zooid 0.6.1 → 0.7.1

package/dist/index.js

@@ -1,3794 +1,8 @@
 #!/usr/bin/env node
 import {
-  createClient,
-  createPublishClient,
-  createSubscribeClient,
-  normalizeServerUrl,
-  resolveChannel
-} from "./chunk-VBGU2NST.js";
-import {
-  getConfigDir,
-  getStatePath,
-  loadConfig,
-  loadConfigFile,
-  loadDirectoryToken,
-  recordTailHistory,
-  resolveServer,
-  saveConfig,
-  saveDirectoryToken,
-  switchServer
-} from "./chunk-67ZRMVHO.js";
-import {
-  parseGitHubUrl
-} from "./chunk-AR456MHY.js";
-
-// src/index.ts
-import { Command } from "commander";
-
-// src/lib/telemetry.ts
-import fs from "fs";
-import path from "path";
-import { randomUUID } from "crypto";
-import { spawn } from "child_process";
-var TELEMETRY_ENDPOINT = "https://telemetry.zooid.dev/v1/events";
-var QUEUE_FILENAME = "telemetry.json";
-var MAX_QUEUE_SIZE = 1e3;
-function isEnabled() {
-  const envVar = process.env.ZOOID_TELEMETRY;
-  if (envVar !== void 0) {
-    return envVar !== "0" && envVar.toLowerCase() !== "false" && envVar.toLowerCase() !== "off";
-  }
-  const flag = readTelemetryFlag();
-  if (flag === false) return false;
-  return true;
-}
-function showNoticeIfNeeded() {
-  if (process.env.ZOOID_TELEMETRY === "0") return false;
-  const flag = readTelemetryFlag();
-  if (flag !== void 0) return false;
-  console.log("");
-  console.log("  Zooid collects anonymous usage metrics to improve the tool");
-  console.log("  and help rank channels in the public directory.");
-  console.log("");
-  console.log("  To opt out: npx zooid config set telemetry off");
-  console.log("  Or set ZOOID_TELEMETRY=0 in your environment.");
-  console.log("");
-  writeTelemetryFlag(true);
-  return true;
-}
-function writeEvent(event) {
-  const queuePath = getQueuePath();
-  const dir = getConfigDir();
-  try {
-    fs.mkdirSync(dir, { recursive: true });
-    let queue = [];
-    try {
-      const raw = fs.readFileSync(queuePath, "utf-8");
-      queue = JSON.parse(raw);
-    } catch {
-    }
-    queue.push(event);
-    if (queue.length > MAX_QUEUE_SIZE) {
-      queue = queue.slice(-MAX_QUEUE_SIZE);
-    }
-    fs.writeFileSync(queuePath, JSON.stringify(queue, null, 2) + "\n");
-  } catch {
-  }
-}
-function flushInBackground() {
-  const queuePath = getQueuePath();
-  try {
-    const raw = fs.readFileSync(queuePath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed) || parsed.length === 0) return;
-  } catch {
-    return;
-  }
-  try {
-    const child = spawn(process.execPath, ["-e", flushScript(queuePath)], {
-      detached: true,
-      stdio: "ignore",
-      env: { ...process.env }
-    });
-    child.unref();
-  } catch {
-  }
-}
-function getInstallId() {
-  const configPath = getStatePath();
-  try {
-    const raw = fs.readFileSync(configPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (parsed.install_id) return parsed.install_id;
-  } catch {
-  }
-  const id = randomUUID();
-  persistToConfig("install_id", id);
-  return id;
-}
-function getQueuePath() {
-  return path.join(getConfigDir(), QUEUE_FILENAME);
-}
-function readTelemetryFlag() {
-  const configPath = getStatePath();
-  try {
-    const raw = fs.readFileSync(configPath, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (parsed.telemetry === true) return true;
-    if (parsed.telemetry === false) return false;
-    return void 0;
-  } catch {
-    return void 0;
-  }
-}
-function writeTelemetryFlag(enabled) {
-  persistToConfig("telemetry", enabled);
-}
-function persistToConfig(key, value) {
-  const dir = getConfigDir();
-  const configPath = getStatePath();
-  try {
-    fs.mkdirSync(dir, { recursive: true });
-    let config = {};
-    try {
-      const raw = fs.readFileSync(configPath, "utf-8");
-      config = JSON.parse(raw);
-    } catch {
-    }
-    config[key] = value;
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-  } catch {
-  }
-}
-function flushScript(queuePath) {
-  return `
-const fs = require('fs');
-const https = require('https');
-const http = require('http');
-
-try {
-  const raw = fs.readFileSync(${JSON.stringify(queuePath)}, 'utf-8');
-  const events = JSON.parse(raw);
-  if (!Array.isArray(events) || events.length === 0) process.exit(0);
-
-  const body = JSON.stringify({ events });
-  const url = new URL(${JSON.stringify(TELEMETRY_ENDPOINT)});
-  const transport = url.protocol === 'https:' ? https : http;
-
-  const req = transport.request(url, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(body),
-    },
-    timeout: 5000,
-  }, (res) => {
-    if (res.statusCode >= 200 && res.statusCode < 300) {
-      fs.writeFileSync(${JSON.stringify(queuePath)}, '[]\\n');
-    }
-    process.exit(0);
-  });
-
-  req.on('error', () => process.exit(0));
-  req.on('timeout', () => { req.destroy(); process.exit(0); });
-  req.write(body);
-  req.end();
-} catch (e) {
-  process.exit(0);
-}
-`.trim();
-}
-
-// src/commands/config.ts
-var VALID_KEYS = ["server", "admin-token", "telemetry"];
-function runConfigSet(key, value) {
-  if (key === "server") {
-    switchServer(value);
-  } else if (key === "admin-token") {
-    saveConfig({ admin_token: value });
-  } else if (key === "telemetry") {
-    const enabled = value === "on" || value === "true" || value === "1";
-    writeTelemetryFlag(enabled);
-  } else {
-    throw new Error(
-      `Unknown config key: "${key}". Valid keys: ${VALID_KEYS.join(", ")}`
-    );
-  }
-}
-function runConfigGet(key) {
-  const config = loadConfig();
-  if (key === "server") return config.server;
-  if (key === "admin-token") return config.admin_token;
-  if (key === "telemetry") return isEnabled() ? "on" : "off";
-  throw new Error(
-    `Unknown config key: "${key}". Valid keys: ${VALID_KEYS.join(", ")}`
-  );
-}
-
-// src/lib/workforce.ts
-import fs3 from "fs";
-import path3 from "path";
-
-// src/lib/project.ts
-import fs2 from "fs";
-import path2 from "path";
-function findProjectRoot(from) {
-  let dir = fs2.realpathSync(from ?? process.cwd());
-  while (true) {
-    if (fs2.existsSync(path2.join(dir, "zooid.json")) || fs2.existsSync(path2.join(dir, ".zooid"))) {
-      return dir;
-    }
-    const parent = path2.dirname(dir);
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function getZooidDir(from) {
-  const root = findProjectRoot(from);
-  if (!root) {
-    throw new Error(
-      "Not a Zooid project (no zooid.json or .zooid/ found). Run `npx zooid init` first."
-    );
-  }
-  return path2.join(root, ".zooid");
-}
-
-// src/lib/workforce.ts
-var WORKFORCE_FILENAME = "workforce.json";
-var SLUG_RE = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
-function isValidSlug(s) {
-  return SLUG_RE.test(s);
-}
-function validateWorkforceFile(raw, filePath) {
-  if (raw.meta && typeof raw.meta === "object") {
-    const meta = raw.meta;
-    if (meta.slug !== void 0) {
-      if (typeof meta.slug !== "string" || !isValidSlug(meta.slug)) {
-        throw new Error(
-          `Invalid meta.slug in ${filePath}: "${meta.slug}" \u2014 must be a valid slug (lowercase alphanumeric + hyphens, 3-64 chars)`
-        );
-      }
-    }
-  }
-  if (raw.include) {
-    if (!Array.isArray(raw.include)) {
-      throw new Error(`"include" must be an array in ${filePath}`);
-    }
-    for (const p of raw.include) {
-      if (typeof p !== "string") {
-        throw new Error(`Include entries must be strings in ${filePath}`);
-      }
-      if (path3.isAbsolute(p)) {
-        throw new Error(`Include path must be relative in ${filePath}: ${p}`);
-      }
-    }
-  }
-  if (raw.channels && typeof raw.channels === "object") {
-    for (const [id, ch] of Object.entries(
-      raw.channels
-    )) {
-      if (!isValidSlug(id)) {
-        throw new Error(
-          `Invalid channel slug "${id}" in ${filePath} \u2014 must be lowercase alphanumeric + hyphens, 3-64 chars`
-        );
-      }
-      if (!ch || typeof ch !== "object" || !ch.visibility) {
-        throw new Error(
-          `Channel "${id}" in ${filePath} must have a "visibility" field`
-        );
-      }
-    }
-  }
-  if (raw.roles && typeof raw.roles === "object") {
-    for (const [id, role] of Object.entries(
-      raw.roles
-    )) {
-      if (!isValidSlug(id)) {
-        throw new Error(
-          `Invalid role slug "${id}" in ${filePath} \u2014 must be lowercase alphanumeric + hyphens, 3-64 chars`
-        );
-      }
-      if (!role || typeof role !== "object" || !Array.isArray(role.scopes)) {
-        throw new Error(
-          `Role "${id}" in ${filePath} must have a "scopes" array`
-        );
-      }
-    }
-  }
-}
-function resolveIncludes(filePath, ancestors, isRoot = false) {
-  const realPath = fs3.realpathSync(filePath);
-  if (ancestors.has(realPath)) {
-    const chain = [...ancestors, realPath].map((p) => path3.basename(p)).join(" \u2192 ");
-    throw new Error(`Circular include: ${chain}`);
-  }
-  const childAncestors = new Set(ancestors);
-  childAncestors.add(realPath);
-  const raw = JSON.parse(fs3.readFileSync(filePath, "utf-8"));
-  validateWorkforceFile(raw, filePath);
-  const wf = raw;
-  const baseDir = path3.dirname(filePath);
-  const result = {
-    channels: {},
-    roles: {},
-    agents: {},
-    provenance: { channels: {}, roles: {}, agents: {} }
-  };
-  if (wf.include) {
-    for (const includePath of wf.include) {
-      const resolved = path3.resolve(baseDir, includePath);
-      try {
-        const zooidDir = getZooidDir();
-        const realZooidDir = fs3.realpathSync(zooidDir);
-        if (!resolved.startsWith(realZooidDir + path3.sep) && resolved !== realZooidDir) {
-          throw new Error(
-            `Include path escapes .zooid/ in ${filePath}: ${includePath}`
-          );
-        }
-      } catch (e) {
-        if (e instanceof Error && e.message.includes("escapes")) throw e;
-      }
-      if (!fs3.existsSync(resolved)) {
-        throw new Error(
-          `Included file not found: ${includePath} (resolved to ${resolved})`
-        );
-      }
-      const included = resolveIncludes(resolved, childAncestors);
-      if (!isRoot) {
-        for (const id of Object.keys(included.channels)) {
-          if (id in result.channels) {
-            const prev = path3.basename(result.provenance.channels[id]);
-            const curr = path3.basename(included.provenance.channels[id]);
-            console.warn(
-              `\u26A0 Channel "${id}" defined in both ${prev} and ${curr} \u2014 using ${curr} (last wins)`
-            );
-          }
-        }
-        for (const id of Object.keys(included.roles)) {
-          if (id in result.roles) {
-            const prev = path3.basename(result.provenance.roles[id]);
-            const curr = path3.basename(included.provenance.roles[id]);
-            console.warn(
-              `\u26A0 Role "${id}" defined in both ${prev} and ${curr} \u2014 using ${curr} (last wins)`
-            );
-          }
-        }
-      }
-      Object.assign(result.channels, included.channels);
-      Object.assign(result.roles, included.roles);
-      Object.assign(result.agents, included.agents);
-      Object.assign(result.provenance.channels, included.provenance.channels);
-      Object.assign(result.provenance.roles, included.provenance.roles);
-      Object.assign(result.provenance.agents, included.provenance.agents);
-    }
-  }
-  if (wf.channels) {
-    for (const [id, def] of Object.entries(wf.channels)) {
-      result.channels[id] = def;
-      result.provenance.channels[id] = filePath;
-    }
-  }
-  if (wf.roles) {
-    for (const [id, def] of Object.entries(wf.roles)) {
-      result.roles[id] = def;
-      result.provenance.roles[id] = filePath;
-    }
-  }
-  if (wf.agents) {
-    for (const [id, def] of Object.entries(wf.agents)) {
-      result.agents[id] = def;
-      result.provenance.agents[id] = filePath;
-    }
-  }
-  return result;
-}
-function loadWorkforce() {
-  let zooidDir;
-  try {
-    zooidDir = getZooidDir();
-  } catch {
-    return {
-      channels: {},
-      roles: {},
-      provenance: { channels: {}, roles: {} }
-    };
-  }
-  const filePath = path3.join(zooidDir, WORKFORCE_FILENAME);
-  if (!fs3.existsSync(filePath)) {
-    return {
-      channels: {},
-      roles: {},
-      provenance: { channels: {}, roles: {} }
-    };
-  }
-  const resolved = resolveIncludes(filePath, /* @__PURE__ */ new Set(), true);
-  if (Object.keys(resolved.agents).length > 0) {
-    for (const agentId of Object.keys(resolved.agents)) {
-      if (agentId in resolved.roles) {
-        throw new Error(
-          `agent "${agentId}" collides with a role of the same name. Use one or the other.`
-        );
-      }
-    }
-    const derivedRoles = compileAgents(resolved.agents);
-    Object.assign(resolved.roles, derivedRoles);
-    for (const id of Object.keys(derivedRoles)) {
-      resolved.provenance.roles[id] = resolved.provenance.agents[id] ?? filePath;
-    }
-  }
-  return {
-    channels: resolved.channels,
-    roles: resolved.roles,
-    provenance: resolved.provenance
-  };
-}
-function saveWorkforce(data, options) {
-  let filePath;
-  if (options?.targetFile) {
-    filePath = options.targetFile;
-  } else {
-    let zooidDir;
-    try {
-      zooidDir = getZooidDir();
-    } catch {
-      zooidDir = path3.join(process.cwd(), ".zooid");
-    }
-    fs3.mkdirSync(zooidDir, { recursive: true });
-    filePath = path3.join(zooidDir, WORKFORCE_FILENAME);
-  }
-  let existing = {};
-  if (fs3.existsSync(filePath)) {
-    existing = JSON.parse(fs3.readFileSync(filePath, "utf-8"));
-  }
-  const output = {};
-  if (existing.$schema) output.$schema = existing.$schema;
-  if (existing.meta) output.meta = existing.meta;
-  if (existing.include) output.include = existing.include;
-  output.channels = data.channels;
-  output.roles = data.roles;
-  if (existing.agents) output.agents = existing.agents;
-  fs3.writeFileSync(filePath, JSON.stringify(output, null, 2) + "\n");
-}
-function updateInFile(filePath, section, id, def) {
-  const raw = JSON.parse(fs3.readFileSync(filePath, "utf-8"));
-  if (!raw[section]) raw[section] = {};
-  raw[section][id] = def;
-  fs3.writeFileSync(filePath, JSON.stringify(raw, null, 2) + "\n");
-}
-function removeFromFile(filePath, section, id) {
-  const raw = JSON.parse(fs3.readFileSync(filePath, "utf-8"));
-  if (raw[section]) {
-    delete raw[section][id];
-  }
-  fs3.writeFileSync(filePath, JSON.stringify(raw, null, 2) + "\n");
-}
-function compileAgents(agents) {
-  const roles = {};
-  for (const [id, agent] of Object.entries(agents)) {
-    const scopes = [];
-    if (agent.subscribes) {
-      for (const ch of agent.subscribes) {
-        scopes.push(`sub:${ch}`);
-      }
-    }
-    if (agent.publishes) {
-      for (const ch of agent.publishes) {
-        scopes.push(`pub:${ch}`);
-      }
-    }
-    const role = { scopes };
-    if (agent.name) role.name = agent.name;
-    if (agent.description) role.description = agent.description;
-    roles[id] = role;
-  }
-  return roles;
-}
-
-// src/commands/channel.ts
-async function runChannelCreate(id, options, client) {
-  const c = client ?? createClient();
-  let config = options.config;
-  if (options.strict !== void 0) {
-    config = { ...config, strict_types: options.strict };
-  }
-  const result = await c.createChannel({
-    id,
-    name: options.name ?? id,
-    description: options.description,
-    is_public: options.public ?? false,
-    config
-  });
-  if (!client) {
-    const config2 = loadConfig();
-    const channels = config2.channels ?? {};
-    channels[id] = { token: result.token };
-    saveConfig({ channels });
-  }
-  if (findProjectRoot()) {
-    try {
-      const wf = loadWorkforce();
-      wf.channels[id] = {
-        visibility: options.public ? "public" : "private",
-        ...options.name && { name: options.name },
-        ...options.description && { description: options.description },
-        ...config && { config }
-      };
-      saveWorkforce(wf);
-    } catch {
-    }
-  }
-  return result;
-}
-async function runChannelList(client) {
-  const c = client ?? createClient();
-  return c.listChannels();
-}
-async function runChannelUpdate(channelId, options, client) {
-  const c = client ?? createClient();
-  const result = await c.updateChannel(channelId, options);
-  if (findProjectRoot()) {
-    try {
-      const wf = loadWorkforce();
-      const def = {
-        visibility: result.is_public ? "public" : "private",
-        ...result.name && result.name !== channelId && { name: result.name },
-        ...result.description && { description: result.description },
-        ...result.config && { config: result.config }
-      };
-      const targetFile = wf.provenance.channels[channelId];
-      if (targetFile) {
-        updateInFile(targetFile, "channels", channelId, def);
-      } else {
-        wf.channels[channelId] = def;
-        saveWorkforce(wf);
-      }
-    } catch {
-    }
-  }
-  return result;
-}
-async function runChannelDelete(channelId, client) {
-  const c = client ?? createClient();
-  await c.deleteChannel(channelId);
-  if (!client) {
-    const file = loadConfigFile();
-    const serverUrl = resolveServer();
-    if (serverUrl && file.servers?.[serverUrl]?.channels?.[channelId]) {
-      delete file.servers[serverUrl].channels[channelId];
-      const fs13 = await import("fs");
-      fs13.writeFileSync(getStatePath(), JSON.stringify(file, null, 2) + "\n");
-    }
-  }
-  if (findProjectRoot()) {
-    try {
-      const wf = loadWorkforce();
-      const targetFile = wf.provenance.channels[channelId];
-      if (targetFile) {
-        removeFromFile(targetFile, "channels", channelId);
-      } else {
-        delete wf.channels[channelId];
-        saveWorkforce(wf);
-      }
-    } catch {
-    }
-  }
-}
-
-// src/lib/zoon.ts
-var DEFAULT_PLATFORM_URL = "https://api.zooid.dev";
-function getPlatformUrl() {
-  return process.env.ZOON_PLATFORM_URL || DEFAULT_PLATFORM_URL;
-}
-function extractSubdomain(serverUrl) {
-  try {
-    const url = new URL(serverUrl);
-    const match = url.hostname.match(/^([^.]+)\.zoon\.eco$/);
-    return match ? match[1] : null;
-  } catch {
-    return null;
-  }
-}
-function isZoonHosted(serverUrl) {
-  return extractSubdomain(serverUrl) !== null;
-}
-function authHeaders(token) {
-  return {
-    Authorization: `Bearer ${token}`,
-    "Content-Type": "application/json"
-  };
-}
-function platformUrl(subdomain, path10) {
-  return `${getPlatformUrl()}/api/v1/servers/${subdomain}${path10}`;
-}
-async function syncRolesToZoon(serverUrl, token, roles, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  if (!subdomain) {
-    throw new Error(`${serverUrl} is not a Zoon-hosted server`);
-  }
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(platformUrl(subdomain, "/roles"), {
-    method: "PUT",
-    headers: authHeaders(token),
-    body: JSON.stringify(roles)
-  });
-  if (!res.ok) {
-    const err = await res.json().catch(() => ({}));
-    throw new Error(
-      `Role sync failed: ${err.message || res.status}`
-    );
-  }
-  return res.json();
-}
-async function createCredential(serverUrl, token, name, roleNames, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const rolesRes = await _fetch(platformUrl(subdomain, "/roles"), {
-    headers: authHeaders(token)
-  });
-  const roles = await rolesRes.json();
-  const roleSlugs = roleNames.map((n) => roles.find((r) => r.slug === n || r.name === n)?.slug).filter(Boolean);
-  if (roleSlugs.length === 0) {
-    throw new Error(`No matching roles found for: ${roleNames.join(", ")}`);
-  }
-  const res = await _fetch(platformUrl(subdomain, "/credentials"), {
-    method: "POST",
-    headers: authHeaders(token),
-    body: JSON.stringify({ name, role_slugs: roleSlugs })
-  });
-  if (!res.ok) {
-    const err = await res.json().catch(() => ({}));
-    throw new Error(
-      `Credential creation failed: ${err.message || res.status}`
-    );
-  }
-  return res.json();
-}
-async function listCredentials(serverUrl, token, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(platformUrl(subdomain, "/credentials"), {
-    headers: authHeaders(token)
-  });
-  if (!res.ok) throw new Error(`Failed to list credentials: ${res.status}`);
-  return await res.json();
-}
-async function rotateCredential(serverUrl, token, clientId, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(
-    platformUrl(subdomain, `/credentials/${clientId}/rotate`),
-    { method: "POST", headers: authHeaders(token) }
-  );
-  if (!res.ok) throw new Error(`Failed to rotate credential: ${res.status}`);
-  return res.json();
-}
-async function listRolesFromZoon(serverUrl, token, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(platformUrl(subdomain, "/roles"), {
-    headers: authHeaders(token)
-  });
-  if (!res.ok) throw new Error(`Failed to list roles: ${res.status}`);
-  return res.json();
-}
-async function revokeCredential(serverUrl, token, clientId, options) {
-  const subdomain = extractSubdomain(serverUrl);
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(platformUrl(subdomain, `/credentials/${clientId}`), {
-    method: "DELETE",
-    headers: authHeaders(token)
-  });
-  if (!res.ok) throw new Error(`Failed to revoke credential: ${res.status}`);
-}
-
-// src/lib/output.ts
-function printSuccess(message) {
-  console.log(`\u2713 ${message}`);
-}
-function printError(message) {
-  console.error(`\u2717 ${message}`);
-}
-function printInfo(label, value) {
-  console.log(`  ${label}: ${value}`);
-}
-function printStep(message) {
-  console.log(`  ${message}`);
-}
-function formatRelative(isoString) {
-  const diff = Date.now() - new Date(isoString).getTime();
-  const minutes = Math.floor(diff / 6e4);
-  if (minutes < 1) return "just now";
-  if (minutes < 60) return `${minutes}m ago`;
-  const hours = Math.floor(minutes / 60);
-  if (hours < 24) return `${hours}h ago`;
-  const days = Math.floor(hours / 24);
-  return `${days}d ago`;
-}
-
-// src/commands/pull.ts
-async function runPull(client) {
-  const c = client ?? createClient();
-  const wf = loadWorkforce();
-  const written = [];
-  let newChannelsAdded = false;
-  const channels = await c.listChannels();
-  if (channels.length > 0) {
-    printStep("Pulling channels...");
-    for (const ch of channels) {
-      const def = {
-        visibility: ch.is_public ? "public" : "private"
-      };
-      if (ch.name && ch.name !== ch.id) def.name = ch.name;
-      if (ch.description) def.description = ch.description;
-      if (ch.config) def.config = ch.config;
-      const targetFile = wf.provenance.channels[ch.id];
-      if (targetFile) {
-        updateInFile(targetFile, "channels", ch.id, def);
-      } else {
-        wf.channels[ch.id] = def;
-        newChannelsAdded = true;
-      }
-      written.push(ch.id);
-    }
-  }
-  let newRolesAdded = false;
-  try {
-    const server = resolveServer();
-    const file = loadConfigFile();
-    const entry = server ? file.servers?.[server] : void 0;
-    let roles;
-    if (server && isZoonHosted(server) && entry?.platform_token) {
-      roles = await listRolesFromZoon(server, entry.platform_token);
-    } else {
-      roles = await c.listRoles();
-    }
-    if (roles.length > 0) {
-      printStep("Pulling roles...");
-      for (const role of roles) {
-        const roleKey = role.slug ?? role.id;
-        const def = { scopes: role.scopes };
-        if (role.name) def.name = role.name;
-        if (role.description) def.description = role.description;
-        const targetFile = wf.provenance.roles[roleKey];
-        if (targetFile) {
-          updateInFile(targetFile, "roles", roleKey, def);
-        } else {
-          wf.roles[roleKey] = def;
-          newRolesAdded = true;
-        }
-      }
-    }
-  } catch {
-  }
-  if (newChannelsAdded || newRolesAdded) {
-    saveWorkforce(wf);
-  }
-  if (written.length > 0 || Object.keys(wf.roles).length > 0) {
-    printSuccess(
-      `Pulled ${written.length} channel(s) and ${Object.keys(wf.roles).length} role(s) into .zooid/workforce.json`
-    );
-  } else {
-    printInfo("Nothing to pull", "no channels or roles on server");
-  }
-  return written;
-}
-
-// src/commands/publish.ts
-import fs4 from "fs";
-import readline from "readline";
-function parseJSON(raw, source) {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    throw new Error(`Invalid JSON from ${source}: ${raw.slice(0, 100)}`);
-  }
-}
-function readStdin() {
-  return new Promise((resolve, reject) => {
-    if (process.stdin.isTTY) {
-      reject(
-        new Error(
-          "No data provided. Usage: zooid publish <channel> <json> or pipe via stdin"
-        )
-      );
-      return;
-    }
-    let data = "";
-    process.stdin.setEncoding("utf-8");
-    process.stdin.on("data", (chunk) => data += chunk);
-    process.stdin.on("end", () => resolve(data.trim()));
-    process.stdin.on("error", reject);
-  });
-}
-async function runPublish(channelId, options, client, dataArg) {
-  const c = client ?? createPublishClient(channelId);
-  let type;
-  let data;
-  if (options.file) {
-    const raw = fs4.readFileSync(options.file, "utf-8");
-    const parsed = parseJSON(raw, options.file);
-    if (typeof parsed === "object" && parsed !== null && "type" in parsed) {
-      const obj = parsed;
-      type = obj.type;
-      data = obj.data ?? parsed;
-    } else {
-      data = parsed;
-    }
-  } else if (options.data) {
-    data = parseJSON(options.data, "--data");
-    type = options.type;
-  } else if (dataArg) {
-    data = parseJSON(dataArg, "argument");
-    type = options.type;
-  } else {
-    const raw = await readStdin();
-    data = parseJSON(raw, "stdin");
-    type = options.type;
-  }
-  const publishOpts = { data };
-  if (type) publishOpts.type = type;
-  return c.publish(channelId, publishOpts);
-}
-async function runPublishStream(channelId, options, client, onEvent) {
-  if (process.stdin.isTTY) {
-    throw new Error(
-      "--stream requires piped input (e.g. cat events.jsonl | zooid publish channel --stream)"
-    );
-  }
-  const c = client ?? createPublishClient(channelId);
-  const rl = readline.createInterface({ input: process.stdin });
-  let published = 0;
-  let errors = 0;
-  let lineNum = 0;
-  for await (const line of rl) {
-    lineNum++;
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    const data = parseJSON(trimmed, `stdin line ${lineNum}`);
-    const publishOpts = { data };
-    if (options.type) publishOpts.type = options.type;
-    try {
-      const event = await c.publish(channelId, publishOpts);
-      published++;
-      onEvent?.(event, lineNum);
-    } catch (err) {
-      errors++;
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`Line ${lineNum}: ${msg}
-`);
-    }
-  }
-  return { published, errors };
-}
-
-// src/commands/subscribe.ts
-async function runSubscribePoll(channelId, options = {}, client) {
-  const c = client ?? createSubscribeClient(channelId);
-  const callback = options.callback ?? ((event) => {
-    console.log(JSON.stringify(event));
-  });
-  return c.subscribe(channelId, callback, {
-    interval: options.interval ?? 5e3,
-    mode: options.mode,
-    type: options.type
-  });
-}
-async function runSubscribeWebhook(channelId, url, client) {
-  const c = client ?? createSubscribeClient(channelId);
-  return c.registerWebhook(channelId, url);
-}
-
-// src/commands/tail.ts
-async function runTail(channelId, options = {}, client) {
-  const c = client ?? createSubscribeClient(channelId);
-  if (options.follow) {
-    return runTailFollow(c, channelId, options);
-  }
-  const pollOpts = {};
-  if (options.limit !== void 0) pollOpts.limit = options.limit;
-  if (options.type) pollOpts.type = options.type;
-  if (options.since) pollOpts.since = options.since;
-  if (options.cursor) pollOpts.cursor = options.cursor;
-  return c.tail(channelId, pollOpts);
-}
-async function runTailFollow(client, channelId, options) {
-  const tailOpts = {
-    follow: true,
-    mode: options.mode,
-    interval: options.interval,
-    type: options.type
-  };
-  const stream = client.tail(channelId, tailOpts);
-  for await (const event of stream) {
-    console.log(JSON.stringify(event));
-  }
-  return void 0;
-}
-
-// src/commands/status.ts
-async function runStatus(client) {
-  const c = client ?? createClient();
-  const [discovery, identity] = await Promise.all([
-    c.getMetadata(),
-    c.getServerMeta()
-  ]);
-  return { discovery, identity };
-}
-
-// src/commands/history.ts
-function runHistory() {
-  const file = loadConfigFile();
-  const entries = [];
-  if (!file.servers) return entries;
-  const seen = /* @__PURE__ */ new Map();
-  for (const [serverUrl, serverConfig] of Object.entries(file.servers)) {
-    if (!serverConfig.channels) continue;
-    const normalizedServer = normalizeServerUrl(serverUrl);
-    for (const [channelId, channelData] of Object.entries(
-      serverConfig.channels
-    )) {
-      if (!channelData.stats) continue;
-      const key = `${normalizedServer}\0${channelId}`;
-      const existingIdx = seen.get(key);
-      if (existingIdx !== void 0) {
-        const existing = entries[existingIdx];
-        existing.num_tails += channelData.stats.num_tails;
-        if (channelData.stats.last_tailed_at > existing.last_tailed_at) {
-          existing.last_tailed_at = channelData.stats.last_tailed_at;
-          existing.name = channelData.name ?? existing.name;
-        }
-        if (channelData.stats.first_tailed_at < existing.first_tailed_at) {
-          existing.first_tailed_at = channelData.stats.first_tailed_at;
-        }
-      } else {
-        seen.set(key, entries.length);
-        entries.push({
-          server: normalizedServer,
-          channel_id: channelId,
-          name: channelData.name,
-          num_tails: channelData.stats.num_tails,
-          last_tailed_at: channelData.stats.last_tailed_at,
-          first_tailed_at: channelData.stats.first_tailed_at
-        });
-      }
-    }
-  }
-  entries.sort(
-    (a, b) => new Date(b.last_tailed_at).getTime() - new Date(a.last_tailed_at).getTime()
-  );
-  return entries;
-}
-
-// src/commands/share.ts
-import readline2 from "readline/promises";
-
-// src/lib/directory.ts
-var DIRECTORY_BASE_URL = "https://directory.zooid.dev";
-var TOKEN_PREFIX = "zd_";
-var POLL_INTERVAL_MS = 3e3;
-var POLL_TIMEOUT_MS = 2 * 60 * 1e3;
-function getDirectoryToken() {
-  const token = loadDirectoryToken();
-  if (token && token.startsWith(TOKEN_PREFIX)) {
-    return token;
-  }
-  return void 0;
-}
-async function ensureDirectoryToken() {
-  const existing = getDirectoryToken();
-  if (existing) return existing;
-  return deviceAuth();
-}
-async function deviceAuth() {
-  const res = await fetch(`${DIRECTORY_BASE_URL}/api/auth/device`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" }
-  });
-  if (!res.ok) {
-    throw new Error(`Directory auth failed: ${res.status} ${res.statusText}`);
-  }
-  const data = await res.json();
-  const { device_code, verification_url } = data;
-  console.log("");
-  printInfo("Authorize", verification_url);
-  console.log("  Opening browser to complete GitHub sign-in...\n");
-  try {
-    const { exec: exec2 } = await import("child_process");
-    const platform = process.platform;
-    const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
-    exec2(`${cmd} "${verification_url}"`);
-  } catch {
-    console.log(
-      "  Could not open browser automatically. Please visit the URL above.\n"
-    );
-  }
-  const deadline = Date.now() + POLL_TIMEOUT_MS;
-  while (Date.now() < deadline) {
-    await sleep(POLL_INTERVAL_MS);
-    const statusRes = await fetch(
-      `${DIRECTORY_BASE_URL}/api/auth/status?code=${encodeURIComponent(device_code)}`
-    );
-    if (!statusRes.ok) continue;
-    const status = await statusRes.json();
-    if (status.status === "complete" && status.token) {
-      saveDirectoryToken(status.token);
-      console.log("  Authenticated with Zooid Directory.\n");
-      return status.token;
-    }
-    if (status.status === "expired") {
-      throw new Error("Device authorization expired. Please try again.");
-    }
-  }
-  throw new Error(
-    "Authorization timed out. You need your human to authorize you. Run `npx zooid share` again to retry."
-  );
-}
-async function directoryFetch(path10, options = {}) {
-  let token = await ensureDirectoryToken();
-  const doFetch = (t) => {
-    const headers = new Headers(options.headers);
-    headers.set("Authorization", `Bearer ${t}`);
-    headers.set("Content-Type", "application/json");
-    return fetch(`${DIRECTORY_BASE_URL}${path10}`, { ...options, headers });
-  };
-  let res = await doFetch(token);
-  if (res.status === 401) {
-    console.log("  Directory token expired. Re-authenticating...\n");
-    token = await deviceAuth();
-    res = await doFetch(token);
-  }
-  return res;
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function formatDirectoryError(res) {
-  let msg = `Directory returned ${res.status}`;
-  try {
-    const body = await res.json();
-    const parts = [];
-    if (body.error) parts.push(String(body.error));
-    if (body.message) parts.push(String(body.message));
-    if (parts.length > 0) msg = parts.join(": ");
-  } catch {
-  }
-  return msg;
-}
-
-// src/lib/prompts.ts
-async function ask(rl, label, defaultValue) {
-  const hint = defaultValue ? ` [${defaultValue}]` : "";
-  const answer = await rl.question(`  ${label}${hint}: `);
-  return answer.trim() || defaultValue;
-}
-
-// src/commands/share.ts
-async function runShare(channelIds, options = {}) {
-  const client = createClient();
-  const config = loadConfig();
-  const serverUrl = config.server;
-  if (!serverUrl) {
-    throw new Error(
-      "No server configured. Run: npx zooid config set server <url>"
-    );
-  }
-  const allChannels = await client.listChannels();
-  const publicChannels = allChannels.filter((ch) => ch.is_public);
-  if (publicChannels.length === 0) {
-    throw new Error("No public channels found on this server.");
-  }
-  let selected;
-  if (channelIds.length > 0) {
-    const byId = new Map(allChannels.map((ch) => [ch.id, ch]));
-    const missing = [];
-    selected = [];
-    for (const id of channelIds) {
-      const ch = byId.get(id);
-      if (!ch) {
-        missing.push(id);
-      } else {
-        selected.push(ch);
-      }
-    }
-    if (missing.length > 0) {
-      throw new Error(`Channels not found: ${missing.join(", ")}`);
-    }
-    const privateChannels = selected.filter((ch) => !ch.is_public);
-    if (privateChannels.length > 0) {
-      throw new Error(
-        `Cannot share private channels: ${privateChannels.map((ch) => ch.id).join(", ")}. Only public channels can be listed in the directory.`
-      );
-    }
-  } else if (options.yes) {
-    selected = publicChannels;
-  } else {
-    selected = await pickChannels(publicChannels);
-    if (selected.length === 0) {
-      throw new Error("No channels selected.");
-    }
-  }
-  const channelDetails = await promptChannelDetails(selected, options.yes);
-  const ids = selected.map((ch) => ch.id);
-  const { claim, signature } = await client.getClaim(ids);
-  const channels = selected.map((ch) => {
-    const details = channelDetails.get(ch.id);
-    const entry = {
-      channel_id: ch.id,
-      name: ch.name
-    };
-    if (details.description) entry.description = details.description;
-    if (details.tags.length > 0) entry.tags = details.tags;
-    return entry;
-  });
-  const res = await directoryFetch("/api/servers", {
-    method: "POST",
-    body: JSON.stringify({ server_url: serverUrl, claim, signature, channels })
-  });
-  if (!res.ok) {
-    throw new Error(await formatDirectoryError(res));
-  }
-  await res.json();
-  console.log("");
-  for (const ch of selected) {
-    console.log(`  ${ch.id} \u2192 ${serverUrl}/${ch.id}`);
-  }
-  console.log("");
-  console.log(`  Any zooid can find your channel using:`);
-  console.log(`    npx zooid discover --query ${selected[0].id}`);
-  const tags = [
-    ...new Set(selected.flatMap((ch) => channelDetails.get(ch.id)?.tags ?? []))
-  ];
-  if (tags.length > 0) {
-    console.log(`    npx zooid discover --tag ${tags[0]}`);
-  }
-  console.log("");
-}
-async function pickChannels(channels) {
-  const { default: checkbox } = await import("@inquirer/checkbox");
-  const selected = await checkbox({
-    message: "Select channels to share",
-    choices: channels.map((ch) => ({
-      name: ch.description ? `${ch.id} \u2014 ${ch.description}` : ch.id,
-      value: ch.id,
-      checked: true
-    })),
-    theme: {
-      icon: { cursor: "> " },
-      style: { highlight: (text) => text }
-    }
-  });
-  const selectedSet = new Set(selected);
-  return channels.filter((ch) => selectedSet.has(ch.id));
-}
-async function promptChannelDetails(channels, skipPrompt) {
-  const result = /* @__PURE__ */ new Map();
-  if (skipPrompt) {
-    for (const ch of channels) {
-      result.set(ch.id, {
-        description: ch.description ?? "",
-        tags: ch.tags
-      });
-    }
-    return result;
-  }
-  const rl = readline2.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  try {
-    console.log("");
-    console.log("  Set description and tags for each channel.");
-    console.log("  Press Enter to accept defaults shown in [brackets].\n");
-    for (const ch of channels) {
-      console.log(`  ${ch.id}:`);
-      const desc = await ask(rl, "Description", ch.description ?? "");
-      const tagsRaw = await ask(
-        rl,
-        "Tags (comma-separated)",
-        ch.tags.join(", ")
-      );
-      const tags = tagsRaw.split(",").map((t) => t.trim()).filter(Boolean);
-      result.set(ch.id, { description: desc, tags });
-      console.log("");
-    }
-  } finally {
-    rl.close();
-  }
-  return result;
-}
-
-// src/commands/unshare.ts
-async function runUnshare(channelId) {
-  const client = createClient();
-  const config = loadConfig();
-  const serverUrl = config.server;
-  if (!serverUrl) {
-    throw new Error(
-      "No server configured. Run: npx zooid config set server <url>"
-    );
-  }
-  const { claim, signature } = await client.getClaim([channelId], "delete");
-  const res = await directoryFetch("/api/servers/channels", {
-    method: "DELETE",
-    body: JSON.stringify({
-      server_url: serverUrl,
-      channel_id: channelId,
-      claim,
-      signature
-    })
-  });
-  if (!res.ok) {
-    throw new Error(await formatDirectoryError(res));
-  }
-}
-
-// src/commands/discover.ts
-async function runDiscover(options) {
-  const params = new URLSearchParams();
-  if (options.query) params.set("q", options.query);
-  if (options.tag) params.set("tag", options.tag);
-  if (options.limit) params.set("limit", String(options.limit));
-  const qs = params.toString();
-  const url = `${DIRECTORY_BASE_URL}/api/discover${qs ? `?${qs}` : ""}`;
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new Error(`Directory returned ${res.status}`);
-  }
-  const data = await res.json();
-  if (data.channels.length === 0) {
-    console.log("No channels found.");
-    return;
-  }
-  console.log("");
-  for (const ch of data.channels) {
-    const host = new URL(ch.server_url).host;
-    const tags = ch.tags.length > 0 ? ` [${ch.tags.join(", ")}]` : "";
-    const desc = ch.description ? ` \u2014 ${ch.description}` : "";
-    console.log(`  ${host}/${ch.channel_id}${desc}${tags}`);
-  }
-  console.log(`
-  ${data.total} channel${data.total === 1 ? "" : "s"} found.`);
-  console.log("");
-}
-
-// src/commands/server.ts
-async function runServerGet(client) {
-  const c = client ?? createClient();
-  return c.getServerMeta();
-}
-async function runServerSet(fields, client) {
-  const c = client ?? createClient();
-  return c.updateServerMeta(fields);
-}
-
-// src/lib/roles.ts
-function loadRoleDefs() {
-  const wf = loadWorkforce();
-  return new Map(Object.entries(wf.roles));
-}
-function rolesToScopeMapping(roles) {
-  const mapping = {};
-  for (const [id, def] of roles) {
-    mapping[id] = def.scopes;
-  }
-  return JSON.stringify(mapping);
-}
-
-// src/lib/resolve-roles.ts
-function resolveRoleScopes(roleNames) {
-  const roles = loadRoleDefs();
-  const allScopes = /* @__PURE__ */ new Set();
-  for (const name of roleNames) {
-    const role = roles.get(name);
-    if (!role) {
-      throw new Error(
-        `Role "${name}" not found in .zooid/workforce.json. Available: ${[...roles.keys()].join(", ") || "(none)"}`
-      );
-    }
-    for (const scope of role.scopes) {
-      allScopes.add(scope);
-    }
-  }
-  return [...allScopes];
-}
-
-// src/commands/token.ts
-async function runTokenMint(scopes, options) {
-  const client = createClient();
-  if (options.role?.length && scopes.length) {
-    throw new Error("Cannot combine --role with explicit scopes");
-  }
-  if (options.role?.length) {
-    scopes = resolveRoleScopes(options.role);
-  }
-  const body = { scopes };
-  if (options.sub) body.sub = options.sub;
-  if (options.name) body.name = options.name;
-  if (options.expiresIn) body.expires_in = options.expiresIn;
-  if (options.role?.length) body.groups = options.role;
-  return client.mintToken(body);
-}
-
-// src/commands/dev.ts
-import { execSync, spawn as spawn2 } from "child_process";
-import crypto2 from "crypto";
-import fs5 from "fs";
-import path4 from "path";
-import { fileURLToPath } from "url";
-
-// src/lib/crypto.ts
-function base64url(buf) {
-  return buf.toString("base64url");
-}
-async function createAdminToken(secret) {
-  const header = base64url(
-    Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" }))
-  );
-  const payload = base64url(
-    Buffer.from(
-      JSON.stringify({
-        scope: "admin",
-        iat: Math.floor(Date.now() / 1e3)
-      })
-    )
-  );
-  const data = `${header}.${payload}`;
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const sig = await crypto.subtle.sign(
-    "HMAC",
-    key,
-    new TextEncoder().encode(data)
-  );
-  const signature = base64url(Buffer.from(sig));
-  return `${data}.${signature}`;
-}
-async function createEdDSAAdminToken(privateKeyJwk, kid) {
-  const header = base64url(
-    Buffer.from(JSON.stringify({ alg: "EdDSA", typ: "JWT", kid }))
-  );
-  const payload = base64url(
-    Buffer.from(
-      JSON.stringify({
-        scope: "admin",
-        iat: Math.floor(Date.now() / 1e3)
-      })
-    )
-  );
-  const message = `${header}.${payload}`;
-  const privateKey = await crypto.subtle.importKey(
-    "jwk",
-    privateKeyJwk,
-    { name: "Ed25519" },
-    false,
-    ["sign"]
-  );
-  const sig = await crypto.subtle.sign(
-    "Ed25519",
-    privateKey,
-    new TextEncoder().encode(message)
-  );
-  const signature = base64url(Buffer.from(sig));
-  return `${message}.${signature}`;
-}
-
-// src/commands/dev.ts
-function findServerDir() {
-  const cliDir = path4.dirname(fileURLToPath(import.meta.url));
-  return path4.resolve(cliDir, "../../server");
-}
-async function runDev(port = 8787) {
-  const serverDir = findServerDir();
-  if (!fs5.existsSync(path4.join(serverDir, "wrangler.toml"))) {
-    throw new Error(
-      `Server directory not found at ${serverDir}. Make sure you're running from the zooid monorepo.`
-    );
-  }
-  const jwtSecret = crypto2.randomUUID();
-  const devVarsPath = path4.join(serverDir, ".dev.vars");
-  fs5.writeFileSync(devVarsPath, `ZOOID_JWT_SECRET=${jwtSecret}
-`);
-  const adminToken = await createAdminToken(jwtSecret);
-  const serverUrl = `http://localhost:${port}`;
-  saveConfig({ admin_token: adminToken }, serverUrl);
-  const schemaPath = path4.join(serverDir, "src/db/schema.sql");
-  if (fs5.existsSync(schemaPath)) {
-    try {
-      execSync(
-        `npx wrangler d1 execute zooid-db --local --file=${schemaPath}`,
-        {
-          cwd: serverDir,
-          stdio: "pipe"
-        }
-      );
-      printSuccess("Database schema initialized");
-    } catch {
-      printSuccess("Database ready (schema already exists)");
-    }
-  }
-  printSuccess("Local server configured");
-  printInfo("Server", serverUrl);
-  printInfo("Admin token", adminToken.slice(0, 20) + "...");
-  printInfo("Config saved to", "~/.zooid/state.json");
-  console.log("");
-  console.log("Starting wrangler dev...");
-  console.log("");
-  const child = spawn2(
-    "npx",
-    ["wrangler", "dev", "--local", "--port", String(port)],
-    {
-      cwd: serverDir,
-      stdio: "inherit",
-      shell: true
-    }
-  );
-  child.on("error", (err) => {
-    console.error(`Failed to start local server: ${err.message}`);
-    process.exit(1);
-  });
-  child.on("exit", (code) => {
-    process.exit(code ?? 0);
-  });
-}
-
-// src/commands/init.ts
-import fs7 from "fs";
-import path6 from "path";
-import readline3 from "readline/promises";
-
-// src/commands/use.ts
-import fs6 from "fs";
-import path5 from "path";
-var SLUG_RE2 = /^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/;
-function deriveTemplateName(url) {
-  const parts = parseGitHubUrl(url);
-  if (!parts) throw new Error("Cannot derive template name from URL");
-  if (parts.path) {
-    const segments = parts.path.split("/").filter(Boolean);
-    return segments[segments.length - 1];
-  }
-  return parts.repo;
-}
-function resolveTemplateName(url, workforce) {
-  const meta = workforce.meta;
-  if (meta?.slug) {
-    const slug = meta.slug;
-    if (!SLUG_RE2.test(slug)) {
-      throw new Error(
-        `Invalid meta.slug "${slug}" \u2014 must be lowercase alphanumeric + hyphens, 3-64 chars`
-      );
-    }
-    return slug;
-  }
-  return deriveTemplateName(url);
-}
-function addToInclude(relativePath) {
-  const zooidDir = getZooidDir();
-  const workforcePath = path5.join(zooidDir, "workforce.json");
-  let raw;
-  if (fs6.existsSync(workforcePath)) {
-    raw = JSON.parse(fs6.readFileSync(workforcePath, "utf-8"));
-  } else {
-    raw = { channels: {}, roles: {} };
-  }
-  const include = raw.include ?? [];
-  if (!include.includes(relativePath)) {
-    include.push(relativePath);
-  }
-  raw.include = include;
-  fs6.writeFileSync(workforcePath, JSON.stringify(raw, null, 2) + "\n");
-}
-async function runUse(url, options) {
-  printStep("Fetching template...");
-  const zooidDir = getZooidDir();
-  const tmpDir = fs6.mkdtempSync(path5.join(zooidDir, ".tmp-template-"));
-  try {
-    const { fetchTemplate } = await import("./template-T5IB4YWC.js");
-    const result = await fetchTemplate(url, tmpDir, {
-      fetch: options?.fetch
-    });
-    const fetchedZooidDir = path5.join(tmpDir, ".zooid");
-    const fetchedWorkforce = path5.join(fetchedZooidDir, "workforce.json");
-    if (!fs6.existsSync(fetchedWorkforce)) {
-      throw new Error("Template has no .zooid/workforce.json");
-    }
-    const wfRaw = JSON.parse(fs6.readFileSync(fetchedWorkforce, "utf-8"));
-    const slug = resolveTemplateName(url, wfRaw);
-    const targetDir = path5.join(zooidDir, slug);
-    if (fs6.existsSync(targetDir)) {
-      fs6.rmSync(targetDir, { recursive: true });
-    }
-    fs6.cpSync(fetchedZooidDir, targetDir, { recursive: true });
-    addToInclude(`./${slug}/workforce.json`);
-    printSuccess(
-      `Saved .zooid/${slug}/ (${result.channelCount} channel(s), ${result.roleCount} role(s))`
-    );
-    printInfo("Added to include", "workforce.json");
-  } finally {
-    fs6.rmSync(tmpDir, { recursive: true, force: true });
-  }
-}
-
-// src/commands/init.ts
-var CONFIG_FILENAME = "zooid.json";
-function getConfigPath() {
-  return path6.join(process.cwd(), CONFIG_FILENAME);
-}
-function loadServerConfig() {
-  const configPath = getConfigPath();
-  if (!fs7.existsSync(configPath)) return null;
-  const raw = fs7.readFileSync(configPath, "utf-8");
-  return JSON.parse(raw);
-}
-function saveServerConfig(config) {
-  const configPath = getConfigPath();
-  fs7.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-}
-async function runInit(options) {
-  const configPath = getConfigPath();
-  const existing = loadServerConfig();
-  if (existing?.url && options?.use) {
-    const workforcePath = path6.join(process.cwd(), ".zooid", "workforce.json");
-    if (!fs7.existsSync(workforcePath)) {
-      fs7.mkdirSync(path6.join(process.cwd(), ".zooid"), { recursive: true });
-      fs7.writeFileSync(
-        workforcePath,
-        JSON.stringify({ channels: {}, roles: {} }, null, 2) + "\n"
-      );
-    }
-    await runUse(options.use);
-    console.log("");
-    printInfo("Server", existing.url);
-    printInfo("Workforce", ".zooid/workforce.json");
-    console.log("");
-    printSuccess("Ready to deploy. Run: npx zooid deploy");
-    console.log("");
-    return;
-  }
-  if (existing) {
-    printInfo("Found existing", configPath);
-    console.log("");
-  }
-  const rl = readline3.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  try {
-    console.log("");
-    console.log("  Configure your Zooid server");
-    console.log("  Press Enter to accept defaults shown in [brackets].\n");
-    const name = await ask(rl, "Server name", existing?.name ?? "");
-    const description = await ask(
-      rl,
-      "Description",
-      existing?.description ?? ""
-    );
-    const owner = await ask(rl, "Owner", existing?.owner ?? "");
-    const company = await ask(rl, "Company", existing?.company ?? "");
-    const email = await ask(rl, "Email", existing?.email ?? "");
-    const tagsRaw = await ask(
-      rl,
-      "Tags (comma-separated)",
-      existing?.tags?.join(", ") ?? ""
-    );
-    const url = await ask(
-      rl,
-      "URL (leave empty to assign on deploy)",
-      existing?.url ?? ""
-    );
-    const tags = tagsRaw.split(",").map((t) => t.trim()).filter(Boolean);
-    const config = {
-      name,
-      description,
-      owner,
-      company,
-      email,
-      tags,
-      url
-    };
-    fs7.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
-    const workforcePath = path6.join(process.cwd(), ".zooid", "workforce.json");
-    if (!fs7.existsSync(workforcePath)) {
-      fs7.mkdirSync(path6.join(process.cwd(), ".zooid"), { recursive: true });
-      fs7.writeFileSync(
-        workforcePath,
-        JSON.stringify({ channels: {}, roles: {} }, null, 2) + "\n"
-      );
-    }
-    console.log("");
-    printSuccess(`Saved ${CONFIG_FILENAME}`);
-    console.log("");
-    printInfo("Name", config.name || "(not set)");
-    printInfo("Description", config.description || "(not set)");
-    printInfo("Owner", config.owner || "(not set)");
-    printInfo("Company", config.company || "(not set)");
-    printInfo("Email", config.email || "(not set)");
-    printInfo(
-      "Tags",
-      config.tags.length > 0 ? config.tags.join(", ") : "(none)"
-    );
-    printInfo("URL", config.url || "(not set)");
-    printInfo("Workforce", ".zooid/workforce.json");
-    console.log("");
-  } finally {
-    rl.close();
-  }
-  if (options?.use) {
-    await runUse(options.use);
-  }
-}
-
-// src/commands/deploy.ts
-import { execSync as execSync2, spawnSync } from "child_process";
-import crypto3 from "crypto";
-import fs9 from "fs";
-import os from "os";
-import path7 from "path";
-import readline5 from "readline/promises";
-import { createRequire } from "module";
-import { ZooidClient } from "@zooid/sdk";
-
-// src/lib/channels.ts
-function loadChannelDefs() {
-  const wf = loadWorkforce();
-  return new Map(Object.entries(wf.channels));
-}
-
-// src/lib/wrangler-vars.ts
-import fs8 from "fs";
-function setWranglerVar(tomlPath, key, value) {
-  const content = fs8.readFileSync(tomlPath, "utf-8");
-  const lines = content.split("\n");
-  let varsStart = -1;
-  let varsEnd = lines.length;
-  for (let i = 0; i < lines.length; i++) {
-    if (/^\[vars\]\s*$/.test(lines[i])) {
-      varsStart = i;
-      for (let j = i + 1; j < lines.length; j++) {
-        if (/^\[/.test(lines[j]) && !/^\[vars\]/.test(lines[j])) {
-          varsEnd = j;
-          break;
-        }
-      }
-      break;
-    }
-  }
-  const keyPattern = new RegExp(`^${key}\\s*=`);
-  let existingLine = -1;
-  const searchStart = varsStart >= 0 ? varsStart + 1 : 0;
-  const searchEnd = varsStart >= 0 ? varsEnd : lines.length;
-  for (let i = searchStart; i < searchEnd; i++) {
-    if (keyPattern.test(lines[i])) {
-      existingLine = i;
-      break;
-    }
-  }
-  if (value === null) {
-    if (existingLine >= 0) {
-      lines.splice(existingLine, 1);
-    }
-  } else {
-    const newLine = `${key} = '${value}'`;
-    if (existingLine >= 0) {
-      lines[existingLine] = newLine;
-    } else if (varsStart >= 0) {
-      lines.splice(varsStart + 1, 0, newLine);
-    } else {
-      lines.push("", "[vars]", newLine);
-    }
-  }
-  fs8.writeFileSync(tomlPath, lines.join("\n"));
-}
-
-// src/lib/channel-sync.ts
-import readline4 from "readline/promises";
-async function syncChannelsToServer(client, options = {}) {
-  const localDefs = loadChannelDefs();
-  const remoteChannels = await client.listChannels();
-  const remoteIds = new Set(remoteChannels.map((ch) => ch.id));
-  const localIds = new Set(localDefs.keys());
-  let created = 0;
-  let updated = 0;
-  let deleted = 0;
-  for (const [id, def] of localDefs) {
-    if (!remoteIds.has(id)) {
-      await client.createChannel({
-        id,
-        name: def.name ?? id,
-        description: def.description,
-        is_public: def.visibility === "public",
-        config: def.config
-      });
-      printSuccess(`Channel created: ${id}`);
-      created++;
-    }
-  }
-  for (const [id, def] of localDefs) {
-    if (remoteIds.has(id)) {
-      await client.updateChannel(id, {
-        name: def.name,
-        description: def.description,
-        is_public: def.visibility === "public",
-        config: def.config ?? {}
-      });
-      printSuccess(`Channel updated: ${id}`);
-      updated++;
-    }
-  }
-  const orphaned = remoteChannels.filter((ch) => !localIds.has(ch.id));
-  if (orphaned.length > 0) {
-    if (options.prune) {
-      for (const ch of orphaned) {
-        await client.deleteChannel(ch.id);
-        printSuccess(`Channel deleted: ${ch.id}`);
-        deleted++;
-      }
-    } else if (options.confirmDelete) {
-      const confirmed = await options.confirmDelete(orphaned);
-      if (confirmed) {
-        for (const ch of orphaned) {
-          await client.deleteChannel(ch.id);
-          printSuccess(`Channel deleted: ${ch.id}`);
-          deleted++;
-        }
-      } else {
-        printInfo("Skipped", "Remote-only channels left unchanged");
-      }
-    } else {
-      printInfo(
-        "Warning",
-        `${orphaned.length} channel(s) on server not in workforce.json (use --prune to remove)`
-      );
-      for (const ch of orphaned) {
-        printInfo("  -", `${ch.id}${ch.name ? ` (${ch.name})` : ""}`);
-      }
-    }
-  }
-  return { created, updated, deleted };
-}
-
-// src/commands/deploy.ts
-var require2 = createRequire(import.meta.url);
-function resolvePackageDir(packageName) {
-  const pkgJson = require2.resolve(`${packageName}/package.json`);
-  return path7.dirname(pkgJson);
-}
-var USER_WRANGLER_TOML = path7.join(process.cwd(), "wrangler.toml");
-function ejectWranglerToml(opts) {
-  const serverDir = resolvePackageDir("@zooid/server");
-  let toml = fs9.readFileSync(path7.join(serverDir, "wrangler.toml"), "utf-8");
-  toml = toml.replace(/directory\s*=\s*"[^"]*"/, 'directory = "./web-dist/"');
-  toml = toml.replace(/name = "[^"]*"/, `name = "${opts.workerName}"`);
-  toml = toml.replace(
-    /database_name = "[^"]*"/,
-    `database_name = "${opts.dbName}"`
-  );
-  toml = toml.replace(
-    /database_id = "[^"]*"/,
-    `database_id = "${opts.databaseId}"`
-  );
-  toml = toml.replace(
-    /ZOOID_SERVER_ID = "[^"]*"/,
-    `ZOOID_SERVER_ID = "${opts.serverSlug}"`
-  );
-  fs9.writeFileSync(USER_WRANGLER_TOML, toml);
-}
-function prepareStagingDir() {
-  const serverDir = resolvePackageDir("@zooid/server");
-  const serverRequire = createRequire(path7.join(serverDir, "package.json"));
-  const webDir = path7.dirname(serverRequire.resolve("@zooid/web/package.json"));
-  const webDistDir = path7.join(webDir, "dist");
-  if (!fs9.existsSync(webDistDir)) {
-    throw new Error(`Web dashboard not built. Missing: ${webDistDir}`);
-  }
-  const tmpDir = fs9.mkdtempSync(path7.join(os.tmpdir(), "zooid-deploy-"));
-  copyDirSync(path7.join(serverDir, "src"), path7.join(tmpDir, "src"));
-  copyDirSync(webDistDir, path7.join(tmpDir, "web-dist"));
-  if (fs9.existsSync(USER_WRANGLER_TOML)) {
-    fs9.copyFileSync(USER_WRANGLER_TOML, path7.join(tmpDir, "wrangler.toml"));
-  } else {
-    if (!fs9.existsSync(path7.join(serverDir, "wrangler.toml"))) {
-      throw new Error(`Server package missing wrangler.toml at ${serverDir}`);
-    }
-    let toml = fs9.readFileSync(path7.join(serverDir, "wrangler.toml"), "utf-8");
-    toml = toml.replace(/directory\s*=\s*"[^"]*"/, 'directory = "./web-dist/"');
-    fs9.writeFileSync(path7.join(tmpDir, "wrangler.toml"), toml);
-  }
-  const nodeModules = findServerNodeModules(serverDir);
-  if (nodeModules) {
-    fs9.symlinkSync(nodeModules, path7.join(tmpDir, "node_modules"), "junction");
-  }
-  return tmpDir;
-}
-function findServerNodeModules(serverDir) {
-  const local = path7.join(serverDir, "node_modules");
-  if (fs9.existsSync(path7.join(local, "hono"))) return local;
-  const storeNodeModules = path7.resolve(serverDir, "..", "..");
-  if (fs9.existsSync(path7.join(storeNodeModules, "hono")))
-    return storeNodeModules;
-  let dir = serverDir;
-  while (dir !== path7.dirname(dir)) {
-    dir = path7.dirname(dir);
-    const nm = path7.join(dir, "node_modules");
-    if (fs9.existsSync(path7.join(nm, "hono"))) return nm;
-  }
-  return null;
-}
-function copyDirSync(src, dest) {
-  fs9.mkdirSync(dest, { recursive: true });
-  for (const entry of fs9.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path7.join(src, entry.name);
-    const destPath = path7.join(dest, entry.name);
-    if (entry.isDirectory()) {
-      copyDirSync(srcPath, destPath);
-    } else {
-      fs9.copyFileSync(srcPath, destPath);
-    }
-  }
-}
-function wranglerEnv(creds) {
-  const env = {
-    ...process.env,
-    CLOUDFLARE_API_TOKEN: creds.apiToken
-  };
-  if (creds.accountId) {
-    env.CLOUDFLARE_ACCOUNT_ID = creds.accountId;
-  }
-  return env;
-}
-function wrangler(cmd, cwd, creds, opts) {
-  return execSync2(`npx wrangler ${cmd}`, {
-    cwd,
-    stdio: "pipe",
-    encoding: "utf-8",
-    env: wranglerEnv(creds),
-    input: opts?.input
-  });
-}
-function wranglerVerbose(cmd, cwd, creds) {
-  const result = spawnSync("npx", ["wrangler", ...cmd.split(" ")], {
-    cwd,
-    stdio: "pipe",
-    encoding: "utf-8",
-    env: wranglerEnv(creds),
-    timeout: 5 * 60 * 1e3,
-    // 5 minute timeout
-    shell: true
-  });
-  if (result.stderr) process.stderr.write(result.stderr);
-  if (result.stdout) process.stdout.write(result.stdout);
-  if (result.error) {
-    throw result.error;
-  }
-  if (result.status !== 0) {
-    throw new Error(`wrangler ${cmd} exited with code ${result.status}`);
-  }
-  return result.stdout ?? "";
-}
-function parseDeployUrls(output) {
-  const workersDev = output.match(/https:\/\/[^\s]+\.workers\.dev/);
-  const custom = output.match(
-    /^\s+(\S+\.(?!workers\.dev)\S+)\s+\(custom domain\)/m
-  );
-  return {
-    workerUrl: workersDev ? workersDev[0] : null,
-    customDomain: custom ? `https://${custom[1]}` : null
-  };
-}
-function loadDotEnv() {
-  const envPath = path7.join(process.cwd(), ".env");
-  if (!fs9.existsSync(envPath)) return {};
-  const content = fs9.readFileSync(envPath, "utf-8");
-  const tokenMatch = content.match(/^CLOUDFLARE_API_TOKEN=(.+)$/m);
-  const accountMatch = content.match(/^CLOUDFLARE_ACCOUNT_ID=(.+)$/m);
-  return {
-    apiToken: tokenMatch ? tokenMatch[1].trim() : void 0,
-    accountId: accountMatch ? accountMatch[1].trim() : void 0
-  };
-}
-async function getCfCredentials() {
-  const envToken = process.env.CLOUDFLARE_API_TOKEN;
-  const envAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
-  if (envToken) {
-    return { apiToken: envToken, accountId: envAccount };
-  }
-  const dotEnv = loadDotEnv();
-  if (dotEnv.apiToken) {
-    printInfo("Using credentials from", ".env");
-    return { apiToken: dotEnv.apiToken, accountId: dotEnv.accountId };
-  }
-  const rl = readline5.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  try {
-    console.log("");
-    console.log("  Cloudflare API token required for deployment.");
-    console.log("  Go to: https://dash.cloudflare.com/profile/api-tokens");
-    console.log(
-      '  Use the "Edit Cloudflare Workers" template, then add D1 Edit permission.'
-    );
-    console.log("  Tip: save credentials in .env to skip this prompt.");
-    console.log("");
-    const token = await rl.question("  API token: ");
-    const accountId = await rl.question(
-      "  Account ID (from the dashboard URL or Workers overview): "
-    );
-    return {
-      apiToken: token.trim(),
-      accountId: accountId.trim() || void 0
-    };
-  } finally {
-    rl.close();
-  }
-}
-async function runDeploy(opts) {
-  let config = loadServerConfig();
-  if (!config) {
-    printInfo("No zooid.json found", "starting setup...");
-    console.log("");
-    await runInit();
-    config = loadServerConfig();
-  }
-  if (!config) {
-    printError("Failed to load zooid.json after init");
-    process.exit(1);
-  }
-  const serverUrl = config.url;
-  if (serverUrl && isZoonHosted(serverUrl)) {
-    await deployZoonHosted(config, serverUrl, opts);
-    return;
-  }
-  let stagingDir;
-  try {
-    stagingDir = prepareStagingDir();
-  } catch (err) {
-    printError(err.message);
-    process.exit(1);
-  }
-  const serverSlug = config.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-");
-  const dbName = `zooid-db-${serverSlug}`;
-  const workerName = `zooid-${serverSlug}`;
-  try {
-    execSync2("npx wrangler --version", { cwd: stagingDir, stdio: "pipe" });
-  } catch {
-    printError("wrangler not found. Install with: npm install -g wrangler");
-    process.exit(1);
-  }
-  const creds = await getCfCredentials();
-  try {
-    wrangler("whoami", stagingDir, creds);
-    printSuccess("Cloudflare authentication verified");
-  } catch {
-    printError("Invalid Cloudflare API token");
-    cleanup(stagingDir);
-    process.exit(1);
-  }
-  let isFirstDeploy = false;
-  try {
-    const output = wrangler("d1 list --json", stagingDir, creds);
-    const databases = JSON.parse(output);
-    isFirstDeploy = !databases.some((db) => db.name === dbName);
-  } catch {
-    isFirstDeploy = true;
-  }
-  let adminToken;
-  if (isFirstDeploy) {
-    console.log("");
-    printInfo("Deploy type", "First deploy \u2014 setting up database and secrets");
-    console.log("");
-    printStep(`Creating D1 database (${dbName})...`);
-    const d1Output = wrangler(`d1 create ${dbName}`, stagingDir, creds);
-    const dbIdMatch = d1Output.match(/database_id\s*=\s*"([^"]+)"/);
-    if (!dbIdMatch) {
-      printError("Failed to parse database ID from wrangler output");
-      console.log(d1Output);
-      cleanup(stagingDir);
-      process.exit(1);
-    }
-    const databaseId = dbIdMatch[1];
-    printSuccess(`D1 database created (${databaseId})`);
-    ejectWranglerToml({ workerName, dbName, databaseId, serverSlug });
-    fs9.copyFileSync(USER_WRANGLER_TOML, path7.join(stagingDir, "wrangler.toml"));
-    printSuccess(
-      "Created wrangler.toml (edit to add vars, observability, etc.)"
-    );
-    const schemaPath = path7.join(stagingDir, "src/db/schema.sql");
-    if (fs9.existsSync(schemaPath)) {
-      printStep("Running database schema migration...");
-      wrangler(
-        `d1 execute ${dbName} --remote --file=${schemaPath}`,
-        stagingDir,
-        creds
-      );
-      printSuccess("Database schema initialized");
-    }
-    printStep("Generating secrets...");
-    const keyPair = await crypto3.subtle.generateKey("Ed25519", true, [
-      "sign",
-      "verify"
-    ]);
-    const privateKeyRaw = await crypto3.subtle.exportKey(
-      "pkcs8",
-      keyPair.privateKey
-    );
-    const publicKeyRaw = await crypto3.subtle.exportKey(
-      "raw",
-      keyPair.publicKey
-    );
-    const privateKeyJwk = await crypto3.subtle.exportKey(
-      "jwk",
-      keyPair.privateKey
-    );
-    const publicKeyJwk = await crypto3.subtle.exportKey(
-      "jwk",
-      keyPair.publicKey
-    );
-    const privateKeyB64 = Buffer.from(privateKeyRaw).toString("base64");
-    const publicKeyB64 = Buffer.from(publicKeyRaw).toString("base64");
-    wrangler("secret put ZOOID_SIGNING_KEY", stagingDir, creds, {
-      input: privateKeyB64
-    });
-    printSuccess("Set ZOOID_SIGNING_KEY (Ed25519 private)");
-    wrangler("secret put ZOOID_PUBLIC_KEY", stagingDir, creds, {
-      input: publicKeyB64
-    });
-    printSuccess("Set ZOOID_PUBLIC_KEY (Ed25519 public)");
-    const kid = "local-1";
-    const xValue = publicKeyJwk.x;
-    const insertSql = `INSERT INTO trusted_keys (kid, x, issuer) VALUES ('${kid}', '${xValue}', 'local');`;
-    wrangler(
-      `d1 execute ${dbName} --remote --command="${insertSql}"`,
-      stagingDir,
-      creds
-    );
-    printSuccess(`Registered EdDSA public key (kid: ${kid})`);
-    adminToken = await createEdDSAAdminToken(privateKeyJwk, kid);
-    printSuccess("EdDSA admin token generated");
-  } else {
-    console.log("");
-    printInfo("Deploy type", "Redeploying existing server");
-    console.log("");
-    if (!fs9.existsSync(USER_WRANGLER_TOML)) {
-      printStep("Ejecting wrangler.toml...");
-      let databaseId = "";
-      try {
-        const output = wrangler("d1 list --json", stagingDir, creds);
-        const databases = JSON.parse(output);
-        const db = databases.find((d) => d.name === dbName);
-        if (db) databaseId = db.uuid;
-      } catch {
-      }
-      ejectWranglerToml({ workerName, dbName, databaseId, serverSlug });
-      printSuccess(
-        "Created wrangler.toml (edit to add vars, observability, etc.)"
-      );
-    }
-    fs9.copyFileSync(USER_WRANGLER_TOML, path7.join(stagingDir, "wrangler.toml"));
-    const schemaPath = path7.join(stagingDir, "src/db/schema.sql");
-    if (fs9.existsSync(schemaPath)) {
-      printStep("Running schema migration...");
-      wrangler(
-        `d1 execute ${dbName} --remote --file=${schemaPath}`,
-        stagingDir,
-        creds
-      );
-      printSuccess("Schema up to date");
-    }
-    const migrationsDir = path7.join(stagingDir, "src/db/migrations");
-    if (fs9.existsSync(migrationsDir)) {
-      const migrationFiles = fs9.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
-      for (const file of migrationFiles) {
-        const migrationPath = path7.join(migrationsDir, file);
-        try {
-          wrangler(
-            `d1 execute ${dbName} --remote --file=${migrationPath}`,
-            stagingDir,
-            creds
-          );
-        } catch {
-        }
-      }
-    }
-    try {
-      const keysOutput = wrangler(
-        `d1 execute ${dbName} --remote --json --command="SELECT kid FROM trusted_keys WHERE issuer = 'local' LIMIT 1"`,
-        stagingDir,
-        creds
-      );
-      const keysResult = JSON.parse(keysOutput);
-      const hasLocalKey = keysResult?.[0]?.results?.length > 0;
-      if (!hasLocalKey) {
-        printStep("Upgrading to EdDSA auth...");
-        const keyPair = await crypto3.subtle.generateKey("Ed25519", true, [
-          "sign",
-          "verify"
-        ]);
-        const privateKeyRaw = await crypto3.subtle.exportKey(
-          "pkcs8",
-          keyPair.privateKey
-        );
-        const publicKeyRaw = await crypto3.subtle.exportKey(
-          "raw",
-          keyPair.publicKey
-        );
-        const privateKeyJwk = await crypto3.subtle.exportKey(
-          "jwk",
-          keyPair.privateKey
-        );
-        const publicKeyJwk = await crypto3.subtle.exportKey(
-          "jwk",
-          keyPair.publicKey
-        );
-        const privateKeyB64 = Buffer.from(privateKeyRaw).toString("base64");
-        const publicKeyB64 = Buffer.from(publicKeyRaw).toString("base64");
-        wrangler("secret put ZOOID_SIGNING_KEY", stagingDir, creds, {
-          input: privateKeyB64
-        });
-        wrangler("secret put ZOOID_PUBLIC_KEY", stagingDir, creds, {
-          input: publicKeyB64
-        });
-        const kid = "local-1";
-        const xValue = publicKeyJwk.x;
-        const insertSql = `INSERT INTO trusted_keys (kid, x, issuer) VALUES ('${kid}', '${xValue}', 'local');`;
-        wrangler(
-          `d1 execute ${dbName} --remote --command="${insertSql}"`,
-          stagingDir,
-          creds
-        );
-        printSuccess("EdDSA keypair generated and registered");
-        adminToken = await createEdDSAAdminToken(privateKeyJwk, kid);
-        printSuccess("Upgraded to EdDSA admin token");
-      }
-    } catch {
-      printInfo(
-        "Note",
-        "Could not check EdDSA key status, keeping existing token"
-      );
-    }
-    if (!adminToken) {
-      const existingConfig = loadConfig();
-      adminToken = existingConfig.admin_token;
-    }
-    if (!adminToken) {
-      printError("No admin token found in ~/.zooid/state.json for this server");
-      console.log(
-        "If this is a first deploy, remove the D1 database and try again."
-      );
-      cleanup(stagingDir);
-      process.exit(1);
-    }
-  }
-  const roles = loadRoleDefs();
-  if (roles.size > 0) {
-    printStep("Syncing roles to wrangler.toml...");
-    const mapping = rolesToScopeMapping(roles);
-    setWranglerVar(USER_WRANGLER_TOML, "ZOOID_SCOPE_MAPPING", mapping);
-    fs9.copyFileSync(USER_WRANGLER_TOML, path7.join(stagingDir, "wrangler.toml"));
-    printSuccess(`${roles.size} role(s) synced to ZOOID_SCOPE_MAPPING`);
-  } else {
-    setWranglerVar(USER_WRANGLER_TOML, "ZOOID_SCOPE_MAPPING", null);
-    fs9.copyFileSync(USER_WRANGLER_TOML, path7.join(stagingDir, "wrangler.toml"));
-  }
-  printStep("Deploying worker...");
-  const deployOutput = wranglerVerbose("deploy", stagingDir, creds);
-  const { workerUrl, customDomain } = parseDeployUrls(deployOutput);
-  printSuccess("Worker deployed");
-  if (workerUrl) {
-    printInfo("Worker URL", workerUrl);
-  }
-  if (customDomain) {
-    printInfo("Custom domain", customDomain);
-  }
-  const canonicalUrl = config.url || customDomain || workerUrl;
-  await new Promise((r) => setTimeout(r, 2e3));
-  if (canonicalUrl && adminToken) {
-    try {
-      const client = new ZooidClient({
-        server: canonicalUrl,
-        token: adminToken
-      });
-      await client.updateServerMeta({
-        name: config.name || void 0,
-        description: config.description || void 0,
-        tags: config.tags.length > 0 ? config.tags : void 0,
-        owner: config.owner || void 0,
-        company: config.company || void 0,
-        email: config.email || void 0
-      });
-      printSuccess("Server identity updated");
-    } catch (err) {
-      printError(
-        `Failed to push server identity: ${err instanceof Error ? err.message : err}`
-      );
-    }
-  }
-  if (!config.url && (customDomain || workerUrl)) {
-    config.url = customDomain || workerUrl;
-    saveServerConfig(config);
-    printSuccess("Saved URL to zooid.json");
-  }
-  const configToSave = {
-    worker_url: workerUrl || void 0,
-    admin_token: adminToken
-  };
-  if (isFirstDeploy) {
-    configToSave.channels = {};
-  }
-  saveConfig(configToSave, canonicalUrl || void 0);
-  printSuccess("Saved connection config to ~/.zooid/state.json");
-  cleanup(stagingDir);
-  console.log("");
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  console.log("  \u{1FAB8} Zooid server deployed!");
-  console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-  printInfo("Server", canonicalUrl || "(unknown)");
-  if (workerUrl && workerUrl !== canonicalUrl) {
-    printInfo("Worker URL", workerUrl);
-  }
-  printInfo("Name", config.name || "(not set)");
-  if (isFirstDeploy) {
-    printInfo("Admin token", adminToken.slice(0, 20) + "...");
-  }
-  printInfo("Config", "~/.zooid/state.json");
-  console.log("");
-  if (canonicalUrl && adminToken) {
-    const channelDefs = loadChannelDefs();
-    if (channelDefs.size > 0 || !isFirstDeploy) {
-      printStep("Syncing channels to server...");
-      try {
-        const client = new ZooidClient({
-          server: canonicalUrl,
-          token: adminToken
-        });
-        const result = await syncChannelsToServer(client, {
-          prune: opts?.prune
-        });
-        if (result.created || result.updated || result.deleted) {
-          printSuccess(
-            `Channels synced (${result.created} created, ${result.updated} updated, ${result.deleted} deleted)`
-          );
-        } else {
-          printSuccess("Channels up to date");
-        }
-      } catch (err) {
-        printError(
-          `Failed to sync channels: ${err instanceof Error ? err.message : err}`
-        );
-      }
-    }
-  }
-  if (isFirstDeploy) {
-    console.log("  Next steps:");
-    console.log("    Edit wrangler.toml to add env vars, observability, etc.");
-    console.log("    npx zooid channel create my-channel");
-    console.log(
-      `    npx zooid publish my-channel --data='{"hello": "world"}'`
-    );
-    console.log("");
-  }
-  if (canonicalUrl) {
-    try {
-      const openCmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-      execSync2(`${openCmd} ${canonicalUrl}`, { stdio: "ignore" });
-    } catch {
-    }
-  }
-}
-function cleanup(dir) {
-  try {
-    fs9.rmSync(dir, { recursive: true, force: true });
-  } catch {
-  }
-}
-async function deployZoonHosted(config, serverUrl, opts) {
-  const file = loadConfigFile();
-  const entry = file.servers?.[serverUrl];
-  const adminToken = entry?.admin_token;
-  const platformToken = entry?.platform_token;
-  if (!platformToken) {
-    printError("Not authenticated with Zoon platform. Run: npx zooid login");
-    process.exit(1);
-  }
-  console.log("");
-  printInfo("Deploy type", `Zoon-hosted (${serverUrl})`);
-  console.log("");
-  const roles = loadRoleDefs();
-  const roleDefs = Array.from(roles.entries()).filter(([id]) => id !== "owner").map(([id, def]) => {
-    if (id === "public") {
-      printInfo(
-        "Deprecation",
-        'The "public" role has been renamed to "authenticated". Please update your workforce.json.'
-      );
-    }
-    return {
-      slug: id === "public" ? "authenticated" : id,
-      ...def.name ? { name: def.name } : {},
-      scopes: def.scopes,
-      ...def.description ? { description: def.description } : {}
-    };
-  });
-  if (roleDefs.length > 0) {
-    printStep("Syncing roles to Zoon...");
-    try {
-      const result = await syncRolesToZoon(serverUrl, platformToken, roleDefs);
-      printSuccess(
-        `Roles synced (${result.synced} synced, ${result.deleted} deleted)`
-      );
-    } catch (err) {
-      printError(
-        `Failed to sync roles: ${err instanceof Error ? err.message : err}`
-      );
-    }
-  }
-  if (adminToken) {
-    const channelDefs = loadChannelDefs();
-    if (channelDefs.size > 0) {
-      printStep("Syncing channels to server...");
-      try {
-        const client = new ZooidClient({
-          server: serverUrl,
-          token: adminToken
-        });
-        const result = await syncChannelsToServer(client, {
-          prune: opts?.prune
-        });
-        if (result.created || result.updated || result.deleted) {
-          printSuccess(
-            `Channels synced (${result.created} created, ${result.updated} updated, ${result.deleted} deleted)`
-          );
-        } else {
-          printSuccess("Channels up to date");
-        }
-      } catch (err) {
-        printError(
-          `Failed to sync channels: ${err instanceof Error ? err.message : err}`
-        );
-      }
-    }
-  }
-  console.log("");
-  printSuccess("Deploy complete (Zoon-hosted \u2014 no wrangler deploy needed)");
-  console.log("");
-}
-
-// src/commands/destroy.ts
-import fs10 from "fs";
-import path8 from "path";
-import readline6 from "readline/promises";
-import { ZooidClient as ZooidClient2 } from "@zooid/sdk";
-function parseWranglerToml(content) {
-  const nameMatch = content.match(/^name\s*=\s*"([^"]+)"/m);
-  const dbNameMatch = content.match(/database_name\s*=\s*"([^"]+)"/);
-  const dbIdMatch = content.match(/database_id\s*=\s*"([^"]+)"/);
-  return {
-    workerName: nameMatch?.[1] ?? null,
-    dbName: dbNameMatch?.[1] ?? null,
-    databaseId: dbIdMatch?.[1] ?? null
-  };
-}
-function removeServerFromState(serverUrl) {
-  const statePath = getStatePath();
-  if (!fs10.existsSync(statePath)) return;
-  const file = JSON.parse(fs10.readFileSync(statePath, "utf-8"));
-  if (file.servers) {
-    delete file.servers[serverUrl];
-  }
-  if (file.current === serverUrl) {
-    delete file.current;
-  }
-  fs10.writeFileSync(statePath, JSON.stringify(file, null, 2) + "\n");
-}
-async function cfApiFetch(apiPath, apiToken, opts) {
-  return fetch(`https://api.cloudflare.com/client/v4${apiPath}`, {
-    ...opts,
-    headers: {
-      Authorization: `Bearer ${apiToken}`,
-      "Content-Type": "application/json",
-      ...opts?.headers ?? {}
-    }
-  });
-}
-async function deleteD1Database(accountId, databaseId, apiToken) {
-  const res = await cfApiFetch(
-    `/accounts/${accountId}/d1/database/${databaseId}`,
-    apiToken,
-    { method: "DELETE" }
-  );
-  return res.ok;
-}
-async function deleteWorker(accountId, scriptName, apiToken) {
-  const res = await cfApiFetch(
-    `/accounts/${accountId}/workers/scripts/${scriptName}`,
-    apiToken,
-    { method: "DELETE" }
-  );
-  return res.ok;
-}
-function loadDotEnvValue(key) {
-  const envPath = path8.join(process.cwd(), ".env");
-  if (!fs10.existsSync(envPath)) return void 0;
-  const content = fs10.readFileSync(envPath, "utf-8");
-  const match = content.match(new RegExp(`^${key}=(.+)$`, "m"));
-  return match?.[1]?.trim();
-}
-async function runDestroy(opts = {}) {
-  const config = loadServerConfig();
-  if (!config) {
-    printError(
-      "No zooid.json found. Run this from your Zooid project directory."
-    );
-    process.exit(1);
-  }
-  const serverUrl = config.url;
-  if (serverUrl && isZoonHosted(serverUrl)) {
-    printError("Zoon-hosted server destroy is not yet supported.");
-    printInfo("Use the Zoon dashboard to delete your server", serverUrl);
-    process.exit(1);
-  }
-  const wranglerPath = path8.join(process.cwd(), "wrangler.toml");
-  if (!fs10.existsSync(wranglerPath)) {
-    printError("No wrangler.toml found. Is this a deployed Zooid project?");
-    process.exit(1);
-  }
-  const wranglerContent = fs10.readFileSync(wranglerPath, "utf-8");
-  const wrangler2 = parseWranglerToml(wranglerContent);
-  if (!wrangler2.workerName) {
-    printError("Could not determine Worker name from wrangler.toml");
-    process.exit(1);
-  }
-  const apiToken = process.env.CLOUDFLARE_API_TOKEN || loadDotEnvValue("CLOUDFLARE_API_TOKEN");
-  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID || loadDotEnvValue("CLOUDFLARE_ACCOUNT_ID");
-  if (!apiToken) {
-    printError(
-      "Cloudflare credentials required. Set CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID."
-    );
-    process.exit(1);
-  }
-  if (!accountId) {
-    printError(
-      "CLOUDFLARE_ACCOUNT_ID required. Set it in environment or .env file."
-    );
-    process.exit(1);
-  }
-  const configFile = loadConfigFile();
-  const serverEntry = serverUrl ? configFile.servers?.[serverUrl] : void 0;
-  const adminToken = serverEntry?.admin_token;
-  let channelCount = 0;
-  if (adminToken && serverUrl) {
-    try {
-      const client = new ZooidClient2({
-        server: serverUrl,
-        token: adminToken
-      });
-      const channels = await client.listChannels();
-      channelCount = channels.length;
-    } catch {
-    }
-  }
-  if (!opts.force) {
-    console.log("");
-    console.log(
-      "  \u26A0  This will permanently delete your Zooid server and all its data."
-    );
-    console.log("");
-    printInfo("Worker", wrangler2.workerName);
-    if (wrangler2.dbName) printInfo("Database", wrangler2.dbName);
-    if (channelCount > 0) printInfo("Channels", `${channelCount}`);
-    console.log("");
-    console.log("  This action cannot be undone.");
-    console.log("");
-    const serverSlug = wrangler2.workerName.replace(/^zooid-/, "");
-    const rl = readline6.createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-    try {
-      const answer = await rl.question(
-        `  Type the server name to confirm (${serverSlug}): `
-      );
-      if (answer.trim() !== serverSlug) {
-        printError("Name does not match. Aborting.");
-        process.exit(1);
-      }
-    } finally {
-      rl.close();
-    }
-  }
-  if (adminToken && serverUrl) {
-    printStep("Destroying Durable Objects...");
-    try {
-      const res = await fetch(`${serverUrl}/api/v1/admin/destroy`, {
-        method: "POST",
-        headers: { Authorization: `Bearer ${adminToken}` }
-      });
-      if (res.ok) {
-        const body = await res.json();
-        printSuccess(`${body.destroyed} Durable Object(s) destroyed`);
-      } else {
-        console.warn(
-          "  Warning: Could not destroy DOs \u2014 server may be unreachable."
-        );
-      }
-    } catch {
-      console.warn(
-        "  Warning: Server unreachable \u2014 Durable Objects may not be fully cleaned up."
-      );
-    }
-  }
-  if (wrangler2.databaseId) {
-    printStep("Deleting D1 database...");
-    const dbOk = await deleteD1Database(
-      accountId,
-      wrangler2.databaseId,
-      apiToken
-    );
-    if (dbOk) {
-      printSuccess(`Deleted ${wrangler2.dbName ?? wrangler2.databaseId}`);
-    } else {
-      console.warn(
-        "  Warning: Could not delete D1 database (may already be deleted)."
-      );
-    }
-  }
-  printStep("Deleting Worker...");
-  const workerOk = await deleteWorker(accountId, wrangler2.workerName, apiToken);
-  if (workerOk) {
-    printSuccess(`Deleted ${wrangler2.workerName}`);
-  } else {
-    console.warn(
-      "  Warning: Could not delete Worker (may already be deleted)."
-    );
-  }
-  if (!opts.keepLocal) {
-    printStep("Cleaning up local files...");
-    if (fs10.existsSync(wranglerPath)) {
-      fs10.unlinkSync(wranglerPath);
-      printSuccess("Removed wrangler.toml");
-    }
-    if (serverUrl) {
-      removeServerFromState(serverUrl);
-      printSuccess("Removed server entry from ~/.zooid/state.json");
-    }
-  }
-  console.log("");
-  printSuccess("Server destroyed.");
-  console.log(
-    "  If you configured a custom domain, remember to remove the DNS record."
-  );
-}
-
-// src/commands/login.ts
-import fs11 from "fs";
-import path9 from "path";
-
-// src/lib/device-auth.ts
-import { exec } from "child_process";
-function defaultOpenBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  try {
-    exec(`${cmd} ${JSON.stringify(url)}`);
-  } catch {
-  }
-}
-async function pollDeviceAuth(accountsUrl, options) {
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const openBrowser = options?.openBrowser ?? defaultOpenBrowser;
-  const initRes = await _fetch(`${accountsUrl}/api/auth/device/code`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ client_id: "zooid-cli" })
-  });
-  if (!initRes.ok) {
-    throw new Error(`Failed to initiate device auth: ${initRes.status}`);
-  }
-  const init = await initRes.json();
-  process.stderr.write(
-    `If the browser doesn't open, visit:
-  ${init.verification_uri_complete}
-`
-  );
-  openBrowser(init.verification_uri_complete);
-  const deadline = Date.now() + init.expires_in * 1e3;
-  const interval = (init.interval ?? 5) * 1e3;
-  return new Promise((resolve, reject) => {
-    const poll = async () => {
-      if (Date.now() > deadline) {
-        reject(new Error("Authentication timed out. Please try again."));
-        return;
-      }
-      try {
-        const res = await _fetch(`${accountsUrl}/api/auth/device/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-            device_code: init.device_code,
-            client_id: "zooid-cli"
-          })
-        });
-        if (res.status === 200) {
-          const data = await res.json();
-          const sessionRes = await _fetch(
-            `${accountsUrl}/api/auth/get-session`,
-            {
-              headers: { Authorization: `Bearer ${data.access_token}` }
-            }
-          );
-          let user = {
-            email: "unknown",
-            name: void 0
-          };
-          if (sessionRes.ok) {
-            const session = await sessionRes.json();
-            if (session.user) {
-              user = { email: session.user.email, name: session.user.name };
-            }
-          }
-          resolve({ sessionToken: data.access_token, user });
-          return;
-        }
-        if (res.status === 400) {
-          const error = await res.json();
-          if (error.error === "expired_token") {
-            reject(new Error("Device code expired. Please try again."));
-            return;
-          }
-        }
-      } catch {
-      }
-      setTimeout(poll, interval);
-    };
-    setTimeout(poll, interval);
-  });
-}
-async function exchangeToken(accountsUrl, sessionToken, serverUrl, options) {
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(`${accountsUrl}/api/auth/device-code/exchange`, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${sessionToken}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({ server_url: serverUrl })
-  });
-  if (!res.ok) {
-    const error = await res.json().catch(() => ({}));
-    throw new Error(
-      `Token exchange failed: ${error.message || error.error || res.status}`
-    );
-  }
-  return await res.json();
-}
-async function fetchServers(accountsUrl, sessionToken, options) {
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  const res = await _fetch(`${accountsUrl}/api/auth/device-code/servers`, {
-    headers: { Authorization: `Bearer ${sessionToken}` }
-  });
-  if (!res.ok) return [];
-  const data = await res.json();
-  return data.servers;
-}
-
-// src/commands/login.ts
-var ACCOUNTS_URL = "https://accounts.zooid.dev";
-function writeProjectConfig(serverUrl) {
-  const configPath = path9.join(process.cwd(), "zooid.json");
-  let existing = {};
-  try {
-    existing = JSON.parse(fs11.readFileSync(configPath, "utf-8"));
-  } catch {
-  }
-  existing.url = serverUrl;
-  fs11.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
-}
-async function runLogin(url, options) {
-  const _fetch = options?.fetch ?? globalThis.fetch;
-  if (url) {
-    return loginToServer(normalizeServerUrl(url), _fetch);
-  }
-  return loginToZoon(_fetch);
-}
-async function loginToZoon(_fetch) {
-  process.stderr.write("\nOpening browser to authenticate with Zoon...\n");
-  const result = await pollDeviceAuth(ACCOUNTS_URL, { fetch: _fetch });
-  process.stderr.write(
-    `
-Logged in as ${result.user.name || result.user.email}
-`
-  );
-  const servers = await fetchServers(ACCOUNTS_URL, result.sessionToken, {
-    fetch: _fetch
-  });
-  let targetServer;
-  try {
-    const fs13 = await import("fs");
-    const path10 = await import("path");
-    const configPath = path10.join(process.cwd(), "zooid.json");
-    if (fs13.existsSync(configPath)) {
-      const raw = JSON.parse(fs13.readFileSync(configPath, "utf-8"));
-      if (raw.url) {
-        const hasAccess = servers.some((s) => s.url === raw.url);
-        if (hasAccess) {
-          targetServer = raw.url;
-        } else {
-          printInfo(
-            "Note",
-            `zooid.json references ${raw.url} but you don't have access to it`
-          );
-        }
-      }
-    }
-  } catch {
-  }
-  if (!targetServer && servers.length > 0) {
-    targetServer = servers[0].url;
-  }
-  if (!targetServer) {
-    saveConfig(
-      {
-        platform_token: result.sessionToken,
-        auth_method: "oidc"
-      },
-      ACCOUNTS_URL,
-      { setCurrent: false }
-    );
-    printSuccess("Authenticated with Zoon");
-    printInfo("Note", "No servers found. Create one at app.zooid.dev");
-    process.stderr.write("\n");
-    return;
-  }
-  const exchangeResult = await exchangeToken(
-    ACCOUNTS_URL,
-    result.sessionToken,
-    targetServer,
-    { fetch: _fetch }
-  );
-  saveConfig(
-    {
-      admin_token: exchangeResult.token,
-      platform_token: result.sessionToken,
-      auth_method: "oidc"
-    },
-    targetServer,
-    { setCurrent: true }
-  );
-  writeProjectConfig(targetServer);
-  printSuccess(`Server: ${targetServer} (set as current)`);
-  printInfo("Project", `zooid.json \u2192 ${targetServer}`);
-  process.stderr.write("\n");
-}
-async function loginToServer(serverUrl, _fetch) {
-  const url = new URL(serverUrl);
-  if (url.hostname.endsWith(".zoon.eco")) {
-    process.stderr.write("\nOpening browser to authenticate with Zoon...\n");
-    const result = await pollDeviceAuth(ACCOUNTS_URL, { fetch: _fetch });
-    process.stderr.write(
-      `
-Logged in as ${result.user.name || result.user.email}
-`
-    );
-    const exchangeResult = await exchangeToken(
-      ACCOUNTS_URL,
-      result.sessionToken,
-      serverUrl,
-      { fetch: _fetch }
-    );
-    saveConfig(
-      {
-        admin_token: exchangeResult.token,
-        platform_token: result.sessionToken,
-        auth_method: "oidc"
-      },
-      serverUrl,
-      { setCurrent: true }
-    );
-    writeProjectConfig(serverUrl);
-    printSuccess(`Server: ${serverUrl} (set as current)`);
-    printInfo("Project", `zooid.json \u2192 ${serverUrl}`);
-    return;
-  }
-  throw new Error(
-    "CLI login for self-hosted servers with external OIDC is coming soon.\nFor now, use `npx zooid token mint` to create a token manually."
-  );
-}
-
-// src/commands/logout.ts
-import fs12 from "fs";
-async function runLogout(options) {
-  const file = loadConfigFile();
-  if (options.all) {
-    for (const url of Object.keys(file.servers ?? {})) {
-      clearServerAuth(file, url);
-    }
-    process.stderr.write("Logged out of all servers\n");
-  } else {
-    const server = resolveServer();
-    if (!server) {
-      throw new Error("No server configured.");
-    }
-    clearServerAuth(file, server);
-    process.stderr.write(`Logged out of ${server}
-`);
-  }
-  const dir = getConfigDir();
-  fs12.mkdirSync(dir, { recursive: true });
-  fs12.writeFileSync(getStatePath(), JSON.stringify(file, null, 2) + "\n");
-}
-function clearServerAuth(file, url) {
-  const entry = file.servers?.[url];
-  if (!entry) return;
-  delete entry.admin_token;
-  delete entry.refresh_token;
-  delete entry.auth_method;
-}
-
-// src/commands/whoami.ts
-async function runWhoami() {
-  const config = loadConfig();
-  const file = loadConfigFile();
-  if (!config.server) {
-    throw new Error("No server configured. Run: npx zooid login");
-  }
-  const client = createClient();
-  const claims = await client.getTokenClaims();
-  const entry = file.servers?.[config.server];
-  return {
-    server: config.server,
-    sub: claims.sub ?? "unknown",
-    name: claims.name,
-    scopes: claims.scopes ?? [],
-    exp: claims.exp,
-    authMethod: entry?.auth_method
-  };
-}
-
-// src/commands/credentials.ts
-function requireZoonServer() {
-  const server = resolveServer();
-  if (!server) {
-    throw new Error("No server configured. Run: npx zooid login");
-  }
-  if (!isZoonHosted(server)) {
-    throw new Error(
-      "Credentials are only available for Zoon-hosted servers (*.zoon.eco)"
-    );
-  }
-  const file = loadConfigFile();
-  const entry = file.servers?.[server];
-  if (!entry?.platform_token) {
-    throw new Error(
-      "Not authenticated with Zoon platform. Run: npx zooid login"
-    );
-  }
-  return { server, platformToken: entry.platform_token };
-}
-function formatEnv(server, clientId, clientSecret) {
-  return [
-    `ZOOID_SERVER=${server}`,
-    `ZOOID_CLIENT_ID=${clientId}`,
-    `ZOOID_CLIENT_SECRET=${clientSecret}`
-  ].join("\n");
-}
-async function runCredentialsCreate(name, options) {
-  const { server, platformToken } = requireZoonServer();
-  let roleNames = options.role;
-  if (!roleNames || roleNames.length === 0) {
-    const wf = loadWorkforce();
-    if (wf.roles[name]) {
-      roleNames = [name];
-    } else {
-      throw new Error(
-        `No roles specified and no matching agent/role "${name}" found in workforce.json`
-      );
-    }
-  }
-  const result = await createCredential(server, platformToken, name, roleNames);
-  process.stderr.write(
-    `
-  Created credential "${name}" on ${server} (roles: ${roleNames.join(", ")})
-
-`
-  );
-  return formatEnv(server, result.client_id, result.client_secret);
-}
-async function runCredentialsList() {
-  const { server, platformToken } = requireZoonServer();
-  return listCredentials(server, platformToken);
-}
-async function resolveClientId(nameOrId) {
-  const { server, platformToken } = requireZoonServer();
-  const creds = await listCredentials(server, platformToken);
-  const match = creds.find((c) => c.name === nameOrId) || creds.find((c) => c.client_id === nameOrId);
-  if (!match) {
-    throw new Error(
-      `Credential "${nameOrId}" not found. Run: npx zooid credentials list`
-    );
-  }
-  return { clientId: match.client_id, name: match.name };
-}
-async function runCredentialsRotate(nameOrId) {
-  const { server, platformToken } = requireZoonServer();
-  const { clientId, name } = await resolveClientId(nameOrId);
-  const result = await rotateCredential(server, platformToken, clientId);
-  process.stderr.write(`
-  Rotated credential "${name}" on ${server}
-
-`);
-  return formatEnv(server, result.client_id, result.client_secret);
-}
-async function runCredentialsRevoke(nameOrId) {
-  const { server, platformToken } = requireZoonServer();
-  const { clientId, name } = await resolveClientId(nameOrId);
-  await revokeCredential(server, platformToken, clientId);
-  process.stderr.write(`
-  Revoked credential "${name}" on ${server}
-`);
-}
-
-// src/lib/auto-refresh.ts
-function decodeJwtPayload(jwt) {
-  try {
-    const parts = jwt.split(".");
-    if (parts.length !== 3) return null;
-    const payload = atob(parts[1]);
-    return JSON.parse(payload);
-  } catch {
-    return null;
-  }
-}
-async function maybeRefreshToken(serverConfig, _serverUrl, _options) {
-  if (serverConfig.auth_method !== "oidc") return;
-  if (!serverConfig.admin_token) return;
-  const payload = decodeJwtPayload(serverConfig.admin_token);
-  if (!payload?.exp) return;
-  const expiresAt = payload.exp * 1e3;
-  const twoMinutes = 2 * 60 * 1e3;
-  if (Date.now() < expiresAt - twoMinutes) return;
-  process.stderr.write(
-    "Session expired. Run `npx zooid login` to re-authenticate.\n"
-  );
-}
-
-// src/commands/role.ts
-function runRoleCreate(id, options) {
-  const wf = loadWorkforce();
-  if (id in wf.roles) {
-    throw new Error(
-      `Role "${id}" already exists. Use "zooid role update" to modify it.`
-    );
-  }
-  const def = { scopes: options.scopes };
-  if (options.name) def.name = options.name;
-  if (options.description) def.description = options.description;
-  wf.roles[id] = def;
-  saveWorkforce(wf);
-}
-function runRoleList() {
-  const wf = loadWorkforce();
-  return Object.keys(wf.roles);
-}
-function runRoleUpdate(id, fields) {
-  const wf = loadWorkforce();
-  const existing = wf.roles[id];
-  if (!existing) {
-    throw new Error(`Role "${id}" not found. Use "zooid role create" first.`);
-  }
-  if (fields.name !== void 0) {
-    if (fields.name === null) {
-      delete existing.name;
-    } else {
-      existing.name = fields.name;
-    }
-  }
-  if (fields.description !== void 0) {
-    if (fields.description === null) {
-      delete existing.description;
-    } else {
-      existing.description = fields.description;
-    }
-  }
-  if (fields.scopes !== void 0) {
-    existing.scopes = fields.scopes;
-  }
-  const targetFile = wf.provenance.roles[id];
-  if (targetFile) {
-    updateInFile(targetFile, "roles", id, existing);
-  } else {
-    wf.roles[id] = existing;
-    saveWorkforce(wf);
-  }
-  return existing;
-}
-function runRoleDelete(id) {
-  const wf = loadWorkforce();
-  if (!(id in wf.roles)) {
-    throw new Error(`Role "${id}" not found in .zooid/workforce.json`);
-  }
-  const targetFile = wf.provenance.roles[id];
-  if (targetFile) {
-    removeFromFile(targetFile, "roles", id);
-  } else {
-    delete wf.roles[id];
-    saveWorkforce(wf);
-  }
-}
-
-// src/index.ts
-async function resolveAndRecord(channel, opts) {
-  const result = resolveChannel(channel, {
-    token: opts.token,
-    tokenType: "subscribe"
-  });
-  setTelemetryChannel(result.channelId);
-  if (result.tokenSaved) {
-    printInfo(
-      "Token saved",
-      `for ${result.channelId} \u2014 won't need --token next time`
-    );
-  }
-  try {
-    const channels = await result.client.listChannels();
-    const ch = channels.find((c) => c.id === result.channelId);
-    recordTailHistory(result.channelId, result.server, ch?.name);
-  } catch {
-    recordTailHistory(result.channelId, result.server);
-  }
-  return result;
-}
-var program = new Command();
-program.name("zooid").description("\u{1FAB8} Pub/sub for AI agents").version("0.6.1");
-var telemetryCtx = { startTime: 0 };
-function setTelemetryChannel(channelId) {
-  telemetryCtx.channelId = channelId;
-  const config = loadConfig();
-  const channelTokens = config.channels?.[channelId];
-  const hasChannelToken = !!(channelTokens?.token || channelTokens?.publish_token || channelTokens?.subscribe_token);
-  telemetryCtx.usedToken = hasChannelToken || !!config.admin_token;
-}
-function getCommandPath(cmd) {
-  const parts = [];
-  let current = cmd;
-  while (current && current !== program) {
-    parts.unshift(current.name());
-    current = current.parent;
-  }
-  return parts.join(" ");
-}
-function handleError(commandName, err) {
-  const message = err instanceof Error ? err.message : String(err);
-  sendTelemetry(commandName, 1, message);
-  printError(message);
-  process.exit(1);
-}
-program.hook("preAction", async () => {
-  telemetryCtx.startTime = Date.now();
-  if (isEnabled()) {
-    showNoticeIfNeeded();
-  }
-  try {
-    const file = loadConfigFile();
-    const server = resolveServer();
-    if (server && file.servers?.[server]) {
-      const entry = file.servers[server];
-      await maybeRefreshToken(entry, server, {
-        save: (partial) => saveConfig(partial, server)
-      });
-    }
-  } catch {
-  }
-});
-function sendTelemetry(commandName, exitCode, error) {
-  if (!isEnabled()) return;
-  try {
-    const event = {
-      install_id: getInstallId(),
-      command: commandName,
-      exit_code: exitCode,
-      duration_ms: Date.now() - telemetryCtx.startTime,
-      cli_version: program.version() ?? "0.0.0",
-      os: process.platform,
-      arch: process.arch,
-      node_version: process.version,
-      ts: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    if (error) event.error = error;
-    if (telemetryCtx.channelId && !telemetryCtx.usedToken) {
-      event.channel_id = telemetryCtx.channelId;
-      const config = loadConfig();
-      if (config.server) event.server_url = config.server;
-    }
-    writeEvent(event);
-    flushInBackground();
-  } catch {
-  }
-  telemetryCtx.channelId = void 0;
-  telemetryCtx.usedToken = void 0;
-}
-program.hook("postAction", (_thisCommand, actionCommand) => {
-  sendTelemetry(getCommandPath(actionCommand), 0);
-});
-program.command("dev").description("Start local development server").option("--port <port>", "Server port", "8787").action(async (opts) => {
-  try {
-    await runDev(parseInt(opts.port, 10));
-  } catch (err) {
-    handleError("dev", err);
-  }
-});
-program.command("init").description("Create zooid.json with server identity").option("--use <url>", "Include a template from a GitHub URL").action(async (opts) => {
-  try {
-    await runInit({ use: opts.use });
-  } catch (err) {
-    handleError("init", err);
-  }
-});
-program.command("use <url>").description("Add a template to your workforce via include").action(async (url) => {
-  try {
-    await runUse(url);
-  } catch (err) {
-    handleError("use", err);
-  }
-});
-program.command("deploy").description("Deploy Zooid server to Cloudflare Workers").option("--prune", "Delete server resources not in workforce.json").action(async (opts) => {
-  try {
-    await runDeploy(opts);
-  } catch (err) {
-    handleError("deploy", err);
-  }
-});
-program.command("destroy").description("Destroy a deployed Zooid server and all its data").option("--force", "Skip confirmation prompt").option("--keep-local", "Keep wrangler.toml and state entries").action(async (options) => {
-  try {
-    await runDestroy({
-      force: options.force,
-      keepLocal: options.keepLocal
-    });
-  } catch (err) {
-    handleError("destroy", err);
-  }
-});
-program.command("login").argument("[url]", "Server URL (e.g., https://beno.zoon.eco)").description("Authenticate with Zoon or a specific server").action(async (url) => {
-  try {
-    await runLogin(url);
-  } catch (err) {
-    handleError("login", err);
-  }
-});
-program.command("logout").option("--all", "Log out of all servers").description("Clear authentication for the current server").action(async (opts) => {
-  try {
-    await runLogout(opts);
-  } catch (err) {
-    handleError("logout", err);
-  }
-});
-program.command("whoami").description("Show current identity and auth status").action(async () => {
-  try {
-    const result = await runWhoami();
-    console.log(`Server: ${result.server}`);
-    console.log(`User: ${result.name || result.sub}`);
-    console.log(`Scopes: ${result.scopes.join(", ")}`);
-    if (result.authMethod) {
-      const expStr = result.exp ? ` (expires ${new Date(result.exp * 1e3).toISOString()})` : "";
-      console.log(`Auth: ${result.authMethod}${expStr}`);
-    }
-  } catch (err) {
-    handleError("whoami", err);
-  }
-});
-var configCmd = program.command("config").description("Manage Zooid configuration");
-configCmd.command("set <key> <value>").description("Set a config value (server, admin-token, telemetry)").action((key, value) => {
-  try {
-    runConfigSet(key, value);
-    printSuccess(`Set ${key}`);
-  } catch (err) {
-    handleError("config set", err);
-  }
-});
-configCmd.command("get <key>").description("Get a config value").action((key) => {
-  try {
-    const value = runConfigGet(key);
-    if (value) {
-      console.log(value);
-    } else {
-      console.log("(not set)");
-    }
-  } catch (err) {
-    handleError("config get", err);
-  }
-});
-var channelCmd = program.command("channel").description("Manage channels");
-channelCmd.command("create <id>").description("Create a new channel").option("--name <name>", "Display name (defaults to id)").option("--description <desc>", "Channel description").option("--public", "Make channel public").option("--private", "Make channel private (default)", true).option("--strict", "Enable strict schema validation on publish").option(
-  "--config <file>",
-  "Path to channel config JSON file (types, policies, storage)"
-).option(
-  "--schema <file>",
-  "Path to JSON schema file (map of event types to JSON schemas)"
-).action(async (id, opts) => {
-  try {
-    let config;
-    if (opts.config) {
-      const fs13 = await import("fs");
-      const raw = fs13.readFileSync(opts.config, "utf-8");
-      config = JSON.parse(raw);
-    } else if (opts.schema) {
-      const fs13 = await import("fs");
-      const raw = fs13.readFileSync(opts.schema, "utf-8");
-      const parsed = JSON.parse(raw);
-      const types = {};
-      for (const [eventType, schemaDef] of Object.entries(parsed)) {
-        types[eventType] = { schema: schemaDef };
-      }
-      config = { types };
-    }
-    const result = await runChannelCreate(id, {
-      name: opts.name,
-      description: opts.description,
-      public: opts.public ? true : false,
-      strict: opts.strict,
-      config
-    });
-    printSuccess(`Created channel: ${id}`);
-    printInfo("Token", result.token);
-  } catch (err) {
-    handleError("channel create", err);
-  }
-});
-channelCmd.command("update <id>").description("Update a channel").option("--name <name>", "Display name").option("--description <desc>", "Channel description").option("--tags <tags>", "Comma-separated tags").option("--public", "Make channel public").option("--private", "Make channel private").option("--strict", "Enable strict schema validation on publish").option("--no-strict", "Disable strict schema validation").option(
-  "--config <file>",
-  "Path to channel config JSON file (types, policies, storage)"
-).option(
-  "--schema <file>",
-  "Path to JSON schema file (map of event types to JSON schemas)"
-).action(async (id, opts) => {
-  try {
-    const fields = {};
-    if (opts.name !== void 0) fields.name = opts.name;
-    if (opts.description !== void 0) fields.description = opts.description;
-    if (opts.tags !== void 0)
-      fields.tags = opts.tags.split(",").map((t) => t.trim());
-    if (opts.public) fields.is_public = true;
-    if (opts.private) fields.is_public = false;
-    if (opts.config) {
-      const fs13 = await import("fs");
-      const raw = fs13.readFileSync(opts.config, "utf-8");
-      fields.config = JSON.parse(raw);
-    } else if (opts.schema) {
-      const fs13 = await import("fs");
-      const raw = fs13.readFileSync(opts.schema, "utf-8");
-      const parsed = JSON.parse(raw);
-      const types = {};
-      for (const [eventType, schemaDef] of Object.entries(parsed)) {
-        types[eventType] = { schema: schemaDef };
-      }
-      fields.config = { types };
-    }
-    if (opts.strict !== void 0) {
-      const existing = fields.config ?? {};
-      fields.config = { ...existing, strict_types: opts.strict };
-    }
-    if (Object.keys(fields).length === 0) {
-      throw new Error(
-        "No fields specified. Use --name, --description, --tags, --public, --private, --config, --schema, or --strict."
-      );
-    }
-    const channel = await runChannelUpdate(id, fields);
-    printSuccess(`Updated channel: ${id}`);
-    printInfo("Name", channel.name);
-  } catch (err) {
-    handleError("channel update", err);
-  }
-});
-channelCmd.command("list").description("List all channels").action(async () => {
-  try {
-    const channels = await runChannelList();
-    if (channels.length === 0) {
-      console.log(
-        "No channels yet. Create one with: npx zooid channel create <name>"
-      );
-    } else {
-      for (const ch of channels) {
-        const visibility = ch.is_public ? "public" : "private";
-        console.log(
-          `  ${ch.id} \u2014 ${ch.name} (${visibility}, ${ch.event_count} events)`
-        );
-      }
-    }
-  } catch (err) {
-    handleError("channel list", err);
-  }
-});
-channelCmd.command("delete <id>").description("Delete a channel and all its data").option("-y, --yes", "Skip confirmation prompt").action(async (id, opts) => {
-  try {
-    if (!opts.yes) {
-      const readline7 = await import("readline");
-      const rl = readline7.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const answer = await new Promise((resolve) => {
-        rl.question(
-          `Delete channel "${id}" and all its events and webhooks? [y/N] `,
-          resolve
-        );
-      });
-      rl.close();
-      if (answer.toLowerCase() !== "y") {
-        console.log("Aborted.");
-        return;
-      }
-    }
-    await runChannelDelete(id);
-    printSuccess(`Deleted channel: ${id}`);
-  } catch (err) {
-    handleError("channel delete", err);
-  }
-});
-program.command("pull").description(
-  "Pull channel and role definitions from server into workforce.json"
-).action(async () => {
-  try {
-    await runPull();
-  } catch (err) {
-    handleError("pull", err);
-  }
-});
-program.command("publish <channel> [data]").description(
-  "Publish an event to a channel (accepts JSON arg, --data, --file, or stdin)"
-).option("--type <type>", "Event type").option("--data <json>", "Event data as JSON string").option("--file <path>", "Read event from JSON file").option(
-  "--stream",
-  "Stream mode: read newline-delimited JSON from stdin, publish each line"
-).option("--token <token>", "Auth token (for remote/private channels)").action(async (channel, dataArg, opts) => {
-  try {
-    const { client, channelId, tokenSaved } = resolveChannel(channel, {
-      token: opts.token,
-      tokenType: "publish"
-    });
-    setTelemetryChannel(channelId);
-    if (tokenSaved) {
-      printInfo(
-        "Token saved",
-        `for ${channelId} \u2014 won't need --token next time`
-      );
-    }
-    if (opts.stream) {
-      const { published, errors } = await runPublishStream(
-        channelId,
-        opts,
-        client,
-        (event) => printSuccess(`Published event: ${event.id}`)
-      );
-      const summary = `${published} published`;
-      printSuccess(errors ? `${summary}, ${errors} failed` : summary);
-    } else {
-      const event = await runPublish(channelId, opts, client, dataArg);
-      printSuccess(`Published event: ${event.id}`);
-    }
-  } catch (err) {
-    handleError("publish", err);
-  }
-});
-program.command("delete-event <channel> <event-id>").description("Delete a single event by ID").option("-y, --yes", "Skip confirmation prompt").action(async (channel, eventId, opts) => {
-  try {
-    const { client, channelId } = resolveChannel(channel, {
-      tokenType: "publish"
-    });
-    if (!opts.yes) {
-      const readline7 = await import("readline");
-      const rl = readline7.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const answer = await new Promise((resolve) => {
-        rl.question(
-          `Delete event "${eventId}" from channel "${channelId}"? [y/N] `,
-          resolve
-        );
-      });
-      rl.close();
-      if (answer.toLowerCase() !== "y") {
-        console.log("Aborted.");
-        return;
-      }
-    }
-    await client.deleteEvent(channelId, eventId);
-    printSuccess(`Deleted event: ${eventId}`);
-  } catch (err) {
-    handleError("delete-event", err);
-  }
-});
-program.command("tail <channel>").description("Fetch latest events, or stream live with -f").option("-n, --limit <n>", "Max events to return", "50").option("-f, --follow", "Follow mode \u2014 stream new events as they arrive").option("--type <type>", "Filter events by type").option("--since <iso>", "Only events after this ISO 8601 timestamp").option("--cursor <cursor>", "Resume from a previous cursor").option(
-  "--mode <mode>",
-  "Transport mode for follow: auto, ws, or poll",
-  "auto"
-).option("--interval <ms>", "Poll interval in ms for follow mode", "5000").option("--unseen", "Only show events since your last tail").option("--token <token>", "Auth token (for remote/private channels)").action(async (channel, opts) => {
-  try {
-    let unseenCursor;
-    let unseenSince;
-    if (opts.unseen) {
-      const file = loadConfigFile();
-      const { parseChannelUrl } = await import("./client-4VMFEFDX.js");
-      const { resolveServer: resolveServer2 } = await import("./config-2KK5GX42.js");
-      const parsed = parseChannelUrl(channel);
-      const channelId2 = parsed?.channelId ?? channel;
-      const serverUrl = parsed?.server ?? resolveServer2();
-      const stats = serverUrl ? file.servers?.[serverUrl]?.channels?.[channelId2]?.stats : void 0;
-      if (!stats) {
-        throw new Error(
-          `No tail history for ${channelId2} \u2014 tail it at least once first`
-        );
-      }
-      if (stats.last_event_id) {
-        unseenCursor = stats.last_event_id;
-      } else if (stats.last_tailed_at) {
-        unseenSince = stats.last_tailed_at;
-      }
-    }
-    const { client, channelId, server } = await resolveAndRecord(
-      channel,
-      opts
-    );
-    if (opts.unseen) {
-      if (unseenCursor) {
-        opts.cursor = unseenCursor;
-      } else if (unseenSince) {
-        opts.since = unseenSince;
-      }
-    }
-    if (opts.follow) {
-      const mode = opts.mode;
-      const transport = mode === "auto" ? "auto (WebSocket \u2192 poll fallback)" : mode;
-      console.log(
-        `Tailing ${channelId} [${transport}]${opts.type ? ` type=${opts.type}` : ""}...`
-      );
-      console.log("Press Ctrl+C to stop.\n");
-      await runTail(
-        channelId,
-        {
-          follow: true,
-          mode,
-          interval: parseInt(opts.interval, 10),
-          type: opts.type
-        },
-        client
-      );
-    } else {
-      const result = await runTail(
-        channelId,
-        {
-          limit: parseInt(opts.limit, 10),
-          type: opts.type,
-          since: opts.since,
-          cursor: opts.cursor
-        },
-        client
-      );
-      if (result.events.length > 0) {
-        const lastEvent = result.events[result.events.length - 1];
-        recordTailHistory(channelId, server, void 0, lastEvent.id);
-      }
-      if (result.events.length === 0) {
-        console.log("No events.");
-      } else {
-        for (const event of result.events) {
-          console.log(JSON.stringify(event));
-        }
-      }
-      if (result.cursor) {
-        printInfo("Cursor", result.cursor);
-      }
-    }
-  } catch (err) {
-    handleError("tail", err);
-  }
-});
-program.command("subscribe <channel>").description("Subscribe to a channel").option("--webhook <url>", "Register a webhook instead of polling").option("--interval <ms>", "Poll interval in milliseconds", "5000").option("--mode <mode>", "Transport mode: auto, ws, or poll", "auto").option("--type <type>", "Filter events by type").option("--token <token>", "Auth token (for remote/private channels)").action(async (channel, opts) => {
-  try {
-    const { client, channelId } = await resolveAndRecord(channel, opts);
-    if (opts.webhook) {
-      const wh = await runSubscribeWebhook(channelId, opts.webhook, client);
-      printSuccess(`Registered webhook: ${wh.id}`);
-      printInfo("URL", wh.url);
-      printInfo("Expires", wh.expires_at);
-    } else {
-      const mode = opts.mode;
-      const transport = mode === "auto" ? "auto (WebSocket \u2192 poll fallback)" : mode;
-      console.log(
-        `Subscribing to ${channelId} [${transport}]${opts.type ? ` type=${opts.type}` : ""}...`
-      );
-      console.log("Press Ctrl+C to stop.\n");
-      await runSubscribePoll(
-        channelId,
-        {
-          interval: parseInt(opts.interval, 10),
-          mode,
-          type: opts.type
-        },
-        client
-      );
-      await new Promise(() => {
-      });
-    }
-  } catch (err) {
-    handleError("subscribe", err);
-  }
-});
-var serverCmd = program.command("server").description("Manage server metadata");
-serverCmd.command("get").description("Show server metadata").action(async () => {
-  try {
-    const meta = await runServerGet();
-    console.log(`
-  ${meta.name}
-`);
-    if (meta.description) printInfo("Description", meta.description);
-    if (meta.tags.length > 0) printInfo("Tags", meta.tags.join(", "));
-    if (meta.owner) printInfo("Owner", meta.owner);
-    if (meta.company) printInfo("Company", meta.company);
-    if (meta.email) printInfo("Email", meta.email);
-    printInfo("Updated", meta.updated_at);
-    console.log("");
-  } catch (err) {
-    handleError("server get", err);
-  }
-});
-serverCmd.command("set").description("Update server metadata").option("--name <name>", "Server name").option("--description <desc>", "Server description").option("--tags <tags>", "Comma-separated tags").option("--owner <owner>", "Server owner").option("--company <company>", "Company name").option("--email <email>", "Contact email").action(async (opts) => {
-  try {
-    const fields = {};
-    if (opts.name !== void 0) fields.name = opts.name;
-    if (opts.description !== void 0) fields.description = opts.description;
-    if (opts.tags !== void 0)
-      fields.tags = opts.tags.split(",").map((t) => t.trim());
-    if (opts.owner !== void 0) fields.owner = opts.owner;
-    if (opts.company !== void 0) fields.company = opts.company;
-    if (opts.email !== void 0) fields.email = opts.email;
-    if (Object.keys(fields).length === 0) {
-      throw new Error(
-        "No fields specified. Use --name, --description, --tags, --owner, --company, or --email."
-      );
-    }
-    const meta = await runServerSet(fields);
-    printSuccess(`Updated server metadata`);
-    printInfo("Name", meta.name);
-    console.log("");
-  } catch (err) {
-    handleError("server set", err);
-  }
-});
-var tokenCmd = program.command("token").description("Manage tokens");
-tokenCmd.command("mint").description(
-  "Mint a new token. Scopes: admin, pub:<channel>, sub:<channel>. Wildcards: pub:*, sub:prefix-*"
-).argument(
-  "[scopes...]",
-  "Scopes to grant (e.g. admin, pub:my-channel, sub:*)"
-).option(
-  "--role <roles...>",
-  "Mint with scopes from named roles (reads workforce.json)"
-).option("--sub <sub>", "Subject identifier (e.g. publisher ID)").option("--name <name>", "Display name (used for publisher identity)").option("--expires-in <duration>", "Token expiry (e.g. 5m, 1h, 7d, 30d)").action(async (scopes, opts) => {
-  try {
-    if (!opts.role?.length && (!scopes || scopes.length === 0)) {
-      printError("Provide scopes or --role");
-      process.exit(1);
-    }
-    if (!opts.role?.length) {
-      for (const s of scopes) {
-        if (s !== "admin" && !s.startsWith("pub:") && !s.startsWith("sub:")) {
-          printError(
-            `Invalid scope "${s}". Must be "admin", "pub:<channel>", or "sub:<channel>"`
-          );
-          process.exit(1);
-        }
-      }
-    }
-    const result = await runTokenMint(scopes ?? [], {
-      sub: opts.sub,
-      name: opts.name,
-      expiresIn: opts.expiresIn,
-      role: opts.role
-    });
-    console.log(result.token);
-  } catch (err) {
-    handleError("token", err);
-  }
-});
-program.command("status").description("Check server status").action(async () => {
-  try {
-    const { discovery, identity } = await runStatus();
-    console.log(`
-  ${identity.name} v${discovery.version}
-`);
-    printInfo("Server ID", discovery.server_id);
-    printInfo("Algorithm", discovery.algorithm);
-    printInfo("Poll interval", `${discovery.poll_interval}s`);
-    printInfo("Delivery", discovery.delivery.join(", "));
-    console.log("");
-  } catch (err) {
-    handleError("status", err);
-  }
-});
-program.command("history").description("Show tail/subscribe history").option("-n, --limit <n>", "Max entries to show", "20").option("--json", "Output as JSON").action((opts) => {
-  try {
-    const entries = runHistory();
-    const limit = parseInt(opts.limit, 10);
-    const shown = entries.slice(0, limit);
-    if (shown.length === 0) {
-      console.log("No tail/subscribe history yet.");
-      return;
-    }
-    if (opts.json) {
-      console.log(JSON.stringify(shown, null, 2));
-      return;
-    }
-    console.log("");
-    for (const entry of shown) {
-      const ago = formatRelative(entry.last_tailed_at);
-      const label = entry.name ?? entry.channel_id;
-      const url = `${entry.server}/${entry.channel_id}`;
-      console.log(`  ${label}  ${url}`);
-      console.log(
-        `    ${entry.num_tails} tail${entry.num_tails === 1 ? "" : "s"}, last ${ago}`
-      );
-    }
-    console.log("");
-  } catch (err) {
-    handleError("history", err);
-  }
-});
-program.command("share [channels...]").description("List channels in the Zooid Directory").option("--channel <id>", "Channel to share (alternative to positional args)").option("-y, --yes", "Skip prompts, use server values for description/tags").action(async (channels, opts) => {
-  try {
-    const ids = opts.channel ? [opts.channel, ...channels] : channels;
-    await runShare(ids, { yes: opts.yes });
-    printSuccess("Channels shared to directory");
-  } catch (err) {
-    handleError("share", err);
-  }
-});
-program.command("discover").description("Browse public channels in the Zooid Directory").option("-q, --query <text>", "Search by keyword").option("-t, --tag <tag>", "Filter by tag").option("-n, --limit <n>", "Max results", "20").action(async (opts) => {
-  try {
-    await runDiscover({
-      query: opts.query,
-      tag: opts.tag,
-      limit: parseInt(opts.limit, 10)
-    });
-  } catch (err) {
-    handleError("discover", err);
-  }
-});
-program.command("unshare <channel>").description("Remove a channel from the Zooid Directory").action(async (channel) => {
-  try {
-    await runUnshare(channel);
-    printSuccess(`Removed ${channel} from directory`);
-  } catch (err) {
-    handleError("unshare", err);
-  }
-});
-var roleCmd = program.command("role").description("Manage role definitions");
-roleCmd.command("create <id>").description("Create a role definition in workforce.json").option("--name <name>", "Display name").option("--description <desc>", "Role description").argument("<scopes...>", "Scopes to grant (e.g. pub:signals sub:market-data)").action((id, scopes, opts) => {
-  try {
-    for (const s of scopes) {
-      if (s !== "admin" && !s.startsWith("pub:") && !s.startsWith("sub:")) {
-        printError(
-          `Invalid scope "${s}". Must be "admin", "pub:<channel>", or "sub:<channel>"`
-        );
-        process.exit(1);
-      }
-    }
-    runRoleCreate(id, {
-      name: opts.name,
-      description: opts.description,
-      scopes
-    });
-    printSuccess(`Created role "${id}" in workforce.json`);
-    printInfo("Next", "Run `npx zooid deploy` to sync to server");
-  } catch (err) {
-    handleError("role create", err);
-  }
-});
-roleCmd.command("list").description("List role definitions in workforce.json").action(() => {
-  try {
-    const ids = runRoleList();
-    if (ids.length === 0) {
-      console.log(
-        "No roles defined. Create one with: npx zooid role create <id> <scopes...>"
-      );
-    } else {
-      for (const id of ids) {
-        console.log(`  ${id}`);
-      }
-    }
-  } catch (err) {
-    handleError("role list", err);
-  }
-});
-roleCmd.command("update <id>").description("Update a role definition in workforce.json").option("--name <name>", "Display name").option("--description <desc>", "Role description").option("--scopes <scopes...>", "Replace scopes").action((id, opts) => {
-  try {
-    const fields = {};
-    if (opts.name !== void 0) fields.name = opts.name;
-    if (opts.description !== void 0) fields.description = opts.description;
-    if (opts.scopes !== void 0) fields.scopes = opts.scopes;
-    if (Object.keys(fields).length === 0) {
-      throw new Error(
-        "No fields specified. Use --name, --description, or --scopes."
-      );
-    }
-    runRoleUpdate(id, fields);
-    printSuccess(`Updated role "${id}" in workforce.json`);
-    printInfo("Next", "Run `npx zooid deploy` to sync to server");
-  } catch (err) {
-    handleError("role update", err);
-  }
-});
-roleCmd.command("delete <id>").description("Delete a role definition from workforce.json").option("-y, --yes", "Skip confirmation prompt").action(async (id, opts) => {
-  try {
-    if (!opts.yes) {
-      const readline7 = await import("readline");
-      const rl = readline7.createInterface({
-        input: process.stdin,
-        output: process.stdout
-      });
-      const answer = await new Promise((resolve) => {
-        rl.question(
-          `Delete role "${id}" from workforce.json? [y/N] `,
-          resolve
-        );
-      });
-      rl.close();
-      if (answer.toLowerCase() !== "y") {
-        console.log("Aborted.");
-        return;
-      }
-    }
-    runRoleDelete(id);
-    printSuccess(`Deleted role "${id}" from workforce.json`);
-    printInfo("Next", "Run `npx zooid deploy` to sync to server");
-  } catch (err) {
-    handleError("role delete", err);
-  }
-});
-var credentialsCmd = program.command("credentials").description("Manage M2M agent credentials");
-credentialsCmd.command("create <name>").option("--role <role...>", "Role names to assign").description("Create a new credential (outputs .env to stdout)").action(async (name, opts) => {
-  try {
-    const env = await runCredentialsCreate(name, opts);
-    process.stdout.write(env + "\n");
-  } catch (err) {
-    handleError("credentials create", err);
-  }
-});
-credentialsCmd.command("list").description("List all credentials for the current server").action(async () => {
-  try {
-    const creds = await runCredentialsList();
-    if (creds.length === 0) {
-      printInfo("No credentials", "found for this server");
-      return;
-    }
-    for (const c of creds) {
-      const roleNames = c.roles.map((r) => r.name ?? r).join(", ");
-      console.log(
-        `  ${c.name.padEnd(20)} ${c.client_id.padEnd(35)} roles: ${roleNames}`
-      );
-    }
-  } catch (err) {
-    handleError("credentials list", err);
-  }
-});
-credentialsCmd.command("rotate <name>").description("Rotate credential secret (outputs .env to stdout)").action(async (name) => {
-  try {
-    const env = await runCredentialsRotate(name);
-    process.stdout.write(env + "\n");
-  } catch (err) {
-    handleError("credentials rotate", err);
-  }
-});
-credentialsCmd.command("revoke <name>").description("Revoke (delete) a credential").action(async (name) => {
-  try {
-    await runCredentialsRevoke(name);
-  } catch (err) {
-    handleError("credentials revoke", err);
-  }
-});
-program.parse();
+  buildAcpRegistry
+} from "./chunk-SUPTPSN3.js";
 export {
-  setTelemetryChannel
+  buildAcpRegistry
 };
+//# sourceMappingURL=index.js.map