
+  const { manifest, chunks } = manifestFor(files, chunkSize);
+  const all = [...chunks.keys()];
+  const missing = /* @__PURE__ */ new Set();
+  for (let i = 0; i < all.length; i += 1e3) {
+    const res2 = await api2.send("POST", `organizations/${seg(org)}/chunks/missing`, { checksums: all.slice(i, i + 1e3) }, { retry: true });
+    for (const id of res2.missing ?? []) missing.add(id);
+  }
+  let uploadedBytes = 0;
+  const send = async (ids) => {
+    let batch = [];
+    let size = 0;
+    const flush = async () => {
+      if (!batch.length) return;
+      const form = new FormData();
+      for (const id of batch) form.append("chunk", new Blob([new Uint8Array(chunks.get(id))]), id);
+      await api2.request("POST", `organizations/${seg(org)}/chunks`, { form, retry: true, timeoutMs: Math.max(UPLOAD_TIMEOUT_MS, ctx.config.timeoutMs) });
+      uploadedBytes += size;
+      ctx.log(`uploaded ${batch.length} chunk(s), ${(size / 1024).toFixed(0)} KiB`);
+      batch = [];
+      size = 0;
+    };
+    for (const id of ids) {
+      const len = chunks.get(id).length;
+      if (batch.length && (batch.length >= perRequest || size + len > maxRequest)) await flush();
+      batch.push(id);
+      size += len;
+    }
+    await flush();
+  };
+  await send([...missing]);
+  const path = `projects/${seg(org)}/${seg(project2)}/artifacts`;
+  const body = { release: opts.release ?? null, dist: opts.dist ?? null, files: manifest };
+  const slow = { retry: true, timeoutMs: Math.max(UPLOAD_TIMEOUT_MS, ctx.config.timeoutMs) };
+  let res = await api2.send("POST", path, body, slow);
+  if (res?.state === "missing_chunks") {
+    const again = (res.missingChunks ?? []).filter((id) => chunks.has(id));
+    for (const id of again) missing.add(id);
+    await send(again);
+    res = await api2.send("POST", path, body, slow);
+  }
+  const deadline = Date.now() + opts.waitSeconds * 1e3;
+  let delay = 1e3;
+  while (res?.state === "pending" && res.id && Date.now() < deadline) {
+    await sleep3(delay);
+    delay = Math.min(delay * 2, 5e3);
+    res = await api2.get(`${path}/assemblies/${seg(res.id)}`);
+  }
+  const total = [...chunks.values()].reduce((n, b) => n + b.length, 0);
+  const result = {
+    id: res?.id,
+    state: res?.state ?? "unknown",
+    release: opts.release ?? null,
+    files: res?.files ?? manifest.map((m) => ({ name: m.name, kind: m.kind })),
+    chunks: { total: all.length, uploaded: missing.size, alreadyOnServer: all.length - missing.size },
+    bytes: { total, uploaded: uploadedBytes }
+  };
+  if (result.state === "error" || result.state === "missing_chunks") {
+    const failed = result.files.filter((f) => f?.state === "error");
+    const what = failed.length ? `${failed.length} of ${result.files.length} file(s) were refused: ${failed.slice(0, 5).map((f) => `${f.name} (${f.detail ?? "error"})`).join("; ")}${failed.length > 5 ? "; ..." : ""}` : `Assembly ended in state ${result.state}.`;
+    throw new CliError("upload.failed", what, {
+      exit: EXIT.invalid,
+      hint: "The files marked ok were stored; fix the refused ones and re-run (only what changed is sent again).",
+      details: result
+    });
+  }
+  if (result.state === "pending") {
+    throw new CliError("upload.pending", "The server is still assembling the upload.", {
+      exit: EXIT.checkFailed,
+      hint: "Raise --wait, or check later with `tracksiy artifacts list`.",
+      details: result
+    });
+  }
+  return result;
+}
+var DNS_NAMESPACE = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
+function uuid5(namespace, name) {
+  const ns = Buffer.from(namespace.replace(/-/g, ""), "hex");
+  const h = createHash2("sha1").update(ns).update(name).digest();
+  h[6] = h[6] & 15 | 80;
+  h[8] = h[8] & 63 | 128;
+  const hex = h.subarray(0, 16).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function proguardUuid(mapping) {
+  return uuid5(uuid5(DNS_NAMESPACE, "guardsquare.com"), mapping);
+}
+
+// src/commands/artifacts.ts
+async function scan(paths) {
+  try {
+    return await findPairs(paths);
+  } catch (err) {
+    throw usageError("bad_path", err.message);
+  }
+}
+async function inject(pairs, dryRun) {
+  const out = [];
+  for (const pair of pairs) {
+    if (!pair.map) {
+      out.push({ file: pair.js, map: null, debugId: "", action: "skipped-no-map" });
+      continue;
+    }
+    const code = await readFile2(pair.js, "utf8");
+    const mapText = await readFile2(pair.map, "utf8");
+    const existing = debugIdInCode(code);
+    const id = existing ?? debugIdFor(code);
+    let action = existing ? "already-injected" : "injected";
+    if (!existing && !dryRun) await writeFile2(pair.js, injectCode(code, id));
+    if (debugIdInMap(mapText) !== id) {
+      if (!dryRun) await writeFile2(pair.map, injectMap(mapText, id));
+      if (existing) action = "map-updated";
+    }
+    out.push({ file: pair.js, map: pair.map, debugId: id, action });
+  }
+  return out;
+}
+var injectFlags = {
+  "dry-run": { type: "boolean", description: "Report what would change; write nothing." }
+};
+var sourcemapsInject = {
+  path: ["sourcemaps", "inject"],
+  summary: "Stamp built JavaScript and its source maps with a debug ID, so errors map to the exact build. Run after the build, before deploying.",
+  description: "Adds one line (a tiny registration snippet and a //# debugId= comment) to the end of each minified file that has a source map, and the same ID to the map. Deterministic and idempotent: re-running changes nothing. Line/column mappings are untouched.",
+  context: "none",
+  auth: false,
+  effect: "write",
+  idempotent: true,
+  args: [{ name: "paths", required: true, variadic: true, description: "Build output directories or files, e.g. dist public/build." }],
+  flags: injectFlags,
+  examples: [{ command: "tracksiy sourcemaps inject dist", description: "Stamp everything under dist/." }],
+  output: "{files:[{file, map, debugId, action}], injected, alreadyInjected, withoutMap}",
+  text: (d) => `${table(d.files, [["action", (r) => r.action], ["debug id", (r) => r.debugId || "-"], "file"])}
+
+${d.injected} injected, ${d.alreadyInjected} already, ${d.withoutMap} without a source map`,
+  async run(ctx) {
+    const files = await inject(await scan(ctx.input.paths), Boolean(ctx.input.dryRun));
+    return {
+      dryRun: Boolean(ctx.input.dryRun),
+      files,
+      injected: files.filter((f) => f.action === "injected").length,
+      alreadyInjected: files.filter((f) => f.action !== "injected" && f.action !== "skipped-no-map").length,
+      withoutMap: files.filter((f) => f.action === "skipped-no-map").length
+    };
+  }
+};
+var sourcemapsUpload = {
+  path: ["sourcemaps", "upload"],
+  summary: "Upload built JavaScript and source maps so stack traces show original files and lines. Only missing bytes are sent.",
+  description: "Files are matched to events by debug ID (run `sourcemaps inject` first, or pass --inject) or, without debug IDs, by --release plus the file's URL. --url-prefix must match how the browser loads the files (~/ matches any host).",
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/artifacts" },
+  scopes: ["project:releases", "project:write", "project:admin"],
+  args: [{ name: "paths", required: true, variadic: true, description: "Build output directories or files." }],
+  flags: {
+    release: { type: "string", value: "<version>", description: "Tie the files to this release (required when files have no debug ID)." },
+    dist: { type: "string", value: "<name>", description: "Distribution within the release, e.g. a build number." },
+    "url-prefix": { type: "string", value: "<prefix>", default: "~/", description: "Prefix of the URL the files are served from, e.g. ~/assets/ or ~/static/js/." },
+    inject: { type: "boolean", description: "Inject debug IDs first (same as running `sourcemaps inject`)." },
+    wait: { type: "integer", value: "<seconds>", default: 120, description: "How long to wait for the server to finish assembling." },
+    "dry-run": { type: "boolean", description: "Show what would be uploaded; send nothing." }
+  },
+  examples: [
+    { command: "tracksiy sourcemaps upload dist --inject", description: "Inject and upload a Vite build." },
+    { command: "tracksiy sourcemaps upload public/build --release shop@$(git rev-parse --short HEAD) --url-prefix ~/build/", description: "Release-based, for apps that set a release in the SDK." }
+  ],
+  output: "{id, state, release, files[{name, kind, state, detail}], chunks{total, uploaded, alreadyOnServer}, bytes{total, uploaded}, skipped[] (minified files without a map)}",
+  text: (d) => d.dryRun ? table(d.files, ["kind", ["debug id", (r) => r.debugId ?? "-"], "name", "size"]) : `${d.state}: ${d.files.length} file(s), ${d.chunks.uploaded}/${d.chunks.total} chunks sent (${d.chunks.alreadyOnServer} already on the server)
+${table(d.files, ["kind", "state", "name", "detail"])}${d.skipped?.length ? `
+
+skipped, no source map: ${d.skipped.join(", ")}` : ""}`,
+  async run(ctx) {
+    const i = ctx.input;
+    const pairs = await scan(i.paths);
+    if (!pairs.length) throw usageError("nothing_to_upload", "No JavaScript files found.", "Point at the build output directory (dist, build, public/build).");
+    if (i.inject && !i.dryRun) await inject(pairs, false);
+    const skipped = pairs.filter((p) => !p.map).map((p) => artifactName(p.js, p.root, i.urlPrefix));
+    const withMaps = pairs.filter((p) => p.map);
+    if (!withMaps.length) {
+      throw usageError("nothing_to_upload", `None of the ${pairs.length} JavaScript file(s) has a source map.`, "Build with source maps on (e.g. Vite build.sourcemap: true, webpack devtool: 'source-map').");
+    }
+    const files = [];
+    let withoutId = 0;
+    for (const pair of withMaps) {
+      const code = await readFile2(pair.js);
+      const mapBuf = pair.map ? await readFile2(pair.map) : void 0;
+      const id = debugIdInCode(code.toString("utf8")) ?? (mapBuf ? debugIdInMap(mapBuf.toString("utf8")) : void 0);
+      if (!id) withoutId++;
+      const name = artifactName(pair.js, pair.root, i.urlPrefix);
+      const mapName = pair.map ? artifactName(pair.map, pair.root, i.urlPrefix) : void 0;
+      files.push(compact({ name, kind: "source", data: code, debugId: id, sourcemap: mapName }));
+      if (pair.map && mapBuf) files.push(compact({ name: mapName, kind: "sourcemap", data: mapBuf, debugId: id }));
+    }
+    if (withoutId && !i.release) {
+      throw usageError(
+        "no_match_key",
+        `${withoutId} file(s) have no debug ID and no --release was given, so nothing could ever match them to an event.`,
+        "Add --inject (recommended), or pass --release with the same value the SDK reports."
+      );
+    }
+    if (i.dryRun) {
+      return { dryRun: true, release: i.release ?? null, files: files.map(({ data, ...rest }) => ({ ...rest, size: data.length })), skipped };
+    }
+    const result = await uploadArtifacts(ctx, files, { release: i.release, dist: i.dist, waitSeconds: i.wait });
+    return { ...result, skipped };
+  }
+};
+function uuidFromDebugMeta(path) {
+  if (!existsSync3(path)) throw usageError("bad_path", `No such file: ${path}`);
+  const m = /ProguardUuids\s*[=:]\s*([0-9a-fA-F-]{36})/.exec(readFileSync3(path, "utf8"));
+  if (!m) throw usageError("bad_value", `No ProguardUuids entry in ${path}`);
+  return m[1].toLowerCase();
+}
+var proguardUpload = {
+  path: ["proguard", "upload"],
+  aliases: [["r8", "upload"]],
+  summary: "Upload an Android ProGuard/R8 mapping so obfuscated stack traces are readable.",
+  description: "The UUID must be the one the app reports for this build. Pass --uuid, or --debug-meta pointing at the properties file your build generates; without either, the UUID is derived from the mapping's content.",
+  context: "project",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "POST", path: "/api/agent/v1/projects/{org}/{project}/artifacts" },
+  scopes: ["project:releases", "project:write", "project:admin"],
+  args: [{ name: "mapping", required: true, description: "Path to mapping.txt (e.g. app/build/outputs/mapping/release/mapping.txt)." }],
+  flags: {
+    uuid: { type: "string", value: "<uuid>", description: "The mapping UUID the app reports." },
+    "debug-meta": { type: "string", value: "<file>", description: "A .properties file with ProguardUuids=<uuid> (generated by the Android build)." },
+    release: { type: "string", value: "<version>", description: "Release to associate, e.g. com.example.app@2.1.0+80." },
+    wait: { type: "integer", value: "<seconds>", default: 120, description: "How long to wait for assembly." }
+  },
+  examples: [{ command: "tracksiy proguard upload app/build/outputs/mapping/release/mapping.txt --uuid $UUID", description: "Upload the release mapping." }],
+  output: "{id, state, files[{name, kind, state}], chunks{}, bytes{}, uuid}",
+  async run(ctx) {
+    const i = ctx.input;
+    if (!existsSync3(i.mapping)) throw usageError("bad_path", `No such file: ${i.mapping}`);
+    const data = await readFile2(i.mapping);
+    if (!data.length) throw usageError("bad_value", `${i.mapping} is empty.`);
+    const uuid = (i.uuid ?? (i.debugMeta ? uuidFromDebugMeta(i.debugMeta) : proguardUuid(data))).toLowerCase();
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(uuid)) throw usageError("bad_value", `--uuid is not a UUID: ${uuid}`);
+    const res = await uploadArtifacts(ctx, [{ name: `proguard/${uuid}.txt`, kind: "proguard", data, debugId: uuid }], { release: i.release, waitSeconds: i.wait });
+    return { ...res, uuid, uuidSource: i.uuid ? "--uuid" : i.debugMeta ? i.debugMeta : "derived from content" };
+  }
+};
+var artifactsList = {
+  path: ["artifacts", "list"],
+  aliases: [["artifacts"]],
+  summary: "What is actually stored for a project: source files, source maps and ProGuard mappings. Use it to prove an upload landed.",
+  context: "project",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/projects/{org}/{project}/artifacts" },
+  flags: {
+    release: { type: "string", value: "<version>", description: "Only this release." },
+    "debug-id": { type: "string", value: "<uuid>", description: "Only this debug ID." },
+    kind: { type: "string", enum: ["source", "sourcemap", "proguard"], description: "Only this kind." },
+    limit: { type: "integer", value: "<n>", description: "How many." }
+  },
+  output: "[{name, kind, debugId, release, size, sha1, created, lastUsed}]",
+  text: (d) => table(d, ["kind", "name", "release", ["debug id", (r) => r.debugId ?? "-"], "size", ["created", (r) => ago(r.created)]]),
+  async run(ctx) {
+    return ctx.api.get(await projectPath(ctx, "artifacts"), {
+      release: ctx.input.release,
+      debugId: ctx.input.debugId,
+      kind: ctx.input.kind,
+      limit: ctx.input.limit
+    });
+  }
+};
+var artifacts_default = [sourcemapsInject, sourcemapsUpload, proguardUpload, artifactsList];
+
+// src/commands/tokens.ts
+var SCOPE_HINT = "e.g. org:read,project:read,event:read,event:write,project:write,project:releases,project:admin";
+var list4 = {
+  path: ["tokens", "list"],
+  aliases: [["tokens"]],
+  summary: "Your tokens, newest first, without their values.",
+  context: "none",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/tokens" },
+  output: "[{id, label, scopes, projects, created, expires, lastUsed, isExpired, isCurrent}]",
+  text: (d) => table(d, [
+    "id",
+    ["", (r) => r.isCurrent ? "*" : ""],
+    "label",
+    "scopes",
+    ["projects", (r) => r.projects?.length ? r.projects.join(",") : "all"],
+    ["last used", (r) => ago(r.lastUsed)],
+    ["expires", (r) => r.isExpired ? "EXPIRED" : r.expires ? ago(r.expires) : "never"]
+  ]),
+  async run(ctx) {
+    return ctx.api.get("tokens");
+  }
+};
+var create2 = {
+  path: ["tokens", "create"],
+  summary: "Mint a token for the same user, never broader than the one making the call.",
+  description: "The value is returned once. Restrict it to projects and the narrowest scopes the consumer needs.",
+  context: "none",
+  effect: "write",
+  endpoint: { method: "POST", path: "/api/agent/v1/tokens" },
+  flags: {
+    label: { type: "string", required: true, value: "<text>", description: "What it is for, e.g. 'ci source maps for shop'." },
+    scopes: { type: "list", required: true, value: "<scope,...>", description: `Scopes, ${SCOPE_HINT}.` },
+    projects: { type: "list", value: "<slug,...>", description: "Only these projects (default: all the caller can reach)." },
+    "expires-in-days": { type: "integer", value: "<n>", description: "Lifetime in days (server default 365)." }
+  },
+  examples: [
+    { command: "tracksiy tokens create --label 'ci sourcemaps' --scopes project:releases --projects shop --expires-in-days 90", description: "A CI token that can only upload artifacts for one project." }
+  ],
+  output: "{id, label, scopes, projects, expires, token} -- `token` is shown only here.",
+  async run(ctx) {
+    return ctx.api.send("POST", "tokens", compact({ label: ctx.input.label, scopes: ctx.input.scopes, projects: ctx.input.projects, expiresInDays: ctx.input.expiresInDays }));
+  }
+};
+var update = {
+  path: ["tokens", "update"],
+  summary: "Change a token's label, scopes, projects or lifetime (never broader than the caller).",
+  context: "none",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "PATCH", path: "/api/agent/v1/tokens/{token_id}" },
+  args: [{ name: "id", required: true, description: "Token id from `tokens list`." }],
+  flags: {
+    label: { type: "string", value: "<text>", description: "New label." },
+    scopes: { type: "list", value: "<scope,...>", description: `Replace the scopes, ${SCOPE_HINT}.` },
+    projects: { type: "list", value: "<slug,...>", description: "Replace the project list (empty string = all)." },
+    "expires-in-days": { type: "integer", value: "<n>", description: "New lifetime from now." }
+  },
+  async run(ctx) {
+    const body = compact({ label: ctx.input.label, scopes: ctx.input.scopes, projects: ctx.input.projects, expiresInDays: ctx.input.expiresInDays });
+    if (!Object.keys(body).length) throw usageError("missing_flag", "Nothing to change.", "Pass --label, --scopes, --projects or --expires-in-days.");
+    return ctx.api.send("PATCH", `tokens/${encodeURIComponent(ctx.input.id)}`, body);
+  }
+};
+var remove = {
+  path: ["tokens", "delete"],
+  aliases: [["tokens", "revoke"]],
+  summary: "Revoke a token immediately.",
+  context: "none",
+  effect: "destructive",
+  idempotent: true,
+  endpoint: { method: "DELETE", path: "/api/agent/v1/tokens/{token_id}" },
+  args: [{ name: "id", required: true, description: "Token id from `tokens list`." }],
+  flags: YES,
+  async run(ctx) {
+    requireYes(ctx, `Token ${ctx.input.id} stops working at once, for everything that uses it.`);
+    await ctx.api.send("DELETE", `tokens/${encodeURIComponent(ctx.input.id)}`);
+    return { deleted: Number(ctx.input.id) };
+  }
+};
+var rotate2 = {
+  path: ["tokens", "rotate"],
+  summary: "Replace the token making this call; the old one keeps working for a grace period.",
+  description: "If the token came from `tracksiy auth login`, the saved login is updated to the new value.",
+  context: "none",
+  effect: "destructive",
+  endpoint: { method: "POST", path: "/api/agent/v1/tokens/self/rotate" },
+  flags: {
+    "grace-minutes": { type: "integer", value: "<n>", description: "How long the old token keeps working (server default 60)." },
+    ...YES
+  },
+  output: "{token, id, expires, previous{id, expiresAt}, savedTo?}",
+  async run(ctx) {
+    requireYes(ctx, "The current token will stop working after the grace period, everywhere it is used.");
+    const data = await ctx.api.send("POST", "tokens/self/rotate", compact({ graceMinutes: ctx.input.graceMinutes }));
+    if (ctx.config.tokenSource === ctx.config.configPath && data?.token) {
+      const cfg = readUserConfig(ctx.config.configPath);
+      cfg.hosts[ctx.config.url] = { ...cfg.hosts[ctx.config.url], token: data.token, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      await writeUserConfig(ctx.config.configPath, cfg);
+      return { ...data, savedTo: ctx.config.configPath };
+    }
+    return data;
+  }
+};
+var self = {
+  path: ["tokens", "self"],
+  summary: "Describe the token making this call: scopes, projects, expiry.",
+  context: "none",
+  effect: "read",
+  endpoint: { method: "GET", path: "/api/agent/v1/tokens/self" },
+  text: (d) => kv(d),
+  async run(ctx) {
+    return ctx.api.get("tokens/self");
+  }
+};
+var tokens_default = [list4, self, create2, update, remove, rotate2];
+
+// src/commands/support.ts
+var SUPPORT = {
+  via: "peerpacket",
+  channel: "tracksiy-support",
+  handle: "tracksiy-agent",
+  install: "npm install -g peerpacket",
+  join: "pp join tracksiy-support",
+  open: 'pp ticket new tracksiy-support "<one-line problem>" --to tracksiy-agent --label bug -f report.md',
+  follow: "pp tickets tracksiy-support"
+};
+var SUPPORT_HINT = `tell the Tracksiy team on PeerPacket: ${SUPPORT.open} (see \`tracksiy support\`)`;
+var support = {
+  path: ["support"],
+  aliases: [["feedback"], ["contact"]],
+  summary: "How to tell the Tracksiy team what got in your way: a bug, a missing capability, an error you cannot interpret, or a blocker.",
+  description: "Tickets go through PeerPacket (the pp CLI): open one in the tracksiy-support channel for tracksiy-agent, who answers on the ticket and closes it with what was done. Labels: bug, feature, question, blocker. Say what you ran, what came back (error code, request id) and what you expected; include your CLI version. Never paste tokens; use `pp secret send`. Needs no token and makes no request.",
+  context: "none",
+  auth: false,
+  effect: "read",
+  idempotent: true,
+  examples: [{ command: "tracksiy support", description: "Print the channel, handle and the exact commands." }],
+  output: "{via, channel, handle, install, join, open, follow, labels[], include[], cliVersion}",
+  text: (d) => kv({ via: d.via, channel: d.channel, "ticket for": d.handle, install: d.install, join: d.join, open: d.open, follow: d.follow, labels: d.labels.join(", ") }),
+  async run() {
+    return {
+      ...SUPPORT,
+      labels: ["bug", "feature", "question", "blocker"],
+      include: ["what you ran", "what came back: error code, message, request id", "what you expected", `tracksiy --version (${VERSION})`],
+      cliVersion: VERSION
+    };
+  }
+};
+var support_default = [support];
+
+// src/commands/init.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
+import { appendFile, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join4, resolve as resolve4 } from "node:path";
+
+// src/lib/detect.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync } from "node:fs";
+import { basename, join as join3 } from "node:path";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function has(dir, ...names) {
+  return names.find((n) => existsSync4(join3(dir, n)));
+}
+function slugify(s) {
+  return s.toLowerCase().replace(/^@[^/]+\//, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 50);
+}
+function detect(dir, guideBase) {
+  const evidence = [];
+  const composer = readJson(join3(dir, "composer.json"));
+  const pkg = readJson(join3(dir, "package.json"));
+  const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
+  const hasDep = (d) => d in deps;
+  const name = slugify(pkg?.name ?? composer?.name?.split("/").pop() ?? basename(dir)) || "app";
+  const guide = (slug) => `${guideBase}/${slug}.md`;
+  if (composer?.require?.["laravel/framework"]) {
+    evidence.push("composer.json requires laravel/framework");
+    const web = hasDep("react") || hasDep("vue") || hasDep("svelte") || hasDep("@inertiajs/react") || hasDep("@inertiajs/vue3");
+    if (web) evidence.push("package.json has a browser framework");
+    return {
+      platform: "php-laravel",
+      framework: "laravel",
+      surfaces: web ? ["backend", "web"] : ["backend"],
+      env: web ? { backend: "SENTRY_LARAVEL_DSN", web: "VITE_SENTRY_DSN" } : { backend: "SENTRY_LARAVEL_DSN" },
+      guide: guide("php-laravel"),
+      buildDir: web ? "public/build" : void 0,
+      name,
+      evidence
+    };
+  }
+  if (hasDep("react-native") || hasDep("expo")) {
+    evidence.push(`package.json depends on ${hasDep("expo") ? "expo" : "react-native"}`);
+    return { platform: "react-native", framework: hasDep("expo") ? "expo" : "react-native", surfaces: ["mobile"], env: {}, guide: guide("mobile"), name, evidence };
+  }
+  if (hasDep("next")) {
+    evidence.push("package.json depends on next");
+    return {
+      platform: "javascript-nextjs",
+      framework: "nextjs",
+      surfaces: ["backend", "web"],
+      env: { backend: "SENTRY_DSN", web: "NEXT_PUBLIC_SENTRY_DSN" },
+      guide: guide("javascript"),
+      buildDir: ".next/static",
+      name,
+      evidence
+    };
+  }
+  const browser = ["react", "vue", "svelte", "@angular/core", "solid-js", "preact"].find(hasDep);
+  if (browser) {
+    evidence.push(`package.json depends on ${browser}`);
+    const vite = hasDep("vite");
+    return {
+      platform: browser === "react" ? "javascript-react" : browser === "vue" ? "javascript-vue" : browser === "@angular/core" ? "javascript-angular" : "javascript",
+      framework: browser.replace("@angular/core", "angular"),
+      surfaces: ["web"],
+      env: { web: vite ? "VITE_SENTRY_DSN" : "SENTRY_DSN" },
+      guide: guide("javascript"),
+      buildDir: vite ? "dist" : "build",
+      name,
+      evidence
+    };
+  }
+  if (pkg) {
+    evidence.push("package.json without a browser framework");
+    return { platform: "node", framework: ["express", "fastify", "@nestjs/core", "hono", "koa"].find(hasDep) ?? "node", surfaces: ["backend"], env: { backend: "SENTRY_DSN" }, guide: guide("node"), name, evidence };
+  }
+  const py = has(dir, "pyproject.toml", "requirements.txt", "Pipfile", "manage.py");
+  if (py) {
+    const text = ["pyproject.toml", "requirements.txt", "Pipfile"].map((f) => existsSync4(join3(dir, f)) ? readFileSync4(join3(dir, f), "utf8") : "").join("\n").toLowerCase();
+    const fw = existsSync4(join3(dir, "manage.py")) || text.includes("django") ? "django" : text.includes("fastapi") ? "fastapi" : text.includes("flask") ? "flask" : "python";
+    evidence.push(`${py} (${fw})`);
+    return { platform: fw === "python" ? "python" : `python-${fw}`, framework: fw, surfaces: ["backend"], env: { backend: "SENTRY_DSN" }, guide: guide("python-sentry-sdk"), name, evidence };
+  }
+  const gradle = has(dir, "build.gradle.kts", "build.gradle", "app/build.gradle.kts", "app/build.gradle");
+  if (gradle) {
+    evidence.push(gradle);
+    return { platform: "android", framework: "android", surfaces: ["mobile"], env: {}, guide: guide("mobile"), name, evidence };
+  }
+  const apple = has(dir, "Podfile", "Package.swift") ?? readdirSync(dir).find((f) => f.endsWith(".xcodeproj"));
+  if (apple) {
+    evidence.push(apple);
+    return { platform: "apple-ios", framework: "ios", surfaces: ["mobile"], env: {}, guide: guide("mobile"), name, evidence };
+  }
+  if (has(dir, "pubspec.yaml")) {
+    evidence.push("pubspec.yaml");
+    return { platform: "flutter", framework: "flutter", surfaces: ["mobile"], env: {}, guide: guide("mobile"), name, evidence };
+  }
+  return { platform: "other", framework: "unknown", surfaces: ["backend"], env: { backend: "SENTRY_DSN" }, guide: guide("other-stacks"), name, evidence: ["nothing recognised"] };
+}
+
+// src/commands/init.ts
+var init = {
+  path: ["init"],
+  summary: "Integrate the app in this directory, without a browser: detect the stack, create the project and its keys, write .tracksiy.json, and print the exact next steps.",
+  description: "Idempotent: re-running on an integrated app returns the same project. It never edits source code; it writes .tracksiy.json (no secrets) and, only with --write-env, appends missing ingest-key variables to an existing .env. Finish with `tracksiy projects verify --wait 120` after the first deploy.",
+  context: "org",
+  effect: "write",
+  idempotent: true,
+  endpoint: { method: "POST", path: "/api/agent/v1/organizations/{org}/projects" },
+  scopes: ["project:admin"],
+  flags: {
+    dir: { type: "string", value: "<path>", default: ".", description: "The app's root directory." },
+    name: { type: "string", value: "<project>", description: "Project name (default: package/composer name or directory name)." },
+    platform: { type: "string", value: "<platform>", description: "Override the detected platform." },
+    surfaces: { type: "list", value: "<name,...>", description: "Override the detected surfaces (backend, web, mobile, ...)." },
+    "same-host": { type: "boolean", description: "The app runs on the Tracksiy host itself (loopback ingest)." },
+    "write-env": { type: "boolean", description: "Append missing ingest-key variables to the existing .env (never overwrites a value)." },
+    "dry-run": { type: "boolean", description: "Only detect and show the plan; create nothing." }
+  },
+  examples: [
+    { command: "tracksiy init --dry-run", description: "What would be created for this directory." },
+    { command: "tracksiy init --write-env && tracksiy projects verify --wait 120", description: "Integrate, deploy, and prove the first event arrived." }
+  ],
+  output: "{detected{platform, framework, surfaces, evidence}, project{organization, slug}, created, keys[{surface, env, dsn}], projectFile, env{file, added[], kept[]}, uploadToken, guide, steps[{id, run?, detail}]}",
+  text: (d) => [
+    kv({ platform: d.detected.platform, evidence: d.detected.evidence.join("; "), project: d.project ? `${d.project.organization}/${d.project.slug} (${d.created ? "created" : "existing"})` : "(dry run)", "project file": d.projectFile ?? "-", guide: d.guide }),
+    d.keys?.length ? `
+ingest keys:
+${table(d.keys, ["surface", "env", "dsn"])}` : "",
+    d.env ? `
+.env: added ${d.env.added.join(", ") || "nothing"}${d.env.kept.length ? `; kept existing ${d.env.kept.join(", ")}` : ""}` : "",
+    `
+next:
+${d.steps.map((s, i) => `${i + 1}. ${s.detail}${s.run ? `
+   $ ${s.run}` : ""}`).join("\n")}`
+  ].join("\n"),
+  async run(ctx) {
+    const i = ctx.input;
+    const dir = resolve4(i.dir);
+    if (!existsSync5(dir)) throw usageError("bad_path", `No such directory: ${i.dir}`);
+    const found = detect(dir, ctx.config.url);
+    const platform = i.platform ?? found.platform;
+    const surfaces = i.surfaces ?? found.surfaces;
+    const name = i.name ?? found.name;
+    const detected = { platform, framework: found.framework, surfaces, evidence: found.evidence, name };
+    const steps = [];
+    const upload = found.buildDir ? `tracksiy sourcemaps upload ${found.buildDir} --inject` : void 0;
+    if (i.dryRun) {
+      steps.push({ id: "create", run: `tracksiy init${i.writeEnv ? " --write-env" : ""}`, detail: "Create the project and keys." });
+      return { dryRun: true, detected, guide: found.guide, steps };
+    }
+    const org = await ctx.org();
+    const prov = await ctx.api.send(
+      "POST",
+      `organizations/${seg(org)}/projects`,
+      compact({ name, platform, surfaces, sameHost: i.sameHost })
+    );
+    const project2 = prov.project;
+    const pfPath = join4(dir, PROJECT_FILE);
+    const pf = { org: project2.organization, project: project2.slug };
+    if (ctx.config.url !== DEFAULT_URL) pf.url = ctx.config.url;
+    await writeFile3(pfPath, JSON.stringify(pf, null, 2) + "\n");
+    const keys = (prov.dsns ?? []).map((k) => ({
+      surface: k.surface,
+      env: found.env[k.surface] ?? null,
+      dsn: k.dsn,
+      shipsInPublicArtifact: k.shipsInPublicArtifact
+    }));
+    let env;
+    if (i.writeEnv) {
+      const envPath = join4(dir, ".env");
+      if (!existsSync5(envPath)) {
+        throw usageError("no_env_file", `${envPath} does not exist; nothing was written to it.`, "Create it (and make sure it is gitignored), or set the variables yourself from `keys` in the output.");
+      }
+      const current = readFileSync5(envPath, "utf8");
+      const added = [];
+      const kept = [];
+      let block = "";
+      for (const k of keys) {
+        if (!k.env) continue;
+        if (new RegExp(`^\\s*${k.env}\\s*=`, "m").test(current)) kept.push(k.env);
+        else {
+          block += `${k.env}=${k.dsn}
+`;
+          added.push(k.env);
+        }
+      }
+      if (block) await appendFile(envPath, `${current.endsWith("\n") || !current ? "" : "\n"}
+# Tracksiy (tracksiy init)
+${block}`);
+      env = { file: envPath, added, kept };
+    }
+    steps.push({ id: "sdk", detail: `Install and configure the SDK for ${found.framework} as the guide says (it is plain Markdown).`, run: `curl -s ${found.guide}` });
+    if (!i.writeEnv && keys.some((k) => k.env)) {
+      steps.push({ id: "env", detail: `Set ${keys.filter((k) => k.env).map((k) => k.env).join(", ")} from \`keys\` (or re-run with --write-env).` });
+    }
+    if (upload) steps.push({ id: "sourcemaps", detail: "After each production build, upload source maps (uses project:releases).", run: upload });
+    steps.push({ id: "alerts", detail: "Decide who is told. A project without a recipient notifies nobody.", run: "tracksiy alerts set --recipient email && tracksiy alerts test" });
+    steps.push({ id: "verify", detail: "Deploy, trigger one error, then prove it arrived.", run: "tracksiy projects verify --wait 120" });
+    return {
+      detected,
+      project: project2,
+      created: prov.created,
+      keys,
+      projectFile: pfPath,
+      env: env ?? null,
+      uploadToken: prov.sourcemapToken ?? null,
+      uploadTokenScopes: prov.sourcemapTokenScopes ?? [],
+      guide: found.guide,
+      mustRead: prov.mustRead ?? [],
+      serverNextSteps: prov.nextSteps ?? [],
+      steps
+    };
+  }
+};
+var init_default = [init];
+
+// src/core/spec.ts
+function commandName(spec) {
+  return spec.path.join(" ");
+}
+function toolName(spec) {
+  return spec.path.join("_").replace(/-/g, "_");
+}
+function camel(name) {
+  return name.replace(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+
+// src/core/args.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+var GLOBAL_FLAGS = {
+  org: { type: "string", value: "<slug>", description: "Organization slug. Env: TRACKSIY_ORG. Default: .tracksiy.json, saved login, or your only organization." },
+  project: { type: "string", value: "<slug>", description: "Project slug, or org/project. Env: TRACKSIY_PROJECT. Default: .tracksiy.json." },
+  url: { type: "string", value: "<url>", description: "Server root. Env: TRACKSIY_URL. Default: https://tracksiy.com." },
+  token: { type: "string", value: "<token>", description: "API token. Env: TRACKSIY_TOKEN (preferred: flags show up in process lists)." },
+  json: { type: "boolean", description: "Print JSON. This is the default whenever stdout is not a terminal." },
+  format: { type: "string", enum: ["json", "text"], description: "Output format. Env: TRACKSIY_FORMAT." },
+  select: { type: "list", value: "<fields>", description: "Keep only these fields of `data`, comma-separated; dot paths reach into objects and lists (e.g. issues.id,issues.title)." },
+  timeout: { type: "integer", value: "<seconds>", description: "Seconds to wait per request. Default 30." },
+  verbose: { type: "boolean", description: "Log each HTTP request and its status to stderr (never the token)." },
+  quiet: { type: "boolean", description: "No progress messages on stderr." },
+  help: { type: "boolean", short: "h", description: "Show help for the command." }
+};
+var stdinCache;
+function readStdin() {
+  stdinCache ??= readFileSync6(0, "utf8");
+  return stdinCache;
+}
+function parseJsonValue(name, raw) {
+  let text = raw;
+  if (raw === "-") text = readStdin();
+  else if (raw.startsWith("@")) {
+    try {
+      text = readFileSync6(raw.slice(1), "utf8");
+    } catch (err) {
+      throw usageError("bad_value", `--${name}: cannot read ${raw.slice(1)}: ${err.message}`);
+    }
+  }
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw usageError("bad_json", `--${name} is not valid JSON: ${err.message}`, `Pass inline JSON, @file.json, or - for stdin.`);
+  }
+}
+function coerce(name, spec, value, previous) {
+  const fail = (why) => usageError("bad_value", `--${name} ${why}`);
+  switch (spec.type) {
+    case "boolean": {
+      if (typeof value === "boolean") return value;
+      const v = String(value).toLowerCase();
+      if (["true", "1", "yes", "on"].includes(v)) return true;
+      if (["false", "0", "no", "off"].includes(v)) return false;
+      throw fail(`expects true or false, got ${JSON.stringify(value)}`);
+    }
+    case "integer":
+    case "number": {
+      const n = typeof value === "number" ? value : Number(value);
+      if (!Number.isFinite(n) || spec.type === "integer" && !Number.isInteger(n)) {
+        throw fail(`expects ${spec.type === "integer" ? "an integer" : "a number"}, got ${JSON.stringify(value)}`);
+      }
+      return n;
+    }
+    case "list": {
+      const items = Array.isArray(value) ? value.map(String) : String(value).split(",").map((s) => s.trim()).filter(Boolean);
+      if (spec.enum) for (const item of items) checkEnum(name, spec, item);
+      return [...previous ?? [], ...items];
+    }
+    case "json":
+      return typeof value === "string" ? parseJsonValue(name, value) : value;
+    default: {
+      const s = String(value);
+      checkEnum(name, spec, s);
+      return s;
+    }
+  }
+}
+function checkEnum(name, spec, value) {
+  if (spec.enum && !spec.enum.includes(value)) {
+    throw usageError("bad_value", `--${name} must be one of ${spec.enum.join(", ")}; got ${JSON.stringify(value)}`);
+  }
+}
+function suggest(word, candidates) {
+  let best;
+  let bestScore = Infinity;
+  for (const c of candidates) {
+    const d = c.startsWith(word) || word.startsWith(c) ? 1 : distance(word, c);
+    if (d < bestScore) [best, bestScore] = [c, d];
+  }
+  return bestScore <= Math.max(2, Math.floor(word.length / 3)) ? best : void 0;
+}
+function distance(a, b) {
+  const row = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    let prev = row[0];
+    row[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const tmp = row[j];
+      row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + (a[i - 1] === b[j - 1] ? 0 : 1));
+      prev = tmp;
+    }
+  }
+  return row[b.length];
+}
+function parseArgv(spec, tokens) {
+  const flags = spec?.flags ?? {};
+  const input = {};
+  const globals = {};
+  const positional = [];
+  const shorts = /* @__PURE__ */ new Map();
+  for (const [n, f] of Object.entries({ ...GLOBAL_FLAGS, ...flags })) if (f.short) shorts.set(f.short, n);
+  const lookup = (name) => {
+    if (flags[name]) return [flags[name], false];
+    if (GLOBAL_FLAGS[name]) return [GLOBAL_FLAGS[name], true];
+    return void 0;
+  };
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    if (tok === "--") {
+      positional.push(...tokens.slice(i + 1));
+      break;
+    }
+    let name;
+    let inline;
+    if (tok.startsWith("--") && tok.length > 2) {
+      const eq = tok.indexOf("=");
+      [name, inline] = eq === -1 ? [tok.slice(2), void 0] : [tok.slice(2, eq), tok.slice(eq + 1)];
+    } else if (/^-[a-zA-Z]$/.test(tok)) {
+      const long = shorts.get(tok.slice(1));
+      if (!long) throw usageError("unknown_flag", `Unknown flag ${tok}`, "Run with --help to list the flags.");
+      name = long;
+    } else {
+      positional.push(tok);
+      continue;
+    }
+    let found = lookup(name);
+    let negated = false;
+    if (!found && name.startsWith("no-")) {
+      const base = lookup(name.slice(3));
+      if (base && base[0].type === "boolean") [found, negated, name] = [base, true, name.slice(3)];
+    }
+    if (!found) {
+      const close = suggest(name, [...Object.keys(flags), ...Object.keys(GLOBAL_FLAGS)]);
+      throw usageError(
+        "unknown_flag",
+        `Unknown flag --${name}${spec ? ` for \`tracksiy ${spec.path.join(" ")}\`` : ""}`,
+        close ? `Did you mean --${close}?` : "Run with --help to list the flags."
+      );
+    }
+    const [fspec, isGlobal] = found;
+    let raw;
+    if (fspec.type === "boolean") raw = negated ? false : inline ?? true;
+    else if (inline !== void 0) raw = inline;
+    else {
+      const next = tokens[i + 1];
+      if (next === void 0 || next.startsWith("--") && next.length > 2) {
+        throw usageError("missing_value", `--${name} needs a value${fspec.value ? ` ${fspec.value}` : ""}`);
+      }
+      raw = next;
+      i++;
+    }
+    const target = isGlobal ? globals : input;
+    const key = camel(name);
+    target[key] = coerce(name, fspec, raw, target[key]);
+  }
+  assignPositional(spec, positional, input);
+  return { input, globals };
+}
+function assignPositional(spec, positional, input) {
+  const args = spec?.args ?? [];
+  let i = 0;
+  for (const arg of args) {
+    const key = camel(arg.name);
+    if (arg.variadic) {
+      if (i < positional.length) input[key] = positional.slice(i);
+      i = positional.length;
+    } else if (i < positional.length) {
+      input[key] = positional[i++];
+    }
+  }
+  if (i < positional.length) {
+    throw usageError(
+      "unexpected_argument",
+      `Unexpected argument ${JSON.stringify(positional[i])}${spec ? ` for \`tracksiy ${spec.path.join(" ")}\`` : ""}`,
+      "Run with --help to see the arguments this command takes."
+    );
+  }
+}
+function parseObject(spec, raw) {
+  const input = {};
+  const globals = {};
+  const known = /* @__PURE__ */ new Map();
+  for (const [n, f] of Object.entries(spec.flags ?? {})) known.set(camel(n), [n, f, "input"]);
+  for (const a of spec.args ?? []) {
+    known.set(camel(a.name), [a.name, { type: a.variadic ? "list" : "string", description: a.description }, "input"]);
+  }
+  if (spec.context === "org" || spec.context === "project") known.set("org", ["org", GLOBAL_FLAGS.org, "globals"]);
+  if (spec.context === "project") known.set("project", ["project", GLOBAL_FLAGS.project, "globals"]);
+  for (const [key, value] of Object.entries(raw ?? {})) {
+    if (value === void 0 || value === null) continue;
+    const entry = known.get(key);
+    if (!entry) {
+      const close = suggest(key, [...known.keys()]);
+      throw usageError("unknown_argument", `Unknown argument "${key}"`, close ? `Did you mean "${close}"?` : void 0);
+    }
+    const [name, fspec, where] = entry;
+    (where === "input" ? input : globals)[key] = coerce(name, fspec, value);
+  }
+  return { input, globals };
+}
+function finalizeInput(spec, input) {
+  for (const arg of spec.args ?? []) {
+    const key = camel(arg.name);
+    if (arg.required && (input[key] === void 0 || Array.isArray(input[key]) && !input[key].length)) {
+      throw usageError("missing_argument", `Missing <${arg.name}> for \`tracksiy ${spec.path.join(" ")}\`: ${arg.description}`);
+    }
+  }
+  for (const [name, f] of Object.entries(spec.flags ?? {})) {
+    const key = camel(name);
+    if (input[key] === void 0 && f.default !== void 0) input[key] = f.default;
+    if (f.required && input[key] === void 0) {
+      throw usageError("missing_flag", `Missing --${name} for \`tracksiy ${spec.path.join(" ")}\`: ${f.description}`);
+    }
+  }
+}
+
+// src/commands/meta.ts
+var api = {
+  path: ["api"],
+  summary: "Call any endpoint directly, for what no command covers yet. Paths are relative to /api/agent/v1/ unless they start with /.",
+  description: "The response body is returned as `data`. It can do anything the token allows, including deletions.",
+  context: "none",
+  effect: "write",
+  args: [
+    { name: "method", required: true, description: "GET, POST, PUT, PATCH or DELETE." },
+    { name: "path", required: true, description: "e.g. projects/acme/shop/issues, or /api/agent/v1/health." }
+  ],
+  flags: {
+    body: { type: "json", value: "<json|@file|->", description: "JSON request body." },
+    query: { type: "list", value: "<key=value,...>", description: "Query parameters." }
+  },
+  examples: [
+    { command: "tracksiy api GET organizations", description: "Raw organization list." },
+    { command: "tracksiy api PUT projects/acme/shop/alerts --body @alerts.json", description: "Send a prepared body." }
+  ],
+  async run(ctx) {
+    const method = String(ctx.input.method).toUpperCase();
+    if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(method)) throw usageError("bad_value", `Unsupported method ${ctx.input.method}`);
+    const query = {};
+    for (const pair of ctx.input.query ?? []) {
+      const eq = pair.indexOf("=");
+      if (eq < 1) throw usageError("bad_value", `--query expects key=value, got ${JSON.stringify(pair)}`);
+      query[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    const path = String(ctx.input.path).replace(/^\/api\/agent\/v1\//, "");
+    const res = await ctx.api.request(method, path, { query, body: ctx.input.body });
+    return res.data;
+  }
+};
+function flagSchema(name, f) {
+  const out = { name, input: camel(name), type: f.type, description: f.description };
+  if (f.required) out.required = true;
+  if (f.default !== void 0) out.default = f.default;
+  if (f.enum) out.enum = f.enum;
+  if (f.value) out.value = f.value;
+  return out;
+}
+function describeCommand(spec) {
+  return {
+    name: commandName(spec),
+    aliases: (spec.aliases ?? []).map((a) => a.join(" ")),
+    summary: spec.summary,
+    description: spec.description ?? null,
+    usage: `tracksiy ${commandName(spec)}${(spec.args ?? []).map((a) => a.required ? ` <${a.name}${a.variadic ? "..." : ""}>` : ` [${a.name}${a.variadic ? "..." : ""}]`).join("")}${spec.flags ? " [flags]" : ""}`,
+    args: (spec.args ?? []).map((a) => ({ name: a.name, input: camel(a.name), required: Boolean(a.required), variadic: Boolean(a.variadic), description: a.description })),
+    flags: Object.entries(spec.flags ?? {}).map(([n, f]) => flagSchema(n, f)),
+    context: spec.context ?? "none",
+    needsToken: spec.auth !== false,
+    effect: spec.effect,
+    idempotent: Boolean(spec.idempotent),
+    confirm: spec.flags?.yes ? "--yes" : null,
+    endpoint: spec.endpoint ?? null,
+    scopes: spec.scopes ?? null,
+    output: spec.output ?? null,
+    examples: spec.examples ?? [],
+    mcpTool: spec.mcp === false ? null : toolName(spec)
+  };
+}
+function contract() {
+  return {
+    output: {
+      json: 'One line on stdout. Success: {"ok":true,"data":<result>}. Failure: {"ok":false,"error":{"code","message","hint?","status?","details?"},"data?":<result of a check that did not pass>}.',
+      whenJson: "Whenever stdout is not a terminal, or with --json / TRACKSIY_FORMAT=json.",
+      text: "On a terminal: a readable view on stdout, errors on stderr.",
+      progress: "Progress messages go to stderr only; --quiet silences them.",
+      select: "--select a,b.c keeps only those fields of data; lists are mapped element-wise."
+    },
+    exitCodes: EXIT_MEANINGS,
+    errorCodes: {
+      "usage.*": "bad command line; nothing was sent",
+      "confirmation.required": "destructive command without --yes; nothing was changed",
+      "auth.missing_token": "no token configured",
+      "auth.unauthenticated": "token rejected (expired, revoked, other server)",
+      "auth.forbidden": "token lacks a scope or the project is outside its list",
+      not_found: "organization, project or object does not exist (or is hidden from this token)",
+      "request.invalid": "server rejected the body or parameters; see details",
+      "request.conflict": "conflicts with current state",
+      rate_limited: "slow down; details.retryAfterSeconds",
+      "network.timeout": "no answer in time",
+      "network.unreachable": "server not reachable",
+      "server.error": "5xx",
+      "server.unsupported": "the server is older than this CLI",
+      "check.failed": "the command's check did not pass; data holds the report",
+      "upload.failed": "artifact assembly failed",
+      "upload.pending": "assembly still running after --wait"
+    },
+    environment: {
+      TRACKSIY_TOKEN: "API token (preferred over --token)",
+      TRACKSIY_URL: `server root (default ${DEFAULT_URL})`,
+      TRACKSIY_ORG: "default organization slug",
+      TRACKSIY_PROJECT: "default project slug, or org/project",
+      TRACKSIY_FORMAT: "json or text",
+      TRACKSIY_TIMEOUT: "seconds per request (default 30)",
+      TRACKSIY_CONFIG: "path of the saved-login file"
+    },
+    precedence: `flag > environment > ${PROJECT_FILE} (searched upward from the working directory) > saved login > default. When org or project is still unknown and the token can see exactly one, that one is used.`,
+    projectFile: `${PROJECT_FILE}: {"org": "...", "project": "...", "url?": "..."}. Never holds a token. Written by \`tracksiy init\`.`,
+    writes: "Every write is a declaration: re-running it is safe and reports the stored state. Destructive commands require --yes. Bulk changes are dry runs unless --apply.",
+    mcp: "`tracksiy mcp` serves every command (except login/logout/mcp/describe) as an MCP tool over stdio. Tool names are the command path joined by underscores, e.g. issues_list."
+  };
+}
+var describe = {
+  path: ["describe"],
+  aliases: [["schema"]],
+  summary: "Machine-readable description of every command, flag, exit code and error code. Start here if you are an agent.",
+  context: "none",
+  auth: false,
+  effect: "read",
+  mcp: false,
+  args: [{ name: "command", variadic: true, description: "Describe only this command, e.g. `issues list`." }],
+  output: "{name, version, contract{output, exitCodes, errorCodes, environment, precedence, projectFile, writes, mcp}, globalFlags[], commands[]}",
+  text: (d) => JSON.stringify(d, null, 2),
+  async run(ctx) {
+    const words = ctx.input.command ?? [];
+    if (words.length) {
+      const key = words.join(" ");
+      const spec = COMMANDS.find((c) => commandName(c) === key || (c.aliases ?? []).some((a) => a.join(" ") === key));
+      if (!spec) throw usageError("unknown_command", `No command \`${key}\`.`, "Run `tracksiy describe` for the full list.");
+      return describeCommand(spec);
+    }
+    return {
+      name: "tracksiy",
+      version: VERSION,
+      summary: "Agent-first CLI and MCP server for Tracksiy: errors, uptime, alerts, releases and source maps from one token.",
+      docs: `${DEFAULT_URL}/cli.md`,
+      contract: contract(),
+      globalFlags: Object.entries(GLOBAL_FLAGS).map(([n, f]) => flagSchema(n, f)),
+      commands: COMMANDS.map(describeCommand)
+    };
+  }
+};
+var meta_default = [api, describe];
+
+// src/mcp.ts
+import { createInterface } from "node:readline";
+
+// src/core/run.ts
+function makeContext(spec, input, globals, surface, io) {
+  const config = resolveConfig(globals, io.env, io.cwd);
+  const quiet = config.quiet || surface === "mcp";
+  const log = (message) => {
+    if (!quiet || surface === "mcp" && config.verbose) io.stderr(`${message}
+`);
+  };
+  const api2 = new Api({ url: config.url, token: config.token, timeoutMs: config.timeoutMs, verbose: config.verbose, log, fetch: io.fetch });
+  let orgs2;
+  const visible = () => {
+    orgs2 ??= api2.get("organizations").catch((err) => {
+      if (err instanceof CliError && (err.code === "server.unsupported" || err.code === "auth.forbidden")) {
+        throw usageError(
+          "missing_org",
+          err.code === "auth.forbidden" ? "No organization given, and this token may not list them." : "No organization given and this server cannot list them.",
+          "Pass --org <slug> and --project <slug> (or --project org/slug), set TRACKSIY_ORG / TRACKSIY_PROJECT, or commit the .tracksiy.json that `tracksiy init` writes."
+        );
+      }
+      throw err;
+    });
+    return orgs2;
+  };
+  let orgPromise;
+  const org = () => {
+    orgPromise ??= (async () => {
+      if (config.org) return config.org;
+      const list5 = await visible();
+      if (list5.length === 1) {
+        log(`using organization ${list5[0].slug}`);
+        return list5[0].slug;
+      }
+      throw usageError(
+        "missing_org",
+        list5.length ? "Which organization? This token can see several." : "This token cannot see any organization.",
+        list5.length ? `Pass --org <slug>, set TRACKSIY_ORG, or add "org" to ${".tracksiy.json"}. Visible: ${list5.map((o) => o.slug).join(", ")}` : "Check the token with `tracksiy auth status`."
+      );
+    })();
+    return orgPromise;
+  };
+  let projectPromise;
+  const project2 = () => {
+    projectPromise ??= (async () => {
+      const o = await org();
+      if (config.project) return { org: o, project: config.project };
+      const list5 = await visible();
+      const projects2 = list5.find((x) => x.slug === o)?.projects ?? [];
+      if (projects2.length === 1) {
+        log(`using project ${o}/${projects2[0].slug}`);
+        return { org: o, project: projects2[0].slug };
+      }
+      throw usageError(
+        "missing_project",
+        "Which project?",
+        `Pass --project <slug>, set TRACKSIY_PROJECT, or run \`tracksiy init\` here to write .tracksiy.json.${projects2.length ? ` Projects in ${o}: ${projects2.slice(0, 30).map((p) => p.slug).join(", ")}` : ""}`
+      );
+    })();
+    return projectPromise;
+  };
+  return { input, api: api2, config, org, project: project2, log, surface };
+}
+async function execute(spec, input, globals, surface, io) {
+  finalizeInput(spec, input);
+  const ctx = makeContext(spec, input, globals, surface, io);
+  if (spec.auth !== false && !ctx.config.token) throw missingToken(ctx.config.url);
+  return spec.run(ctx);
+}
+
+// src/mcp.ts
+var PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+var INSTRUCTIONS = `Tracksiy: error tracking, uptime monitoring, alerting, releases and source maps for the apps of an organization.
+
+Orient first: auth_status (who am I, which org/projects), then overview (the whole fleet: issues, volume trend, silent projects, monitors down, projects nobody is alerted for).
+Dig in: issues_list -> issues_view <id> gives the stack frames, latest event and tags needed to fix something. changes with the returned cursor is the cheap way to poll for anything new.
+Act: issues_resolve / issues_ignore; alerts_set then alerts_test to prove someone is told; monitors_declare for jobs and URLs; releases_declare and sourcemaps_upload from a deploy.
+Verify, don't assume: projects_verify reports whether an integration really works; health says whether the platform itself can be believed.
+If Tracksiy itself gets in your way -- a bug, a missing capability, an error you cannot interpret, or you are blocked -- tell the Tracksiy team: open a PeerPacket ticket for tracksiy-agent in the tracksiy-support channel (pp ticket new tracksiy-support "<problem>" --to tracksiy-agent --label bug -f report.md). The support tool returns the exact commands.
+
+Every tool takes optional "select" (dot paths) to return only the fields you need -- use it to keep results small. org/project default to TRACKSIY_ORG / TRACKSIY_PROJECT or to the only one the token can see.
+Writes are idempotent declarations. Destructive tools need "yes": true. issues_bulk_status is a dry run unless "apply": true.
+Errors come back with isError and a JSON body {error:{code, message, hint}}; the hint says what to do next.`;
+function schemaFor(name, f) {
+  const base = { description: f.description };
+  switch (f.type) {
+    case "boolean":
+      return { type: "boolean", ...base };
+    case "integer":
+      return { type: "integer", ...base };
+    case "number":
+      return { type: "number", ...base };
+    case "list":
+      return { type: "array", items: f.enum ? { type: "string", enum: f.enum } : { type: "string" }, ...base };
+    case "json":
+      return { type: "object", ...base, description: `${f.description} (a JSON object)` };
+    default:
+      return f.enum ? { type: "string", enum: f.enum, ...base } : { type: "string", ...base };
+  }
+}
+function inputSchema(spec) {
+  const properties = {};
+  const required = [];
+  for (const a of spec.args ?? []) {
+    properties[camel(a.name)] = a.variadic ? { type: "array", items: { type: "string" }, description: a.description } : { type: "string", description: a.description };
+    if (a.required) required.push(camel(a.name));
+  }
+  for (const [n, f] of Object.entries(spec.flags ?? {})) {
+    properties[camel(n)] = schemaFor(n, f);
+    if (f.required) required.push(camel(n));
+  }
+  if (spec.context === "org" || spec.context === "project") {
+    properties.org = { type: "string", description: "Organization slug (default: TRACKSIY_ORG, .tracksiy.json, or the only one visible)." };
+  }
+  if (spec.context === "project") {
+    properties.project = { type: "string", description: "Project slug or org/project (default: TRACKSIY_PROJECT, .tracksiy.json, or the only one visible)." };
+  }
+  properties.select = { type: "array", items: { type: "string" }, description: "Return only these fields of the result (dot paths, e.g. issues.id). Use it to keep the result small." };
+  return { type: "object", properties, required, additionalProperties: false };
+}
+function toolFor(spec) {
+  const parts = [spec.summary];
+  if (spec.description) parts.push(spec.description);
+  if (spec.output) parts.push(`Returns: ${spec.output}`);
+  if (spec.flags?.yes) parts.push('Destructive: pass "yes": true to confirm.');
+  const title = `tracksiy ${commandName(spec)}`;
+  return {
+    name: toolName(spec),
+    title,
+    description: parts.join("\n\n"),
+    inputSchema: inputSchema(spec),
+    annotations: {
+      title,
+      readOnlyHint: spec.effect === "read",
+      destructiveHint: spec.effect === "destructive" || spec.path[0] === "api",
+      idempotentHint: Boolean(spec.idempotent),
+      openWorldHint: true
+    }
+  };
+}
+function mcpTools() {
+  return COMMANDS.filter((c) => c.mcp !== false);
+}
+var McpServer = class {
+  protocol = PROTOCOL_VERSIONS[0];
+  tools;
+  io;
+  defaults;
+  get toolCount() {
+    return this.tools.size;
+  }
+  constructor(io, defaults2 = {}) {
+    this.io = io;
+    this.defaults = defaults2;
+    this.tools = new Map(mcpTools().map((t) => [toolName(t), t]));
+  }
+  /** Returns the response to send, or undefined for notifications and responses. */
+  async handle(msg) {
+    if (!msg || typeof msg !== "object" || !msg.method) return void 0;
+    const isRequest = msg.id !== void 0 && msg.id !== null;
+    if (!isRequest) return void 0;
+    const ok = (result) => ({ jsonrpc: "2.0", id: msg.id, result });
+    const fail = (code, message) => ({ jsonrpc: "2.0", id: msg.id, error: { code, message } });
+    switch (msg.method) {
+      case "initialize": {
+        const requested = msg.params?.protocolVersion;
+        this.protocol = PROTOCOL_VERSIONS.includes(requested) ? requested : PROTOCOL_VERSIONS[0];
+        return ok({
+          protocolVersion: this.protocol,
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: "tracksiy", title: "Tracksiy", version: VERSION },
+          instructions: INSTRUCTIONS
+        });
+      }
+      case "ping":
+        return ok({});
+      case "tools/list":
+        return ok({ tools: [...this.tools.values()].map(toolFor) });
+      case "tools/call":
+        return ok(await this.call(msg.params?.name, msg.params?.arguments ?? {}));
+      default:
+        return fail(-32601, `Method not found: ${msg.method}`);
+    }
+  }
+  async call(name, args) {
+    const spec = this.tools.get(name);
+    const text = (value) => [{ type: "text", text: JSON.stringify(value ?? null) }];
+    if (!spec) {
+      return { content: text({ error: { code: "usage.unknown_tool", message: `No tool named ${name}.` } }), isError: true };
+    }
+    try {
+      const { select, ...rest } = args ?? {};
+      for (const [n, f] of Object.entries(spec.flags ?? {})) {
+        if (f.type === "json" && rest[camel(n)] === "-") throw usageError("bad_value", `"${camel(n)}" cannot be read from stdin here; pass the JSON object itself.`);
+      }
+      const parsed = parseObject(spec, rest);
+      const data = await execute(spec, parsed.input, { ...this.defaults, ...parsed.globals }, "mcp", this.io);
+      return { content: text(selectFields(data, Array.isArray(select) ? select : typeof select === "string" && select.trim() ? select.split(",").map((x) => x.trim()).filter(Boolean) : void 0)), isError: false };
+    } catch (err) {
+      const e = toCliError(err);
+      const body = { error: e.toJSON() };
+      if (e instanceof CheckFailed) body.data = e.data;
+      return { content: text(body), isError: true };
+    }
+  }
+};
+async function serve(io, defaults2) {
+  const server = new McpServer(io, defaults2);
+  const write = (msg) => process.stdout.write(JSON.stringify(msg) + "\n");
+  const pending = /* @__PURE__ */ new Set();
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  io.stderr(`tracksiy mcp ${VERSION}: ${server.toolCount} tools on stdio
+`);
+  for await (const line of rl) {
+    if (!line.trim()) continue;
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
+      continue;
+    }
+    const job = (async () => {
+      if (Array.isArray(msg)) {
+        const out = (await Promise.all(msg.map((m) => server.handle(m)))).filter(Boolean);
+        if (out.length) write(out);
+      } else {
+        const out = await server.handle(msg);
+        if (out) write(out);
+      }
+    })().catch((err) => io.stderr(`tracksiy mcp: ${err.stack}
+`));
+    pending.add(job);
+    job.finally(() => pending.delete(job));
+  }
+  await Promise.all(pending);
+}
+var SERVED = Symbol("served");
+var mcpCommand = {
+  path: ["mcp"],
+  summary: "Run as an MCP server on stdio: every command becomes a tool for Claude, Cursor or any MCP client.",
+  description: "Configure the token with TRACKSIY_TOKEN in the client's server config (and optionally TRACKSIY_ORG / TRACKSIY_PROJECT / TRACKSIY_URL). --org/--project/--url given here become defaults for every tool call.",
+  context: "none",
+  auth: false,
+  effect: "read",
+  mcp: false,
+  examples: [
+    { command: "claude mcp add tracksiy -e TRACKSIY_TOKEN=<token> -- npx -y tracksiy mcp", description: "Add it to Claude Code." },
+    { command: '{"mcpServers":{"tracksiy":{"command":"npx","args":["-y","tracksiy","mcp"],"env":{"TRACKSIY_TOKEN":"<token>"}}}}', description: "The JSON most MCP clients take." }
+  ],
+  async run(ctx) {
+    const defaults2 = {};
+    if (ctx.config.urlSource === "--url") defaults2.url = ctx.config.url;
+    if (ctx.config.orgSource === "--org") defaults2.org = ctx.config.org;
+    if (ctx.config.projectSource === "--project") defaults2.project = ctx.config.project;
+    if (ctx.config.tokenSource === "--token") defaults2.token = ctx.config.token;
+    if (ctx.config.verbose) defaults2.verbose = true;
+    await serve({ env: process.env, cwd: process.cwd(), stderr: (s) => process.stderr.write(s) }, defaults2);
+    return SERVED;
+  }
+};
+var mcp_default = [mcpCommand];
+
+// src/registry.ts
+var COMMANDS = [
+  ...init_default,
+  ...auth_default,
+  ...fleet_default,
+  ...issues_default,
+  ...projects_default,
+  ...alerts_default,
+  ...keys_default,
+  ...releases_default,
+  ...artifacts_default,
+  ...tokens_default,
+  ...support_default,
+  ...meta_default,
+  ...mcp_default
+];
+var GROUPS = [
+  ["Start", "init auth onboarding describe"],
+  ["Look", "overview changes health orgs projects issues monitors performance releases alerts keys artifacts"],
+  ["Ship", "sourcemaps proguard"],
+  ["Manage", "tokens"],
+  ["Talk to us", "support"],
+  ["Other", "api mcp"]
+];
+
+// src/core/help.ts
+function flagLine(name, f) {
+  const value = f.type === "boolean" ? "" : ` ${f.value ?? (f.enum ? `<${f.enum.join("|")}>` : `<${f.type}>`)}`;
+  const left = `${f.short ? `-${f.short}, ` : "    "}--${name}${value}`;
+  const extra = [f.required ? "required" : "", f.default !== void 0 ? `default ${JSON.stringify(f.default)}` : "", f.enum && f.value ? `one of ${f.enum.join(", ")}` : ""].filter(Boolean).join("; ");
+  return { left, right: `${f.description}${extra ? ` (${extra})` : ""}` };
+}
+function columns(rows, indent = "  ") {
+  const pad = Math.min(38, Math.max(...rows.map((r) => r.left.length)));
+  return rows.map((r) => `${indent}${r.left.padEnd(pad)}  ${r.right}`).join("\n");
+}
+function commandHelp(spec) {
+  const usage = `tracksiy ${commandName(spec)}${(spec.args ?? []).map((a) => a.required ? ` <${a.name}${a.variadic ? "..." : ""}>` : ` [${a.name}${a.variadic ? "..." : ""}]`).join("")}${spec.flags ? " [flags]" : ""}`;
+  const out = [`${spec.summary}`, "", `Usage: ${usage}`];
+  if (spec.description) out.push("", spec.description);
+  if (spec.args?.length) out.push("", "Arguments:", columns(spec.args.map((a) => ({ left: `<${a.name}>`, right: a.description }))));
+  if (spec.flags && Object.keys(spec.flags).length) out.push("", "Flags:", columns(Object.entries(spec.flags).map(([n, f]) => flagLine(n, f))));
+  const ctxFlags = ["org", "project"].filter((n) => n === "org" && (spec.context === "org" || spec.context === "project") || n === "project" && spec.context === "project");
+  out.push("", "Global flags:", columns([...ctxFlags, "json", "select", "url", "quiet", "verbose"].map((n) => flagLine(n, GLOBAL_FLAGS[n]))));
+  if (spec.examples?.length) out.push("", "Examples:", spec.examples.map((e) => `  # ${e.description}
+  $ ${e.command}`).join("\n\n"));
+  const facts = [
+    `effect: ${spec.effect}${spec.idempotent ? ", idempotent" : ""}`,
+    spec.endpoint ? `calls: ${spec.endpoint.method} ${spec.endpoint.path}` : "",
+    spec.output ? `data: ${spec.output}` : "",
+    spec.mcp === false ? "" : `MCP tool: ${commandName(spec).replace(/[ -]/g, "_")}`
+  ].filter(Boolean);
+  out.push("", facts.join("\n"));
+  return out.join("\n") + "\n";
+}
+function groupHelp(group) {
+  const cmds = COMMANDS.filter((c) => c.path[0] === group);
+  return `Commands under \`tracksiy ${group}\`:
+
+${columns(cmds.map((c) => ({ left: commandName(c), right: c.summary })))}
+
+Run \`tracksiy ${group} <command> --help\` for details.
+`;
+}
+function rootHelp() {
+  const sections = GROUPS.map(([title, words]) => {
+    const set3 = words.split(" ");
+    const cmds = COMMANDS.filter((c) => set3.includes(c.path[0])).sort((a, b) => set3.indexOf(a.path[0]) - set3.indexOf(b.path[0]));
+    return `${title}:
+${columns(cmds.map((c) => ({ left: commandName(c), right: c.summary.length > 90 ? c.summary.slice(0, 88) + "\u2026" : c.summary })))}`;
+  });
+  return `tracksiy ${VERSION} -- errors, uptime, alerts, releases and source maps, from one token. Built for agents first.
+
+Usage: tracksiy <command> [flags]
+
+${sections.join("\n\n")}
+
+Global flags:
+${columns(Object.entries(GLOBAL_FLAGS).map(([n, f]) => flagLine(n, f)))}
+
+Output is JSON whenever stdout is not a terminal: {"ok":true,"data":...} or {"ok":false,"error":{"code","message","hint"}}.
+Exit codes: 0 ok, 2 usage, 3 auth, 4 not found, 5 invalid, 6 rate limited, 7 network, 8 server, 9 server too old, 10 check failed.
+Agents: \`tracksiy describe\` prints every command as JSON. \`tracksiy mcp\` serves them as MCP tools.
+Docs: https://tracksiy.com/cli.md
+`;
+}
+
+// src/main.ts
+function resolveCommand(tokens) {
+  const wordIdx = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === "--") break;
+    if (t.startsWith("-")) {
+      const name = t.replace(/^--?/, "").split("=")[0];
+      const f = GLOBAL_FLAGS[name];
+      if (f && f.type !== "boolean" && !t.includes("=")) i++;
+      if (wordIdx.length) break;
+      continue;
+    }
+    wordIdx.push(i);
+  }
+  const words = wordIdx.map((i) => tokens[i]);
+  let best;
+  for (const spec of COMMANDS) {
+    for (const path of [spec.path, ...spec.aliases ?? []]) {
+      if (path.length <= words.length && path.every((w, i) => words[i] === w) && (!best || path.length > best.len)) best = { spec, len: path.length };
+    }
+  }
+  const strip = (n) => tokens.filter((_, i) => !wordIdx.slice(0, n).includes(i));
+  const flagsOnly = strip(wordIdx.length);
+  if (best) return { spec: best.spec, len: best.len, rest: strip(best.len), words, flagsOnly };
+  const group = words[0] && COMMANDS.some((c) => c.path[0] === words[0]) ? words[0] : void 0;
+  return { group, len: 0, rest: strip(group ? 1 : 0), words, flagsOnly };
+}
+async function main(argv, io) {
+  const w = io.writer;
+  let format = resolveFormat({}, io.env, io.isTTY);
+  let spec;
+  let input = {};
+  let select;
+  try {
+    if (argv[0] === "--version" || argv[0] === "-V" || argv[0] === "version") {
+      if (format === "json" || argv.includes("--json")) w.stdout(JSON.stringify({ ok: true, data: { version: VERSION } }) + "\n");
+      else w.stdout(`${VERSION}
+`);
+      return EXIT.ok;
+    }
+    if (argv[0] === "help") argv = [...argv.slice(1), "--help"];
+    const match = resolveCommand(argv);
+    spec = match.spec;
+    if (spec && match.words.length > match.len && !spec.args?.length && COMMANDS.some((c) => c.path.length > 1 && c.path[0] === match.words[0])) {
+      format = resolveFormat(parseArgv(void 0, match.flagsOnly).globals, io.env, io.isTTY);
+      const sub = match.words.slice(1, match.len + 1).join(" ");
+      const options = COMMANDS.filter((c) => c.path[0] === match.words[0]).map((c) => c.path.slice(1).join(" ")).filter(Boolean);
+      const close = suggest(sub, options);
+      throw usageError("unknown_command", `Unknown command \`tracksiy ${match.words.slice(0, match.len + 1).join(" ")}\``, close ? `Did you mean \`tracksiy ${match.words[0]} ${close}\`?` : `Run \`tracksiy ${match.words[0]} --help\`.`);
+    }
+    const parsed = parseArgv(spec, spec ? match.rest : match.flagsOnly);
+    input = parsed.input;
+    format = resolveFormat(parsed.globals, io.env, io.isTTY);
+    select = parsed.globals.select;
+    if (!spec) {
+      if (match.group) {
+        if (match.words.length > 1) {
+          const options = COMMANDS.filter((c) => c.path[0] === match.group).map((c) => c.path.slice(1).join(" "));
+          const close = suggest(match.words[1], options);
+          throw usageError("unknown_command", `Unknown command \`tracksiy ${match.words.slice(0, 2).join(" ")}\``, close ? `Did you mean \`tracksiy ${match.group} ${close}\`?` : `Run \`tracksiy ${match.group} --help\`.`);
+        }
+        w.stdout(groupHelp(match.group));
+        return EXIT.ok;
+      }
+      if (match.words.length) {
+        const names = [...new Set(COMMANDS.flatMap((c) => [commandName(c), c.path[0], ...(c.aliases ?? []).map((a) => a.join(" "))]))];
+        const close = suggest(match.words.join(" "), names) ?? suggest(match.words[0], names);
+        throw usageError("unknown_command", `Unknown command \`tracksiy ${match.words.join(" ")}\``, close ? `Did you mean \`tracksiy ${close}\`?` : "Run `tracksiy --help`, or `tracksiy describe` for JSON.");
+      }
+      w.stdout(rootHelp());
+      return EXIT.ok;
+    }
+    if (parsed.globals.help) {
+      w.stdout(commandHelp(spec));
+      return EXIT.ok;
+    }
+    const data = await execute(spec, input, parsed.globals, "cli", io);
+    if (data === SERVED) return EXIT.ok;
+    printSuccess(w, format, data, spec, input, parsed.globals.select);
+    return EXIT.ok;
+  } catch (err) {
+    const e = toCliError(err);
+    printError(w, format, e, spec, input, select);
+    return e.exit;
+  }
+}
+
+// src/bin.ts
+main(process.argv.slice(2), {
+  env: process.env,
+  cwd: process.cwd(),
+  isTTY: Boolean(process.stdout.isTTY),
+  writer: processWriter,
+  stderr: (s) => process.stderr.write(s)
+}).then(
+  (code) => {
+    process.exitCode = code;
+  },
+  (err) => {
+    process.stderr.write(`tracksiy: ${err?.stack ?? err}
+`);
+    process.exitCode = 1;
+  }
+);