@braid-cloud/cli 0.1.18 → 0.1.20

package/dist/index.js

@@ -18,10 +18,28 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/lib/automation-headers.ts
+import process3 from "process";
+var VERCEL_AUTOMATION_BYPASS_SECRET, mergeAutomationHeaders;
+var init_automation_headers = __esm({
+  "src/lib/automation-headers.ts"() {
+    "use strict";
+    init_esm_shims();
+    VERCEL_AUTOMATION_BYPASS_SECRET = process3.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+    mergeAutomationHeaders = (headers) => {
+      const merged = new Headers(headers);
+      if (VERCEL_AUTOMATION_BYPASS_SECRET) {
+        merged.set("x-vercel-protection-bypass", VERCEL_AUTOMATION_BYPASS_SECRET);
+      }
+      return merged.entries().next().done ? void 0 : merged;
+    };
+  }
+});
+
 // src/lib/braid-workspace.ts
 import { existsSync, readFileSync } from "fs";
 import { dirname as dirname3, join as join2 } from "path";
-import process3 from "process";
+import process4 from "process";
 function readPackageName(packagePath) {
   if (!existsSync(packagePath)) {
     return void 0;
@@ -38,7 +56,7 @@ function readPackageName(packagePath) {
 function isBraidWorkspaceRoot(directory) {
   return readPackageName(join2(directory, "package.json")) === BRAID_WORKSPACE_NAME;
 }
-function findBraidWorkspaceRoot(startDir = process3.cwd()) {
+function findBraidWorkspaceRoot(startDir = process4.cwd()) {
   let currentDir = startDir;
   while (true) {
     if (isBraidWorkspaceRoot(currentDir)) {
@@ -108,9 +126,9 @@ import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join3, parse } from "path";
-import process4 from "process";
+import process5 from "process";
 import { Data as Data2, Effect as Effect3, pipe as pipe3 } from "effect";
-var CONFIG_DIR, CONFIG_FILE, PROJECT_CONFIG_FILENAME, USER_CONFIG_FILENAME, CONVEX_CLOUD_SUFFIX_REGEX, LOCAL_CONVEX_PORT_REGEX, LOCAL_SERVER_ENV_FILES, LOOPBACK_HOSTS, NEWLINE_REGEX, TRAILING_SLASHES, ConfigReadError, ConfigWriteError, findConfigFile, findProjectConfigFile, findUserConfigFile, stripQuotes, parseDotenv, normalizeBaseUrl, resolveConvexSiteUrl, resolveLocalServerUrlFromEnv, resolveLocalServerUrlFromFiles, resolveLocalServerUrl, loadProjectConfig, loadUserConfig, resolveUserConfigWritePath, resolveProjectConfigWritePath, saveUserConfig, saveProjectConfig, isValidServerUrl, resolveServerUrlFromConfig, applyConfigSource, applyEnvOverrides, createDefaultMergedConfig, loadMergedConfig, loadConfig, saveConfig, getApiKey, setApiKey, getServerUrl, clearApiKey, getDemoContext, setDemoContext, clearDemoContext, loadConfigAsync, loadProjectConfigAsync, loadUserConfigAsync, loadMergedConfigAsync, findProjectConfigFileAsync, findUserConfigFileAsync, saveConfigAsync, saveUserConfigAsync, saveProjectConfigAsync, getApiKeyAsync, setApiKeyAsync, persistApiKeyAsync, getServerUrlAsync, clearApiKeyAsync, getDemoContextAsync, setDemoContextAsync, clearDemoContextAsync;
+var CONFIG_DIR, CONFIG_FILE, PROJECT_CONFIG_FILENAME, USER_CONFIG_FILENAME, CONVEX_CLOUD_SUFFIX_REGEX, LOCAL_CONVEX_PORT_REGEX, LOCAL_SERVER_ENV_FILES, LOOPBACK_HOSTS, NEWLINE_REGEX, TRAILING_SLASHES, ConfigReadError, ConfigWriteError, findConfigFile, findProjectConfigFile, findUserConfigFile, stripQuotes, parseDotenv, normalizeBaseUrl, resolveConvexSiteUrl, resolveLocalServerUrlFromEnv, resolveLocalServerUrlFromFiles, resolveLocalServerUrl, loadProjectConfig, loadUserConfig, resolveUserConfigWritePath, resolveProjectConfigWritePath, saveUserConfig, saveProjectConfig, isValidServerUrl, resolveServerUrlFromConfig, applyConfigSource, applyGlobalConfigSource, applyEnvOverrides, createDefaultMergedConfig, loadMergedConfig, loadConfig, saveConfig, getApiKey, setApiKey, getServerUrl, clearApiKey, getDemoContext, setDemoContext, clearDemoContext, loadConfigAsync, loadProjectConfigAsync, loadUserConfigAsync, loadMergedConfigAsync, findProjectConfigFileAsync, findUserConfigFileAsync, saveConfigAsync, saveUserConfigAsync, saveProjectConfigAsync, getApiKeyAsync, setApiKeyAsync, persistApiKeyAsync, getServerUrlAsync, clearApiKeyAsync, getDemoContextAsync, setDemoContextAsync, clearDemoContextAsync;
 var init_config = __esm({
   "src/lib/config.ts"() {
     "use strict";
@@ -133,7 +151,7 @@ var init_config = __esm({
     };
     ConfigWriteError = class extends Data2.TaggedError("ConfigWriteError") {
     };
-    findConfigFile = (filename, startDir = process4.cwd()) => {
+    findConfigFile = (filename, startDir = process5.cwd()) => {
       let currentDir = startDir;
       while (true) {
         const configPath = join3(currentDir, filename);
@@ -147,8 +165,8 @@ var init_config = __esm({
         currentDir = parsed.dir;
       }
     };
-    findProjectConfigFile = (startDir = process4.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
-    findUserConfigFile = (startDir = process4.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
+    findProjectConfigFile = (startDir = process5.cwd()) => findConfigFile(PROJECT_CONFIG_FILENAME, startDir);
+    findUserConfigFile = (startDir = process5.cwd()) => findConfigFile(USER_CONFIG_FILENAME, startDir);
     stripQuotes = (value) => {
       if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
         return value.slice(1, -1);
@@ -207,7 +225,7 @@ var init_config = __esm({
       }
       return void 0;
     };
-    resolveLocalServerUrlFromFiles = (startDir = process4.cwd()) => {
+    resolveLocalServerUrlFromFiles = (startDir = process5.cwd()) => {
       const workspaceRoot = findBraidWorkspaceRoot(startDir);
       if (!workspaceRoot) {
         return void 0;
@@ -226,7 +244,7 @@ var init_config = __esm({
       }
       return void 0;
     };
-    resolveLocalServerUrl = (startDir = process4.cwd()) => resolveLocalServerUrlFromEnv(process4.env) ?? resolveLocalServerUrlFromFiles(startDir);
+    resolveLocalServerUrl = (startDir = process5.cwd()) => resolveLocalServerUrlFromEnv(process5.env) ?? resolveLocalServerUrlFromFiles(startDir);
     loadProjectConfig = () => Effect3.tryPromise({
       try: async () => {
         const configPath = await findProjectConfigFile();
@@ -249,9 +267,9 @@ var init_config = __esm({
       },
       catch: () => void 0
     }).pipe(Effect3.orElseSucceed(() => void 0));
-    resolveUserConfigWritePath = (startDir = process4.cwd()) => findUserConfigFile(startDir) ?? join3(startDir, USER_CONFIG_FILENAME);
-    resolveProjectConfigWritePath = (startDir = process4.cwd()) => findProjectConfigFile(startDir) ?? join3(startDir, PROJECT_CONFIG_FILENAME);
-    saveUserConfig = (config, startDir = process4.cwd()) => {
+    resolveUserConfigWritePath = (startDir = process5.cwd()) => findUserConfigFile(startDir) ?? join3(startDir, USER_CONFIG_FILENAME);
+    resolveProjectConfigWritePath = (startDir = process5.cwd()) => findProjectConfigFile(startDir) ?? join3(startDir, PROJECT_CONFIG_FILENAME);
+    saveUserConfig = (config, startDir = process5.cwd()) => {
       const targetPath = resolveUserConfigWritePath(startDir);
       return pipe3(
         Effect3.tryPromise({
@@ -267,7 +285,7 @@ var init_config = __esm({
         })
       );
     };
-    saveProjectConfig = (config, startDir = process4.cwd()) => {
+    saveProjectConfig = (config, startDir = process5.cwd()) => {
       const targetPath = resolveProjectConfigWritePath(startDir);
       return pipe3(
         Effect3.tryPromise({
@@ -343,11 +361,17 @@ var init_config = __esm({
         merged.token = config.token;
       }
     };
+    applyGlobalConfigSource = (merged, config) => {
+      const serverUrl = resolveServerUrlFromConfig(config);
+      if (serverUrl) {
+        merged.serverUrl = serverUrl;
+      }
+    };
     applyEnvOverrides = (merged) => {
-      if (process4.env.BRAID_API_KEY) {
-        merged.token = process4.env.BRAID_API_KEY;
+      if (process5.env.BRAID_API_KEY) {
+        merged.token = process5.env.BRAID_API_KEY;
       }
-      const envServerUrl = process4.env.BRAID_SKILLS_SERVER_URL ?? process4.env.BRAID_SERVER_URL;
+      const envServerUrl = process5.env.BRAID_SKILLS_SERVER_URL ?? process5.env.BRAID_SERVER_URL;
       if (envServerUrl && isValidServerUrl(envServerUrl)) {
         merged.serverUrl = envServerUrl;
       }
@@ -367,6 +391,7 @@ var init_config = __esm({
       }),
       Effect3.map(({ projectConfig, userConfig, globalConfig }) => {
         const merged = createDefaultMergedConfig();
+        applyGlobalConfigSource(merged, globalConfig);
         applyConfigSource(merged, projectConfig);
         applyConfigSource(merged, userConfig);
         applyEnvOverrides(merged);
@@ -402,7 +427,7 @@ var init_config = __esm({
       })
     );
     getApiKey = () => pipe3(
-      Effect3.succeed(process4.env.BRAID_API_KEY),
+      Effect3.succeed(process5.env.BRAID_API_KEY),
       Effect3.flatMap(
         (envKey) => envKey ? Effect3.succeed(envKey) : pipe3(
           loadUserConfig(),
@@ -420,7 +445,7 @@ var init_config = __esm({
       Effect3.flatMap((config) => saveConfig({ ...config, apiKey }))
     );
     getServerUrl = () => pipe3(
-      Effect3.succeed(process4.env.BRAID_SERVER_URL),
+      Effect3.succeed(process5.env.BRAID_SERVER_URL),
       Effect3.flatMap(
         (envUrl) => envUrl ? Effect3.succeed(envUrl) : pipe3(
           loadUserConfig(),
@@ -498,89 +523,226 @@ var init_config = __esm({
   }
 });
 
-// src/lib/api.ts
-import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
-var TRAILING_SLASH_REGEX, ALLOW_UNTRUSTED_SERVER_ENV, isTruthy, isLocalHost, isTrustedApiServerUrl, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, normalizeApiServerBaseUrl, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildLibraryOptionsUrl, fetchLibraryOptions, fetchSkills, runLifecycleCommand, DEFAULT_PUBLIC_SERVER_URL, NotFoundError, RateLimitedError, handlePublicApiResponse, fetchPublicMetadata, fetchPublicExport, fetchPublicMetadataAsync, fetchPublicExportAsync, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchLibraryOptionsAsync, runLifecycleCommandAsync;
-var init_api = __esm({
-  "src/lib/api.ts"() {
+// src/lib/device-auth.ts
+import { execFile } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { hostname, platform } from "os";
+import { join as join4 } from "path";
+import process6 from "process";
+function resolveAuthWebBaseUrl(serverUrl) {
+  const canonicalBaseUrl = resolveCanonicalAuthWebBaseUrl(serverUrl);
+  try {
+    const url = new URL(canonicalBaseUrl);
+    const localAuthBaseUrl = resolveLocalAuthWebBaseUrl();
+    if (localAuthBaseUrl && (DEFAULT_BRAID_AUTH_HOSTS.has(url.hostname) || isLoopbackHost(url.hostname))) {
+      return localAuthBaseUrl;
+    }
+    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+  } catch {
+    return canonicalBaseUrl;
+  }
+}
+function buildAuthVerificationUrlFromBaseUrl(authBaseUrl, userCode) {
+  return `${authBaseUrl.replace(TRAILING_SLASHES2, "")}/cli/authorize?user_code=${encodeURIComponent(userCode)}`;
+}
+async function fetchAuthConfigFromBaseUrl(authBaseUrl) {
+  const headers = mergeAutomationHeaders();
+  const authConfigUrl = `${authBaseUrl}/api/cli/auth-config`;
+  const response = headers ? await fetch(authConfigUrl, { headers }) : await fetch(authConfigUrl);
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch auth config (${response.status}): ${body}`
+    );
+  }
+  return {
+    ...await response.json(),
+    verificationBaseUrl: authBaseUrl
+  };
+}
+async function fetchAuthConfig(serverUrl) {
+  const authBaseUrl = resolveAuthWebBaseUrl(serverUrl).replace(
+    TRAILING_SLASHES2,
+    ""
+  );
+  const canonicalAuthBaseUrl = resolveCanonicalAuthWebBaseUrl(
+    serverUrl
+  ).replace(TRAILING_SLASHES2, "");
+  try {
+    return await fetchAuthConfigFromBaseUrl(authBaseUrl);
+  } catch (error) {
+    if (authBaseUrl !== canonicalAuthBaseUrl && isHostedBraidAuthServer(serverUrl)) {
+      return fetchAuthConfigFromBaseUrl(canonicalAuthBaseUrl);
+    }
+    throw error;
+  }
+}
+async function initiateDeviceAuth(convexSiteUrl, deviceInfo) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/device/authorize`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: mergeAutomationHeaders({
+      "Content-Type": "application/json"
+    }),
+    body: JSON.stringify(deviceInfo)
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to initiate device authorization (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function pollForSession(convexSiteUrl, deviceCode, interval, expiresIn, timeoutSeconds) {
+  const tokenUrl = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/device/token`;
+  const deadline = Date.now() + Math.min(expiresIn, timeoutSeconds) * 1e3;
+  let currentInterval = interval;
+  while (Date.now() < deadline) {
+    await sleep(currentInterval * 1e3);
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: mergeAutomationHeaders({
+        "Content-Type": "application/json"
+      }),
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    if (response.ok) {
+      const result = await response.json();
+      return {
+        sessionToken: result.session_token,
+        expiresAt: result.expires_at,
+        user: result.user
+      };
+    }
+    let errorCode;
+    try {
+      const errorBody = await response.json();
+      errorCode = errorBody.error;
+    } catch {
+      throw new Error(`Device auth polling error: HTTP ${response.status}`);
+    }
+    if (errorCode === "authorization_pending") {
+      continue;
+    }
+    if (errorCode === "slow_down") {
+      currentInterval += 5;
+      continue;
+    }
+    if (errorCode === "expired_token") {
+      throw new DeviceAuthExpiredError();
+    }
+    if (errorCode === "access_denied") {
+      throw new DeviceAuthDeniedError();
+    }
+    throw new Error(
+      `Device auth polling error: ${errorCode ?? `HTTP ${response.status}`}`
+    );
+  }
+  throw new DeviceAuthTimeoutError();
+}
+async function fetchSessionInfo(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: mergeAutomationHeaders({
+      Authorization: `Bearer ${sessionToken}`
+    })
+  });
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(
+      `Failed to fetch session info (${response.status}): ${body}`
+    );
+  }
+  return response.json();
+}
+async function revokeSession(convexSiteUrl, sessionToken) {
+  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/sessions/me`;
+  const response = await fetch(url, {
+    method: "DELETE",
+    headers: mergeAutomationHeaders({
+      Authorization: `Bearer ${sessionToken}`
+    })
+  });
+  if (response.status === 404) {
+    return false;
+  }
+  if (!response.ok) {
+    const body = await response.text();
+    throw new Error(`Failed to revoke session (${response.status}): ${body}`);
+  }
+  return true;
+}
+function openBrowser(url) {
+  if (process6.env.BRAID_DISABLE_BROWSER_OPEN === "1" || process6.env.BRAID_DISABLE_BROWSER_OPEN === "true") {
+    return;
+  }
+  const currentPlatform = platform();
+  if (currentPlatform === "darwin") {
+    execFile("open", [url], noop);
+  } else if (currentPlatform === "win32") {
+    execFile("cmd", ["/c", "start", "", url], noop);
+  } else {
+    execFile("xdg-open", [url], noop);
+  }
+}
+function getDeviceInfo() {
+  return {
+    deviceName: hostname(),
+    deviceOs: platform(),
+    deviceHostname: hostname()
+  };
+}
+var TRAILING_SLASHES2, LEGACY_BRAID_AUTH_HOSTS, BRAID_APP_HOST, DEFAULT_BRAID_AUTH_HOSTS, LOOPBACK_HOSTS2, LOCAL_AUTH_ENV_FILES, LOCAL_AUTH_ENV_KEYS, NEWLINE_REGEX2, DeviceAuthTimeoutError, DeviceAuthDeniedError, DeviceAuthExpiredError, sleep, normalizeBaseUrl2, normalizeLoopbackBaseUrl, isLoopbackHost, isLoopbackUrl, stripQuotes2, parseDotenv2, resolveLocalAuthWebBaseUrlFromEnv, resolveLocalAuthWebBaseUrlFromFiles, resolveLocalAuthWebBaseUrl, normalizeServerBaseUrl, resolveCanonicalAuthWebBaseUrl, isHostedBraidAuthServer, noop;
+var init_device_auth = __esm({
+  "src/lib/device-auth.ts"() {
     "use strict";
     init_esm_shims();
-    init_config();
-    TRAILING_SLASH_REGEX = /\/$/;
-    ALLOW_UNTRUSTED_SERVER_ENV = "BRAID_ALLOW_UNTRUSTED_SERVER_URL";
-    isTruthy = (value) => value === "1" || value === "true" || value === "yes";
-    isLocalHost = (hostname2) => hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1";
-    isTrustedApiServerUrl = (serverUrl) => {
-      try {
-        const parsed = new URL(serverUrl);
-        const hostname2 = parsed.hostname;
-        const isBraidHost = hostname2 === "braid.cloud" || hostname2.endsWith(".braid.cloud");
-        const isConvexSite = hostname2.endsWith(".convex.site");
-        if (parsed.protocol === "https:" && (isBraidHost || isConvexSite)) {
-          return true;
-        }
-        if (parsed.protocol === "http:" && isLocalHost(hostname2)) {
-          return true;
-        }
-        return false;
-      } catch {
-        return false;
+    init_automation_headers();
+    init_braid_workspace();
+    TRAILING_SLASHES2 = /\/+$/;
+    LEGACY_BRAID_AUTH_HOSTS = /* @__PURE__ */ new Set([
+      "api.braid.cloud",
+      "braid.cloud",
+      "www.braid.cloud"
+    ]);
+    BRAID_APP_HOST = "app.braid.cloud";
+    DEFAULT_BRAID_AUTH_HOSTS = /* @__PURE__ */ new Set([
+      ...LEGACY_BRAID_AUTH_HOSTS,
+      BRAID_APP_HOST
+    ]);
+    LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
+    LOCAL_AUTH_ENV_FILES = [
+      ["apps", "web", ".env.local"],
+      ["apps", "convex", ".env.local"]
+    ];
+    LOCAL_AUTH_ENV_KEYS = ["APP_URL", "SITE_URL"];
+    NEWLINE_REGEX2 = /\r?\n/;
+    DeviceAuthTimeoutError = class extends Error {
+      constructor() {
+        super("Device authorization timed out");
+        this.name = "DeviceAuthTimeoutError";
       }
     };
-    ApiError = class extends Data3.TaggedError("ApiError") {
-    };
-    AuthenticationError = class extends Data3.TaggedError("AuthenticationError") {
-    };
-    NetworkError = class extends Data3.TaggedError("NetworkError") {
-    };
-    resolveApiKey = (optionsApiKey) => {
-      if (optionsApiKey) {
-        return Effect4.succeed(optionsApiKey);
+    DeviceAuthDeniedError = class extends Error {
+      constructor() {
+        super("Device authorization was denied");
+        this.name = "DeviceAuthDeniedError";
       }
-      return pipe4(
-        Effect4.tryPromise({
-          try: () => getApiKeyAsync(),
-          catch: () => new NetworkError({ message: "Failed to read config" })
-        }),
-        Effect4.flatMap(
-          (key) => key ? Effect4.succeed(key) : Effect4.fail(
-            new AuthenticationError({
-              message: 'No API key configured. Run "braid auth" to authenticate.'
-            })
-          )
-        )
-      );
     };
-    resolveServerUrl = (optionsServerUrl) => {
-      if (optionsServerUrl) {
-        if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(optionsServerUrl))) {
-          return Effect4.fail(
-            new NetworkError({
-              message: `Untrusted server URL '${optionsServerUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
-            })
-          );
-        }
-        return Effect4.succeed(optionsServerUrl);
+    DeviceAuthExpiredError = class extends Error {
+      constructor() {
+        super("Device authorization code has expired");
+        this.name = "DeviceAuthExpiredError";
       }
-      return pipe4(
-        Effect4.tryPromise({
-          try: () => getServerUrlAsync(),
-          catch: () => new NetworkError({ message: "Failed to read config" })
-        }),
-        Effect4.flatMap((serverUrl) => {
-          if (isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(serverUrl)) {
-            return Effect4.succeed(serverUrl);
-          }
-          return Effect4.fail(
-            new NetworkError({
-              message: `Untrusted server URL '${serverUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
-            })
-          );
-        })
-      );
     };
-    normalizeApiServerBaseUrl = (serverUrl) => {
-      const trimmed = serverUrl.replace(TRAILING_SLASH_REGEX, "");
+    sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
+    normalizeBaseUrl2 = (rawUrl) => {
+      const trimmed = rawUrl.replace(TRAILING_SLASHES2, "");
       try {
         const url = new URL(trimmed);
         return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
@@ -588,13 +750,296 @@ var init_api = __esm({
         return trimmed;
       }
     };
+    normalizeLoopbackBaseUrl = (rawUrl) => {
+      const normalized = normalizeBaseUrl2(rawUrl);
+      try {
+        const url = new URL(normalized);
+        if (isLoopbackHost(url.hostname)) {
+          url.hostname = "localhost";
+        }
+        return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+      } catch {
+        return normalized;
+      }
+    };
+    isLoopbackHost = (hostname2) => LOOPBACK_HOSTS2.has(hostname2);
+    isLoopbackUrl = (rawUrl) => {
+      try {
+        return isLoopbackHost(new URL(rawUrl).hostname);
+      } catch {
+        return false;
+      }
+    };
+    stripQuotes2 = (value) => {
+      if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+        return value.slice(1, -1);
+      }
+      return value;
+    };
+    parseDotenv2 = (content) => {
+      const result = {};
+      for (const rawLine of content.split(NEWLINE_REGEX2)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#")) {
+          continue;
+        }
+        const separatorIndex = line.indexOf("=");
+        if (separatorIndex <= 0) {
+          continue;
+        }
+        const key = line.slice(0, separatorIndex).trim();
+        const value = line.slice(separatorIndex + 1).trim();
+        result[key] = stripQuotes2(value);
+      }
+      return result;
+    };
+    resolveLocalAuthWebBaseUrlFromEnv = (env) => {
+      for (const key of LOCAL_AUTH_ENV_KEYS) {
+        const value = env[key];
+        if (value && isLoopbackUrl(value)) {
+          return normalizeLoopbackBaseUrl(value);
+        }
+      }
+      return void 0;
+    };
+    resolveLocalAuthWebBaseUrlFromFiles = () => {
+      const workspaceRoot = findBraidWorkspaceRoot();
+      if (!workspaceRoot) {
+        return void 0;
+      }
+      for (const envFile of LOCAL_AUTH_ENV_FILES) {
+        const envPath = join4(workspaceRoot, ...envFile);
+        if (!existsSync3(envPath)) {
+          continue;
+        }
+        const localAppUrl = resolveLocalAuthWebBaseUrlFromEnv(
+          parseDotenv2(readFileSync3(envPath, "utf8"))
+        );
+        if (localAppUrl) {
+          return localAppUrl;
+        }
+      }
+      return void 0;
+    };
+    resolveLocalAuthWebBaseUrl = () => resolveLocalAuthWebBaseUrlFromEnv(process6.env) ?? resolveLocalAuthWebBaseUrlFromFiles();
+    normalizeServerBaseUrl = (serverUrl) => {
+      const trimmed = normalizeBaseUrl2(serverUrl);
+      try {
+        const url = new URL(trimmed);
+        return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+      } catch {
+        return trimmed;
+      }
+    };
+    resolveCanonicalAuthWebBaseUrl = (serverUrl) => {
+      const normalized = normalizeServerBaseUrl(serverUrl);
+      try {
+        const url = new URL(normalized);
+        if (LEGACY_BRAID_AUTH_HOSTS.has(url.hostname)) {
+          url.hostname = BRAID_APP_HOST;
+          url.pathname = "/";
+        }
+        return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+      } catch {
+        return normalized;
+      }
+    };
+    isHostedBraidAuthServer = (serverUrl) => {
+      try {
+        return DEFAULT_BRAID_AUTH_HOSTS.has(
+          new URL(normalizeServerBaseUrl(serverUrl)).hostname
+        );
+      } catch {
+        return false;
+      }
+    };
+    noop = () => {
+    };
+  }
+});
+
+// src/lib/api.ts
+import { Data as Data3, Effect as Effect4, pipe as pipe4 } from "effect";
+var TRAILING_SLASH_REGEX, ALLOW_UNTRUSTED_SERVER_ENV, SESSION_TOKEN_PREFIX, isTruthy, isLocalHost, isConvexSiteHost, isTrustedApiServerUrl, isSessionApiServerUrl, REAUTH_REQUIRED_MESSAGE, RAW_AUTH_ERROR_PATTERN, normalizeAuthenticationErrorMessage, ApiError, AuthenticationError, NetworkError, resolveApiKey, resolveServerUrl, resolveApiRequestServerUrl, resolvePublicRequestServerUrl, normalizeApiServerBaseUrl, readJsonResponseAsync, readJsonResponse, getApiErrorResponse, isAuthenticationErrorResponse, parseResponse, buildApiUrl, buildExportUrl, executeApiRequest, parseScopeOptionsResponse, fetchScopeOptions, buildLibraryOptionsUrl, fetchLibraryOptions, fetchSkills, runLifecycleCommand, DEFAULT_PUBLIC_SERVER_URL, NotFoundError, RateLimitedError, handlePublicApiResponse, fetchPublicMetadata, fetchPublicExport, fetchPublicMetadataAsync, fetchPublicExportAsync, validateApiKey, fetchSkillsAsync, validateApiKeyAsync, fetchScopeOptionsAsync, fetchLibraryOptionsAsync, runLifecycleCommandAsync;
+var init_api = __esm({
+  "src/lib/api.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_automation_headers();
+    init_config();
+    init_device_auth();
+    TRAILING_SLASH_REGEX = /\/$/;
+    ALLOW_UNTRUSTED_SERVER_ENV = "BRAID_ALLOW_UNTRUSTED_SERVER_URL";
+    SESSION_TOKEN_PREFIX = "brs_";
+    isTruthy = (value) => value === "1" || value === "true" || value === "yes";
+    isLocalHost = (hostname2) => hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1";
+    isConvexSiteHost = (hostname2) => hostname2.endsWith(".convex.site");
+    isTrustedApiServerUrl = (serverUrl) => {
+      try {
+        const parsed = new URL(serverUrl);
+        const hostname2 = parsed.hostname;
+        const isBraidHost = hostname2 === "braid.cloud" || hostname2.endsWith(".braid.cloud");
+        const isConvexSite = isConvexSiteHost(hostname2);
+        if (parsed.protocol === "https:" && (isBraidHost || isConvexSite)) {
+          return true;
+        }
+        if (parsed.protocol === "http:" && isLocalHost(hostname2)) {
+          return true;
+        }
+        return false;
+      } catch {
+        return false;
+      }
+    };
+    isSessionApiServerUrl = (serverUrl) => {
+      try {
+        const hostname2 = new URL(serverUrl).hostname;
+        return isConvexSiteHost(hostname2) || isLocalHost(hostname2);
+      } catch {
+        return false;
+      }
+    };
+    REAUTH_REQUIRED_MESSAGE = "Invalid or expired API key. Run 'braid auth' to re-authenticate.";
+    RAW_AUTH_ERROR_PATTERN = /invalid authentication token|authentication token expired|token expired|not authenticated/i;
+    normalizeAuthenticationErrorMessage = (message) => {
+      if (!message || RAW_AUTH_ERROR_PATTERN.test(message)) {
+        return REAUTH_REQUIRED_MESSAGE;
+      }
+      return message;
+    };
+    ApiError = class extends Data3.TaggedError("ApiError") {
+    };
+    AuthenticationError = class extends Data3.TaggedError("AuthenticationError") {
+    };
+    NetworkError = class extends Data3.TaggedError("NetworkError") {
+    };
+    resolveApiKey = (optionsApiKey) => {
+      if (optionsApiKey) {
+        return Effect4.succeed(optionsApiKey);
+      }
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => getApiKeyAsync(),
+          catch: () => new NetworkError({ message: "Failed to read config" })
+        }),
+        Effect4.flatMap(
+          (key) => key ? Effect4.succeed(key) : Effect4.fail(
+            new AuthenticationError({
+              message: 'No API key configured. Run "braid auth" to authenticate.'
+            })
+          )
+        )
+      );
+    };
+    resolveServerUrl = (optionsServerUrl) => {
+      if (optionsServerUrl) {
+        if (!(isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(optionsServerUrl))) {
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${optionsServerUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        }
+        return Effect4.succeed(optionsServerUrl);
+      }
+      return pipe4(
+        Effect4.tryPromise({
+          try: () => getServerUrlAsync(),
+          catch: () => new NetworkError({ message: "Failed to read config" })
+        }),
+        Effect4.flatMap((serverUrl) => {
+          if (isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(serverUrl)) {
+            return Effect4.succeed(serverUrl);
+          }
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${serverUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        })
+      );
+    };
+    resolveApiRequestServerUrl = (serverUrl, apiKey) => {
+      if (!apiKey?.startsWith(SESSION_TOKEN_PREFIX)) {
+        return Effect4.succeed(serverUrl);
+      }
+      if (isSessionApiServerUrl(serverUrl)) {
+        return Effect4.succeed(serverUrl);
+      }
+      return pipe4(
+        Effect4.tryPromise({
+          try: async () => {
+            const authConfig = await fetchAuthConfig(serverUrl);
+            return authConfig.convexSiteUrl.replace(TRAILING_SLASH_REGEX, "");
+          },
+          catch: (cause) => new NetworkError({
+            message: `Failed to resolve session API server for ${serverUrl}`,
+            cause
+          })
+        }),
+        Effect4.flatMap((resolvedServerUrl) => {
+          if (isTruthy(process.env[ALLOW_UNTRUSTED_SERVER_ENV]) || isTrustedApiServerUrl(resolvedServerUrl)) {
+            return Effect4.succeed(resolvedServerUrl);
+          }
+          return Effect4.fail(
+            new NetworkError({
+              message: `Untrusted server URL '${resolvedServerUrl}'. Set ${ALLOW_UNTRUSTED_SERVER_ENV}=true to override.`
+            })
+          );
+        })
+      );
+    };
+    resolvePublicRequestServerUrl = (serverUrl, apiKey) => resolveApiRequestServerUrl(serverUrl, apiKey);
+    normalizeApiServerBaseUrl = (serverUrl) => {
+      const trimmed = serverUrl.replace(TRAILING_SLASH_REGEX, "");
+      try {
+        const url = new URL(trimmed);
+        return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+      } catch {
+        return trimmed;
+      }
+    };
+    readJsonResponseAsync = async (response) => {
+      const raw = await response.text();
+      if (raw.trim().length === 0) {
+        if (response.ok) {
+          throw new Error("Empty API response");
+        }
+        return null;
+      }
+      try {
+        return JSON.parse(raw);
+      } catch (error) {
+        if (!response.ok) {
+          return null;
+        }
+        throw error;
+      }
+    };
+    readJsonResponse = (response) => Effect4.tryPromise({
+      try: () => readJsonResponseAsync(response),
+      catch: () => new NetworkError({ message: "Failed to parse API response" })
+    });
+    getApiErrorResponse = (json) => {
+      if (typeof json !== "object" || json === null || Array.isArray(json)) {
+        return {};
+      }
+      return json;
+    };
+    isAuthenticationErrorResponse = (response, json) => {
+      if (response.status === 401) {
+        return true;
+      }
+      const errorResponse = getApiErrorResponse(json);
+      return RAW_AUTH_ERROR_PATTERN.test(errorResponse.error ?? "");
+    };
     parseResponse = (response, json) => {
       if (!response.ok) {
-        const errorResponse = json;
-        if (response.status === 401) {
+        const errorResponse = getApiErrorResponse(json);
+        if (isAuthenticationErrorResponse(response, json)) {
           return Effect4.fail(
             new AuthenticationError({
-              message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
+              message: normalizeAuthenticationErrorMessage(errorResponse.error)
             })
           );
         }
@@ -653,10 +1098,10 @@ var init_api = __esm({
       Effect4.tryPromise({
         try: () => fetch(url.toString(), {
           method: "GET",
-          headers: {
+          headers: mergeAutomationHeaders({
             "Content-Type": "application/json",
             ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
-          }
+          })
         }),
         catch: (e) => new NetworkError({
           message: `Failed to connect to ${serverUrl}`,
@@ -666,7 +1111,7 @@ var init_api = __esm({
       Effect4.flatMap(
         (response) => pipe4(
           Effect4.tryPromise({
-            try: () => response.json(),
+            try: () => readJsonResponseAsync(response),
             catch: () => new NetworkError({ message: "Failed to parse API response" })
           }),
           Effect4.flatMap((json) => parseResponse(response, json))
@@ -675,11 +1120,11 @@ var init_api = __esm({
     );
     parseScopeOptionsResponse = (response, json) => {
       if (!response.ok) {
-        const errorResponse = json;
-        if (response.status === 401) {
+        const errorResponse = getApiErrorResponse(json);
+        if (isAuthenticationErrorResponse(response, json)) {
           return Effect4.fail(
             new AuthenticationError({
-              message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
+              message: normalizeAuthenticationErrorMessage(errorResponse.error)
             })
           );
         }
@@ -698,33 +1143,37 @@ var init_api = __esm({
         apiKey: resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect4.flatMap(({ apiKey, serverUrl }) => {
-        const url = buildApiUrl(serverUrl, "/api/skills/scope-options");
-        return pipe4(
-          Effect4.tryPromise({
-            try: () => fetch(url.toString(), {
-              method: "GET",
-              headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json"
-              }
-            }),
-            catch: (e) => new NetworkError({
-              message: `Failed to connect to ${serverUrl}`,
-              cause: e
-            })
-          }),
-          Effect4.flatMap(
-            (response) => pipe4(
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => pipe4(
+          resolveApiRequestServerUrl(serverUrl, apiKey),
+          Effect4.flatMap((apiServerUrl) => {
+            const url = buildApiUrl(apiServerUrl, "/api/skills/scope-options");
+            return pipe4(
               Effect4.tryPromise({
-                try: () => response.json(),
-                catch: () => new NetworkError({ message: "Failed to parse API response" })
+                try: () => fetch(url.toString(), {
+                  method: "GET",
+                  headers: mergeAutomationHeaders({
+                    Authorization: `Bearer ${apiKey}`,
+                    "Content-Type": "application/json"
+                  })
+                }),
+                catch: (e) => new NetworkError({
+                  message: `Failed to connect to ${apiServerUrl}`,
+                  cause: e
+                })
               }),
-              Effect4.flatMap((json) => parseScopeOptionsResponse(response, json))
-            )
-          )
-        );
-      })
+              Effect4.flatMap(
+                (response) => pipe4(
+                  readJsonResponse(response),
+                  Effect4.flatMap(
+                    (json) => parseScopeOptionsResponse(response, json)
+                  )
+                )
+              )
+            );
+          })
+        )
+      )
     );
     buildLibraryOptionsUrl = (serverUrl, options) => {
       const url = buildApiUrl(serverUrl, "/api/skills/library-options");
@@ -758,41 +1207,57 @@ var init_api = __esm({
       }),
       Effect4.flatMap(
         ({ apiKey, serverUrl }) => pipe4(
-          Effect4.tryPromise({
-            try: () => fetch(buildLibraryOptionsUrl(serverUrl, options).toString(), {
-              method: "GET",
-              headers: {
-                Authorization: `Bearer ${apiKey}`,
-                "Content-Type": "application/json"
-              }
-            }),
-            catch: (e) => new NetworkError({
-              message: `Failed to connect to ${serverUrl}`,
-              cause: e
-            })
-          }),
+          resolveApiRequestServerUrl(serverUrl, apiKey),
           Effect4.flatMap(
-            (response) => pipe4(
+            (apiServerUrl) => pipe4(
               Effect4.tryPromise({
-                try: () => response.json(),
-                catch: () => new NetworkError({ message: "Failed to parse API response" })
+                try: () => fetch(
+                  buildLibraryOptionsUrl(apiServerUrl, options).toString(),
+                  {
+                    method: "GET",
+                    headers: mergeAutomationHeaders({
+                      Authorization: `Bearer ${apiKey}`,
+                      "Content-Type": "application/json"
+                    })
+                  }
+                ),
+                catch: (e) => new NetworkError({
+                  message: `Failed to connect to ${apiServerUrl}`,
+                  cause: e
+                })
               }),
-              Effect4.flatMap((json) => {
-                if (!response.ok) {
-                  return parseResponse(response, json).pipe(
-                    Effect4.flatMap(
-                      () => Effect4.fail(
-                        new ApiError({
-                          message: "API request failed",
-                          code: "UNKNOWN_ERROR",
-                          status: response.status
-                        })
-                      )
-                    )
-                  );
-                }
-                return Effect4.succeed(json);
-              })
+              Effect4.flatMap(
+                (response) => pipe4(
+                  readJsonResponse(response),
+                  Effect4.flatMap(
+                    (json) => {
+                      if (!response.ok) {
+                        return pipe4(
+                          parseResponse(response, json),
+                          Effect4.flatMap(
+                            () => Effect4.fail(
+                              new ApiError({
+                                message: "API request failed",
+                                code: "UNKNOWN_ERROR",
+                                status: response.status
+                              })
+                            )
+                          ),
+                          Effect4.catchTag(
+                            "AuthenticationError",
+                            (error) => Effect4.fail(error)
+                          ),
+                          Effect4.catchTag(
+                            "ApiError",
+                            (error) => Effect4.fail(error)
+                          )
+                        );
+                      }
+                      return Effect4.succeed(json);
+                    }
+                  )
+                )
+              )
             )
           )
         )
@@ -803,10 +1268,15 @@ var init_api = __esm({
         apiKey: options.demo ? Effect4.succeed(options.apiKey) : resolveApiKey(options.apiKey),
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
-      Effect4.flatMap(({ apiKey, serverUrl }) => {
-        const url = buildExportUrl(serverUrl, options);
-        return executeApiRequest(url, apiKey, serverUrl);
-      })
+      Effect4.flatMap(
+        ({ apiKey, serverUrl }) => pipe4(
+          resolveApiRequestServerUrl(serverUrl, apiKey),
+          Effect4.flatMap((apiServerUrl) => {
+            const url = buildExportUrl(apiServerUrl, options);
+            return executeApiRequest(url, apiKey, apiServerUrl);
+          })
+        )
+      )
     );
     runLifecycleCommand = (request, options = {}) => pipe4(
       Effect4.all({
@@ -814,45 +1284,56 @@ var init_api = __esm({
         serverUrl: resolveServerUrl(options.serverUrl)
       }),
       Effect4.flatMap(
-        ({ apiKey, serverUrl }) => Effect4.tryPromise({
-          try: async () => {
-            const response = await fetch(
-              buildApiUrl(serverUrl, "/api/lifecycle").toString(),
-              {
-                method: "POST",
-                headers: {
-                  "Content-Type": "application/json",
-                  ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
-                },
-                body: JSON.stringify({ ...request, demo: options.demo })
-              }
-            );
-            const json = await response.json();
-            if (!response.ok) {
-              const errorResponse = json;
-              if (response.status === 401) {
-                throw new AuthenticationError({
-                  message: errorResponse.error || "Invalid or expired API key. Run 'braid auth' to re-authenticate."
+        ({ apiKey, serverUrl }) => pipe4(
+          resolveApiRequestServerUrl(serverUrl, apiKey),
+          Effect4.flatMap(
+            (apiServerUrl) => Effect4.tryPromise({
+              try: async () => {
+                const response = await fetch(
+                  buildApiUrl(apiServerUrl, "/api/lifecycle").toString(),
+                  {
+                    method: "POST",
+                    headers: mergeAutomationHeaders({
+                      "Content-Type": "application/json",
+                      ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+                    }),
+                    body: JSON.stringify({ ...request, demo: options.demo })
+                  }
+                );
+                const json = await readJsonResponseAsync(response).catch(() => {
+                  throw new NetworkError({
+                    message: "Failed to parse API response"
+                  });
+                });
+                if (!response.ok) {
+                  const errorResponse = getApiErrorResponse(json);
+                  if (isAuthenticationErrorResponse(response, json)) {
+                    throw new AuthenticationError({
+                      message: normalizeAuthenticationErrorMessage(
+                        errorResponse.error
+                      )
+                    });
+                  }
+                  throw new ApiError({
+                    message: errorResponse.error || "API request failed",
+                    code: errorResponse.code || "UNKNOWN_ERROR",
+                    status: response.status
+                  });
+                }
+                return json;
+              },
+              catch: (error) => {
+                if (error instanceof ApiError || error instanceof AuthenticationError || error instanceof NetworkError) {
+                  return error;
+                }
+                return new NetworkError({
+                  message: `Failed to connect to ${apiServerUrl}`,
+                  cause: error
                 });
               }
-              throw new ApiError({
-                message: errorResponse.error || "API request failed",
-                code: errorResponse.code || "UNKNOWN_ERROR",
-                status: response.status
-              });
-            }
-            return json;
-          },
-          catch: (error) => {
-            if (error instanceof ApiError || error instanceof AuthenticationError || error instanceof NetworkError) {
-              return error;
-            }
-            return new NetworkError({
-              message: `Failed to connect to ${serverUrl}`,
-              cause: error
-            });
-          }
-        })
+            })
+          )
+        )
       )
     );
     DEFAULT_PUBLIC_SERVER_URL = "https://braid.cloud";
@@ -879,7 +1360,7 @@ var init_api = __esm({
           })
         );
       }
-      const errorResponse = json;
+      const errorResponse = getApiErrorResponse(json);
       return Effect4.fail(
         new ApiError({
           message: errorResponse.error || "API request failed",
@@ -888,72 +1369,84 @@ var init_api = __esm({
         })
       );
     };
-    fetchPublicMetadata = (handle, slug, serverUrl, version) => {
-      const baseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
+    fetchPublicMetadata = (handle, slug, serverUrl, version, apiKey) => {
+      const requestedBaseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
         TRAILING_SLASH_REGEX,
         ""
       );
-      const url = new URL(`${baseUrl}/api/public/@${handle}/${slug}`);
-      if (version !== void 0) {
-        url.searchParams.set("version", String(version));
-      }
       return pipe4(
-        Effect4.tryPromise({
-          try: () => fetch(url.toString(), { method: "GET" }),
-          catch: (e) => new NetworkError({
-            message: `Failed to connect to ${baseUrl}`,
-            cause: e
-          })
-        }),
-        Effect4.flatMap(
-          (response) => pipe4(
+        resolvePublicRequestServerUrl(requestedBaseUrl, apiKey),
+        Effect4.flatMap((baseUrl) => {
+          const url = new URL(`${baseUrl}/api/public/@${handle}/${slug}`);
+          if (version !== void 0) {
+            url.searchParams.set("version", String(version));
+          }
+          return pipe4(
             Effect4.tryPromise({
-              try: () => response.json(),
-              catch: () => new NetworkError({ message: "Failed to parse API response" })
+              try: () => fetch(url.toString(), {
+                method: "GET",
+                headers: mergeAutomationHeaders()
+              }),
+              catch: (e) => new NetworkError({
+                message: `Failed to connect to ${baseUrl}`,
+                cause: e
+              })
             }),
             Effect4.flatMap(
-              (json) => handlePublicApiResponse(response, json)
+              (response) => pipe4(
+                readJsonResponse(response),
+                Effect4.flatMap(
+                  (json) => handlePublicApiResponse(response, json)
+                )
+              )
             )
-          )
-        )
+          );
+        })
       );
     };
-    fetchPublicExport = (handle, slug, ruleIds, serverUrl, version) => {
-      const baseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
+    fetchPublicExport = (handle, slug, ruleIds, serverUrl, version, apiKey) => {
+      const requestedBaseUrl = (serverUrl ?? DEFAULT_PUBLIC_SERVER_URL).replace(
         TRAILING_SLASH_REGEX,
         ""
       );
-      const url = new URL(`${baseUrl}/api/public/@${handle}/${slug}/export`);
-      if (ruleIds && ruleIds.length > 0) {
-        url.searchParams.set("ruleIds", ruleIds.join(","));
-      }
-      if (version !== void 0) {
-        url.searchParams.set("version", String(version));
-      }
       return pipe4(
-        Effect4.tryPromise({
-          try: () => fetch(url.toString(), { method: "GET" }),
-          catch: (e) => new NetworkError({
-            message: `Failed to connect to ${baseUrl}`,
-            cause: e
-          })
-        }),
-        Effect4.flatMap(
-          (response) => pipe4(
+        resolvePublicRequestServerUrl(requestedBaseUrl, apiKey),
+        Effect4.flatMap((baseUrl) => {
+          const url = new URL(`${baseUrl}/api/public/@${handle}/${slug}/export`);
+          if (ruleIds && ruleIds.length > 0) {
+            url.searchParams.set("ruleIds", ruleIds.join(","));
+          }
+          if (version !== void 0) {
+            url.searchParams.set("version", String(version));
+          }
+          return pipe4(
             Effect4.tryPromise({
-              try: () => response.json(),
-              catch: () => new NetworkError({ message: "Failed to parse API response" })
+              try: () => fetch(url.toString(), {
+                method: "GET",
+                headers: mergeAutomationHeaders()
+              }),
+              catch: (e) => new NetworkError({
+                message: `Failed to connect to ${baseUrl}`,
+                cause: e
+              })
             }),
             Effect4.flatMap(
-              (json) => handlePublicApiResponse(response, json)
+              (response) => pipe4(
+                readJsonResponse(response),
+                Effect4.flatMap(
+                  (json) => handlePublicApiResponse(response, json)
+                )
+              )
             )
-          )
-        )
+          );
+        })
       );
     };
-    fetchPublicMetadataAsync = (handle, slug, serverUrl, version) => Effect4.runPromise(fetchPublicMetadata(handle, slug, serverUrl, version));
-    fetchPublicExportAsync = (handle, slug, ruleIds, serverUrl, version) => Effect4.runPromise(
-      fetchPublicExport(handle, slug, ruleIds, serverUrl, version)
+    fetchPublicMetadataAsync = (handle, slug, serverUrl, version, apiKey) => Effect4.runPromise(
+      fetchPublicMetadata(handle, slug, serverUrl, version, apiKey)
+    );
+    fetchPublicExportAsync = (handle, slug, ruleIds, serverUrl, version, apiKey) => Effect4.runPromise(
+      fetchPublicExport(handle, slug, ruleIds, serverUrl, version, apiKey)
     );
     validateApiKey = (apiKey, serverUrl) => pipe4(
       Effect4.try({
@@ -975,10 +1468,10 @@ var init_api = __esm({
             url.searchParams.set("profile", "default");
             const response = await fetch(url.toString(), {
               method: "GET",
-              headers: {
+              headers: mergeAutomationHeaders({
                 Authorization: `Bearer ${apiKey}`,
                 "Content-Type": "application/json"
-              }
+              })
             });
             return response.status !== 401;
           },
@@ -998,7 +1491,7 @@ var init_api = __esm({
 });
 
 // src/lib/tui.ts
-import process5 from "process";
+import process7 from "process";
 import {
   cancel as clackCancel,
   confirm as clackConfirm,
@@ -1023,19 +1516,19 @@ function spinner() {
   return {
     start: (message) => {
       if (message) {
-        process5.stdout.write(`${message}
+        process7.stdout.write(`${message}
 `);
       }
     },
     stop: (message) => {
       if (message) {
-        process5.stdout.write(`${message}
+        process7.stdout.write(`${message}
 `);
       }
     },
     message: (message) => {
       if (message) {
-        process5.stdout.write(`${message}
+        process7.stdout.write(`${message}
 `);
       }
     }
@@ -1045,7 +1538,7 @@ function intro(message) {
   if (isTTY) {
     clackIntro(message);
   } else {
-    process5.stdout.write(`
+    process7.stdout.write(`
 ${message}
 `);
   }
@@ -1054,7 +1547,7 @@ function outro(message) {
   if (isTTY) {
     clackOutro(message);
   } else {
-    process5.stdout.write(`${message}
+    process7.stdout.write(`${message}
 
 `);
   }
@@ -1064,7 +1557,7 @@ var init_tui = __esm({
   "src/lib/tui.ts"() {
     "use strict";
     init_esm_shims();
-    isTTY = Boolean(process5.stdout.isTTY);
+    isTTY = Boolean(process7.stdout.isTTY);
     cancel = clackCancel;
     confirm = clackConfirm;
     isCancel = clackIsCancel;
@@ -1174,10 +1667,10 @@ var scope_exports = {};
 __export(scope_exports, {
   scopeCommand: () => scopeCommand
 });
-import process7 from "process";
+import process9 from "process";
 function exitCancelled(message) {
   cancel(message);
-  process7.exit(0);
+  process9.exit(0);
 }
 async function selectTargetFile(options) {
   if (options.file) {
@@ -1529,7 +2022,7 @@ async function scopeCommand(options) {
   } catch (error) {
     loadSpinner.stop("Failed to load scope options");
     log.error(error instanceof Error ? error.message : String(error));
-    process7.exit(1);
+    process9.exit(1);
   }
 }
 var init_scope = __esm({
@@ -1568,7 +2061,7 @@ __export(lockfile_exports, {
 });
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
 import { join as join6 } from "path";
-import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
+import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
 var LOCKFILE_FILENAME, LOCKFILE_VERSION, MARKETPLACE_KEY_REGEX, ORG_KEY_REGEX, LockfileReadError, LockfileWriteError, LockfileVersionError, LockfileCorruptError, getLockfilePath, emptyLockfile, readLockfile, writeLockfile, resolveLocked, upsertLockfileEntry, removeLockfileEntry, buildLockfileKey, parseLockfileKey, readLockfileAsync, writeLockfileAsync, upsertLockfileEntryAsync, removeLockfileEntryAsync;
 var init_lockfile = __esm({
   "src/lib/lockfile.ts"() {
@@ -1578,13 +2071,13 @@ var init_lockfile = __esm({
     LOCKFILE_VERSION = 1;
     MARKETPLACE_KEY_REGEX = /^@([a-z0-9-]+)\/([a-z0-9-]+)@(\d+)$/;
     ORG_KEY_REGEX = /^([a-z0-9-]+)\/([a-z0-9-]+)@(\d+)$/;
-    LockfileReadError = class extends Data4.TaggedError("LockfileReadError") {
+    LockfileReadError = class extends Data5.TaggedError("LockfileReadError") {
     };
-    LockfileWriteError = class extends Data4.TaggedError("LockfileWriteError") {
+    LockfileWriteError = class extends Data5.TaggedError("LockfileWriteError") {
     };
-    LockfileVersionError = class extends Data4.TaggedError("LockfileVersionError") {
+    LockfileVersionError = class extends Data5.TaggedError("LockfileVersionError") {
     };
-    LockfileCorruptError = class extends Data4.TaggedError("LockfileCorruptError") {
+    LockfileCorruptError = class extends Data5.TaggedError("LockfileCorruptError") {
     };
     getLockfilePath = (dir) => join6(dir, LOCKFILE_FILENAME);
     emptyLockfile = () => ({
@@ -1593,27 +2086,27 @@ var init_lockfile = __esm({
     });
     readLockfile = (dir) => {
       const lockfilePath = getLockfilePath(dir);
-      return pipe5(
-        Effect5.tryPromise({
+      return pipe6(
+        Effect6.tryPromise({
           try: () => readFile3(lockfilePath, "utf-8"),
           catch: () => new LockfileReadError({ path: lockfilePath, cause: "not found" })
         }),
-        Effect5.catchTag(
+        Effect6.catchTag(
           "LockfileReadError",
-          () => Effect5.succeed(null)
+          () => Effect6.succeed(null)
         ),
-        Effect5.flatMap((content) => {
+        Effect6.flatMap((content) => {
           if (content === null) {
-            return Effect5.succeed(null);
+            return Effect6.succeed(null);
           }
-          return pipe5(
-            Effect5.try({
+          return pipe6(
+            Effect6.try({
               try: () => JSON.parse(content),
               catch: (cause) => new LockfileCorruptError({ path: lockfilePath, cause })
             }),
-            Effect5.flatMap((parsed) => {
+            Effect6.flatMap((parsed) => {
               if (parsed.lockfileVersion !== LOCKFILE_VERSION) {
-                return Effect5.fail(
+                return Effect6.fail(
                   new LockfileVersionError({
                     path: lockfilePath,
                     expected: LOCKFILE_VERSION,
@@ -1621,7 +2114,7 @@ var init_lockfile = __esm({
                   })
                 );
               }
-              return Effect5.succeed(parsed);
+              return Effect6.succeed(parsed);
             })
           );
         })
@@ -1629,7 +2122,7 @@ var init_lockfile = __esm({
     };
     writeLockfile = (dir, lockfile) => {
       const lockfilePath = getLockfilePath(dir);
-      return Effect5.tryPromise({
+      return Effect6.tryPromise({
         try: () => writeFile4(
           lockfilePath,
           `${JSON.stringify(lockfile, null, 2)}
@@ -1646,26 +2139,26 @@ var init_lockfile = __esm({
       }
       return entry;
     };
-    upsertLockfileEntry = (dir, key, entry) => pipe5(
+    upsertLockfileEntry = (dir, key, entry) => pipe6(
       readLockfile(dir),
-      Effect5.map((existing) => existing ?? emptyLockfile()),
-      Effect5.map((lockfile) => ({
+      Effect6.map((existing) => existing ?? emptyLockfile()),
+      Effect6.map((lockfile) => ({
         ...lockfile,
         resolved: {
           ...lockfile.resolved,
           [key]: entry
         }
       })),
-      Effect5.flatMap((lockfile) => writeLockfile(dir, lockfile))
+      Effect6.flatMap((lockfile) => writeLockfile(dir, lockfile))
     );
-    removeLockfileEntry = (dir, key) => pipe5(
+    removeLockfileEntry = (dir, key) => pipe6(
       readLockfile(dir),
-      Effect5.map((existing) => existing ?? emptyLockfile()),
-      Effect5.map((lockfile) => {
+      Effect6.map((existing) => existing ?? emptyLockfile()),
+      Effect6.map((lockfile) => {
         const { [key]: _removed, ...rest } = lockfile.resolved;
         return { ...lockfile, resolved: rest };
       }),
-      Effect5.flatMap((lockfile) => writeLockfile(dir, lockfile))
+      Effect6.flatMap((lockfile) => writeLockfile(dir, lockfile))
     );
     buildLockfileKey = (source, handle, slug, version) => {
       const prefix = source === "marketplace" ? `@${handle}` : handle;
@@ -1692,10 +2185,10 @@ var init_lockfile = __esm({
       }
       return null;
     };
-    readLockfileAsync = (dir) => Effect5.runPromise(readLockfile(dir));
-    writeLockfileAsync = (dir, lockfile) => Effect5.runPromise(writeLockfile(dir, lockfile));
-    upsertLockfileEntryAsync = (dir, key, entry) => Effect5.runPromise(upsertLockfileEntry(dir, key, entry));
-    removeLockfileEntryAsync = (dir, key) => Effect5.runPromise(removeLockfileEntry(dir, key));
+    readLockfileAsync = (dir) => Effect6.runPromise(readLockfile(dir));
+    writeLockfileAsync = (dir, lockfile) => Effect6.runPromise(writeLockfile(dir, lockfile));
+    upsertLockfileEntryAsync = (dir, key, entry) => Effect6.runPromise(upsertLockfileEntry(dir, key, entry));
+    removeLockfileEntryAsync = (dir, key) => Effect6.runPromise(removeLockfileEntry(dir, key));
   }
 });
 
@@ -2271,15 +2764,262 @@ var resolveHookConfigPath = (agent, options) => {
   if (options.global) {
     return agent.hookGlobalConfigPath;
   }
-  if (!agent.hookProjectConfigPath) {
-    return void 0;
+  if (!agent.hookProjectConfigPath) {
+    return void 0;
+  }
+  const cwd = options.projectRoot ?? process2.cwd();
+  return join(cwd, agent.hookProjectConfigPath);
+};
+
+// src/commands/agents.ts
+init_api();
+
+// src/lib/command-output.ts
+init_esm_shims();
+init_api();
+import process8 from "process";
+
+// src/lib/marketplace-api.ts
+init_esm_shims();
+init_automation_headers();
+init_config();
+init_device_auth();
+import { Data as Data4, Effect as Effect5, pipe as pipe5 } from "effect";
+var TRAILING_SLASH_REGEX2 = /\/$/;
+var SESSION_TOKEN_PREFIX2 = "brs_";
+var MarketplaceApiError = class extends Data4.TaggedError("MarketplaceApiError") {
+};
+var isLocalHost2 = (hostname2) => hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "::1";
+var isConvexSiteHost2 = (hostname2) => hostname2.endsWith(".convex.site");
+var isSessionApiServerUrl2 = (serverUrl) => {
+  try {
+    const hostname2 = new URL(serverUrl).hostname;
+    return isConvexSiteHost2(hostname2) || isLocalHost2(hostname2);
+  } catch {
+    return false;
+  }
+};
+var resolveApiKey2 = (provided) => {
+  if (provided) {
+    return Effect5.succeed(provided);
+  }
+  return pipe5(
+    Effect5.tryPromise({
+      try: () => getApiKeyAsync(),
+      catch: () => new MarketplaceApiError({
+        message: "Failed to load API key",
+        status: 500,
+        code: "CONFIG_ERROR"
+      })
+    }),
+    Effect5.flatMap(
+      (token) => token ? Effect5.succeed(token) : Effect5.fail(
+        new MarketplaceApiError({
+          message: "Not signed in. Run 'braid auth'.",
+          status: 401,
+          code: "AUTH_REQUIRED"
+        })
+      )
+    )
+  );
+};
+var resolveServer = (provided) => {
+  if (provided) {
+    return Effect5.succeed(provided.replace(TRAILING_SLASH_REGEX2, ""));
+  }
+  return pipe5(
+    Effect5.tryPromise({
+      try: () => getServerUrlAsync(),
+      catch: () => new MarketplaceApiError({
+        message: "Failed to load server URL",
+        status: 500,
+        code: "CONFIG_ERROR"
+      })
+    }),
+    Effect5.map((server) => server.replace(TRAILING_SLASH_REGEX2, ""))
+  );
+};
+var resolveRequestServer = (server, apiKey) => {
+  if (!apiKey.startsWith(SESSION_TOKEN_PREFIX2) || isSessionApiServerUrl2(server)) {
+    return Effect5.succeed(server);
+  }
+  return Effect5.tryPromise({
+    try: async () => {
+      const authConfig = await fetchAuthConfig(server);
+      return authConfig.convexSiteUrl.replace(TRAILING_SLASH_REGEX2, "");
+    },
+    catch: () => new MarketplaceApiError({
+      message: `Failed to resolve marketplace API server for ${server}`,
+      status: 500,
+      code: "CONFIG_ERROR"
+    })
+  });
+};
+var requestJson = (url, options, requestOptions = {}) => pipe5(
+  Effect5.tryPromise({
+    try: () => fetch(url, options),
+    catch: () => new MarketplaceApiError({
+      message: "Network error",
+      status: 503,
+      code: "NETWORK_ERROR"
+    })
+  }),
+  Effect5.flatMap(
+    (response) => Effect5.tryPromise({
+      try: async () => {
+        const payload = await response.json().catch(() => null);
+        if (!response.ok) {
+          const normalizedMessage = requestOptions.normalizeErrorMessage?.({
+            payload,
+            response,
+            url
+          });
+          throw new MarketplaceApiError({
+            message: normalizedMessage ?? (response.status === 404 ? requestOptions.notFoundMessage : void 0) ?? payload?.error ?? payload?.message ?? `Request failed (HTTP ${response.status} from ${new URL(url).origin})`,
+            status: response.status,
+            code: payload?.code ?? "REQUEST_ERROR"
+          });
+        }
+        return payload;
+      },
+      catch: (error) => error instanceof MarketplaceApiError ? error : new MarketplaceApiError({
+        message: "Invalid response",
+        status: 500,
+        code: "PARSE_ERROR"
+      })
+    })
+  )
+);
+var fetchMarketplaceLibrary = (options) => pipe5(
+  Effect5.all({
+    server: resolveServer(options.server),
+    apiKey: resolveApiKey2(options.apiKey)
+  }),
+  Effect5.flatMap(
+    ({ server, apiKey }) => Effect5.all({
+      apiKey: Effect5.succeed(apiKey),
+      server: resolveRequestServer(server, apiKey)
+    })
+  ),
+  Effect5.flatMap(
+    ({ server, apiKey }) => requestJson(
+      `${server}/api/marketplace/library`,
+      {
+        method: "GET",
+        headers: mergeAutomationHeaders({
+          Authorization: `Bearer ${apiKey}`
+        })
+      }
+    )
+  ),
+  Effect5.map((response) => response.items)
+);
+var fetchMarketplaceInstallManifest = (slug, options) => pipe5(
+  Effect5.all({
+    server: resolveServer(options.server),
+    apiKey: resolveApiKey2(options.apiKey)
+  }),
+  Effect5.flatMap(
+    ({ server, apiKey }) => Effect5.all({
+      apiKey: Effect5.succeed(apiKey),
+      server: resolveRequestServer(server, apiKey)
+    })
+  ),
+  Effect5.flatMap(
+    ({ server, apiKey }) => requestJson(
+      `${server}/api/marketplace/install-manifest/${encodeURIComponent(slug)}`,
+      {
+        method: "GET",
+        headers: mergeAutomationHeaders({
+          Authorization: `Bearer ${apiKey}`
+        })
+      },
+      {
+        normalizeErrorMessage: ({ payload }) => payload?.error === "Not entitled" ? "Pack not found or no longer available in your library." : void 0,
+        notFoundMessage: "Pack not found or no longer available in your library."
+      }
+    )
+  )
+);
+var fetchMarketplaceLibraryAsync = (options) => Effect5.runPromise(fetchMarketplaceLibrary(options));
+var fetchMarketplaceInstallManifestAsync = (slug, options) => Effect5.runPromise(fetchMarketplaceInstallManifest(slug, options));
+
+// src/lib/command-output.ts
+init_tui();
+var CommandValidationError = class extends Error {
+  code = "CLI_VALIDATION_ERROR";
+  constructor(message) {
+    super(message);
+    this.name = "CommandValidationError";
+  }
+};
+var writeJson = (value) => {
+  process8.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var toJsonErrorOutput = (error) => {
+  if (error instanceof ApiError) {
+    return {
+      error: error.message,
+      code: error.code,
+      status: error.status
+    };
+  }
+  if (error instanceof AuthenticationError) {
+    return {
+      error: error.message,
+      code: "AUTH_REQUIRED",
+      status: 401
+    };
+  }
+  if (error instanceof NetworkError) {
+    return {
+      error: error.message,
+      code: "NETWORK_ERROR",
+      status: 503
+    };
+  }
+  if (error instanceof MarketplaceApiError) {
+    return {
+      error: error.message,
+      code: error.code,
+      status: error.status
+    };
+  }
+  if (error instanceof CommandValidationError || error instanceof SyntaxError) {
+    return {
+      error: error.message,
+      code: "CLI_VALIDATION_ERROR",
+      status: 400
+    };
+  }
+  if (error instanceof Error) {
+    return {
+      error: error.message,
+      code: "CLI_ERROR",
+      status: 500
+    };
+  }
+  return {
+    error: String(error),
+    code: "CLI_ERROR",
+    status: 500
+  };
+};
+var fail = (message) => {
+  throw new CommandValidationError(message);
+};
+var exitCommandError = (error, options) => {
+  if (options?.json) {
+    writeJson(toJsonErrorOutput(error));
+    process8.exit(1);
   }
-  const cwd = options.projectRoot ?? process2.cwd();
-  return join(cwd, agent.hookProjectConfigPath);
+  const message = error instanceof Error ? error.message : String(error);
+  log.error(message);
+  process8.exit(1);
 };
 
 // src/commands/agents.ts
-init_api();
 init_tui();
 var parseCsv = (input) => {
   if (!input) {
@@ -2288,18 +3028,6 @@ var parseCsv = (input) => {
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var writeJson = (value) => {
-  process.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var fail = (message) => {
-  throw new Error(message);
-};
-var exitWithError = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process.exit(1);
-};
 var run = (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
@@ -2403,7 +3131,7 @@ async function agentsListCommand(options) {
     log.success("sub-agents list completed");
     writeJson(result);
   } catch (error) {
-    exitWithError(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 async function agentsGetCommand(options) {
@@ -2417,7 +3145,7 @@ async function agentsGetCommand(options) {
     log.success("sub-agents get completed");
     writeJson(result);
   } catch (error) {
-    exitWithError(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 async function agentsCreateCommand(options) {
@@ -2445,7 +3173,7 @@ async function agentsCreateCommand(options) {
     }
     log.success("sub-agents create completed");
   } catch (error) {
-    exitWithError(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 async function agentsUpdateCommand(options) {
@@ -2470,7 +3198,7 @@ async function agentsUpdateCommand(options) {
     }
     log.success("sub-agents update completed");
   } catch (error) {
-    exitWithError(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 async function agentsRemoveCommand(options) {
@@ -2486,7 +3214,7 @@ async function agentsRemoveCommand(options) {
     }
     log.success("sub-agents remove completed");
   } catch (error) {
-    exitWithError(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 async function agentsInstallCommand(options) {
@@ -2511,365 +3239,57 @@ async function agentsInstallCommand(options) {
         target,
         [spec],
         installPath
-      );
-      summary.push({
-        platform: target.id,
-        installPath,
-        written: result.written.length,
-        warnings: result.warnings,
-        errors: result.errors
-      });
-    }
-    if (options.json) {
-      writeJson(summary);
-      return;
-    }
-    for (const item of summary) {
-      log.info(
-        `${item.platform}: ${item.written} file(s) written${item.installPath ? ` to ${item.installPath}` : ""}`
-      );
-      for (const warning of item.warnings) {
-        log.warn(`  warning: ${warning}`);
-      }
-      for (const error of item.errors) {
-        log.error(`  error (${error.agent}): ${error.error}`);
-      }
-    }
-    log.success("sub-agents install completed");
-  } catch (error) {
-    exitWithError(error);
-  }
-}
-
-// src/commands/auth.ts
-init_esm_shims();
-init_api();
-init_config();
-import process8 from "process";
-
-// src/lib/device-auth.ts
-init_esm_shims();
-init_braid_workspace();
-import { execFile } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { hostname, platform } from "os";
-import { join as join4 } from "path";
-import process6 from "process";
-var TRAILING_SLASHES2 = /\/+$/;
-var LEGACY_BRAID_AUTH_HOSTS = /* @__PURE__ */ new Set([
-  "api.braid.cloud",
-  "braid.cloud",
-  "www.braid.cloud"
-]);
-var BRAID_APP_HOST = "app.braid.cloud";
-var DEFAULT_BRAID_AUTH_HOSTS = /* @__PURE__ */ new Set([
-  ...LEGACY_BRAID_AUTH_HOSTS,
-  BRAID_APP_HOST
-]);
-var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
-var LOCAL_AUTH_ENV_FILES = [
-  ["apps", "web", ".env.local"],
-  ["apps", "convex", ".env.local"]
-];
-var LOCAL_AUTH_ENV_KEYS = ["APP_URL", "SITE_URL"];
-var NEWLINE_REGEX2 = /\r?\n/;
-var DeviceAuthTimeoutError = class extends Error {
-  constructor() {
-    super("Device authorization timed out");
-    this.name = "DeviceAuthTimeoutError";
-  }
-};
-var DeviceAuthDeniedError = class extends Error {
-  constructor() {
-    super("Device authorization was denied");
-    this.name = "DeviceAuthDeniedError";
-  }
-};
-var DeviceAuthExpiredError = class extends Error {
-  constructor() {
-    super("Device authorization code has expired");
-    this.name = "DeviceAuthExpiredError";
-  }
-};
-var sleep = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
-var normalizeBaseUrl2 = (rawUrl) => {
-  const trimmed = rawUrl.replace(TRAILING_SLASHES2, "");
-  try {
-    const url = new URL(trimmed);
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-  } catch {
-    return trimmed;
-  }
-};
-var normalizeLoopbackBaseUrl = (rawUrl) => {
-  const normalized = normalizeBaseUrl2(rawUrl);
-  try {
-    const url = new URL(normalized);
-    if (isLoopbackHost(url.hostname)) {
-      url.hostname = "localhost";
-    }
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-  } catch {
-    return normalized;
-  }
-};
-var isLoopbackHost = (hostname2) => LOOPBACK_HOSTS2.has(hostname2);
-var isLoopbackUrl = (rawUrl) => {
-  try {
-    return isLoopbackHost(new URL(rawUrl).hostname);
-  } catch {
-    return false;
-  }
-};
-var stripQuotes2 = (value) => {
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    return value.slice(1, -1);
-  }
-  return value;
-};
-var parseDotenv2 = (content) => {
-  const result = {};
-  for (const rawLine of content.split(NEWLINE_REGEX2)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) {
-      continue;
-    }
-    const separatorIndex = line.indexOf("=");
-    if (separatorIndex <= 0) {
-      continue;
-    }
-    const key = line.slice(0, separatorIndex).trim();
-    const value = line.slice(separatorIndex + 1).trim();
-    result[key] = stripQuotes2(value);
-  }
-  return result;
-};
-var resolveLocalAuthWebBaseUrlFromEnv = (env) => {
-  for (const key of LOCAL_AUTH_ENV_KEYS) {
-    const value = env[key];
-    if (value && isLoopbackUrl(value)) {
-      return normalizeLoopbackBaseUrl(value);
-    }
-  }
-  return void 0;
-};
-var resolveLocalAuthWebBaseUrlFromFiles = () => {
-  const workspaceRoot = findBraidWorkspaceRoot();
-  if (!workspaceRoot) {
-    return void 0;
-  }
-  for (const envFile of LOCAL_AUTH_ENV_FILES) {
-    const envPath = join4(workspaceRoot, ...envFile);
-    if (!existsSync3(envPath)) {
-      continue;
-    }
-    const localAppUrl = resolveLocalAuthWebBaseUrlFromEnv(
-      parseDotenv2(readFileSync3(envPath, "utf8"))
-    );
-    if (localAppUrl) {
-      return localAppUrl;
-    }
-  }
-  return void 0;
-};
-var resolveLocalAuthWebBaseUrl = () => resolveLocalAuthWebBaseUrlFromEnv(process6.env) ?? resolveLocalAuthWebBaseUrlFromFiles();
-var normalizeServerBaseUrl = (serverUrl) => {
-  const trimmed = normalizeBaseUrl2(serverUrl);
-  try {
-    const url = new URL(trimmed);
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-  } catch {
-    return trimmed;
-  }
-};
-var resolveCanonicalAuthWebBaseUrl = (serverUrl) => {
-  const normalized = normalizeServerBaseUrl(serverUrl);
-  try {
-    const url = new URL(normalized);
-    if (LEGACY_BRAID_AUTH_HOSTS.has(url.hostname)) {
-      url.hostname = BRAID_APP_HOST;
-      url.pathname = "/";
-    }
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-  } catch {
-    return normalized;
-  }
-};
-var isHostedBraidAuthServer = (serverUrl) => {
-  try {
-    return DEFAULT_BRAID_AUTH_HOSTS.has(
-      new URL(normalizeServerBaseUrl(serverUrl)).hostname
-    );
-  } catch {
-    return false;
-  }
-};
-function resolveAuthWebBaseUrl(serverUrl) {
-  const canonicalBaseUrl = resolveCanonicalAuthWebBaseUrl(serverUrl);
-  try {
-    const url = new URL(canonicalBaseUrl);
-    const localAuthBaseUrl = resolveLocalAuthWebBaseUrl();
-    if (localAuthBaseUrl && (DEFAULT_BRAID_AUTH_HOSTS.has(url.hostname) || isLoopbackHost(url.hostname))) {
-      return localAuthBaseUrl;
-    }
-    return `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-  } catch {
-    return canonicalBaseUrl;
-  }
-}
-function buildAuthVerificationUrlFromBaseUrl(authBaseUrl, userCode) {
-  return `${authBaseUrl.replace(TRAILING_SLASHES2, "")}/cli/authorize?user_code=${encodeURIComponent(userCode)}`;
-}
-async function fetchAuthConfigFromBaseUrl(authBaseUrl) {
-  const response = await fetch(`${authBaseUrl}/api/cli/auth-config`);
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(
-      `Failed to fetch auth config (${response.status}): ${body}`
-    );
-  }
-  return {
-    ...await response.json(),
-    verificationBaseUrl: authBaseUrl
-  };
-}
-async function fetchAuthConfig(serverUrl) {
-  const authBaseUrl = resolveAuthWebBaseUrl(serverUrl).replace(
-    TRAILING_SLASHES2,
-    ""
-  );
-  const canonicalAuthBaseUrl = resolveCanonicalAuthWebBaseUrl(
-    serverUrl
-  ).replace(TRAILING_SLASHES2, "");
-  try {
-    return await fetchAuthConfigFromBaseUrl(authBaseUrl);
-  } catch (error) {
-    if (authBaseUrl !== canonicalAuthBaseUrl && isHostedBraidAuthServer(serverUrl)) {
-      return fetchAuthConfigFromBaseUrl(canonicalAuthBaseUrl);
-    }
-    throw error;
-  }
-}
-async function initiateDeviceAuth(convexSiteUrl, deviceInfo) {
-  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/device/authorize`;
-  const response = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(deviceInfo)
-  });
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(
-      `Failed to initiate device authorization (${response.status}): ${body}`
-    );
-  }
-  return response.json();
-}
-async function pollForSession(convexSiteUrl, deviceCode, interval, expiresIn, timeoutSeconds) {
-  const tokenUrl = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/device/token`;
-  const deadline = Date.now() + Math.min(expiresIn, timeoutSeconds) * 1e3;
-  let currentInterval = interval;
-  while (Date.now() < deadline) {
-    await sleep(currentInterval * 1e3);
-    const response = await fetch(tokenUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ device_code: deviceCode })
-    });
-    if (response.ok) {
-      const result = await response.json();
-      return {
-        sessionToken: result.session_token,
-        expiresAt: result.expires_at,
-        user: result.user
-      };
-    }
-    let errorCode;
-    try {
-      const errorBody = await response.json();
-      errorCode = errorBody.error;
-    } catch {
-      throw new Error(`Device auth polling error: HTTP ${response.status}`);
-    }
-    if (errorCode === "authorization_pending") {
-      continue;
-    }
-    if (errorCode === "slow_down") {
-      currentInterval += 5;
-      continue;
-    }
-    if (errorCode === "expired_token") {
-      throw new DeviceAuthExpiredError();
-    }
-    if (errorCode === "access_denied") {
-      throw new DeviceAuthDeniedError();
-    }
-    throw new Error(
-      `Device auth polling error: ${errorCode ?? `HTTP ${response.status}`}`
-    );
-  }
-  throw new DeviceAuthTimeoutError();
-}
-async function fetchSessionInfo(convexSiteUrl, sessionToken) {
-  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/sessions/me`;
-  const response = await fetch(url, {
-    method: "GET",
-    headers: {
-      Authorization: `Bearer ${sessionToken}`
-    }
-  });
-  if (response.status === 404) {
-    return null;
-  }
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(
-      `Failed to fetch session info (${response.status}): ${body}`
-    );
-  }
-  return response.json();
-}
-async function revokeSession(convexSiteUrl, sessionToken) {
-  const url = `${convexSiteUrl.replace(TRAILING_SLASHES2, "")}/api/cli/sessions/me`;
-  const response = await fetch(url, {
-    method: "DELETE",
-    headers: {
-      Authorization: `Bearer ${sessionToken}`
+      );
+      summary.push({
+        platform: target.id,
+        installPath,
+        written: result.written.length,
+        warnings: result.warnings,
+        errors: result.errors
+      });
     }
-  });
-  if (response.status === 404) {
-    return false;
-  }
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(`Failed to revoke session (${response.status}): ${body}`);
-  }
-  return true;
-}
-var noop = () => {
-};
-function openBrowser(url) {
-  const currentPlatform = platform();
-  if (currentPlatform === "darwin") {
-    execFile("open", [url], noop);
-  } else if (currentPlatform === "win32") {
-    execFile("cmd", ["/c", "start", "", url], noop);
-  } else {
-    execFile("xdg-open", [url], noop);
+    if (options.json) {
+      writeJson(summary);
+      return;
+    }
+    for (const item of summary) {
+      log.info(
+        `${item.platform}: ${item.written} file(s) written${item.installPath ? ` to ${item.installPath}` : ""}`
+      );
+      for (const warning of item.warnings) {
+        log.warn(`  warning: ${warning}`);
+      }
+      for (const error of item.errors) {
+        log.error(`  error (${error.agent}): ${error.error}`);
+      }
+    }
+    log.success("sub-agents install completed");
+  } catch (error) {
+    exitCommandError(error, { json: options.json });
   }
 }
-function getDeviceInfo() {
-  return {
-    deviceName: hostname(),
-    deviceOs: platform(),
-    deviceHostname: hostname()
-  };
-}
 
 // src/commands/auth.ts
+init_esm_shims();
+init_api();
+init_config();
+init_device_auth();
 init_tui();
-var SESSION_TOKEN_PREFIX = "brs_";
+import process10 from "process";
+var SESSION_TOKEN_PREFIX3 = "brs_";
+var LOOPBACK_HOSTS3 = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
 var DEFAULT_TIMEOUT_SECONDS = 300;
+var resolvePersistedCliServerUrl = (serverUrl, convexSiteUrl) => {
+  try {
+    const convexUrl = new URL(convexSiteUrl);
+    if (LOOPBACK_HOSTS3.has(convexUrl.hostname)) {
+      return convexSiteUrl;
+    }
+  } catch {
+    return serverUrl;
+  }
+  return serverUrl;
+};
 async function configureDefaultScopeAsync(serverUrl) {
   const shouldConfigureScope = await confirm({
     message: "Configure organization and scope defaults now?",
@@ -2904,9 +3324,9 @@ async function manualTokenFlow(apiKey, serverUrl, options) {
       log.error(
         "The API key could not be validated. Please check your key and try again."
       );
-      process8.exit(1);
+      process10.exit(1);
     }
-    await persistApiKeyAsync(apiKey);
+    await persistApiKeyAsync(apiKey, serverUrl);
     stopAuthSpinner("API key validated and saved");
     if (options.scope !== false) {
       await configureDefaultScopeAsync(serverUrl);
@@ -2919,7 +3339,7 @@ async function manualTokenFlow(apiKey, serverUrl, options) {
     stopAuthSpinner("Validation failed");
     const message = error instanceof Error ? error.message : String(error);
     log.error(`Failed to validate API key: ${message}`);
-    process8.exit(1);
+    process10.exit(1);
   }
 }
 function handlePollingError(error) {
@@ -2933,7 +3353,7 @@ function handlePollingError(error) {
     const message = error instanceof Error ? error.message : String(error);
     log.error(`Authentication failed: ${message}`);
   }
-  process8.exit(1);
+  process10.exit(1);
 }
 async function deviceFlow(serverUrl, timeoutSeconds, options) {
   const configSpinner = spinner();
@@ -2946,7 +3366,7 @@ async function deviceFlow(serverUrl, timeoutSeconds, options) {
     configSpinner.stop("Failed to fetch auth configuration");
     const message = error instanceof Error ? error.message : String(error);
     log.error(`Could not connect to server: ${message}`);
-    process8.exit(1);
+    process10.exit(1);
   }
   const deviceSpinner = spinner();
   deviceSpinner.start("Initiating device authorization...");
@@ -2961,7 +3381,7 @@ async function deviceFlow(serverUrl, timeoutSeconds, options) {
     deviceSpinner.stop("Failed to initiate device authorization");
     const message = error instanceof Error ? error.message : String(error);
     log.error(`Device authorization failed: ${message}`);
-    process8.exit(1);
+    process10.exit(1);
   }
   const verificationUrl = buildAuthVerificationUrlFromBaseUrl(
     authConfig.verificationBaseUrl,
@@ -2995,9 +3415,13 @@ async function deviceFlow(serverUrl, timeoutSeconds, options) {
     pollSpinner.stop("Authentication failed");
     handlePollingError(error);
   }
-  await persistApiKeyAsync(session.sessionToken, authConfig.convexSiteUrl);
+  const persistedServerUrl = resolvePersistedCliServerUrl(
+    serverUrl,
+    authConfig.convexSiteUrl
+  );
+  await persistApiKeyAsync(session.sessionToken, persistedServerUrl);
   if (options.scope !== false) {
-    await configureDefaultScopeAsync(authConfig.convexSiteUrl);
+    await configureDefaultScopeAsync(persistedServerUrl);
   }
   log.success(`Session saved to ${CONFIG_FILE}`);
   outro(
@@ -3025,12 +3449,12 @@ async function authCommand(options) {
   const timeoutSeconds = options.timeout ? Number.parseInt(options.timeout, 10) : DEFAULT_TIMEOUT_SECONDS;
   if (Number.isNaN(timeoutSeconds) || timeoutSeconds <= 0) {
     log.error("Invalid timeout value. Must be a positive number of seconds.");
-    process8.exit(1);
+    process10.exit(1);
   }
   await deviceFlow(serverUrl, timeoutSeconds, options);
 }
 async function displayTokenSource(masked) {
-  if (process8.env.BRAID_API_KEY) {
+  if (process10.env.BRAID_API_KEY) {
     log.info(`Authenticated with key: ${masked}`);
     log.info("Source: BRAID_API_KEY environment variable");
     return;
@@ -3111,7 +3535,7 @@ async function authStatusCommand() {
     );
     return;
   }
-  if (config.token.startsWith(SESSION_TOKEN_PREFIX)) {
+  if (config.token.startsWith(SESSION_TOKEN_PREFIX3)) {
     await displaySessionInfo(config.token);
     await displayProjectConfig();
     displayResolvedSettings(config);
@@ -3134,7 +3558,7 @@ async function revokeSessionIfActive(token) {
 async function authLogoutCommand() {
   const config = await loadMergedConfigAsync();
   const { clearApiKeyAsync: clearApiKeyAsync2 } = await Promise.resolve().then(() => (init_config(), config_exports));
-  if (config.token?.startsWith(SESSION_TOKEN_PREFIX)) {
+  if (config.token?.startsWith(SESSION_TOKEN_PREFIX3)) {
     await revokeSessionIfActive(config.token);
   }
   await clearApiKeyAsync2();
@@ -3146,7 +3570,6 @@ init_esm_shims();
 init_api();
 init_config();
 init_tui();
-import process9 from "process";
 var parseCsv2 = (input) => {
   if (!input) {
     return void 0;
@@ -3154,15 +3577,6 @@ var parseCsv2 = (input) => {
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var writeJson2 = (value) => {
-  process9.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var exitWithError2 = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process9.exit(1);
-};
 var applyCommonOptions = (base, options) => ({
   ...base,
   ...options.server ? { serverUrl: options.server } : {},
@@ -3189,7 +3603,7 @@ async function projectsListCommand(options) {
       applyCommonOptions({}, options)
     );
     if (options.json) {
-      writeJson2(result);
+      writeJson(result);
       return;
     }
     log.info("Personal projects:");
@@ -3211,7 +3625,7 @@ Organization: ${orgProjects.orgName} (${orgProjects.orgId})`);
       }
     }
   } catch (error) {
-    exitWithError2(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 var buildRulesRequest = async (options) => {
@@ -3232,7 +3646,7 @@ async function rulesListCommand(options) {
       await buildRulesRequest(options)
     );
     if (options.json) {
-      writeJson2(result);
+      writeJson(result);
       return;
     }
     if (result.rules.length === 0) {
@@ -3243,7 +3657,7 @@ async function rulesListCommand(options) {
       log.info(`${rule.id}  ${rule.title}`);
     }
   } catch (error) {
-    exitWithError2(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 var buildSkillsRequest = async (options) => {
@@ -3263,7 +3677,7 @@ async function skillsListCommand(options) {
   try {
     const result = await fetchSkillsAsync(await buildSkillsRequest(options));
     if (options.json) {
-      writeJson2(result);
+      writeJson(result);
       return;
     }
     if (result.skills.length === 0) {
@@ -3274,7 +3688,7 @@ async function skillsListCommand(options) {
       log.info(`${skill.name}`);
     }
   } catch (error) {
-    exitWithError2(error);
+    exitCommandError(error, { json: options.json });
   }
 }
 
@@ -3421,11 +3835,11 @@ init_lockfile();
 init_esm_shims();
 import { readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname6, join as join7 } from "path";
-import { Data as Data5, Effect as Effect6, pipe as pipe6 } from "effect";
+import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
 var METADATA_FILENAME2 = ".braid-metadata.json";
-var MetadataReadError = class extends Data5.TaggedError("MetadataReadError") {
+var MetadataReadError = class extends Data6.TaggedError("MetadataReadError") {
 };
-var MetadataWriteError = class extends Data5.TaggedError("MetadataWriteError") {
+var MetadataWriteError = class extends Data6.TaggedError("MetadataWriteError") {
 };
 var normalizeInstalledSkill = (skill) => ({
   kind: skill.kind ?? "skill",
@@ -3441,18 +3855,18 @@ var normalizeMetadata = (metadata) => ({
 var getMetadataPath = (skillsDir) => join7(dirname6(skillsDir), METADATA_FILENAME2);
 var readMetadata = (skillsDir) => {
   const metadataPath = getMetadataPath(skillsDir);
-  return pipe6(
-    Effect6.tryPromise({
+  return pipe7(
+    Effect7.tryPromise({
       try: () => readFile4(metadataPath, "utf-8"),
       catch: (e) => new MetadataReadError({ path: metadataPath, cause: e })
     }),
-    Effect6.flatMap(
-      (content) => Effect6.try({
+    Effect7.flatMap(
+      (content) => Effect7.try({
         try: () => normalizeMetadata(JSON.parse(content)),
         catch: () => normalizeMetadata(void 0)
       })
     ),
-    Effect6.orElseSucceed(() => normalizeMetadata(void 0))
+    Effect7.orElseSucceed(() => normalizeMetadata(void 0))
   );
 };
 var readRawJson = async (path2) => {
@@ -3469,7 +3883,7 @@ var readRawJson = async (path2) => {
 };
 var writeMetadata = (skillsDir, metadata) => {
   const metadataPath = getMetadataPath(skillsDir);
-  return Effect6.tryPromise({
+  return Effect7.tryPromise({
     try: async () => {
       const existing = await readRawJson(metadataPath);
       const merged = { ...existing, skills: metadata.skills };
@@ -3478,9 +3892,9 @@ var writeMetadata = (skillsDir, metadata) => {
     catch: (e) => new MetadataWriteError({ path: metadataPath, cause: e })
   });
 };
-var updateMetadata = (skillsDir, newSkills) => pipe6(
+var updateMetadata = (skillsDir, newSkills) => pipe7(
   readMetadata(skillsDir),
-  Effect6.map((existing) => {
+  Effect7.map((existing) => {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const updatedSkills = [...existing.skills];
     for (const skill of newSkills) {
@@ -3503,35 +3917,35 @@ var updateMetadata = (skillsDir, newSkills) => pipe6(
     }
     return { skills: updatedSkills };
   }),
-  Effect6.flatMap((metadata) => writeMetadata(skillsDir, metadata))
+  Effect7.flatMap((metadata) => writeMetadata(skillsDir, metadata))
 );
-var removeFromMetadata = (skillsDir, skillName) => pipe6(
+var removeFromMetadata = (skillsDir, skillName) => pipe7(
   readMetadata(skillsDir),
-  Effect6.map((metadata) => ({
+  Effect7.map((metadata) => ({
     skills: metadata.skills.filter((s) => s.name !== skillName)
   })),
-  Effect6.flatMap((metadata) => writeMetadata(skillsDir, metadata))
+  Effect7.flatMap((metadata) => writeMetadata(skillsDir, metadata))
 );
-var readMetadataAsync = (skillsDir) => Effect6.runPromise(readMetadata(skillsDir));
-var updateMetadataAsync = (skillsDir, newSkills) => Effect6.runPromise(updateMetadata(skillsDir, newSkills));
-var removeFromMetadataAsync = (skillsDir, skillName) => Effect6.runPromise(removeFromMetadata(skillsDir, skillName));
+var readMetadataAsync = (skillsDir) => Effect7.runPromise(readMetadata(skillsDir));
+var updateMetadataAsync = (skillsDir, newSkills) => Effect7.runPromise(updateMetadata(skillsDir, newSkills));
+var removeFromMetadataAsync = (skillsDir, skillName) => Effect7.runPromise(removeFromMetadata(skillsDir, skillName));
 
 // src/lib/rule-writer.ts
 init_esm_shims();
 import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname7, resolve as resolve3, sep as sep2 } from "path";
-import { Data as Data6, Effect as Effect7, pipe as pipe7 } from "effect";
-var RuleWriteError = class extends Data6.TaggedError("RuleWriteError") {
+import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
+var RuleWriteError = class extends Data7.TaggedError("RuleWriteError") {
 };
-var createDirectory = (dir) => Effect7.tryPromise({
+var createDirectory = (dir) => Effect8.tryPromise({
   try: () => mkdir4(dir, { recursive: true }),
   catch: (e) => new RuleWriteError({ path: dir, operation: "mkdir", cause: e })
 });
-var writeTextFile = (fullPath, content) => Effect7.tryPromise({
+var writeTextFile = (fullPath, content) => Effect8.tryPromise({
   try: () => writeFile6(fullPath, content, "utf-8"),
   catch: (e) => new RuleWriteError({ path: fullPath, operation: "write", cause: e })
 });
-var readTextFile = (fullPath) => Effect7.tryPromise({
+var readTextFile = (fullPath) => Effect8.tryPromise({
   try: () => readFile5(fullPath, "utf-8"),
   catch: (e) => new RuleWriteError({ path: fullPath, operation: "read", cause: e })
 });
@@ -3539,7 +3953,7 @@ var assertRulePathWithinBase = (basePath, ruleName) => {
   const resolvedBase = resolve3(basePath);
   const resolvedFull = resolve3(basePath, ruleName);
   if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep2)) {
-    return Effect7.fail(
+    return Effect8.fail(
       new RuleWriteError({
         path: ruleName,
         operation: "write",
@@ -3549,7 +3963,7 @@ var assertRulePathWithinBase = (basePath, ruleName) => {
       })
     );
   }
-  return Effect7.succeed(resolvedFull);
+  return Effect8.succeed(resolvedFull);
 };
 var BRAID_SECTION_START = "<!-- braid:rules:start -->";
 var BRAID_SECTION_END = "<!-- braid:rules:end -->";
@@ -3582,30 +3996,30 @@ function buildAppendContent(rules2) {
   lines.push(BRAID_SECTION_END);
   return lines.join("\n");
 }
-var writeMdcRules = (basePath, rules2) => pipe7(
+var writeMdcRules = (basePath, rules2) => pipe8(
   createDirectory(basePath),
-  Effect7.flatMap(
-    () => Effect7.forEach(
+  Effect8.flatMap(
+    () => Effect8.forEach(
       rules2,
-      (rule) => pipe7(
+      (rule) => pipe8(
         assertRulePathWithinBase(basePath, `${rule.name}.mdc`),
-        Effect7.flatMap(
+        Effect8.flatMap(
           (filePath) => writeTextFile(filePath, buildMdcContent(rule))
         )
       ),
       { concurrency: "unbounded" }
     )
   ),
-  Effect7.asVoid
+  Effect8.asVoid
 );
-var writeMarkdownDirRules = (basePath, rules2) => pipe7(
+var writeMarkdownDirRules = (basePath, rules2) => pipe8(
   createDirectory(basePath),
-  Effect7.flatMap(
-    () => Effect7.forEach(
+  Effect8.flatMap(
+    () => Effect8.forEach(
       rules2,
-      (rule) => pipe7(
+      (rule) => pipe8(
         assertRulePathWithinBase(basePath, `${rule.name}.md`),
-        Effect7.flatMap(
+        Effect8.flatMap(
           (filePath) => writeTextFile(filePath, `# ${rule.title}
 
 ${rule.content}`)
@@ -3614,17 +4028,17 @@ ${rule.content}`)
       { concurrency: "unbounded" }
     )
   ),
-  Effect7.asVoid
+  Effect8.asVoid
 );
-var writeAppendSingleRules = (filePath, rules2) => pipe7(
+var writeAppendSingleRules = (filePath, rules2) => pipe8(
   createDirectory(dirname7(filePath)),
-  Effect7.flatMap(
-    () => pipe7(
+  Effect8.flatMap(
+    () => pipe8(
       readTextFile(filePath),
-      Effect7.orElseSucceed(() => "")
+      Effect8.orElseSucceed(() => "")
     )
   ),
-  Effect7.flatMap((existing) => {
+  Effect8.flatMap((existing) => {
     const braidContent = buildAppendContent(rules2);
     const startIdx = existing.indexOf(BRAID_SECTION_START);
     const endIdx = existing.indexOf(BRAID_SECTION_END);
@@ -3648,21 +4062,21 @@ var writeRulesForFormat = (basePath, rules2, format) => {
     case "append-single":
       return writeAppendSingleRules(basePath, rules2);
     default:
-      return Effect7.void;
+      return Effect8.void;
   }
 };
 var writeRulesForAgent = (agent, rules2, rulesPath) => {
   if (!agent.ruleFormat || rules2.length === 0) {
-    return Effect7.succeed({ written: 0, errors: [] });
+    return Effect8.succeed({ written: 0, errors: [] });
   }
-  return pipe7(
+  return pipe8(
     writeRulesForFormat(rulesPath, rules2, agent.ruleFormat),
-    Effect7.map(() => ({
+    Effect8.map(() => ({
       written: rules2.length,
       errors: []
     })),
-    Effect7.catch(
-      (error) => Effect7.succeed({
+    Effect8.catch(
+      (error) => Effect8.succeed({
         written: 0,
         errors: [
           {
@@ -3674,29 +4088,29 @@ var writeRulesForAgent = (agent, rules2, rulesPath) => {
     )
   );
 };
-var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect7.runPromise(writeRulesForAgent(agent, rules2, rulesPath));
+var writeRulesForAgentAsync = (agent, rules2, rulesPath) => Effect8.runPromise(writeRulesForAgent(agent, rules2, rulesPath));
 
 // src/lib/skill-writer.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
 import { chmod, mkdir as mkdir5, rm as rm2, symlink, writeFile as writeFile7 } from "fs/promises";
 import { dirname as dirname8, join as join8, resolve as resolve4, sep as sep3 } from "path";
-import { Data as Data7, Effect as Effect8, pipe as pipe8 } from "effect";
-var WriteError = class extends Data7.TaggedError("WriteError") {
+import { Data as Data8, Effect as Effect9, pipe as pipe9 } from "effect";
+var WriteError = class extends Data8.TaggedError("WriteError") {
 };
-var createDirectory2 = (dir, fullPath) => Effect8.tryPromise({
+var createDirectory2 = (dir, fullPath) => Effect9.tryPromise({
   try: () => mkdir5(dir, { recursive: true }),
   catch: (e) => new WriteError({ path: fullPath, operation: "mkdir", cause: e })
 });
-var writeTextFile2 = (fullPath, content) => Effect8.tryPromise({
+var writeTextFile2 = (fullPath, content) => Effect9.tryPromise({
   try: () => writeFile7(fullPath, content, "utf-8"),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var writeBinaryFile = (fullPath, content) => Effect8.tryPromise({
+var writeBinaryFile = (fullPath, content) => Effect9.tryPromise({
   try: () => writeFile7(fullPath, content),
   catch: (e) => new WriteError({ path: fullPath, operation: "write", cause: e })
 });
-var makeExecutable = (fullPath) => Effect8.tryPromise({
+var makeExecutable = (fullPath) => Effect9.tryPromise({
   try: () => chmod(fullPath, 493),
   catch: (e) => new WriteError({ path: fullPath, operation: "chmod", cause: e })
 });
@@ -3704,7 +4118,7 @@ var assertWithinBase2 = (basePath, untrustedPath) => {
   const resolvedBase = resolve4(basePath);
   const resolvedFull = resolve4(basePath, untrustedPath);
   if (resolvedFull !== resolvedBase && !resolvedFull.startsWith(resolvedBase + sep3)) {
-    return Effect8.fail(
+    return Effect9.fail(
       new WriteError({
         path: untrustedPath,
         operation: "write",
@@ -3714,7 +4128,7 @@ var assertWithinBase2 = (basePath, untrustedPath) => {
       })
     );
   }
-  return Effect8.succeed(resolvedFull);
+  return Effect9.succeed(resolvedFull);
 };
 var COMPATIBILITY_REGEX = /^compatibility:\s*.+$/m;
 var rewriteCompatibility = (content, agentId) => {
@@ -3757,22 +4171,22 @@ var isScriptFile = (path2) => {
   return inScriptsDir && scriptExtensions.some((ext) => lowerPath.endsWith(ext));
 };
 var writeFileContent = (fullPath, file, agentId) => isBinaryFile(file.path) ? writeBinaryFile(fullPath, decodeFileContentBinary(file)) : writeTextFile2(fullPath, decodeFileContent(file, agentId));
-var setExecutableIfScript = (fullPath, file, agentId) => isScriptFile(file.path) && decodeFileContent(file, agentId).startsWith("#!") ? makeExecutable(fullPath) : Effect8.void;
-var writeSkillFile = (basePath, file, agentId) => pipe8(
+var setExecutableIfScript = (fullPath, file, agentId) => isScriptFile(file.path) && decodeFileContent(file, agentId).startsWith("#!") ? makeExecutable(fullPath) : Effect9.void;
+var writeSkillFile = (basePath, file, agentId) => pipe9(
   assertWithinBase2(basePath, file.path),
-  Effect8.flatMap((fullPath) => {
+  Effect9.flatMap((fullPath) => {
     const dir = dirname8(fullPath);
-    return pipe8(
+    return pipe9(
       createDirectory2(dir, fullPath),
-      Effect8.flatMap(() => writeFileContent(fullPath, file, agentId)),
-      Effect8.flatMap(() => setExecutableIfScript(fullPath, file, agentId))
+      Effect9.flatMap(() => writeFileContent(fullPath, file, agentId)),
+      Effect9.flatMap(() => setExecutableIfScript(fullPath, file, agentId))
     );
   })
 );
-var writeSkillAtPath = (skillPath, skill, agentId) => pipe8(
+var writeSkillAtPath = (skillPath, skill, agentId) => pipe9(
   createDirectory2(skillPath, skillPath),
-  Effect8.flatMap(
-    () => Effect8.forEach(
+  Effect9.flatMap(
+    () => Effect9.forEach(
       skill.files,
       (file) => writeSkillFile(skillPath, file, agentId),
       {
@@ -3780,16 +4194,16 @@ var writeSkillAtPath = (skillPath, skill, agentId) => pipe8(
       }
     )
   ),
-  Effect8.map(() => void 0)
+  Effect9.map(() => void 0)
 );
-var writeSkill = (basePath, skill, agentId) => pipe8(
+var writeSkill = (basePath, skill, agentId) => pipe9(
   assertWithinBase2(basePath, skill.name),
-  Effect8.flatMap((skillDir) => writeSkillAtPath(skillDir, skill, agentId))
+  Effect9.flatMap((skillDir) => writeSkillAtPath(skillDir, skill, agentId))
 );
-var writeSkillSymlink = (basePath, skill, agentId, options) => pipe8(
+var writeSkillSymlink = (basePath, skill, agentId, options) => pipe9(
   assertWithinBase2(basePath, skill.name),
-  Effect8.flatMap(
-    (installPath) => Effect8.tryPromise({
+  Effect9.flatMap(
+    (installPath) => Effect9.tryPromise({
       try: async () => {
         if (!options.storeRoot) {
           throw new Error("storeRoot is required for shared-store installs");
@@ -3799,7 +4213,7 @@ var writeSkillSymlink = (basePath, skill, agentId, options) => pipe8(
           skill,
           agentId
         );
-        await Effect8.runPromise(
+        await Effect9.runPromise(
           writeSkillAtPath(storedBundlePath, skill, agentId)
         );
         const destinationPath = await resolveManagedBundlePathAsync(
@@ -3826,14 +4240,14 @@ var writeSkillSymlink = (basePath, skill, agentId, options) => pipe8(
 );
 var hashSkill = (skill, agentId) => createHash2("sha256").update(JSON.stringify({ agentId, skill })).digest("hex").slice(0, 16);
 var resolveStorePath = (storeRoot, skill, agentId) => join8(storeRoot, `${skill.name}-${hashSkill(skill, agentId)}`);
-var writeSkills = (basePath, skills2, agentId, options = {}) => pipe8(
-  Effect8.forEach(
+var writeSkills = (basePath, skills2, agentId, options = {}) => pipe9(
+  Effect9.forEach(
     skills2,
-    (skill) => pipe8(
+    (skill) => pipe9(
       options.storeRoot ? writeSkillSymlink(basePath, skill, agentId, options) : writeSkill(basePath, skill, agentId),
-      Effect8.map(() => ({ success: true, skill: skill.name })),
-      Effect8.catch(
-        (error) => Effect8.succeed({
+      Effect9.map(() => ({ success: true, skill: skill.name })),
+      Effect9.catch(
+        (error) => Effect9.succeed({
           success: false,
           skill: skill.name,
           error: error.cause instanceof Error ? error.cause.message : String(error.cause)
@@ -3842,14 +4256,14 @@ var writeSkills = (basePath, skills2, agentId, options = {}) => pipe8(
     ),
     { concurrency: "unbounded" }
   ),
-  Effect8.map((results) => ({
+  Effect9.map((results) => ({
     written: results.filter((r) => r.success).map((r) => r.skill),
     errors: results.filter(
       (r) => !r.success
     ).map((r) => ({ skill: r.skill, error: r.error }))
   }))
 );
-var writeSkillsAsync = (basePath, skills2, agentId, options) => Effect8.runPromise(writeSkills(basePath, skills2, agentId, options));
+var writeSkillsAsync = (basePath, skills2, agentId, options) => Effect9.runPromise(writeSkills(basePath, skills2, agentId, options));
 
 // src/commands/install.ts
 init_tui();
@@ -4219,7 +4633,7 @@ function showInstallOutro(totalWritten, totalErrors, suffix) {
     outro(`Successfully installed ${totalWritten} items${suffix}.`);
   }
 }
-async function fetchPublicContent(handle, slug, version, lockedRuleIds, options, installSpinner) {
+async function fetchPublicContent(handle, slug, version, lockedRuleIds, apiKey, options, installSpinner) {
   if (version !== void 0 && lockedRuleIds) {
     installSpinner.stop(`Installing pinned version v${version}`);
     installSpinner.start("Downloading content...");
@@ -4229,7 +4643,8 @@ async function fetchPublicContent(handle, slug, version, lockedRuleIds, options,
         slug,
         lockedRuleIds,
         options.server,
-        version
+        version,
+        apiKey
       ),
       ruleIds: lockedRuleIds
     };
@@ -4238,7 +4653,8 @@ async function fetchPublicContent(handle, slug, version, lockedRuleIds, options,
     handle,
     slug,
     options.server,
-    version
+    version,
+    apiKey
   );
   installSpinner.stop("Found public content");
   displayPublicMetadata(metadata);
@@ -4250,7 +4666,8 @@ async function fetchPublicContent(handle, slug, version, lockedRuleIds, options,
       slug,
       ruleIds,
       options.server,
-      version
+      version,
+      apiKey
     ),
     ruleIds
   };
@@ -4299,6 +4716,7 @@ async function writeLockfileAfterInstall(handle, slug, version, contentHash, rul
   }
 }
 async function publicInstallCommand(source, options) {
+  const config = await loadMergedConfigAsync();
   const parsed = parsePublicSource(source);
   if (!parsed) {
     log.error(`Invalid public source: ${source}`);
@@ -4322,6 +4740,7 @@ async function publicInstallCommand(source, options) {
     log.info(`Using locked version: v${version}`);
   }
   const versionSuffix = version !== void 0 ? `@${version}` : "";
+  const serverUrl = options.server ?? config.serverUrl;
   intro(`Installing from @${handle}/${slug}${versionSuffix}`);
   const installSpinner = spinner();
   installSpinner.start("Fetching public content...");
@@ -4331,7 +4750,11 @@ async function publicInstallCommand(source, options) {
       slug,
       version,
       lockedRuleIds,
-      options,
+      config.token,
+      {
+        ...options,
+        server: serverUrl
+      },
       installSpinner
     );
     installSpinner.stop(`Downloaded ${summarizeContent(response)}`);
@@ -4339,11 +4762,13 @@ async function publicInstallCommand(source, options) {
       log.warn("No content to install.");
       process.exit(0);
     }
-    const serverUrl = options.server ?? "https://braid.cloud";
     const { totalWritten, totalErrors } = await installToSelectedAgents(
       response,
       serverUrl,
-      options,
+      {
+        ...options,
+        server: serverUrl
+      },
       installSpinner
     );
     if (totalWritten > 0 && version !== void 0) {
@@ -4540,7 +4965,8 @@ async function listCommand(options) {
 
 // src/commands/manage.ts
 init_esm_shims();
-import process10 from "process";
+init_device_auth();
+import process11 from "process";
 
 // src/lib/manage-server.ts
 init_esm_shims();
@@ -4550,6 +4976,7 @@ import { createServer } from "http";
 import { isAbsolute, relative as relative2, resolve as resolve6 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 init_config();
+init_device_auth();
 
 // src/lib/manage-actions.ts
 init_esm_shims();
@@ -4560,8 +4987,8 @@ import { basename as basename2, dirname as dirname10, join as join11, relative }
 init_esm_shims();
 import { mkdir as mkdir6, readFile as readFile6, rm as rm3, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname9, join as join9 } from "path";
-import { Data as Data8, Effect as Effect9 } from "effect";
-var HookConfigWriteError = class extends Data8.TaggedError("HookConfigWriteError") {
+import { Data as Data9, Effect as Effect10 } from "effect";
+var HookConfigWriteError = class extends Data9.TaggedError("HookConfigWriteError") {
 };
 var HOOK_METADATA_FILENAME = ".braid-metadata.json";
 function stableStringify(value) {
@@ -4886,7 +5313,7 @@ async function ensureMarketplaceHookBundleFile(settingsPath, sourceSlug) {
   });
   return bundlePath;
 }
-var writeMarketplaceHooks = (settingsPath, hooks, options) => Effect9.tryPromise({
+var writeMarketplaceHooks = (settingsPath, hooks, options) => Effect10.tryPromise({
   try: async () => {
     const activeHooks = hooks.filter(
       (hook) => hook.enabled !== false && hook.runtime === "claude"
@@ -4941,131 +5368,18 @@ var writeMarketplaceHooks = (settingsPath, hooks, options) => Effect9.tryPromise
   },
   catch: (cause) => new HookConfigWriteError({ path: settingsPath, cause })
 });
-var writeMarketplaceHooksAsync = (settingsPath, hooks, options) => Effect9.runPromise(writeMarketplaceHooks(settingsPath, hooks, options));
+var writeMarketplaceHooksAsync = (settingsPath, hooks, options) => Effect10.runPromise(writeMarketplaceHooks(settingsPath, hooks, options));
 var removeMarketplaceHooksBySourceAsync = (settingsPath, sourceSlug) => removeMarketplaceHooksBySource(settingsPath, sourceSlug);
 var ensureMarketplaceHookBundleFileAsync = (settingsPath, sourceSlug) => ensureMarketplaceHookBundleFile(settingsPath, sourceSlug);
 var listInstalledMarketplaceHookSourcesAsync = (settingsPath) => listInstalledMarketplaceHookSources(settingsPath);
 var readMarketplaceHookBundleFileAsync = (bundlePath) => readMarketplaceHookBundleFile(bundlePath);
 
-// src/lib/marketplace-api.ts
-init_esm_shims();
-init_config();
-import { Data as Data9, Effect as Effect10, pipe as pipe9 } from "effect";
-var TRAILING_SLASH_REGEX2 = /\/$/;
-var MarketplaceApiError = class extends Data9.TaggedError("MarketplaceApiError") {
-};
-var resolveApiKey2 = (provided) => {
-  if (provided) {
-    return Effect10.succeed(provided);
-  }
-  return pipe9(
-    Effect10.tryPromise({
-      try: () => getApiKeyAsync(),
-      catch: () => new MarketplaceApiError({
-        message: "Failed to load API key",
-        status: 500,
-        code: "CONFIG_ERROR"
-      })
-    }),
-    Effect10.flatMap(
-      (token) => token ? Effect10.succeed(token) : Effect10.fail(
-        new MarketplaceApiError({
-          message: "Not signed in. Run 'braid auth'.",
-          status: 401,
-          code: "AUTH_REQUIRED"
-        })
-      )
-    )
-  );
-};
-var resolveServer = (provided) => {
-  if (provided) {
-    return Effect10.succeed(provided.replace(TRAILING_SLASH_REGEX2, ""));
-  }
-  return pipe9(
-    Effect10.tryPromise({
-      try: () => getServerUrlAsync(),
-      catch: () => new MarketplaceApiError({
-        message: "Failed to load server URL",
-        status: 500,
-        code: "CONFIG_ERROR"
-      })
-    }),
-    Effect10.map((server) => server.replace(TRAILING_SLASH_REGEX2, ""))
-  );
-};
-var requestJson = (url, options) => pipe9(
-  Effect10.tryPromise({
-    try: () => fetch(url, options),
-    catch: () => new MarketplaceApiError({
-      message: "Network error",
-      status: 503,
-      code: "NETWORK_ERROR"
-    })
-  }),
-  Effect10.flatMap(
-    (response) => Effect10.tryPromise({
-      try: async () => {
-        const payload = await response.json().catch(() => null);
-        if (!response.ok) {
-          throw new MarketplaceApiError({
-            message: payload?.error ?? payload?.message ?? `Request failed (HTTP ${response.status} from ${new URL(url).origin})`,
-            status: response.status,
-            code: payload?.code ?? "REQUEST_ERROR"
-          });
-        }
-        return payload;
-      },
-      catch: (error) => error instanceof MarketplaceApiError ? error : new MarketplaceApiError({
-        message: "Invalid response",
-        status: 500,
-        code: "PARSE_ERROR"
-      })
-    })
-  )
-);
-var fetchMarketplaceLibrary = (options) => pipe9(
-  Effect10.all({
-    server: resolveServer(options.server),
-    apiKey: resolveApiKey2(options.apiKey)
-  }),
-  Effect10.flatMap(
-    ({ server, apiKey }) => requestJson(
-      `${server}/api/marketplace/library`,
-      {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${apiKey}`
-        }
-      }
-    )
-  ),
-  Effect10.map((response) => response.items)
-);
-var fetchMarketplaceInstallManifest = (slug, options) => pipe9(
-  Effect10.all({
-    server: resolveServer(options.server),
-    apiKey: resolveApiKey2(options.apiKey)
-  }),
-  Effect10.flatMap(
-    ({ server, apiKey }) => requestJson(
-      `${server}/api/marketplace/install-manifest/${encodeURIComponent(slug)}`,
-      {
-        method: "GET",
-        headers: {
-          Authorization: `Bearer ${apiKey}`
-        }
-      }
-    )
-  )
-);
-var fetchMarketplaceLibraryAsync = (options) => Effect10.runPromise(fetchMarketplaceLibrary(options));
-var fetchMarketplaceInstallManifestAsync = (slug, options) => Effect10.runPromise(fetchMarketplaceInstallManifest(slug, options));
-
 // src/lib/marketplace-installer.ts
 init_esm_shims();
 import { rm as rm4 } from "fs/promises";
 import { join as join10 } from "path";
+init_config();
+var TRAILING_SLASH_REGEX3 = /\/$/;
 function parseAgentIds(value) {
   if (!value) {
     return [];
@@ -5135,7 +5449,7 @@ async function installSkillsForAgent(args) {
         versionId: args.manifest.versionId
       },
       version: args.manifest.versionId ?? args.manifest.commitSha ?? "unknown",
-      serverUrl: "https://braid.cloud"
+      serverUrl: args.serverUrl
     }))
   );
   args.targets.push(`${args.agent.name} -> ${installPath}`);
@@ -5224,6 +5538,7 @@ async function installAllForAgent(args) {
     agent: args.agent,
     manifest: args.manifest,
     slug: args.slug,
+    serverUrl: args.serverUrl,
     skills: args.skills,
     global: args.global,
     installedSkills: args.installedSkills,
@@ -5281,6 +5596,7 @@ async function installMarketplaceSkillSet(options) {
       "No compatible agents found. Use --agents to specify targets."
     );
   }
+  const serverUrl = (options.serverUrl ?? await getServerUrlAsync().catch(() => "https://braid.cloud")).replace(TRAILING_SLASH_REGEX3, "");
   const targets = [];
   const installedSkills = /* @__PURE__ */ new Set();
   for (const agent of targetAgents) {
@@ -5288,6 +5604,7 @@ async function installMarketplaceSkillSet(options) {
       agent,
       manifest: options.manifest,
       slug: options.slug,
+      serverUrl,
       skills: resolvedSkills,
       rules: rules2,
       agents: agents2,
@@ -5437,7 +5754,8 @@ async function installLibraryPackAsync(options) {
     agents: options.agentId,
     global: options.scope === "global",
     manifest,
-    slug: options.slug
+    slug: options.slug,
+    serverUrl: options.server
   });
 }
 
@@ -5914,7 +6232,8 @@ var MIME_TYPES = {
 };
 var TRAILING_SLASHES3 = /\/+$/;
 var MANAGE_AUTH_TIMEOUT_SECONDS = 300;
-var SESSION_TOKEN_PREFIX2 = "brs_";
+var SESSION_TOKEN_PREFIX4 = "brs_";
+var LOOPBACK_HOSTS4 = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
 function getErrorStatus(error) {
   if (typeof error === "object" && error !== null && "status" in error && typeof error.status === "number") {
     return error.status ?? 500;
@@ -5991,7 +6310,18 @@ function getContentType(pathname) {
   const extension = pathname.slice(pathname.lastIndexOf("."));
   return MIME_TYPES[extension] ?? "application/octet-stream";
 }
-function writeJson3(response, status, body) {
+function resolvePersistedCliServerUrl2(serverUrl, convexSiteUrl) {
+  try {
+    const convexUrl = new URL(convexSiteUrl);
+    if (LOOPBACK_HOSTS4.has(convexUrl.hostname)) {
+      return convexSiteUrl;
+    }
+  } catch {
+    return serverUrl;
+  }
+  return serverUrl;
+}
+function writeJson2(response, status, body) {
   response.writeHead(status, {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "no-store"
@@ -6015,7 +6345,7 @@ async function serveStaticAsset(serverResponse, assetRoot, pathname) {
   const assetPath = resolve6(assetRoot, relativePath);
   const resolvedRoot = resolve6(assetRoot);
   if (!isWithinManageAssetRoot(resolvedRoot, assetPath)) {
-    writeJson3(serverResponse, 404, { error: "Not found" });
+    writeJson2(serverResponse, 404, { error: "Not found" });
     return true;
   }
   try {
@@ -6109,19 +6439,19 @@ async function handleManageApiRoute(request, response, dependencies) {
   const pathname = new URL(request.url ?? "/", "http://127.0.0.1").pathname;
   switch (`${method} ${pathname}`) {
     case "GET /api/inventory":
-      writeJson3(response, 200, await dependencies.getInventory());
+      writeJson2(response, 200, await dependencies.getInventory());
       return true;
     case "GET /api/library":
-      writeJson3(response, 200, await dependencies.listLibrary());
+      writeJson2(response, 200, await dependencies.listLibrary());
       return true;
     case "GET /api/auth/session":
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.getAuthSession()
       });
       return true;
     case "POST /api/auth/start":
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.startAuth()
       });
@@ -6135,7 +6465,7 @@ async function handleManageApiRoute(request, response, dependencies) {
           "AUTH_REQUEST_REQUIRED"
         );
       }
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.completeAuth({
           requestId: payload.requestId
@@ -6144,14 +6474,14 @@ async function handleManageApiRoute(request, response, dependencies) {
       return true;
     }
     case "POST /api/auth/sign-out":
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.signOut()
       });
       return true;
     case "POST /api/actions/install": {
       const payload = await readJsonBody(request);
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.installLibraryPack(payload)
       });
@@ -6159,7 +6489,7 @@ async function handleManageApiRoute(request, response, dependencies) {
     }
     case "POST /api/actions/disable": {
       const payload = await readJsonBody(request);
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.disableManagedBundle(payload)
       });
@@ -6167,7 +6497,7 @@ async function handleManageApiRoute(request, response, dependencies) {
     }
     case "POST /api/actions/enable": {
       const payload = await readJsonBody(request);
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.enableManagedBundle(payload)
       });
@@ -6175,7 +6505,7 @@ async function handleManageApiRoute(request, response, dependencies) {
     }
     case "POST /api/actions/remove": {
       const payload = await readJsonBody(request);
-      writeJson3(response, 200, {
+      writeJson2(response, 200, {
         ok: true,
         result: await dependencies.removeManagedBundle(payload)
       });
@@ -6197,11 +6527,11 @@ async function handleManageRequest(request, response, assetRoot, dependencies) {
         return;
       }
     }
-    writeJson3(response, 404, { error: "Not found" });
+    writeJson2(response, 404, { error: "Not found" });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const code = getErrorCode(error);
-    writeJson3(response, getErrorStatus(error), {
+    writeJson2(response, getErrorStatus(error), {
       ...code ? { code } : {},
       error: message
     });
@@ -6272,6 +6602,10 @@ async function startManageServer(options = {}) {
       deviceAuth.user_code
     );
     authRequests.set(requestId, {
+      serverUrl: resolvePersistedCliServerUrl2(
+        serverUrl,
+        authConfig.convexSiteUrl
+      ),
       convexSiteUrl: authConfig.convexSiteUrl,
       deviceCode: deviceAuth.device_code,
       expiresIn: deviceAuth.expires_in,
@@ -6304,7 +6638,7 @@ async function startManageServer(options = {}) {
       );
       await persistApiKeyAsync(
         session.sessionToken,
-        pendingRequest.convexSiteUrl
+        pendingRequest.serverUrl
       );
       return {
         authenticated: true,
@@ -6321,7 +6655,7 @@ async function startManageServer(options = {}) {
     if (!token) {
       return { authenticated: false };
     }
-    if (!token.startsWith(SESSION_TOKEN_PREFIX2)) {
+    if (!token.startsWith(SESSION_TOKEN_PREFIX4)) {
       return { authenticated: true };
     }
     const serverUrl = (options.server ?? config.serverUrl).replace(
@@ -6346,7 +6680,7 @@ async function startManageServer(options = {}) {
   const signOut = options.signOut ?? (async () => {
     const config = await loadMergedConfigAsync();
     const token = config.token;
-    if (token?.startsWith(SESSION_TOKEN_PREFIX2)) {
+    if (token?.startsWith(SESSION_TOKEN_PREFIX4)) {
       try {
         const serverUrl = (options.server ?? config.serverUrl).replace(
           TRAILING_SLASHES3,
@@ -6378,7 +6712,7 @@ async function startManageServer(options = {}) {
     handleManageRequest(request, response, assetRoot, dependencies).catch(
       (error) => {
         const message = error instanceof Error ? error.message : String(error);
-        writeJson3(response, 500, { error: message });
+        writeJson2(response, 500, { error: message });
       }
     );
   });
@@ -6422,7 +6756,7 @@ async function manageCommand(options) {
     const server = await startManageServer({
       apiKey: options.apiKey,
       port: parsePort(options.port),
-      projectRoot: process10.cwd(),
+      projectRoot: process11.cwd(),
       server: options.server
     });
     if (options.open !== false) {
@@ -6432,17 +6766,17 @@ async function manageCommand(options) {
     log.info("Press Ctrl+C to stop.");
     await new Promise((resolveClose, rejectClose) => {
       const shutdown = () => {
-        process10.off("SIGINT", shutdown);
-        process10.off("SIGTERM", shutdown);
+        process11.off("SIGINT", shutdown);
+        process11.off("SIGTERM", shutdown);
         server.close().then(resolveClose).catch(rejectClose);
       };
-      process10.once("SIGINT", shutdown);
-      process10.once("SIGTERM", shutdown);
+      process11.once("SIGINT", shutdown);
+      process11.once("SIGTERM", shutdown);
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     log.error(message);
-    process10.exit(1);
+    process11.exit(1);
   }
 }
 
@@ -6450,7 +6784,7 @@ async function manageCommand(options) {
 init_esm_shims();
 import { rm as rm6 } from "fs/promises";
 import { join as join13, resolve as resolve7 } from "path";
-import process11 from "process";
+import process12 from "process";
 init_tui();
 async function selectInstallScope(options) {
   if (options.global != null) {
@@ -6469,7 +6803,7 @@ async function selectInstallScope(options) {
   });
   if (isCancel(result)) {
     cancel("Install cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return result;
 }
@@ -6504,7 +6838,7 @@ async function selectInstallAgents(options, global) {
   });
   if (isCancel(selected)) {
     cancel("Install cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return selected;
 }
@@ -6521,7 +6855,7 @@ async function confirmHooksOptIn(hookCount, options) {
   });
   if (isCancel(result)) {
     cancel("Install cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return result;
 }
@@ -6546,7 +6880,7 @@ async function marketplaceLibraryCommand(options) {
     log.error(
       error instanceof Error ? error.message : "Failed to fetch library"
     );
-    process11.exit(1);
+    process12.exit(1);
   }
 }
 async function resolveAndInstallPack(slug, options, overrides) {
@@ -6569,7 +6903,8 @@ async function resolveAndInstallPack(slug, options, overrides) {
     manifest,
     agents: agents2,
     global,
-    allowHooks: options.allowHooks
+    allowHooks: options.allowHooks,
+    serverUrl: options.server
   });
 }
 async function marketplaceInstallCommand(slug, options) {
@@ -6580,7 +6915,7 @@ async function marketplaceInstallCommand(slug, options) {
     log.error(
       error instanceof Error ? error.message : "Failed to install pack"
     );
-    process11.exit(1);
+    process12.exit(1);
   }
 }
 function addSkillToPack(packMap, slug, versionId, skillName, agent, installPath) {
@@ -6634,7 +6969,7 @@ async function marketplaceUpdateCommand(slug, options) {
     const toUpdate = slug ? installed.filter((p) => p.slug === slug) : installed;
     if (toUpdate.length === 0) {
       log.error(`Pack "${slug}" is not installed.`);
-      process11.exit(1);
+      process12.exit(1);
     }
     let updated = 0;
     for (const pack of toUpdate) {
@@ -6654,7 +6989,7 @@ async function marketplaceUpdateCommand(slug, options) {
     log.error(
       error instanceof Error ? error.message : "Failed to update packs"
     );
-    process11.exit(1);
+    process12.exit(1);
   }
 }
 async function selectPacksToRemove(installed, slug, options) {
@@ -6680,7 +7015,7 @@ async function selectPacksToRemove(installed, slug, options) {
   });
   if (isCancel(selected)) {
     cancel("Remove cancelled.");
-    process11.exit(0);
+    process12.exit(0);
   }
   return selected;
 }
@@ -6718,7 +7053,7 @@ async function marketplaceRemoveCommand(slug, options) {
       });
       if (isCancel(confirmed) || !confirmed) {
         cancel("Remove cancelled.");
-        process11.exit(0);
+        process12.exit(0);
       }
     }
     for (const pack of toRemove) {
@@ -6729,7 +7064,7 @@ async function marketplaceRemoveCommand(slug, options) {
     log.error(
       error instanceof Error ? error.message : "Failed to remove packs"
     );
-    process11.exit(1);
+    process12.exit(1);
   }
 }
 
@@ -6737,19 +7072,6 @@ async function marketplaceRemoveCommand(slug, options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process12 from "process";
-var writeJson4 = (value) => {
-  process12.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var exitWithError3 = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process12.exit(1);
-};
-var fail2 = (message) => {
-  throw new Error(message);
-};
 var parseContext = (contextJson) => {
   if (!contextJson) {
     return void 0;
@@ -6770,7 +7092,7 @@ var run2 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson4(result);
+    writeJson(result);
     return;
   }
   log.success(`profiles ${command} completed`);
@@ -6779,34 +7101,34 @@ async function profilesListCommand(options) {
   try {
     await run2("list", {}, options);
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 async function profilesGetCommand(options) {
   try {
     if (!(options.id || options.name)) {
-      fail2("profiles get requires --id or --name");
+      fail("profiles get requires --id or --name");
     }
     await run2("get", { id: options.id, name: options.name }, options);
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 async function profilesCreateCommand(options) {
   try {
-    const name = options.name ?? fail2("profiles create requires --name");
+    const name = options.name ?? fail("profiles create requires --name");
     await run2(
       "create",
       { name, context: parseContext(options.contextJson) },
       options
     );
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 async function profilesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail2("profiles update requires --id");
+    const id = options.id ?? fail("profiles update requires --id");
     await run2(
       "update",
       {
@@ -6817,26 +7139,26 @@ async function profilesUpdateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 async function profilesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail2("profiles remove requires --id");
+    const id = options.id ?? fail("profiles remove requires --id");
     if (!options.yes) {
-      fail2("profiles remove requires --yes");
+      fail("profiles remove requires --yes");
     }
     await run2("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 async function profilesSetDefaultCommand(options) {
   try {
-    const id = options.id ?? fail2("profiles set-default requires --id");
+    const id = options.id ?? fail("profiles set-default requires --id");
     await run2("set-default", { id }, options);
   } catch (error) {
-    exitWithError3(error);
+    exitCommandError(error, options);
   }
 }
 
@@ -6844,14 +7166,6 @@ async function profilesSetDefaultCommand(options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process13 from "process";
-var writeJson5 = (value) => {
-  process13.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var fail3 = (message) => {
-  throw new Error(message);
-};
 var run3 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
@@ -6866,39 +7180,34 @@ var run3 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson5(result);
+    writeJson(result);
     return;
   }
   log.success(`projects ${command} completed`);
 };
-var exitWithError4 = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process13.exit(1);
-};
 async function projectsGetCommand(options) {
   try {
-    const id = options.id ?? fail3("projects get requires --id");
+    const id = options.id ?? fail("projects get requires --id");
     await run3("get", { id }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitCommandError(error, options);
   }
 }
 async function projectsCreateCommand(options) {
   try {
-    const name = options.name ?? fail3("projects create requires --name");
+    const name = options.name ?? fail("projects create requires --name");
     await run3(
       "create",
       { name, description: options.description, orgId: options.orgId },
       options
     );
   } catch (error) {
-    exitWithError4(error);
+    exitCommandError(error, options);
   }
 }
 async function projectsUpdateCommand(options) {
   try {
-    const id = options.id ?? fail3("projects update requires --id");
+    const id = options.id ?? fail("projects update requires --id");
     await run3(
       "update",
       {
@@ -6909,18 +7218,18 @@ async function projectsUpdateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError4(error);
+    exitCommandError(error, options);
   }
 }
 async function projectsRemoveCommand(options) {
   try {
-    const id = options.id ?? fail3("projects remove requires --id");
+    const id = options.id ?? fail("projects remove requires --id");
     if (!options.yes) {
-      fail3("projects remove requires --yes");
+      fail("projects remove requires --yes");
     }
     await run3("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError4(error);
+    exitCommandError(error, options);
   }
 }
 
@@ -6928,11 +7237,6 @@ async function projectsRemoveCommand(options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process14 from "process";
-var writeJson6 = (value) => {
-  process14.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
 var parseCsv3 = (input) => {
   if (!input) {
     return void 0;
@@ -6940,14 +7244,6 @@ var parseCsv3 = (input) => {
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var exitWithError5 = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process14.exit(1);
-};
-var fail4 = (message) => {
-  throw new Error(message);
-};
 var run4 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
@@ -6962,69 +7258,69 @@ var run4 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson6(result);
+    writeJson(result);
     return;
   }
   log.success(`references ${command} completed`);
 };
 async function referencesListCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail4("references list requires --rule-id");
+    const ruleId = options.ruleId ?? fail("references list requires --rule-id");
     await run4("list", { ruleId }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 async function referencesGetCommand(options) {
   try {
-    const id = options.id ?? fail4("references get requires --id");
+    const id = options.id ?? fail("references get requires --id");
     await run4("get", { id }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 async function referencesCreateCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail4("references create requires --rule-id");
-    const file = options.file ?? fail4("references create requires --file");
+    const ruleId = options.ruleId ?? fail("references create requires --rule-id");
+    const file = options.file ?? fail("references create requires --file");
     await run4("create", { ruleId, file }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 async function referencesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail4("references update requires --id");
+    const id = options.id ?? fail("references update requires --id");
     await run4(
       "update",
       { id, label: options.label, replaceFile: options.replaceFile },
       options
     );
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 async function referencesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail4("references remove requires --id");
+    const id = options.id ?? fail("references remove requires --id");
     if (!options.yes) {
-      fail4("references remove requires --yes");
+      fail("references remove requires --yes");
     }
     await run4("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 async function referencesReorderCommand(options) {
   try {
-    const ruleId = options.ruleId ?? fail4("references reorder requires --rule-id");
+    const ruleId = options.ruleId ?? fail("references reorder requires --rule-id");
     const orderedIds = parseCsv3(options.orderedIds);
     if (!orderedIds || orderedIds.length === 0) {
-      fail4("references reorder requires --ordered-ids");
+      fail("references reorder requires --ordered-ids");
     }
     await run4("reorder", { ruleId, orderedIds }, options);
   } catch (error) {
-    exitWithError5(error);
+    exitCommandError(error, options);
   }
 }
 
@@ -7032,7 +7328,7 @@ async function referencesReorderCommand(options) {
 init_esm_shims();
 import { rm as rm7 } from "fs/promises";
 import { join as join14, resolve as resolve8 } from "path";
-import process15 from "process";
+import process13 from "process";
 init_tui();
 async function collectInstalledSkills(detectedAgents, options) {
   const skillsToRemove = [];
@@ -7065,7 +7361,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
     if (selected.length === 0) {
       log.error(`Skill '${options.skill}' not found.`);
       log.info("Run 'braid list' to see installed skills.");
-      process15.exit(1);
+      process13.exit(1);
     }
     return selected;
   }
@@ -7084,7 +7380,7 @@ async function selectSkillsToRemove(skillsToRemove, options) {
   });
   if (isCancel(result)) {
     cancel("Remove cancelled.");
-    process15.exit(0);
+    process13.exit(0);
   }
   return result;
 }
@@ -7098,7 +7394,7 @@ async function confirmRemoval(selectedCount, options) {
   });
   if (isCancel(confirmed) || !confirmed) {
     cancel("Remove cancelled.");
-    process15.exit(0);
+    process13.exit(0);
   }
 }
 async function removeSkill(skill, removeSpinner) {
@@ -7162,7 +7458,7 @@ async function removeCommand(options) {
     removeSpinner.stop("Remove failed");
     const message = error instanceof Error ? error.message : String(error);
     log.error(message);
-    process15.exit(1);
+    process13.exit(1);
   }
 }
 
@@ -7221,6 +7517,7 @@ async function retractCommand(source, _options) {
 // src/commands/rollback.ts
 init_esm_shims();
 init_api();
+init_config();
 init_lockfile();
 init_tui();
 var PUBLIC_SOURCE_REGEX2 = /^@([a-z0-9-]+)\/([a-z0-9-]+)$/;
@@ -7239,7 +7536,8 @@ async function findPreviousActiveVersion(args) {
         args.slug,
         args.ruleIds,
         args.server,
-        v
+        v,
+        args.apiKey
       );
       return { version: v, response };
     } catch (error) {
@@ -7253,6 +7551,8 @@ async function findPreviousActiveVersion(args) {
   return null;
 }
 async function rollbackCommand(source, options) {
+  const config = await loadMergedConfigAsync();
+  const serverUrl = options.server ?? config.serverUrl;
   intro(`Rolling back ${source}`);
   const rollbackSpinner = spinner();
   rollbackSpinner.start("Reading lockfile...");
@@ -7317,7 +7617,8 @@ async function rollbackCommand(source, options) {
       slug: publicSource.slug,
       currentVersion: parsed.version,
       ruleIds: currentValue.ruleIds,
-      server: options.server
+      server: serverUrl,
+      apiKey: config.token
     });
     if (!result) {
       rollbackSpinner.stop("No active version found");
@@ -7360,7 +7661,6 @@ async function rollbackCommand(source, options) {
 init_esm_shims();
 init_api();
 init_tui();
-import process16 from "process";
 var parseCsv4 = (input) => {
   if (!input) {
     return void 0;
@@ -7368,18 +7668,6 @@ var parseCsv4 = (input) => {
   const values = input.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
   return values.length > 0 ? values : void 0;
 };
-var writeJson7 = (value) => {
-  process16.stdout.write(`${JSON.stringify(value, null, 2)}
-`);
-};
-var exitWithError6 = (error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  log.error(message);
-  process16.exit(1);
-};
-var fail5 = (message) => {
-  throw new Error(message);
-};
 var run5 = async (command, args, options) => {
   const apiOptions = {
     ...options.server ? { serverUrl: options.server } : {},
@@ -7394,23 +7682,23 @@ var run5 = async (command, args, options) => {
     apiOptions
   );
   if (options.json) {
-    writeJson7(result);
+    writeJson(result);
     return;
   }
   log.success(`rules ${command} completed`);
 };
 async function rulesGetCommand(options) {
   try {
-    const id = options.id ?? fail5("rules get requires --id");
+    const id = options.id ?? fail("rules get requires --id");
     await run5("get", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesCreateCommand(options) {
   try {
-    const title = options.title ?? fail5("rules create requires --title");
-    const content = options.content ?? fail5("rules create requires --content");
+    const title = options.title ?? fail("rules create requires --title");
+    const content = options.content ?? fail("rules create requires --content");
     await run5(
       "create",
       {
@@ -7423,12 +7711,12 @@ async function rulesCreateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesUpdateCommand(options) {
   try {
-    const id = options.id ?? fail5("rules update requires --id");
+    const id = options.id ?? fail("rules update requires --id");
     await run5(
       "update",
       {
@@ -7441,120 +7729,120 @@ async function rulesUpdateCommand(options) {
       options
     );
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesRemoveCommand(options) {
   try {
-    const id = options.id ?? fail5("rules remove requires --id");
+    const id = options.id ?? fail("rules remove requires --id");
     if (!options.yes) {
-      fail5("rules remove requires --yes");
+      fail("rules remove requires --yes");
     }
     await run5("remove", { id, yes: true }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesEnableCommand(options) {
   try {
-    const id = options.id ?? fail5("rules enable requires --id");
+    const id = options.id ?? fail("rules enable requires --id");
     await run5("enable", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesDisableCommand(options) {
   try {
-    const id = options.id ?? fail5("rules disable requires --id");
+    const id = options.id ?? fail("rules disable requires --id");
     await run5("disable", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesMoveCommand(options) {
   try {
-    const id = options.id ?? fail5("rules move requires --id");
-    const projectId = options.projectId ?? fail5("rules move requires --project-id");
+    const id = options.id ?? fail("rules move requires --id");
+    const projectId = options.projectId ?? fail("rules move requires --project-id");
     await run5("move", { id, projectId }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesDuplicateCommand(options) {
   try {
-    const id = options.id ?? fail5("rules duplicate requires --id");
+    const id = options.id ?? fail("rules duplicate requires --id");
     await run5(
       "duplicate",
       { id, targetProjectId: options.targetProjectId },
       options
     );
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesForkCommand(options) {
   try {
-    const id = options.id ?? fail5("rules fork requires --id");
+    const id = options.id ?? fail("rules fork requires --id");
     await run5(
       "fork",
       { id, targetProjectId: options.targetProjectId },
       options
     );
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncStatusCommand(options) {
   try {
     await run5("sync-status", { id: options.id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncHistoryCommand(options) {
   try {
-    const id = options.id ?? fail5("rules sync-history requires --id");
+    const id = options.id ?? fail("rules sync-history requires --id");
     await run5("sync-history", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncEnableCommand(options) {
   try {
-    const id = options.id ?? fail5("rules sync-enable requires --id");
+    const id = options.id ?? fail("rules sync-enable requires --id");
     await run5("sync-enable", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncDisableCommand(options) {
   try {
-    const id = options.id ?? fail5("rules sync-disable requires --id");
+    const id = options.id ?? fail("rules sync-disable requires --id");
     await run5("sync-disable", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncCheckCommand(options) {
   try {
-    const id = options.id ?? fail5("rules sync-check requires --id");
+    const id = options.id ?? fail("rules sync-check requires --id");
     await run5("sync-check", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 async function rulesSyncNowCommand(options) {
   try {
-    const id = options.id ?? fail5("rules sync-now requires --id");
+    const id = options.id ?? fail("rules sync-now requires --id");
     await run5("sync-now", { id }, options);
   } catch (error) {
-    exitWithError6(error);
+    exitCommandError(error, options);
   }
 }
 
 // src/commands/scaffold.ts
 init_esm_shims();
-import process17 from "process";
+import process14 from "process";
 
 // src/lib/scaffold.ts
 init_esm_shims();
@@ -8514,11 +8802,11 @@ var normalizeReferenceList = (referenceLabel, availableNamesLabel, values, avail
 };
 var exitCancelled2 = () => {
   cancel("Scaffold cancelled.");
-  process17.exit(0);
+  process14.exit(0);
 };
-var exitWithError7 = (message) => {
+var exitWithError = (message) => {
   log.error(message);
-  process17.exit(1);
+  process14.exit(1);
 };
 var requirePromptValue = (value) => {
   if (isCancel(value)) {
@@ -8531,7 +8819,7 @@ var resolveType = async (options) => {
     return options.type;
   }
   if (options.yes) {
-    return exitWithError7("--type is required when using --yes");
+    return exitWithError("--type is required when using --yes");
   }
   const selected = requirePromptValue(
     await select({
@@ -8561,7 +8849,7 @@ var resolveName = async (options) => {
     return options.name.trim();
   }
   if (options.yes) {
-    return exitWithError7("--name is required when using --yes");
+    return exitWithError("--name is required when using --yes");
   }
   const value = requirePromptValue(
     await text({
@@ -8647,7 +8935,7 @@ var resolveOptionalReference = async (label, flagValue, options, availableNames)
   return selected || void 0;
 };
 var buildScaffoldInput = async (options) => {
-  const context = await inspectScaffoldDirectory(process17.cwd());
+  const context = await inspectScaffoldDirectory(process14.cwd());
   const availableSkillNames = context.manifest.skills.map(
     (entry) => entry.name
   );
@@ -8701,7 +8989,7 @@ var buildScaffoldInput = async (options) => {
     availableWorkflowNames
   ) : void 0;
   return {
-    cwd: process17.cwd(),
+    cwd: process14.cwd(),
     type,
     name,
     title,
@@ -8730,10 +9018,10 @@ var finishScaffoldSuccess = (type, name, createdFiles) => {
 var isMockedProcessExitError = (error) => error instanceof Error && error.message.startsWith("process.exit:");
 var handleScaffoldCommandFailure = (error) => {
   if (error instanceof ScaffoldError) {
-    exitWithError7(error.message);
+    exitWithError(error.message);
   }
   if (error instanceof Error && !isMockedProcessExitError(error)) {
-    exitWithError7(error.message);
+    exitWithError(error.message);
   }
   throw error;
 };