fix: add rust-toolchain.toml to pin Rust 1.94 for CI

The aarch64-unknown-linux-gnu runner ships rustc 1.93 which doesn't
satisfy rust-version = "1.94". Pin the toolchain so cargo-dist
installs the correct version.

Also adds docs/RELEASING.md, AGENTS.md, and fixes README license.

Author: NeoScript

AGENTS.md

@@ -0,0 +1,85 @@
+# AGENTS.md — Notes for AI coding agents
+
+## Project overview
+
+**fbadmin** is a Rust CLI for Firebase Authentication administration. It wraps the `rs-firebase-admin-sdk` crate and provides subcommands for user management, custom claims, auth action links, and emulator utilities.
+
+## Repository layout
+
+```
+src/
+  main.rs           # CLI struct (clap derive), arg parsing, command dispatch
+  config.rs         # Profile/config management (confy, TOML, local overrides)
+  firebase.rs       # AuthBackend enum, init_firebase() — SDK initialization
+  output.rs         # Render helpers: table, JSON, CSV, colored messages
+  prompt.rs         # Interactive prompts (dialoguer) for missing args
+  errors.rs         # IntoAnyhow trait for error-stack → anyhow conversion
+  commands/
+    mod.rs          # Re-exports
+    users.rs        # users get/create/disable/enable/remove/list/list-inactive/count
+    claims.rs       # claims get/merge/remove/clear/find
+    links.rs        # links password-reset/email-verify/sign-in
+    emulator.rs     # emulator clear-users/config
+    config_cmd.rs   # config init/add/remove/default/list/show/which/path
+    info.rs         # info — resolved connection + connectivity check
+build.rs            # vergen-gitcl: embeds git SHA + build date into --version
+dist-workspace.toml # cargo-dist release configuration
+Cargo.toml          # Dependencies, package metadata, profiles
+```
+
+## Key patterns
+
+- **CLI structure**: All args are defined in `main.rs` via clap derive. Each command module has a `pub async fn run(cli: &Cli, command: &XxxCommand)` entry point.
+- **Error handling**: SDK calls return `Result<T, error_stack::Report<ApiClientError>>`. Use the `IntoAnyhow` trait (`.into_anyhow()`) to convert, then chain `.context("human-readable message")` for user-facing errors.
+- **Interactive prompts**: When a required arg is `None`, command modules call `prompt::resolve_email()` or similar. These use `dialoguer` and are TTY-aware.
+- **Output**: Always go through `output.rs` helpers (`render_single_record`, `render_table`, `render_success`, etc.) — they handle `--format` switching (table/json/csv) and colored output.
+- **Config resolution**: Profile is resolved from CLI flag → `FBADMIN_PROFILE` env → `default_profile` in config. Connection merges profile settings with CLI overrides. See `config::resolve_connection()`.
+- **Firebase init**: `firebase::init_firebase()` takes an `AuthBackend` enum (Emulator or Live with optional credentials/project). The `build_auth` helper in command modules wires config → AuthBackend → FirebaseAuth.
+- **Logging**: `tracing` with `tracing-subscriber`. Controlled by `-v` flag count. Logs go to stderr. Use `tracing::debug!` for internal details, `tracing::info!` for notable operations.
+
+## Build and run
+
+```bash
+cargo build                  # Debug build
+cargo run -- users list      # Run with args
+cargo clippy                 # Lint
+cargo fmt                    # Format
+```
+
+The project requires Rust 1.94+ (edition 2024).
+
+## Releasing
+
+See [docs/RELEASING.md](docs/RELEASING.md) for the full release process. Short version:
+
+1. Bump `version` in `Cargo.toml`
+2. Update `RELEASES.md`
+3. `git tag vX.Y.Z && git push origin main --tags`
+
+## Dependencies of note
+
+| Crate | Purpose |
+|-------|---------|
+| `rs-firebase-admin-sdk` | Firebase Auth SDK (community) |
+| `google-cloud-auth` | ADC / service account auth |
+| `clap` (derive) | CLI argument parsing |
+| `confy` | OS-appropriate config file management |
+| `dialoguer` | Interactive terminal prompts |
+| `comfy-table` | Table rendering |
+| `console` | TTY detection, colored/styled output |
+| `anyhow` + `error-stack` | Error handling layers |
+| `tracing` | Structured logging |
+| `vergen-gitcl` | Build-time git metadata |
+
+## Things to watch out for
+
+- **`rs-firebase-admin-sdk` is community-maintained** — check for API changes when updating. There is no official Rust Firebase SDK.
+- **`IntoAnyhow` trait** in `errors.rs` is the bridge between `error-stack` (used by the SDK) and `anyhow` (used everywhere else). Always use it for SDK calls.
+- **`build.rs`** uses `vergen-gitcl` which shells out to `git`. CI builds need git available.
+- **The `.docs/` directory** contains internal design documents and is gitignored. It's not shipped or published.
+- **Config file paths** are OS-dependent (managed by `confy`). Don't hardcode paths.
+- **Destructive commands** (`remove`, `clear`, `disable`) should always respect `--dry-run` and `--yes` flags.
+
+## License
+
+AGPL-3.0-only

README.md

@@ -131,4 +131,4 @@ fbadmin claims get --email user@example.com -f json  # Single record as JSON
 
 ## License
 
-MIT
+AGPL-3.0-only — see [LICENSE](LICENSE).

docs/RELEASING.md

@@ -0,0 +1,101 @@
+# Releasing fbadmin
+
+Releases are automated via [cargo-dist](https://opensource.axo.dev/cargo-dist/). Pushing a semver tag triggers GitHub Actions which builds binaries, creates a GitHub Release, and publishes a Homebrew formula.
+
+## Prerequisites
+
+- Push access to `NeoScript/firebase-admin-cli`
+- `HOMEBREW_TAP_TOKEN` repo secret set on `firebase-admin-cli` — a fine-grained PAT with **Contents: Read and write** on `NeoScript/homebrew-fbadmin`
+
+## Release checklist
+
+1. **Bump the version** in `Cargo.toml`:
+
+   ```toml
+   [package]
+   version = "0.2.0"
+   ```
+
+2. **Update RELEASES.md** — add a section for the new version at the top:
+
+   ```markdown
+   # v0.2.0
+
+   - Added feature X
+   - Fixed bug Y
+   ```
+
+3. **Regenerate the release workflow** (only needed if you changed `dist-workspace.toml`):
+
+   ```bash
+   dist generate
+   ```
+
+4. **Commit**:
+
+   ```bash
+   git add -A
+   git commit -m "chore: prepare v0.2.0 release"
+   ```
+
+5. **Tag and push**:
+
+   ```bash
+   git tag v0.2.0
+   git push origin main --tags
+   ```
+
+6. **Monitor** the Release workflow at https://github.com/NeoScript/firebase-admin-cli/actions
+
+## What the workflow does
+
+The `release.yml` workflow:
+
+1. **plan** — determines what to build from the tag
+2. **build-local-artifacts** — compiles binaries for each target:
+   - `aarch64-apple-darwin` (Apple Silicon)
+   - `x86_64-apple-darwin` (Intel Mac)
+   - `aarch64-unknown-linux-gnu` (Linux ARM64)
+   - `x86_64-unknown-linux-gnu` (Linux x64)
+   - `x86_64-pc-windows-msvc` (Windows x64)
+3. **build-global-artifacts** — generates shell/powershell installer scripts and checksums
+4. **host** — creates the GitHub Release and uploads all artifacts
+5. **publish-homebrew-formula** — pushes a `.rb` formula to `NeoScript/homebrew-fbadmin`
+6. **announce** — finalizes the release
+
+## Configuration
+
+Release settings live in `dist-workspace.toml`:
+
+```toml
+[dist]
+cargo-dist-version = "0.31.0"
+ci = "github"
+installers = ["shell", "powershell", "homebrew"]
+targets = [...]
+tap = "NeoScript/homebrew-fbadmin"
+publish-jobs = ["homebrew"]
+```
+
+To change targets, installers, or upgrade cargo-dist, edit this file and run `dist generate` to regenerate the workflow.
+
+## Adding a new target
+
+1. Add the Rust target triple to `targets` in `dist-workspace.toml`
+2. Run `dist generate`
+3. Commit the updated `dist-workspace.toml` and `.github/workflows/release.yml`
+
+## Troubleshooting
+
+- **Workflow didn't trigger**: the workflow must already exist on the branch when the tag is pushed. If you added the workflow and tag in the same push, delete and re-push the tag:
+
+  ```bash
+  git push origin :refs/tags/vX.Y.Z
+  git tag -d vX.Y.Z
+  git tag vX.Y.Z
+  git push origin vX.Y.Z
+  ```
+
+- **Homebrew publish failed**: verify the `HOMEBREW_TAP_TOKEN` secret is set and the PAT hasn't expired. The token needs **Contents: Read and write** on `NeoScript/homebrew-fbadmin`.
+
+- **Build failed for a target**: check the build logs in GitHub Actions. Common causes are missing system deps for cross-compilation or Rust version mismatches.

rust-toolchain.toml

@@ -0,0 +1,2 @@
+[toolchain]
+channel = "1.94"