@duvoai/cli 1.45.3 → 1.46.0

package/dist/bin/duvo.js

@@ -9796,15 +9796,7 @@ var adminCaseQueueConsumerSchema = z49.object({
   agentName: z49.string(),
   caseTriggerEnabled: z49.boolean(),
   isHandoverTarget: z49.boolean(),
-  problems: z49.array(adminCaseQueueAgentProblemSchema),
-  /** Raw concurrency set on the trigger row, null if unset or no trigger exists. */
-  triggerConcurrency: z49.number().nullable(),
-  /**
-   * Effective concurrency for the consumer trigger:
-   * `min(triggerConcurrency ?? defaultConcurrency, maxConcurrency)`.
-   * Null when this consumer has no trigger.
-   */
-  effectiveConcurrency: z49.number().nullable()
+  problems: z49.array(adminCaseQueueAgentProblemSchema)
 });
 var adminCaseQueueItemSummarySchema = z49.object({
   id: z49.string(),
@@ -9858,6 +9850,13 @@ var adminCaseQueueDetailResponseSchema = z49.object({
       name: z49.string(),
       description: z49.string().nullable(),
       folderId: z49.string().nullable(),
+      /** The configured per-queue concurrency cap (case_queue.concurrency); null uses the default. */
+      configuredConcurrency: z49.number().nullable(),
+      /**
+       * Effective per-queue concurrency after the default fallback and the
+       * `MAX_CASE_TRIGGER_CONCURRENCY` ceiling. Always a number.
+       */
+      effectiveConcurrency: z49.number(),
       createdAt: z49.string(),
       updatedAt: z49.string()
     }),
@@ -9865,13 +9864,13 @@ var adminCaseQueueDetailResponseSchema = z49.object({
     consumers: z49.array(adminCaseQueueConsumerSchema),
     /**
      * `env.DEFAULT_CASE_TRIGGER_CONCURRENCY` — the per-queue concurrency applied
-     * to a trigger that has no concurrency set.
+     * to a queue that has no explicit cap set.
      */
     defaultConcurrency: z49.number(),
     /**
      * `env.MAX_CASE_TRIGGER_CONCURRENCY` — the hard per-queue ceiling for
-     * effective trigger concurrency, clamping both a trigger's own concurrency
-     * and the fallback default when either exceeds this value.
+     * effective concurrency, clamping both a queue's own cap and the fallback
+     * default when either exceeds this value.
      */
     maxConcurrency: z49.number(),
     items: z49.object({
@@ -9882,20 +9881,19 @@ var adminCaseQueueDetailResponseSchema = z49.object({
     })
   })
 });
-var adminUpdateCaseTriggerConcurrencyRequestSchema = z49.object({
+var adminUpdateQueueConcurrencyRequestSchema = z49.object({
   concurrency: z49.int().positive().nullable().describe(
-    "New per-trigger concurrency cap. A positive integer (up to the platform max) sets an explicit cap; null clears it so the trigger uses the platform default."
+    "New per-queue concurrency cap. A positive integer (up to the platform max) sets an explicit cap; null clears it so the queue uses the platform default."
   )
 });
-var adminUpdateCaseTriggerConcurrencyResponseSchema = z49.object({
+var adminUpdateQueueConcurrencyResponseSchema = z49.object({
   data: z49.object({
-    agentId: z49.string(),
-    /** Raw concurrency stored on the trigger row, null when using the default. */
-    triggerConcurrency: z49.number().nullable(),
+    queueId: z49.string(),
+    /** The configured concurrency stored on the queue row, null when using the default. */
+    configuredConcurrency: z49.number().nullable(),
     /**
      * Effective concurrency after applying the default fallback and the
-     * `MAX_CASE_TRIGGER_CONCURRENCY` ceiling. Always a number because a trigger
-     * row exists.
+     * `MAX_CASE_TRIGGER_CONCURRENCY` ceiling.
      */
     effectiveConcurrency: z49.number()
   })
@@ -11542,7 +11540,6 @@ var automationRevisionQueueBindingApiSchema = z64.object({
     "Agent the queue routes to in this revision (null when unrouted)"
   ),
   enabled: z64.boolean().describe("Whether the queue's routing is enabled"),
-  concurrency: z64.int().nullable().describe("Per-revision concurrency limit (null for the queue default)"),
   name: z64.string().nullable().describe(
     "Per-revision queue name override (null to keep the queue's own name)"
   ),
@@ -11586,6 +11583,111 @@ var automationRevisionScheduleBindingApiSchema = z64.object({
   day_of_month: z64.int().min(1).max(31).nullable().describe("Day of month for a monthly schedule"),
   task: z64.string().nullable().describe("Prompt passed as the run's initial user message")
 });
+var automationTriggerSubscriptionApiSchema = z64.object({
+  id: z64.guid().describe("Subscription identifier"),
+  automation_trigger_id: z64.guid().describe("Declaration this subscription fulfills"),
+  user_id: z64.guid().nullable().describe(
+    "Scope owner. Always populated today: a null-scope (team) subscription needs the shared-run runtime, so nothing creates one yet"
+  ),
+  created_by: z64.guid().nullable().describe("Who authored the subscription"),
+  enabled: z64.boolean().describe("Whether this scope participates"),
+  integration_instance_id: z64.guid().nullable().describe("The connection this subscription currently fires with"),
+  pending_integration_instance_id: z64.guid().nullable().describe(
+    "A connection change staged with a draft, applied atomically on that draft's promotion"
+  ),
+  pending_from_revision_id: z64.guid().nullable().describe("Draft revision the staged connection change belongs to")
+});
+var automationScheduleSubscriptionApiSchema = z64.object({
+  id: z64.guid().describe("Subscription identifier"),
+  automation_schedule_id: z64.guid().describe("Declaration this subscription fulfills"),
+  user_id: z64.guid().nullable().describe(
+    "Scope owner. Always populated today: a null-scope (team) subscription needs the shared-run runtime, so nothing creates one yet"
+  ),
+  created_by: z64.guid().nullable().describe("Who authored the subscription"),
+  enabled: z64.boolean().describe("Whether this scope participates")
+});
+var automationRevisionTriggersResponseApiSchema = z64.object({
+  revision_id: z64.guid().describe("Revision these declarations were read from"),
+  revision_status: automationRevisionStatusApiSchema.describe(
+    "`draft`, `live`, or `historic` \u2014 drives read-only presentation"
+  ),
+  revision_updated_at: z64.string().describe(
+    "ISO 8601 change stamp, and the concurrency token for the paired PUT. Send it back as `If-Match` and a write from stale state is refused with 409. Without it there is no check, and because the PUT replaces the complete set, a stale client silently drops declarations another editor added"
+  ),
+  triggers: z64.array(automationRevisionTriggerBindingApiSchema).describe(
+    "Credential-free trigger declarations and this revision's config"
+  ),
+  subscriptions: z64.array(automationTriggerSubscriptionApiSchema).describe(
+    "How each declaration is fulfilled **right now** \u2014 every scope's, not just the caller's. Returned at any revision status, and always current state: this is not a record of what fulfilled the declaration while a historic revision was live (that is not stored). On a historic revision it answers what a rollback would resume \u2014 note that activation disables the subscriptions of a declaration a newer revision omits and never re-enables them, so a bound-but-disabled row means rolling back will not resume it until each member opts back in"
+  )
+});
+var automationRevisionSchedulesResponseApiSchema = z64.object({
+  revision_id: z64.guid().describe("Revision these declarations were read from"),
+  revision_status: automationRevisionStatusApiSchema.describe(
+    "`draft`, `live`, or `historic` \u2014 drives read-only presentation"
+  ),
+  revision_updated_at: z64.string().describe(
+    "ISO 8601 change stamp, and the concurrency token for the paired PUT. Send it back as `If-Match` and a write from stale state is refused with 409. Without it there is no check, and because the PUT replaces the complete set, a stale client silently drops declarations another editor added"
+  ),
+  schedules: z64.array(automationRevisionScheduleBindingApiSchema).describe(
+    "Credential-free schedule declarations and this revision's config"
+  ),
+  subscriptions: z64.array(automationScheduleSubscriptionApiSchema).describe(
+    "Who the schedule runs as **right now** \u2014 every scope's, not just the caller's. Returned at any revision status, and always current state rather than a record of who it ran as while a historic revision was live. Unlike the trigger lane, activation never disables a schedule opt-in when a revision omits the declaration, so these survive a rollback intact"
+  )
+});
+var setAutomationRevisionTriggerApiSchema = z64.object({
+  automation_trigger_id: z64.guid().optional().describe("Existing declaration to update; omit to mint a new one"),
+  agent_id: z64.guid().describe("Agent this trigger routes to"),
+  integration_slug: z64.string().min(1).describe("Integration to watch"),
+  trigger_type: z64.string().min(1).describe("Trigger type within the integration"),
+  enabled: z64.boolean().default(true).describe("Whether the trigger is enabled in this revision"),
+  filter_config: z64.record(z64.string(), z64.unknown()).default({}).describe("Per-revision filter configuration"),
+  integration_instance_id: z64.guid().nullable().optional().describe(
+    "Connection to fulfill this declaration with. Applied on promotion for an already-live declaration; set directly for one that is not live. Omit to leave it as it is; pass null to discard a choice staged against this draft"
+  )
+});
+var setAutomationRevisionTriggersRequestApiSchema = z64.object({
+  triggers: z64.array(setAutomationRevisionTriggerApiSchema).describe(
+    "The draft's complete desired trigger set; declarations absent here are removed from the draft"
+  )
+});
+var setAutomationRevisionScheduleApiSchema = z64.object({
+  automation_schedule_id: z64.guid().optional().describe("Existing declaration to update; omit to mint a new one"),
+  agent_id: z64.guid().describe("Agent this schedule fires"),
+  enabled: z64.boolean().default(true).describe("Whether the schedule is enabled"),
+  cron: z64.string().min(1).nullable().optional().describe("5-field cron expression; mutually exclusive with `frequency`"),
+  frequency: z64.enum(AUTOMATION_SCHEDULE_FREQUENCIES).nullable().optional().describe("Frequency form; mutually exclusive with `cron`"),
+  time: z64.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/).nullable().optional().describe("Local time of day as HH:MM"),
+  timezone: z64.string().default("UTC").describe("IANA timezone the schedule is evaluated in"),
+  day: z64.enum(AUTOMATION_SCHEDULE_DAYS).nullable().optional().describe("Day of week for a weekly schedule"),
+  day_of_month: z64.int().min(1).max(31).nullable().optional().describe("Day of month for a monthly schedule"),
+  task: z64.string().nullable().optional().describe("Prompt passed as the run's initial user message")
+});
+var setAutomationRevisionSchedulesRequestApiSchema = z64.object({
+  schedules: z64.array(setAutomationRevisionScheduleApiSchema).describe(
+    "The draft's complete desired schedule set; declarations absent here are removed from the draft"
+  )
+});
+var setAutomationTriggerSubscriptionRequestApiSchema = z64.object({
+  enabled: z64.boolean().describe("Whether this scope participates"),
+  integration_instance_id: z64.guid().nullable().optional().describe(
+    "Connection this scope fires with. Required to enable a subscription that has none"
+  )
+});
+var setAutomationScheduleSubscriptionRequestApiSchema = z64.object({
+  enabled: z64.boolean().describe("Whether this scope participates")
+});
+var automationTriggerSubscriptionResponseApiSchema = z64.object({
+  subscription: automationTriggerSubscriptionApiSchema.describe(
+    "The subscription after the change"
+  )
+});
+var automationScheduleSubscriptionResponseApiSchema = z64.object({
+  subscription: automationScheduleSubscriptionApiSchema.describe(
+    "The subscription after the change"
+  )
+});
 var automationRevisionDetailApiSchema = automationRevisionSummaryApiSchema.extend({
   ai_description: z64.string().nullable().describe(
     "AI-generated short description of what this revision does (null until generated)"
@@ -11665,9 +11767,6 @@ var setAutomationRevisionQueueBodyApiSchema = z64.object({
   enabled: z64.boolean().optional().describe(
     "Whether routing is enabled (omit to keep current; default true when new)"
   ),
-  concurrency: z64.int().nonnegative().nullable().optional().describe(
-    "Per-revision concurrency limit (null for queue default; omit to keep current)"
-  ),
   name: revisionNameFieldSchema.nullable().optional().describe("Per-revision name override (null clears; omit to keep current)"),
   description: revisionDescriptionFieldSchema.nullable().optional().describe(
     "Per-revision description override (null clears; omit to keep current)"
@@ -12592,6 +12691,7 @@ var getTeamInviteLinkResponseSchema = z79.object({
   hasLink: z79.boolean(),
   link: teamInviteLinkSchema.optional()
 });
+var createTeamInviteLinkResponseSchema = teamInviteLinkSchema;
 var joinLinkInfoResponseSchema = z79.object({
   valid: z79.boolean(),
   teamName: z79.string().optional(),
@@ -13844,6 +13944,7 @@ var bulkInviteResponseSchema = z93.object({
   skipped: z93.number(),
   failed: z93.number()
 });
+var createTeamInvitationResponseSchema = teamInvitationDetailApiSchema;
 var TEAM_DISCOVERY_MODES = ["request", "auto"];
 var teamDiscoveryModeSchema = z94.enum(TEAM_DISCOVERY_MODES);
 var BrowserRegionSchema = z94.enum([
@@ -16010,7 +16111,8 @@ function normalizeProfile(value) {
     return {
       type: "api-key",
       apiKey: profile.apiKey,
-      apiBaseUrl
+      apiBaseUrl,
+      defaultTeamId: typeof profile.defaultTeamId === "string" ? profile.defaultTeamId : void 0
     };
   }
   return null;
@@ -16188,7 +16290,10 @@ async function resolveConfig(options = {}) {
       apiBaseUrl: env.DUVO_API_BASE_URL ?? profile.apiBaseUrl,
       profileName,
       authType: "api-key",
-      defaultTeamId: null
+      // Honored for user-scoped keys (team_id NULL server-side), which can
+      // act on every team the owner can reach; a team-scoped key ignores it
+      // because the server pins the key's team.
+      defaultTeamId: profile.defaultTeamId ?? null
     };
   }
   const fresh = await ensureFreshOAuthProfile(config, profileName, profile);
@@ -16333,6 +16438,11 @@ async function resolveTeamIdFromApiKey(config) {
       "API key is not associated with a team. Pass --team <id> or check your key."
     );
   }
+  if (parsed.data.teams.length > 1) {
+    throw new CliError(
+      "This key can act on multiple teams. Pass --team <id>, set DUVO_TEAM_ID, or choose a default with `duvo team use <id>`. Run `duvo teams list` to see them."
+    );
+  }
   return team.id;
 }
 __name(resolveTeamIdFromApiKey, "resolveTeamIdFromApiKey");
@@ -29096,187 +29206,865 @@ function registerIntegrations(program) {
 }
 __name(registerIntegrations, "registerIntegrations");
 
-// src/commands/login.ts
-import { isCancel as isCancel4, log, password, spinner, text as text2 } from "@clack/prompts";
-
-// src/oauth/auth0-config.ts
-var BAKED_DOMAIN = "login.duvo.ai" ? "login.duvo.ai" : "login.dev.duvo.ai";
-var BAKED_CLIENT_ID = "MpK8jktbMHPlrCxmSPeRbkiSNrRTUjeT" ? "MpK8jktbMHPlrCxmSPeRbkiSNrRTUjeT" : "mq4MhUUHRNKrzkqr1MnAJdcvv5MNfuBU";
-var BAKED_AUDIENCE = "https://api.duvo.ai" ? "https://api.duvo.ai" : "https://api.dev.duvo.ai";
-function resolveAuth0Config() {
-  return {
-    domain: BAKED_DOMAIN,
-    clientId: BAKED_CLIENT_ID,
-    audience: BAKED_AUDIENCE,
-    issuer: `https://${BAKED_DOMAIN}/`
-  };
-}
-__name(resolveAuth0Config, "resolveAuth0Config");
-
-// src/oauth/loopback.ts
-import { createServer } from "node:http";
-var LOOPBACK_PORTS = [49152, 49153, 49154, 49155, 49156];
-var HOST = "127.0.0.1";
-async function startLoopbackServer() {
-  const result = await tryBindNext([...LOOPBACK_PORTS]);
-  if (!result) {
+// src/commands/invite/team-roles.ts
+var TEAM_ROLES2 = Object.values(TEAM_ROLE);
+var DEFAULT_TEAM_ROLE = TEAM_ROLE.MEMBER;
+function assertTeamRole(role, flag = "--role") {
+  if (!TEAM_ROLES2.includes(role)) {
     throw new CliError(
-      `Could not bind to a local port \u2014 tried ${LOOPBACK_PORTS.join(", ")}.`
+      `Invalid ${flag} "${role}"; expected one of: ${TEAM_ROLES2.join(", ")}`
     );
   }
-  const redirectUri = `http://${HOST}:${result.port}/callback`;
-  return wrapServer(result.server, redirectUri);
+  return role;
 }
-__name(startLoopbackServer, "startLoopbackServer");
-async function tryBindNext(ports) {
-  if (ports.length === 0) {
-    return null;
+__name(assertTeamRole, "assertTeamRole");
+
+// src/commands/invite/bulk.ts
+var MAX_MEMBERS = 50;
+function collect3(value, previous = []) {
+  return [...previous, value];
+}
+__name(collect3, "collect");
+function parseMember(value, defaultRole) {
+  const raw = trimRequired(value, "--member");
+  const separator = raw.indexOf("=");
+  if (separator === -1) {
+    return { email: raw, role: defaultRole };
   }
-  const [port, ...rest] = ports;
-  const server = await tryBind(port);
-  if (server) {
-    return { server, port };
+  const email = raw.slice(0, separator).trim();
+  const role = raw.slice(separator + 1).trim();
+  if (email.length === 0) {
+    throw new CliError(
+      `Invalid --member "${raw}"; expected <email> or <email>=<role>.`
+    );
   }
-  return tryBindNext(rest);
-}
-__name(tryBindNext, "tryBindNext");
-async function tryBind(port) {
-  return new Promise((resolve) => {
-    const server = createServer();
-    const onError = /* @__PURE__ */ __name((err) => {
-      if (err.code === "EADDRINUSE" || err.code === "EACCES") {
-        resolve(null);
-        return;
-      }
-      server.close();
-      resolve(null);
-    }, "onError");
-    server.once("error", onError);
-    server.listen(port, HOST, () => {
-      server.removeListener("error", onError);
-      const address = server.address();
-      if (!address || address.port !== port) {
-        server.close();
-        resolve(null);
-        return;
-      }
-      resolve(server);
-    });
-  });
+  return { email, role: assertTeamRole(role, `--member ${email} role`) };
 }
-__name(tryBind, "tryBind");
-function wrapServer(server, redirectUri) {
-  let resolved = false;
-  let resolver = null;
-  let rejecter = null;
-  server.on("request", (req, res) => {
-    if (!req.url) {
-      res.statusCode = 400;
-      res.end("Bad Request");
-      return;
+__name(parseMember, "parseMember");
+function registerInviteBulk(invite) {
+  invite.command("bulk").description("Invite several people to a team and email each invitation").requiredOption(
+    "--member <email[=role]>",
+    "person to invite; repeat for multiple. Append =<role> to override the --role default",
+    collect3,
+    []
+  ).option(
+    "--role <role>",
+    `role for members that don't specify their own (default ${DEFAULT_TEAM_ROLE})`,
+    DEFAULT_TEAM_ROLE
+  ).option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function bulkAction(options) {
+    if (options.member.length === 0) {
+      throw new CliError("Provide at least one --member <email[=role]>.");
     }
-    const url = new URL(req.url, redirectUri);
-    if (url.pathname !== "/callback") {
-      res.statusCode = 404;
-      res.end("Not Found");
-      return;
+    const defaultRole = assertTeamRole(options.role ?? DEFAULT_TEAM_ROLE);
+    const members = options.member.map(
+      (value) => parseMember(value, defaultRole)
+    );
+    if (members.length > MAX_MEMBERS) {
+      throw new CliError(
+        `Provide at most ${MAX_MEMBERS} --member values (got ${members.length}).`
+      );
     }
-    const error = url.searchParams.get("error");
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    if (error) {
-      const description = url.searchParams.get("error_description") ?? error;
-      res.statusCode = 400;
-      res.setHeader("Content-Type", "text/html; charset=utf-8");
-      res.end(renderHtml(`Authorization failed: ${description}`));
-      if (!resolved && rejecter) {
-        resolved = true;
-        rejecter(new CliError(`Authorization denied: ${description}`));
-      }
-      return;
+    const emails = members.map((member) => member.email.toLowerCase());
+    if (new Set(emails).size !== emails.length) {
+      throw new CliError("--member emails must be unique.");
     }
-    if (!code || !state) {
-      res.statusCode = 400;
-      res.setHeader("Content-Type", "text/html; charset=utf-8");
-      res.end(renderHtml("Missing code or state."));
-      if (!resolved && rejecter) {
-        resolved = true;
-        rejecter(new CliError("Callback missing code or state."));
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const raw = await httpRequest({
+      method: "POST",
+      path: buildTeamPath(teamId, "/invites/bulk"),
+      apiKey,
+      apiBaseUrl,
+      body: { members }
+    });
+    const parsed = bulkInviteResponseSchema.safeParse(raw);
+    if (options.json) {
+      printJson(raw);
+      if (parsed.success && parsed.data.failed > 0) {
+        throw new CliError(
+          `${parsed.data.failed} of ${members.length} invitations could not be emailed and were rolled back.`
+        );
       }
       return;
     }
-    res.statusCode = 200;
-    res.setHeader("Content-Type", "text/html; charset=utf-8");
-    res.end(renderHtml("You are now signed in. You can close this tab."));
-    if (!resolved && resolver) {
-      resolved = true;
-      resolver({ code, state });
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
     }
-  });
-  return {
-    redirectUri,
-    waitForCallback(timeoutMs) {
-      return new Promise((resolve, reject) => {
-        resolver = resolve;
-        rejecter = reject;
-        const timer = setTimeout(() => {
-          if (!resolved) {
-            resolved = true;
-            reject(new CliError("Authorization timed out."));
-          }
-        }, timeoutMs);
-        timer.unref();
-      });
-    },
-    async close() {
-      await new Promise((resolve) => server.close(() => resolve()));
+    const { succeeded, skipped, failed } = parsed.data;
+    console.log(green(`Invited ${succeeded} of ${members.length} people.`));
+    console.log();
+    console.log(
+      renderKeyValue([
+        { label: "Invited", value: String(succeeded) },
+        { label: "Skipped", value: String(skipped) },
+        { label: "Failed", value: String(failed) }
+      ])
+    );
+    if (skipped > 0) {
+      console.log();
+      console.log(
+        "Skipped people are already on the team or already hold a pending invitation."
+      );
     }
-  };
-}
-__name(wrapServer, "wrapServer");
-var HTML_ESCAPES = {
-  "&": "&amp;",
-  "<": "&lt;",
-  ">": "&gt;"
-};
-function renderHtml(message) {
-  const safe = message.replace(/[&<>]/g, (c) => HTML_ESCAPES[c] ?? c);
-  return `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <title>Duvo CLI</title>
-    <style>
-      body { font-family: system-ui, sans-serif; padding: 4rem; text-align: center; }
-      .card { display: inline-block; padding: 2rem 3rem; border-radius: 12px; background: #f6f8fa; }
-    </style>
-  </head>
-  <body>
-    <div class="card">
-      <h2>Duvo CLI</h2>
-      <p>${safe}</p>
-    </div>
-  </body>
-</html>`;
+    if (failed > 0) {
+      console.log();
+      console.log(
+        "Failed invitations could not be emailed and were rolled back \u2014 re-run for those addresses."
+      );
+      throw new CliError(
+        `${failed} of ${members.length} invitations could not be emailed and were rolled back.`
+      );
+    }
+  }, "bulkAction"));
 }
-__name(renderHtml, "renderHtml");
+__name(registerInviteBulk, "registerInviteBulk");
 
-// src/oauth/open-browser.ts
-import { spawn } from "node:child_process";
-import { platform } from "node:os";
-var BASE_OPTIONS = {
-  detached: true,
-  stdio: "ignore",
-  shell: false
-};
-function spawnPlanFor(url) {
-  const os = platform();
-  if (os === "darwin") {
-    return { command: "open", args: [url], options: BASE_OPTIONS };
+// src/api/invite-schemas.ts
+import { z as z127 } from "zod";
+var updateTeamInviteResponseSchema = z127.object({
+  id: z127.string(),
+  role: z127.string()
+});
+var inviteSuccessResponseSchema = z127.object({
+  success: z127.literal(true)
+});
+
+// src/commands/invite/send-invitation-email.ts
+function classifyFailure(error) {
+  if (error instanceof CliHttpError && error.status < 500) {
+    return "failed";
   }
-  if (os === "win32") {
-    return {
-      command: "cmd.exe",
+  return "unconfirmed";
+}
+__name(classifyFailure, "classifyFailure");
+async function trySendInvitationEmail(args) {
+  try {
+    const raw = await httpRequest({
+      method: "POST",
+      path: buildTeamPath(
+        args.teamId,
+        `/invites/${encodeURIComponent(args.inviteId)}/send-email`
+      ),
+      apiKey: args.apiKey,
+      apiBaseUrl: args.apiBaseUrl,
+      body: {}
+    });
+    const parsed = inviteSuccessResponseSchema.safeParse(raw);
+    if (parsed.success) {
+      return { status: "sent", error: null };
+    }
+    return { status: "unconfirmed", error: parsed.error.message };
+  } catch (error) {
+    return {
+      status: classifyFailure(error),
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+__name(trySendInvitationEmail, "trySendInvitationEmail");
+
+// src/commands/invite/create.ts
+var EMAIL_SENT_LABEL = {
+  sent: "yes",
+  failed: "no",
+  unconfirmed: "unconfirmed"
+};
+function assertEmailDelivered(emailRequested, outcome) {
+  if (!emailRequested || outcome.status === "sent") {
+    return;
+  }
+  throw new CliError(
+    outcome.status === "failed" ? `The invitation was created but --send-email failed: ${outcome.error}` : `The invitation was created but --send-email could not be confirmed: ${outcome.error}`
+  );
+}
+__name(assertEmailDelivered, "assertEmailDelivered");
+function registerInviteCreate(invite) {
+  invite.command("create").description("Invite one person to a team").requiredOption("--email <email>", "email address of the person to invite").option(
+    "--role <role>",
+    `team role to grant (default ${DEFAULT_TEAM_ROLE}, or ${TEAM_ROLE.CLARITY_MEMBER} with --process)`
+  ).option(
+    "--process <id>",
+    `invite them to this Clarity process instead of the whole team (defaults --role to ${TEAM_ROLE.CLARITY_MEMBER}, the only role a process invitation accepts)`
+  ).option(
+    "--send-email",
+    "also email the invitation to the recipient. Without it the invitation is created but nobody is notified"
+  ).option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function createAction(options) {
+    const email = trimRequired(options.email ?? "", "--email");
+    const processId = options.process === void 0 ? void 0 : trimRequired(options.process, "--process");
+    const defaultRole = processId === void 0 ? DEFAULT_TEAM_ROLE : TEAM_ROLE.CLARITY_MEMBER;
+    const role = assertTeamRole(options.role ?? defaultRole);
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const body = { email, role };
+    if (processId !== void 0) {
+      body.processId = processId;
+    }
+    const raw = await httpRequest({
+      method: "POST",
+      path: buildTeamPath(teamId, "/invites"),
+      apiKey,
+      apiBaseUrl,
+      body
+    });
+    const parsed = createTeamInvitationResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      if (options.json) {
+        printJson(raw);
+        return;
+      }
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    const emailRequested = options.sendEmail === true;
+    const emailOutcome = emailRequested ? await trySendInvitationEmail({
+      apiKey,
+      apiBaseUrl,
+      teamId,
+      inviteId: parsed.data.id
+    }) : { status: "failed", error: null };
+    if (options.json) {
+      printJson(raw);
+      assertEmailDelivered(emailRequested, emailOutcome);
+      return;
+    }
+    console.log(green("Invitation created!"));
+    console.log();
+    console.log(
+      renderKeyValue([
+        { label: "Invitation ID", value: parsed.data.id },
+        { label: "Email", value: parsed.data.email },
+        { label: "Role", value: parsed.data.role },
+        { label: "Team", value: parsed.data.team.name },
+        { label: "Process", value: parsed.data.process?.name ?? "\u2014" },
+        { label: "Status", value: parsed.data.status },
+        { label: "Email sent", value: EMAIL_SENT_LABEL[emailOutcome.status] }
+      ])
+    );
+    if (!emailRequested) {
+      console.log();
+      console.log(
+        `Nobody has been notified yet. Send the email with: duvo invite resend ${parsed.data.id}`
+      );
+      return;
+    }
+    if (emailOutcome.status === "failed") {
+      console.log();
+      console.log(
+        `The invitation exists but the email was rejected, so nobody was notified: ${emailOutcome.error}`
+      );
+      console.log(`Send it with: duvo invite resend ${parsed.data.id}`);
+    }
+    if (emailOutcome.status === "unconfirmed") {
+      console.log();
+      console.log(
+        `The invitation exists but the email could not be confirmed: ${emailOutcome.error}`
+      );
+      console.log(
+        `It may or may not have been delivered. Check with the recipient before running: duvo invite resend ${parsed.data.id}`
+      );
+    }
+    assertEmailDelivered(emailRequested, emailOutcome);
+  }, "createAction"));
+}
+__name(registerInviteCreate, "registerInviteCreate");
+
+// src/commands/invite/delete.ts
+function registerInviteDelete(invite) {
+  invite.command("delete <id>").alias("revoke").description(
+    "Revoke a pending invitation so its link and email stop working"
+  ).option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("-y, --yes", "skip the confirmation prompt").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function deleteAction(id, options) {
+    const inviteId = trimRequired(id, "<id>");
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    await confirmDestructive({
+      message: `Revoke invitation "${inviteId}"?`,
+      skip: options.yes === true
+    });
+    const raw = await httpRequest({
+      method: "DELETE",
+      path: buildTeamPath(teamId, `/invites/${encodeURIComponent(inviteId)}`),
+      apiKey,
+      apiBaseUrl
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = inviteSuccessResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    console.log(green(`Invitation ${inviteId} revoked.`));
+  }, "deleteAction"));
+}
+__name(registerInviteDelete, "registerInviteDelete");
+
+// src/commands/invite/link.ts
+var LINK_PATH = "/team-invite-link";
+function registerGet(link) {
+  link.command("get").description("Show the team's shareable invite link").option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function getAction(options) {
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const raw = await httpRequest({
+      method: "GET",
+      path: buildTeamPath(teamId, LINK_PATH),
+      apiKey,
+      apiBaseUrl
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = getTeamInviteLinkResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    const { hasLink, link: inviteLink } = parsed.data;
+    if (!hasLink || !inviteLink) {
+      console.log(
+        "No invite link yet. Create one with: duvo invite link create"
+      );
+      return;
+    }
+    console.log(
+      renderKeyValue([
+        { label: "Link ID", value: inviteLink.id },
+        { label: "URL", value: inviteLink.url ?? "\u2014" },
+        { label: "Created", value: inviteLink.createdAt },
+        {
+          label: "Created by",
+          value: inviteLink.createdBy.name ?? inviteLink.createdBy.email
+        }
+      ])
+    );
+  }, "getAction"));
+}
+__name(registerGet, "registerGet");
+function registerCreate2(link) {
+  link.command("create").description(
+    "Create or regenerate the team's shareable invite link (regenerating invalidates the previous URL)"
+  ).option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function createAction(options) {
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const raw = await httpRequest({
+      method: "POST",
+      path: buildTeamPath(teamId, LINK_PATH),
+      apiKey,
+      apiBaseUrl,
+      body: {}
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = createTeamInviteLinkResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    console.log(green("Invite link ready!"));
+    console.log();
+    console.log(
+      renderKeyValue([
+        { label: "Link ID", value: parsed.data.id },
+        { label: "URL", value: parsed.data.url ?? "\u2014" },
+        { label: "Created", value: parsed.data.createdAt }
+      ])
+    );
+    console.log();
+    console.log(
+      "Anyone with this URL can join the team. Any previous link no longer works."
+    );
+  }, "createAction"));
+}
+__name(registerCreate2, "registerCreate");
+function registerDelete2(link) {
+  link.command("delete").description("Delete the team's shareable invite link").option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("-y, --yes", "skip the confirmation prompt").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function deleteAction(options) {
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    await confirmDestructive({
+      message: `Delete the invite link for team "${teamId}"?`,
+      skip: options.yes === true
+    });
+    const raw = await httpRequest({
+      method: "DELETE",
+      path: buildTeamPath(teamId, LINK_PATH),
+      apiKey,
+      apiBaseUrl
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    console.log(green("Invite link deleted."));
+  }, "deleteAction"));
+}
+__name(registerDelete2, "registerDelete");
+function registerInviteLink(invite) {
+  const link = invite.command("link").description("Manage the team's shareable invite link");
+  registerGet(link);
+  registerCreate2(link);
+  registerDelete2(link);
+}
+__name(registerInviteLink, "registerInviteLink");
+
+// src/commands/invite/list.ts
+var TABLE_COLUMNS27 = [
+  { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
+  { header: "EMAIL", cell: /* @__PURE__ */ __name((row) => row.email, "cell") },
+  { header: "ROLE", cell: /* @__PURE__ */ __name((row) => row.role, "cell") },
+  { header: "STATUS", cell: /* @__PURE__ */ __name((row) => row.status, "cell") },
+  {
+    header: "PROCESS",
+    cell: /* @__PURE__ */ __name((row) => row.process_id ?? "", "cell")
+  },
+  { header: "CREATED", cell: /* @__PURE__ */ __name((row) => row.created_at, "cell") }
+];
+function registerInviteList(invite) {
+  invite.command("list").description("List a team's pending invitations").option(
+    "--process <id>",
+    "list the pending invitations for this Clarity process instead of the team's own"
+  ).option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function listAction(options) {
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const searchParams = new URLSearchParams();
+    if (options.process !== void 0) {
+      searchParams.append(
+        "processId",
+        trimRequired(options.process, "--process")
+      );
+    }
+    const raw = await httpRequest({
+      method: "GET",
+      path: buildTeamPath(teamId, "/invites"),
+      apiKey,
+      apiBaseUrl,
+      searchParams
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = listTeamInvitesResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    const { invitations } = parsed.data;
+    if (invitations.length === 0) {
+      console.log("No pending invitations found.");
+      return;
+    }
+    console.log(renderTable(TABLE_COLUMNS27, invitations));
+    console.log(`Showing ${invitations.length}`);
+  }, "listAction"));
+}
+__name(registerInviteList, "registerInviteList");
+
+// src/commands/invite/org-member.ts
+var ORG_ROLES2 = Object.values(ORG_ROLE);
+var DEFAULT_ROLE = ORG_ROLE.MEMBER;
+function registerInviteOrgMember(invite) {
+  invite.command("org-member <org-id>").description(
+    "Invite a person to an organization, optionally onto one of its teams"
+  ).requiredOption("--email <email>", "email address of the person to invite").option(
+    "--role <role>",
+    `organization role to grant: ${ORG_ROLES2.join(", ")} (default ${DEFAULT_ROLE})`,
+    DEFAULT_ROLE
+  ).option("--team-id <id>", "assign the invitee to this team in the org").option(
+    "--send-email",
+    "also email the invitation to the recipient. Without it the invitation is created but nobody is notified"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function inviteOrgMemberAction(orgId, options) {
+    const email = options.email?.trim();
+    if (email === void 0 || email.length === 0) {
+      throw new CliError("--email must not be empty");
+    }
+    const role = options.role ?? DEFAULT_ROLE;
+    if (!ORG_ROLES2.includes(role)) {
+      throw new CliError(
+        `Invalid --role "${role}"; expected one of: ${ORG_ROLES2.join(", ")}`
+      );
+    }
+    const { apiKey, apiBaseUrl } = await requireAuthenticatedConfig(this);
+    const body = { email, role };
+    if (options.teamId !== void 0) {
+      const teamId = options.teamId.trim();
+      if (teamId.length === 0) {
+        throw new CliError("--team-id must not be empty");
+      }
+      body.teamId = teamId;
+    }
+    if (options.sendEmail === true) {
+      body.sendEmail = true;
+    }
+    const raw = await httpRequest({
+      method: "POST",
+      path: `/v2/organizations/${encodeURIComponent(orgId)}/members`,
+      apiKey,
+      apiBaseUrl,
+      body
+    });
+    const parsed = inviteOrgMemberResponseSchema.safeParse(raw);
+    if (options.json) {
+      printJson(raw);
+      if (options.sendEmail === true && parsed.success && !parsed.data.emailSent) {
+        throw new CliError(
+          `The invitation was created (${parsed.data.invitationId}) but --send-email did not deliver it.`
+        );
+      }
+      return;
+    }
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from POST /v2/organizations/:orgId/members: ${parsed.error.message}`
+      );
+    }
+    console.log(green("Invitation created!"));
+    console.log();
+    console.log(
+      renderKeyValue([
+        { label: "Invitation ID", value: parsed.data.invitationId },
+        { label: "Email", value: email },
+        { label: "Role", value: role },
+        { label: "Team", value: body.teamId ?? "\u2014" },
+        { label: "Email sent", value: parsed.data.emailSent ? "yes" : "no" }
+      ])
+    );
+    if (options.sendEmail === true && !parsed.data.emailSent) {
+      console.log();
+      throw new CliError(
+        `The invitation was created (${parsed.data.invitationId}) but --send-email did not deliver it. Send it from the organization members page.`
+      );
+    }
+  }, "inviteOrgMemberAction"));
+}
+__name(registerInviteOrgMember, "registerInviteOrgMember");
+
+// src/commands/invite/resend.ts
+function registerInviteResend(invite) {
+  invite.command("resend <id>").description("Email an invitation to its recipient").option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function resendAction(id, options) {
+    const inviteId = trimRequired(id, "<id>");
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const raw = await httpRequest({
+      method: "POST",
+      path: buildTeamPath(
+        teamId,
+        `/invites/${encodeURIComponent(inviteId)}/send-email`
+      ),
+      apiKey,
+      apiBaseUrl,
+      body: {}
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = inviteSuccessResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    console.log(green(`Invitation ${inviteId} emailed.`));
+  }, "resendAction"));
+}
+__name(registerInviteResend, "registerInviteResend");
+
+// src/commands/invite/update.ts
+function registerInviteUpdate(invite) {
+  invite.command("update <id>").description("Change the role on a pending invitation").requiredOption("--role <role>", "new team role for the invitation").option(
+    "--team <id>",
+    "team ID (defaults to the team scoped to your credentials)"
+  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function updateAction(id, options) {
+    const inviteId = trimRequired(id, "<id>");
+    const role = assertTeamRole(trimRequired(options.role ?? "", "--role"));
+    const config = await requireAuthenticatedConfig(this);
+    const { apiKey, apiBaseUrl } = config;
+    const teamId = await resolveRequiredTeamId(config, {
+      override: options.team ?? getTeamFlag(this)
+    });
+    const raw = await httpRequest({
+      method: "PATCH",
+      path: buildTeamPath(teamId, `/invites/${encodeURIComponent(inviteId)}`),
+      apiKey,
+      apiBaseUrl,
+      body: { role }
+    });
+    if (options.json) {
+      printJson(raw);
+      return;
+    }
+    const parsed = updateTeamInviteResponseSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new CliError(
+        `Unexpected response from the API: ${parsed.error.message}`
+      );
+    }
+    console.log(green("Invitation updated!"));
+    console.log();
+    console.log(
+      renderKeyValue([
+        { label: "Invitation ID", value: parsed.data.id },
+        { label: "Role", value: parsed.data.role }
+      ])
+    );
+  }, "updateAction"));
+}
+__name(registerInviteUpdate, "registerInviteUpdate");
+
+// src/commands/invite/index.ts
+function registerInvite(program) {
+  const invite = program.command("invite").description("Invite people to a team or organization");
+  registerInviteList(invite);
+  registerInviteCreate(invite);
+  registerInviteBulk(invite);
+  registerInviteUpdate(invite);
+  registerInviteResend(invite);
+  registerInviteDelete(invite);
+  registerInviteOrgMember(invite);
+  registerInviteLink(invite);
+}
+__name(registerInvite, "registerInvite");
+
+// src/commands/login.ts
+import { isCancel as isCancel4, log, password, spinner, text as text2 } from "@clack/prompts";
+
+// src/oauth/auth0-config.ts
+var BAKED_DOMAIN = "login.duvo.ai" ? "login.duvo.ai" : "login.dev.duvo.ai";
+var BAKED_CLIENT_ID = "MpK8jktbMHPlrCxmSPeRbkiSNrRTUjeT" ? "MpK8jktbMHPlrCxmSPeRbkiSNrRTUjeT" : "mq4MhUUHRNKrzkqr1MnAJdcvv5MNfuBU";
+var BAKED_AUDIENCE = "https://api.duvo.ai" ? "https://api.duvo.ai" : "https://api.dev.duvo.ai";
+function resolveAuth0Config() {
+  return {
+    domain: BAKED_DOMAIN,
+    clientId: BAKED_CLIENT_ID,
+    audience: BAKED_AUDIENCE,
+    issuer: `https://${BAKED_DOMAIN}/`
+  };
+}
+__name(resolveAuth0Config, "resolveAuth0Config");
+
+// src/oauth/loopback.ts
+import { createServer } from "node:http";
+var LOOPBACK_PORTS = [49152, 49153, 49154, 49155, 49156];
+var HOST = "127.0.0.1";
+async function startLoopbackServer() {
+  const result = await tryBindNext([...LOOPBACK_PORTS]);
+  if (!result) {
+    throw new CliError(
+      `Could not bind to a local port \u2014 tried ${LOOPBACK_PORTS.join(", ")}.`
+    );
+  }
+  const redirectUri = `http://${HOST}:${result.port}/callback`;
+  return wrapServer(result.server, redirectUri);
+}
+__name(startLoopbackServer, "startLoopbackServer");
+async function tryBindNext(ports) {
+  if (ports.length === 0) {
+    return null;
+  }
+  const [port, ...rest] = ports;
+  const server = await tryBind(port);
+  if (server) {
+    return { server, port };
+  }
+  return tryBindNext(rest);
+}
+__name(tryBindNext, "tryBindNext");
+async function tryBind(port) {
+  return new Promise((resolve) => {
+    const server = createServer();
+    const onError = /* @__PURE__ */ __name((err) => {
+      if (err.code === "EADDRINUSE" || err.code === "EACCES") {
+        resolve(null);
+        return;
+      }
+      server.close();
+      resolve(null);
+    }, "onError");
+    server.once("error", onError);
+    server.listen(port, HOST, () => {
+      server.removeListener("error", onError);
+      const address = server.address();
+      if (!address || address.port !== port) {
+        server.close();
+        resolve(null);
+        return;
+      }
+      resolve(server);
+    });
+  });
+}
+__name(tryBind, "tryBind");
+function wrapServer(server, redirectUri) {
+  let resolved = false;
+  let resolver = null;
+  let rejecter = null;
+  server.on("request", (req, res) => {
+    if (!req.url) {
+      res.statusCode = 400;
+      res.end("Bad Request");
+      return;
+    }
+    const url = new URL(req.url, redirectUri);
+    if (url.pathname !== "/callback") {
+      res.statusCode = 404;
+      res.end("Not Found");
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (error) {
+      const description = url.searchParams.get("error_description") ?? error;
+      res.statusCode = 400;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(renderHtml(`Authorization failed: ${description}`));
+      if (!resolved && rejecter) {
+        resolved = true;
+        rejecter(new CliError(`Authorization denied: ${description}`));
+      }
+      return;
+    }
+    if (!code || !state) {
+      res.statusCode = 400;
+      res.setHeader("Content-Type", "text/html; charset=utf-8");
+      res.end(renderHtml("Missing code or state."));
+      if (!resolved && rejecter) {
+        resolved = true;
+        rejecter(new CliError("Callback missing code or state."));
+      }
+      return;
+    }
+    res.statusCode = 200;
+    res.setHeader("Content-Type", "text/html; charset=utf-8");
+    res.end(renderHtml("You are now signed in. You can close this tab."));
+    if (!resolved && resolver) {
+      resolved = true;
+      resolver({ code, state });
+    }
+  });
+  return {
+    redirectUri,
+    waitForCallback(timeoutMs) {
+      return new Promise((resolve, reject) => {
+        resolver = resolve;
+        rejecter = reject;
+        const timer = setTimeout(() => {
+          if (!resolved) {
+            resolved = true;
+            reject(new CliError("Authorization timed out."));
+          }
+        }, timeoutMs);
+        timer.unref();
+      });
+    },
+    async close() {
+      await new Promise((resolve) => server.close(() => resolve()));
+    }
+  };
+}
+__name(wrapServer, "wrapServer");
+var HTML_ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;"
+};
+function renderHtml(message) {
+  const safe = message.replace(/[&<>]/g, (c) => HTML_ESCAPES[c] ?? c);
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Duvo CLI</title>
+    <style>
+      body { font-family: system-ui, sans-serif; padding: 4rem; text-align: center; }
+      .card { display: inline-block; padding: 2rem 3rem; border-radius: 12px; background: #f6f8fa; }
+    </style>
+  </head>
+  <body>
+    <div class="card">
+      <h2>Duvo CLI</h2>
+      <p>${safe}</p>
+    </div>
+  </body>
+</html>`;
+}
+__name(renderHtml, "renderHtml");
+
+// src/oauth/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+var BASE_OPTIONS = {
+  detached: true,
+  stdio: "ignore",
+  shell: false
+};
+function spawnPlanFor(url) {
+  const os = platform();
+  if (os === "darwin") {
+    return { command: "open", args: [url], options: BASE_OPTIONS };
+  }
+  if (os === "win32") {
+    return {
+      command: "cmd.exe",
       args: ["/c", "start", '""', `"${url}"`],
       options: { ...BASE_OPTIONS, windowsVerbatimArguments: true }
     };
@@ -29789,7 +30577,7 @@ __name(parseNotificationTypeOption, "parseNotificationTypeOption");
 
 // src/commands/notifications/feed.ts
 var MIN_LIMIT11 = 1;
-var TABLE_COLUMNS27 = [
+var TABLE_COLUMNS28 = [
   { header: "KIND", cell: /* @__PURE__ */ __name((row) => row.kind, "cell") },
   {
     header: "ID",
@@ -29876,7 +30664,7 @@ function registerNotificationsFeed(notifications) {
       console.log("No feed items found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS27, items));
+    console.log(renderTable(TABLE_COLUMNS28, items));
     console.log(`Showing ${items.length}`);
     if (nextCursor) {
       console.log(
@@ -29983,7 +30771,7 @@ __name(registerNotificationsGet, "registerNotificationsGet");
 
 // src/commands/notifications/list.ts
 var MIN_LIMIT12 = 1;
-var TABLE_COLUMNS28 = [
+var TABLE_COLUMNS29 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "TYPE", cell: /* @__PURE__ */ __name((row) => row.type, "cell") },
   { header: "SEVERITY", cell: /* @__PURE__ */ __name((row) => row.severity, "cell") },
@@ -30117,7 +30905,7 @@ function registerNotificationsList(notifications) {
       console.log("No notifications found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS28, notifications2));
+    console.log(renderTable(TABLE_COLUMNS29, notifications2));
     console.log(`Showing ${notifications2.length}`);
     if (nextCursor) {
       console.log(
@@ -30472,7 +31260,7 @@ function parseHeaders(raw) {
   return result;
 }
 __name(parseHeaders, "parseHeaders");
-var TABLE_COLUMNS29 = [
+var TABLE_COLUMNS30 = [
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   { header: "DESCRIPTION", cell: /* @__PURE__ */ __name((row) => row.description, "cell") }
 ];
@@ -30530,7 +31318,7 @@ function registerOauthMcpProbe(mcp) {
       console.log("No tools advertised by this MCP server.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS29, rows));
+    console.log(renderTable(TABLE_COLUMNS30, rows));
     console.log(`Showing ${rows.length}`);
   }, "probeMcpAction"));
 }
@@ -30621,7 +31409,7 @@ function registerOauth(program) {
 __name(registerOauth, "registerOauth");
 
 // src/commands/plugins/list.ts
-var TABLE_COLUMNS30 = [
+var TABLE_COLUMNS31 = [
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   { header: "TYPE", cell: /* @__PURE__ */ __name((row) => row.type, "cell") },
   {
@@ -30655,7 +31443,7 @@ function registerPluginsList(plugins) {
       console.log("No plugins found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS30, parsed.data.plugins));
+    console.log(renderTable(TABLE_COLUMNS31, parsed.data.plugins));
     console.log(`Showing ${parsed.data.plugins.length}`);
   }, "listAction"));
 }
@@ -31115,7 +31903,7 @@ function registerPulseAttachmentUrl(pulse) {
 __name(registerPulseAttachmentUrl, "registerPulseAttachmentUrl");
 
 // src/commands/pulse/connections.ts
-var TABLE_COLUMNS31 = [
+var TABLE_COLUMNS32 = [
   {
     header: "CONNECTION ID",
     cell: /* @__PURE__ */ __name((row) => row.connection_id, "cell")
@@ -31147,7 +31935,7 @@ function registerList4(connections) {
       console.log("No connections attached.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS31, parsed.data.connections));
+    console.log(renderTable(TABLE_COLUMNS32, parsed.data.connections));
   }, "listAction"));
 }
 __name(registerList4, "registerList");
@@ -31439,7 +32227,7 @@ __name(registerPulseHtml, "registerPulseHtml");
 var DEFAULT_LIMIT11 = 20;
 var MIN_LIMIT13 = 1;
 var MAX_LIMIT11 = 100;
-var TABLE_COLUMNS32 = [
+var TABLE_COLUMNS33 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   {
     header: "TITLE",
@@ -31501,7 +32289,7 @@ function registerPulseList(pulse) {
       console.log("No Pulse dashboards found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS32, response.artifacts));
+    console.log(renderTable(TABLE_COLUMNS33, response.artifacts));
     console.log(
       `Showing ${response.artifacts.length} of ${response.total} \xB7 offset ${response.offset}`
     );
@@ -31513,7 +32301,7 @@ __name(registerPulseList, "registerPulseList");
 var DEFAULT_LIMIT12 = 100;
 var MIN_LIMIT14 = 1;
 var MAX_LIMIT12 = 500;
-var TABLE_COLUMNS33 = [
+var TABLE_COLUMNS34 = [
   { header: "ROLE", cell: /* @__PURE__ */ __name((row) => row.role, "cell") },
   {
     header: "CONTENT",
@@ -31561,7 +32349,7 @@ function registerPulseMessages(pulse) {
       console.log("No messages yet.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS33, data));
+    console.log(renderTable(TABLE_COLUMNS34, data));
     console.log(`Showing ${data.length} of ${total}`);
     if (hasMore) {
       console.log(
@@ -32114,7 +32902,7 @@ function registerPulse(program) {
 __name(registerPulse, "registerPulse");
 
 // src/commands/queue-labels/index.ts
-var TABLE_COLUMNS34 = [
+var TABLE_COLUMNS35 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "KEY", cell: /* @__PURE__ */ __name((row) => row.key, "cell") },
   { header: "VALUE", cell: /* @__PURE__ */ __name((row) => row.value, "cell") },
@@ -32130,9 +32918,9 @@ var TABLE_COLUMNS34 = [
 function registerQueueLabels(program) {
   const labels = program.command("queue-labels").description("Manage label vocabularies on a queue");
   registerList5(labels);
-  registerCreate2(labels);
+  registerCreate3(labels);
   registerUpdate2(labels);
-  registerDelete2(labels);
+  registerDelete3(labels);
 }
 __name(registerQueueLabels, "registerQueueLabels");
 function registerList5(labels) {
@@ -32168,12 +32956,12 @@ function registerList5(labels) {
       console.log("No labels defined on this queue.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS34, parsed.data.labels));
+    console.log(renderTable(TABLE_COLUMNS35, parsed.data.labels));
     console.log(`Showing ${parsed.data.labels.length}`);
   }, "listAction"));
 }
 __name(registerList5, "registerList");
-function registerCreate2(labels) {
+function registerCreate3(labels) {
   labels.command("create").description("Create a label on a queue without assigning it to a case").requiredOption("--queue <id>", "ID of the queue").option("--key <text>", "label key (omit for tag-only labels)").requiredOption("--value <text>", "label value (required, non-empty)").option("--color-hue <n>", "color hue 0-360 (auto-derived if omitted)").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function createAction(options) {
     if (options.value.trim().length === 0) {
       throw new CliError("--value must not be empty");
@@ -32217,7 +33005,7 @@ function registerCreate2(labels) {
     );
   }, "createAction"));
 }
-__name(registerCreate2, "registerCreate");
+__name(registerCreate3, "registerCreate");
 function registerUpdate2(labels) {
   labels.command("update <label-id>").description(
     "Rename a label or change its color (affects every case it's assigned to)"
@@ -32280,7 +33068,7 @@ function registerUpdate2(labels) {
   }, "updateAction"));
 }
 __name(registerUpdate2, "registerUpdate");
-function registerDelete2(labels) {
+function registerDelete3(labels) {
   labels.command("delete <label-id>").description(
     "Delete a label from a queue (cascade-removes from every case it was assigned to)"
   ).requiredOption("--queue <id>", "ID of the queue the label belongs to").option("-y, --yes", "skip confirmation prompt").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function deleteAction(labelId, options) {
@@ -32311,7 +33099,7 @@ function registerDelete2(labels) {
     console.log(green("Label deleted!"));
   }, "deleteAction"));
 }
-__name(registerDelete2, "registerDelete");
+__name(registerDelete3, "registerDelete");
 var LABEL_PAGE_SIZE = 1e3;
 async function fetchCurrentLabelValue(queueId, labelId, apiKey, apiBaseUrl) {
   for (let offset = 0; ; offset += LABEL_PAGE_SIZE) {
@@ -32922,7 +33710,7 @@ __name(registerQueuesLinkAgent, "registerQueuesLinkAgent");
 var DEFAULT_LIMIT13 = 20;
 var MIN_LIMIT15 = 1;
 var MAX_LIMIT13 = 100;
-var TABLE_COLUMNS35 = [
+var TABLE_COLUMNS36 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   {
@@ -32970,7 +33758,7 @@ function registerQueuesList(queues) {
       console.log("No queues found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS35, response.queues));
+    console.log(renderTable(TABLE_COLUMNS36, response.queues));
     const resolvedOffset = response.offset ?? offset;
     const total = response.total ?? null;
     const summary = total === null ? `Showing ${response.queues.length} \xB7 offset ${resolvedOffset}` : `Showing ${response.queues.length} of ${total} \xB7 offset ${resolvedOffset}`;
@@ -33228,7 +34016,7 @@ function registerRevisionLoginsDetach(revisionLogins) {
 __name(registerRevisionLoginsDetach, "registerRevisionLoginsDetach");
 
 // src/commands/revision-logins/list.ts
-var TABLE_COLUMNS36 = [
+var TABLE_COLUMNS37 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "DOMAIN", cell: /* @__PURE__ */ __name((row) => row.domain, "cell") },
   {
@@ -33264,7 +34052,7 @@ function registerRevisionLoginsList(revisionLogins) {
       console.log("No logins attached to this revision.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS36, rows));
+    console.log(renderTable(TABLE_COLUMNS37, rows));
     console.log(`Showing ${rows.length}`);
   }, "listAction"));
 }
@@ -33337,7 +34125,7 @@ function registerRevisionSecretsDetach(revisionSecrets) {
 __name(registerRevisionSecretsDetach, "registerRevisionSecretsDetach");
 
 // src/commands/revision-secrets/list.ts
-var TABLE_COLUMNS37 = [
+var TABLE_COLUMNS38 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   {
@@ -33375,7 +34163,7 @@ function registerRevisionSecretsList(revisionSecrets) {
       console.log("No secrets attached to this revision.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS37, rows));
+    console.log(renderTable(TABLE_COLUMNS38, rows));
     console.log(`Showing ${rows.length}`);
   }, "listAction"));
 }
@@ -33391,91 +34179,91 @@ function registerRevisionSecrets(program) {
 __name(registerRevisionSecrets, "registerRevisionSecrets");
 
 // src/api/run-schemas.ts
-import { z as z127 } from "zod";
-var publicRunSchema = z127.object({
-  id: z127.string(),
-  agent_id: z127.string(),
-  build_id: z127.string(),
-  status: z127.string(),
-  source: z127.string().nullish(),
-  sandbox_id: z127.string().nullish(),
-  started_at: z127.string().nullish(),
-  completed_at: z127.string().nullish(),
-  created_at: z127.string(),
-  updated_at: z127.string().nullish(),
-  human_in_the_loop_enabled: z127.boolean().nullish()
-});
-var startRunResponseSchema = z127.object({
+import { z as z128 } from "zod";
+var publicRunSchema = z128.object({
+  id: z128.string(),
+  agent_id: z128.string(),
+  build_id: z128.string(),
+  status: z128.string(),
+  source: z128.string().nullish(),
+  sandbox_id: z128.string().nullish(),
+  started_at: z128.string().nullish(),
+  completed_at: z128.string().nullish(),
+  created_at: z128.string(),
+  updated_at: z128.string().nullish(),
+  human_in_the_loop_enabled: z128.boolean().nullish()
+});
+var startRunResponseSchema = z128.object({
   run: publicRunSchema
 });
-var questionOptionSchema = z127.object({
-  label: z127.string(),
-  description: z127.string().nullish()
-});
-var questionSchema = z127.object({
-  question: z127.string(),
-  header: z127.string().nullish(),
-  options: z127.array(questionOptionSchema).nullish(),
-  multi_select: z127.boolean().nullish()
-});
-var pendingHumanRequestSchema = z127.object({
-  id: z127.string(),
-  title: z127.string(),
-  description: z127.string().nullish(),
-  created_at: z127.string(),
-  type: z127.string(),
-  questions: z127.array(questionSchema).nullish()
-});
-var getRunResponseSchema = z127.object({
+var questionOptionSchema = z128.object({
+  label: z128.string(),
+  description: z128.string().nullish()
+});
+var questionSchema = z128.object({
+  question: z128.string(),
+  header: z128.string().nullish(),
+  options: z128.array(questionOptionSchema).nullish(),
+  multi_select: z128.boolean().nullish()
+});
+var pendingHumanRequestSchema = z128.object({
+  id: z128.string(),
+  title: z128.string(),
+  description: z128.string().nullish(),
+  created_at: z128.string(),
+  type: z128.string(),
+  questions: z128.array(questionSchema).nullish()
+});
+var getRunResponseSchema = z128.object({
   run: publicRunSchema.nullable(),
   pending_human_request: pendingHumanRequestSchema.nullish()
 });
-var stopRunResponseSchema = z127.object({
-  success: z127.boolean(),
-  message: z127.string().nullish()
-});
-var runMessageSchema = z127.object({
-  id: z127.string(),
-  type: z127.string(),
-  role: z127.string(),
-  timestamp: z127.string(),
-  text_content: z127.string().nullish(),
-  tool_call: z127.object({
-    id: z127.string(),
-    name: z127.string(),
-    arguments: z127.record(z127.string(), z127.unknown()).nullish()
+var stopRunResponseSchema = z128.object({
+  success: z128.boolean(),
+  message: z128.string().nullish()
+});
+var runMessageSchema = z128.object({
+  id: z128.string(),
+  type: z128.string(),
+  role: z128.string(),
+  timestamp: z128.string(),
+  text_content: z128.string().nullish(),
+  tool_call: z128.object({
+    id: z128.string(),
+    name: z128.string(),
+    arguments: z128.record(z128.string(), z128.unknown()).nullish()
   }).nullish(),
-  tool_result: z127.object({
-    tool_call_id: z127.string(),
-    result: z127.unknown().nullish(),
-    error: z127.string().nullish()
+  tool_result: z128.object({
+    tool_call_id: z128.string(),
+    result: z128.unknown().nullish(),
+    error: z128.string().nullish()
   }).nullish()
 });
-var listRunMessagesResponseSchema = z127.object({
-  messages: z127.array(runMessageSchema),
-  total: z127.number().nullish(),
-  limit: z127.number().nullish(),
-  offset: z127.number().nullish()
+var listRunMessagesResponseSchema = z128.object({
+  messages: z128.array(runMessageSchema),
+  total: z128.number().nullish(),
+  limit: z128.number().nullish(),
+  offset: z128.number().nullish()
 });
-var postedMessageSchema = z127.object({
-  id: z127.string(),
-  type: z127.string(),
-  role: z127.string(),
-  timestamp: z127.string(),
-  text_content: z127.string()
+var postedMessageSchema = z128.object({
+  id: z128.string(),
+  type: z128.string(),
+  role: z128.string(),
+  timestamp: z128.string(),
+  text_content: z128.string()
 });
-var postRunMessageResponseSchema = z127.object({
+var postRunMessageResponseSchema = z128.object({
   message: postedMessageSchema
 });
-var respondHumanRequestResponseSchema = z127.object({
-  human_request: z127.object({
-    id: z127.string(),
-    run_id: z127.string(),
-    title: z127.string(),
-    description: z127.string().nullish(),
-    response: z127.string().nullish(),
-    responded_at: z127.string().nullish(),
-    created_at: z127.string()
+var respondHumanRequestResponseSchema = z128.object({
+  human_request: z128.object({
+    id: z128.string(),
+    run_id: z128.string(),
+    title: z128.string(),
+    description: z128.string().nullish(),
+    response: z128.string().nullish(),
+    responded_at: z128.string().nullish(),
+    created_at: z128.string()
   })
 });
 
@@ -33626,7 +34414,7 @@ var MAX_LIMIT14 = 100;
 var SORT_ORDERS2 = ["asc", "desc"];
 var HAS_ISSUES_VALUES = ["true", "false"];
 var TITLE_PREVIEW_WIDTH = 50;
-var TABLE_COLUMNS38 = [
+var TABLE_COLUMNS39 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "RUN#", cell: /* @__PURE__ */ __name((row) => String(row.run_number), "cell") },
   { header: "STATUS", cell: /* @__PURE__ */ __name((row) => row.status, "cell") },
@@ -33750,7 +34538,7 @@ function registerRunsList(runs) {
       console.log("No runs found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS38, response.data));
+    console.log(renderTable(TABLE_COLUMNS39, response.data));
     console.log(
       `Showing ${response.data.length} of ${response.total} \xB7 offset ${offset}`
     );
@@ -33860,7 +34648,7 @@ var DEFAULT_LIMIT15 = 20;
 var MIN_LIMIT17 = 1;
 var MAX_LIMIT15 = 50;
 var TEXT_PREVIEW_WIDTH2 = 60;
-var TABLE_COLUMNS39 = [
+var TABLE_COLUMNS40 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "ROLE", cell: /* @__PURE__ */ __name((row) => row.role, "cell") },
   { header: "TYPE", cell: /* @__PURE__ */ __name((row) => row.type, "cell") },
@@ -33925,7 +34713,7 @@ function registerRunsMessages(runs) {
       console.log("No messages found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS39, response.messages));
+    console.log(renderTable(TABLE_COLUMNS40, response.messages));
     const resolvedOffset = response.offset ?? offset;
     const summary = response.total === null || response.total === void 0 ? `Showing ${response.messages.length} \xB7 offset ${resolvedOffset}` : `Showing ${response.messages.length} of ${response.total} \xB7 offset ${resolvedOffset}`;
     console.log(summary);
@@ -34193,28 +34981,28 @@ function registerRuns(program) {
 __name(registerRuns, "registerRuns");
 
 // src/api/sandbox-schemas.ts
-import { z as z128 } from "zod";
-var createSandboxResponseSchema = z128.object({
-  sandbox_id: z128.string(),
-  expires_at: z128.string()
+import { z as z129 } from "zod";
+var createSandboxResponseSchema = z129.object({
+  sandbox_id: z129.string(),
+  expires_at: z129.string()
 });
-var createSandboxUploadUrlResponseSchema = z128.object({
-  upload_url: z128.string(),
-  path: z128.string(),
-  expires_in_seconds: z128.number()
+var createSandboxUploadUrlResponseSchema = z129.object({
+  upload_url: z129.string(),
+  path: z129.string(),
+  expires_in_seconds: z129.number()
 });
-var sandboxFileSchema = z128.object({
-  name: z128.string(),
-  path: z128.string(),
-  type: z128.enum(["file", "dir"]),
-  size_bytes: z128.number()
+var sandboxFileSchema = z129.object({
+  name: z129.string(),
+  path: z129.string(),
+  type: z129.enum(["file", "dir"]),
+  size_bytes: z129.number()
 });
-var listSandboxFilesResponseSchema = z128.object({
-  files: z128.array(sandboxFileSchema)
+var listSandboxFilesResponseSchema = z129.object({
+  files: z129.array(sandboxFileSchema)
 });
-var uploadSandboxFileResponseSchema = z128.object({
-  path: z128.string(),
-  size_bytes: z128.number()
+var uploadSandboxFileResponseSchema = z129.object({
+  path: z129.string(),
+  size_bytes: z129.number()
 });
 var DEFAULT_SANDBOX_FILES_PATH = "/workspace";
 
@@ -34251,7 +35039,7 @@ function registerSandboxesCreate(sandboxes) {
 __name(registerSandboxesCreate, "registerSandboxesCreate");
 
 // src/commands/sandboxes/files.ts
-var TABLE_COLUMNS40 = [
+var TABLE_COLUMNS41 = [
   { header: "TYPE", cell: /* @__PURE__ */ __name((row) => row.type, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   { header: "PATH", cell: /* @__PURE__ */ __name((row) => row.path, "cell") },
@@ -34289,7 +35077,7 @@ function registerSandboxesFiles(sandboxes) {
       console.log("No files found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS40, files));
+    console.log(renderTable(TABLE_COLUMNS41, files));
     console.log(`Showing ${files.length}`);
   }, "filesAction"));
 }
@@ -34634,7 +35422,7 @@ function registerSecretsGet(secrets) {
 __name(registerSecretsGet, "registerSecretsGet");
 
 // src/commands/secrets/list.ts
-var TABLE_COLUMNS41 = [
+var TABLE_COLUMNS42 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   {
@@ -34678,7 +35466,7 @@ function registerSecretsList(secrets) {
       console.log("No secrets found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS41, rows));
+    console.log(renderTable(TABLE_COLUMNS42, rows));
     console.log(`Showing ${rows.length}`);
   }, "listAction"));
 }
@@ -34789,7 +35577,7 @@ function registerSecrets(program) {
 __name(registerSecrets, "registerSecrets");
 
 // src/commands/skills/assignments.ts
-var TABLE_COLUMNS42 = [
+var TABLE_COLUMNS43 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") }
 ];
@@ -34817,7 +35605,7 @@ function registerSkillsAssignments(skills) {
       console.log("No agents use this skill.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS42, assignments));
+    console.log(renderTable(TABLE_COLUMNS43, assignments));
     console.log(`Showing ${assignments.length} of ${total}`);
   }, "assignmentsAction"));
 }
@@ -34825,13 +35613,13 @@ __name(registerSkillsAssignments, "registerSkillsAssignments");
 
 // src/commands/skills/create.ts
 import { readFileSync as readFileSync5 } from "node:fs";
-import { z as z129 } from "zod";
-var createSkillResponseSchema = z129.object({
-  skill: z129.object({
-    id: z129.string(),
-    name: z129.string(),
-    description: z129.string(),
-    team_id: z129.string()
+import { z as z130 } from "zod";
+var createSkillResponseSchema = z130.object({
+  skill: z130.object({
+    id: z130.string(),
+    name: z130.string(),
+    description: z130.string(),
+    team_id: z130.string()
   })
 });
 function registerSkillsCreate(skills) {
@@ -35110,7 +35898,7 @@ function registerSkillsFileUpdate(skills) {
 __name(registerSkillsFileUpdate, "registerSkillsFileUpdate");
 
 // src/commands/skills/files.ts
-var TABLE_COLUMNS43 = [
+var TABLE_COLUMNS44 = [
   { header: "PATH", cell: /* @__PURE__ */ __name((row) => row.path, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   {
@@ -35149,7 +35937,7 @@ function registerSkillsFiles(skills) {
       console.log("No files found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS43, parsed.data.files));
+    console.log(renderTable(TABLE_COLUMNS44, parsed.data.files));
     console.log(`Showing ${parsed.data.files.length}`);
   }, "filesAction"));
 }
@@ -35206,13 +35994,13 @@ function readExistingContent(source) {
 __name(readExistingContent, "readExistingContent");
 
 // src/commands/skills/install.ts
-import { z as z130 } from "zod";
-var installSkillResponseSchema = z130.object({
-  skill: z130.object({
-    id: z130.string(),
-    name: z130.string(),
-    description: z130.string(),
-    team_id: z130.string()
+import { z as z131 } from "zod";
+var installSkillResponseSchema = z131.object({
+  skill: z131.object({
+    id: z131.string(),
+    name: z131.string(),
+    description: z131.string(),
+    team_id: z131.string()
   })
 });
 function registerSkillsInstall(skills) {
@@ -35361,48 +36149,48 @@ function registerSkillsList(skills) {
 __name(registerSkillsList, "registerSkillsList");
 
 // src/api/skill-revision-schemas.ts
-import { z as z131 } from "zod";
-var skillRevisionSchema = z131.object({
-  id: z131.string(),
-  skill_id: z131.string(),
-  revision_number: z131.number().nullable(),
-  status: z131.enum(["draft", "live", "historic"]),
-  revision_name: z131.string().nullable(),
-  revision_description: z131.string().nullable(),
-  created_by: z131.string().nullable(),
-  created_by_name: z131.string().nullable(),
-  created_at: z131.string(),
-  updated_at: z131.string()
-});
-var listSkillRevisionsResponseSchema = z131.object({
-  revisions: z131.array(skillRevisionSchema),
-  total: z131.number().nullish(),
-  limit: z131.number().nullish(),
-  offset: z131.number().nullish()
-});
-var createSkillRevisionResponseSchema = z131.object({
+import { z as z132 } from "zod";
+var skillRevisionSchema = z132.object({
+  id: z132.string(),
+  skill_id: z132.string(),
+  revision_number: z132.number().nullable(),
+  status: z132.enum(["draft", "live", "historic"]),
+  revision_name: z132.string().nullable(),
+  revision_description: z132.string().nullable(),
+  created_by: z132.string().nullable(),
+  created_by_name: z132.string().nullable(),
+  created_at: z132.string(),
+  updated_at: z132.string()
+});
+var listSkillRevisionsResponseSchema = z132.object({
+  revisions: z132.array(skillRevisionSchema),
+  total: z132.number().nullish(),
+  limit: z132.number().nullish(),
+  offset: z132.number().nullish()
+});
+var createSkillRevisionResponseSchema = z132.object({
   revision: skillRevisionSchema,
-  created: z131.boolean()
+  created: z132.boolean()
 });
-var skillRevisionResponseSchema = z131.object({
+var skillRevisionResponseSchema = z132.object({
   revision: skillRevisionSchema
 });
-var deleteSkillRevisionResponseSchema = z131.object({
-  success: z131.boolean(),
-  message: z131.string()
+var deleteSkillRevisionResponseSchema = z132.object({
+  success: z132.boolean(),
+  message: z132.string()
 });
-var skillRevisionFileSchema = z131.object({
-  name: z131.string(),
-  path: z131.string(),
-  size: z131.number().optional(),
-  contentType: z131.string().optional(),
-  updatedAt: z131.string().optional()
+var skillRevisionFileSchema = z132.object({
+  name: z132.string(),
+  path: z132.string(),
+  size: z132.number().optional(),
+  contentType: z132.string().optional(),
+  updatedAt: z132.string().optional()
 });
-var listSkillRevisionFilesResponseSchema = z131.object({
-  files: z131.array(skillRevisionFileSchema),
-  limit: z131.number().nullish(),
-  has_more: z131.boolean().nullish(),
-  next_cursor: z131.string().nullish()
+var listSkillRevisionFilesResponseSchema = z132.object({
+  files: z132.array(skillRevisionFileSchema),
+  limit: z132.number().nullish(),
+  has_more: z132.boolean().nullish(),
+  next_cursor: z132.string().nullish()
 });
 
 // src/commands/skills/revisions/create.ts
@@ -35565,7 +36353,7 @@ __name(registerSkillsRevisionsFileUpdate, "registerSkillsRevisionsFileUpdate");
 var DEFAULT_LIMIT16 = 100;
 var MIN_LIMIT18 = 1;
 var MAX_LIMIT16 = 1e3;
-var TABLE_COLUMNS44 = [
+var TABLE_COLUMNS45 = [
   { header: "PATH", cell: /* @__PURE__ */ __name((row) => row.path, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name, "cell") },
   {
@@ -35627,7 +36415,7 @@ function registerSkillsRevisionsFiles(revisions) {
       );
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS44, parsed.data.files));
+    console.log(renderTable(TABLE_COLUMNS45, parsed.data.files));
     console.log(
       nextCursor === null ? `Showing ${parsed.data.files.length}` : `Showing ${parsed.data.files.length} \xB7 more files remain \u2014 next page: --cursor ${nextCursor}`
     );
@@ -35639,7 +36427,7 @@ __name(registerSkillsRevisionsFiles, "registerSkillsRevisionsFiles");
 var DEFAULT_LIMIT17 = 20;
 var MIN_LIMIT19 = 1;
 var MAX_LIMIT17 = 100;
-var TABLE_COLUMNS45 = [
+var TABLE_COLUMNS46 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   {
     header: "VERSION",
@@ -35688,7 +36476,7 @@ function registerSkillsRevisionsList(revisions) {
       console.log("No revisions found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS45, response.revisions));
+    console.log(renderTable(TABLE_COLUMNS46, response.revisions));
     const resolvedOffset = response.offset ?? offset;
     const total = response.total ?? null;
     const summary = total === null ? `Showing ${response.revisions.length} \xB7 offset ${resolvedOffset}` : `Showing ${response.revisions.length} of ${total} \xB7 offset ${resolvedOffset}`;
@@ -35878,13 +36666,13 @@ __name(registerSkillsSystem, "registerSkillsSystem");
 // src/commands/skills/upload.ts
 import { readFile as readFile10, stat as stat3 } from "node:fs/promises";
 import { basename as basename4 } from "node:path";
-import { z as z132 } from "zod";
-var uploadSkillResponseSchema = z132.object({
-  skill: z132.object({
-    id: z132.string(),
-    name: z132.string(),
-    description: z132.string(),
-    team_id: z132.string()
+import { z as z133 } from "zod";
+var uploadSkillResponseSchema = z133.object({
+  skill: z133.object({
+    id: z133.string(),
+    name: z133.string(),
+    description: z133.string(),
+    team_id: z133.string()
   })
 });
 function registerSkillsUpload(skills) {
@@ -36120,17 +36908,17 @@ function registerSuggestionsGet(suggestions) {
 __name(registerSuggestionsGet, "registerSuggestionsGet");
 
 // src/commands/suggestions/list.ts
-import { z as z133 } from "zod";
+import { z as z134 } from "zod";
 var DEFAULT_LIMIT18 = 100;
 var MIN_LIMIT20 = 1;
 var MAX_LIMIT18 = 250;
-var listEnvelopeSchema = z133.object({
-  data: z133.array(z133.unknown()),
-  pending_count: z133.number().int().nonnegative()
+var listEnvelopeSchema = z134.object({
+  data: z134.array(z134.unknown()),
+  pending_count: z134.number().int().nonnegative()
 });
 var STATUS_FILTERS = ["pending", "history"];
 var TITLE_PREVIEW_WIDTH2 = 50;
-var TABLE_COLUMNS46 = [
+var TABLE_COLUMNS47 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "TYPE", cell: /* @__PURE__ */ __name((row) => row.type, "cell") },
   { header: "STATUS", cell: /* @__PURE__ */ __name((row) => row.status, "cell") },
@@ -36208,7 +36996,7 @@ function registerSuggestionsList(suggestions) {
       console.log(`Pending total: ${pendingCount}`);
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS46, data));
+    console.log(renderTable(TABLE_COLUMNS47, data));
     console.log(
       `Showing ${data.length} \xB7 offset ${offset} \xB7 pending total ${pendingCount}`
     );
@@ -36335,7 +37123,7 @@ __name(registerTeamGet, "registerTeamGet");
 var DEFAULT_LIMIT19 = 50;
 var MIN_LIMIT21 = 1;
 var MAX_LIMIT19 = 100;
-var TABLE_COLUMNS47 = [
+var TABLE_COLUMNS48 = [
   { header: "ID", cell: /* @__PURE__ */ __name((row) => row.id, "cell") },
   { header: "NAME", cell: /* @__PURE__ */ __name((row) => row.name ?? "", "cell") },
   { header: "EMAIL", cell: /* @__PURE__ */ __name((row) => row.email, "cell") },
@@ -36386,7 +37174,7 @@ function registerTeamMembers(team) {
       console.log("No members found.");
       return;
     }
-    console.log(renderTable(TABLE_COLUMNS47, response.members));
+    console.log(renderTable(TABLE_COLUMNS48, response.members));
     console.log(
       `Showing ${response.members.length} of ${response.total} \xB7 offset ${response.offset}`
     );
@@ -36395,19 +37183,14 @@ function registerTeamMembers(team) {
 __name(registerTeamMembers, "registerTeamMembers");
 
 // src/commands/team/use.ts
-import { z as z134 } from "zod";
+import { z as z135 } from "zod";
 var TEAM_ID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var teamIdSchema = z134.string().regex(TEAM_ID_SHAPE);
+var teamIdSchema = z135.string().regex(TEAM_ID_SHAPE);
 function registerTeamUse(team) {
   team.command("use <team-id>").description(
-    "Set the default team for the active OAuth profile (overridable per-command via --team or DUVO_TEAM_ID)"
+    "Set the default team for the active profile (overridable per-command via --team or DUVO_TEAM_ID)"
   ).action(/* @__PURE__ */ __name(async function useAction(teamId) {
     const auth = await requireAuthenticatedConfig(this);
-    if (auth.authType === "api-key") {
-      throw new CliError(
-        `This is an API-key profile \u2014 the team is baked into the key itself. Create or switch to an OAuth profile to use \`team use\`.`
-      );
-    }
     const parsedTeamId = teamIdSchema.safeParse(teamId);
     if (!parsedTeamId.success) {
       throw new CliError(
@@ -36420,16 +37203,17 @@ function registerTeamUse(team) {
       auth.apiBaseUrl
     );
     const config = await readConfig();
-    const profileFlag = getProfileFlag(this);
-    const profileName = profileFlag ?? config.defaultProfile;
+    const profileName = auth.profileName;
     if (!profileName) {
       throw new CliError(
-        "No active profile. Run `duvo login` first or pass --profile."
+        "Can't set a default team for an env-supplied credential (DUVO_API_KEY) \u2014 there's no stored profile to persist it to. Set DUVO_TEAM_ID instead, or store the key first with `duvo login --api-key`."
       );
     }
     const profile = config.profiles[profileName];
-    if (!profile || profile.type !== "oauth") {
-      throw new CliError(`Profile "${profileName}" is not an OAuth profile.`);
+    if (!profile) {
+      throw new CliError(
+        `Profile "${profileName}" does not exist. Run \`duvo profiles list\` to see available profiles.`
+      );
     }
     const updated = {
       ...config,
@@ -36483,10 +37267,10 @@ function registerTeam(program) {
 __name(registerTeam, "registerTeam");
 
 // src/commands/teams/create-org-team.ts
-import { z as z135 } from "zod";
-var createOrgTeamResponseSchema = z135.object({
-  id: z135.guid(),
-  name: z135.string()
+import { z as z136 } from "zod";
+var createOrgTeamResponseSchema = z136.object({
+  id: z136.guid(),
+  name: z136.string()
 });
 function registerTeamsCreateOrgTeam(teams) {
   teams.command("create-org-team <org-id>").description("Create a new team inside an organization you administer").requiredOption("--name <name>", "team name").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function createOrgTeamAction(orgId, options) {
@@ -36523,87 +37307,15 @@ function registerTeamsCreateOrgTeam(teams) {
 }
 __name(registerTeamsCreateOrgTeam, "registerTeamsCreateOrgTeam");
 
-// src/commands/teams/invite-org-member.ts
-var ORG_ROLES2 = Object.values(ORG_ROLE);
-var DEFAULT_ROLE = ORG_ROLE.MEMBER;
-function registerTeamsInviteOrgMember(teams) {
-  teams.command("invite-org-member <org-id>").description(
-    "Invite a person to an organization, optionally onto one of its teams"
-  ).requiredOption("--email <email>", "email address of the person to invite").option(
-    "--role <role>",
-    `organization role to grant: ${ORG_ROLES2.join(", ")} (default ${DEFAULT_ROLE})`,
-    DEFAULT_ROLE
-  ).option("--team-id <id>", "assign the invitee to this team in the org").option(
-    "--frontend-url <url>",
-    "base URL used to build the invitation email link (email is skipped if omitted)"
-  ).option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function inviteOrgMemberAction(orgId, options) {
-    const email = options.email?.trim();
-    if (email === void 0 || email.length === 0) {
-      throw new CliError("--email must not be empty");
-    }
-    const role = options.role ?? DEFAULT_ROLE;
-    if (!ORG_ROLES2.includes(role)) {
-      throw new CliError(
-        `Invalid --role "${role}"; expected one of: ${ORG_ROLES2.join(", ")}`
-      );
-    }
-    const { apiKey, apiBaseUrl } = await requireAuthenticatedConfig(this);
-    const body = { email, role };
-    if (options.teamId !== void 0) {
-      const teamId = options.teamId.trim();
-      if (teamId.length === 0) {
-        throw new CliError("--team-id must not be empty");
-      }
-      body.teamId = teamId;
-    }
-    if (options.frontendUrl !== void 0) {
-      const frontendUrl = options.frontendUrl.trim();
-      if (frontendUrl.length === 0) {
-        throw new CliError("--frontend-url must not be empty");
-      }
-      body.frontendUrl = frontendUrl;
-    }
-    const raw = await httpRequest({
-      method: "POST",
-      path: `/v2/organizations/${encodeURIComponent(orgId)}/members`,
-      apiKey,
-      apiBaseUrl,
-      body
-    });
-    if (options.json) {
-      printJson(raw);
-      return;
-    }
-    const parsed = inviteOrgMemberResponseSchema.safeParse(raw);
-    if (!parsed.success) {
-      throw new CliError(
-        `Unexpected response from POST /v2/organizations/:orgId/members: ${parsed.error.message}`
-      );
-    }
-    console.log(green("Invitation created!"));
-    console.log();
-    console.log(
-      renderKeyValue([
-        { label: "Invitation ID", value: parsed.data.invitationId },
-        { label: "Email", value: email },
-        { label: "Role", value: role },
-        { label: "Team", value: body.teamId ?? "\u2014" },
-        { label: "Email sent", value: parsed.data.emailSent ? "yes" : "no" }
-      ])
-    );
-  }, "inviteOrgMemberAction"));
-}
-__name(registerTeamsInviteOrgMember, "registerTeamsInviteOrgMember");
-
 // src/commands/teams/list.ts
-import { z as z136 } from "zod";
-var teamApiSchema2 = z136.object({
-  id: z136.string(),
-  name: z136.string(),
-  organization_id: z136.string().nullable()
+import { z as z137 } from "zod";
+var teamApiSchema2 = z137.object({
+  id: z137.string(),
+  name: z137.string(),
+  organization_id: z137.string().nullable()
 });
-var listMyTeamsResponseSchema3 = z136.object({
-  teams: z136.array(teamApiSchema2)
+var listMyTeamsResponseSchema3 = z137.object({
+  teams: z137.array(teamApiSchema2)
 });
 function registerTeamsList(teams) {
   teams.command("list", { isDefault: true }).description("List every team you can act on").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function listAction(options) {
@@ -36646,21 +37358,21 @@ function registerTeamsList(teams) {
 __name(registerTeamsList, "registerTeamsList");
 
 // src/commands/teams/org-insights.ts
-import { z as z137 } from "zod";
-var headlineSchema = z137.object({
-  total_runs: z137.number(),
-  completed_runs: z137.number(),
-  failed_runs: z137.number(),
-  success_rate: z137.number().nullable(),
-  active_agents: z137.number(),
-  active_users: z137.number(),
-  start_date: z137.string(),
-  end_date: z137.string(),
-  truncated: z137.boolean(),
-  aggregated_teams: z137.number(),
-  total_teams: z137.number()
-});
-var orgInsightsHeadlineResponseSchema = z137.object({
+import { z as z138 } from "zod";
+var headlineSchema = z138.object({
+  total_runs: z138.number(),
+  completed_runs: z138.number(),
+  failed_runs: z138.number(),
+  success_rate: z138.number().nullable(),
+  active_agents: z138.number(),
+  active_users: z138.number(),
+  start_date: z138.string(),
+  end_date: z138.string(),
+  truncated: z138.boolean(),
+  aggregated_teams: z138.number(),
+  total_teams: z138.number()
+});
+var orgInsightsHeadlineResponseSchema = z138.object({
   headline: headlineSchema
 });
 function formatRate(rate) {
@@ -36728,26 +37440,26 @@ function registerTeamsOrgInsights(teams) {
 __name(registerTeamsOrgInsights, "registerTeamsOrgInsights");
 
 // src/commands/teams/org-metrics.ts
-import { z as z138 } from "zod";
-var teamMetricSchema = z138.object({
-  team_id: z138.string(),
-  team_name: z138.string(),
-  is_deleted: z138.boolean(),
-  member_count: z138.number(),
-  assignment_count: z138.number(),
-  scheduled_job_count: z138.number(),
-  total_jobs: z138.number(),
-  completed_jobs: z138.number(),
-  failed_jobs: z138.number(),
-  total_runs: z138.number()
-});
-var orgInsightsMetricsResponseSchema = z138.object({
-  teams: z138.array(teamMetricSchema),
-  start_date: z138.string(),
-  end_date: z138.string(),
-  truncated: z138.boolean(),
-  total_teams: z138.number(),
-  org_member_count: z138.number()
+import { z as z139 } from "zod";
+var teamMetricSchema = z139.object({
+  team_id: z139.string(),
+  team_name: z139.string(),
+  is_deleted: z139.boolean(),
+  member_count: z139.number(),
+  assignment_count: z139.number(),
+  scheduled_job_count: z139.number(),
+  total_jobs: z139.number(),
+  completed_jobs: z139.number(),
+  failed_jobs: z139.number(),
+  total_runs: z139.number()
+});
+var orgInsightsMetricsResponseSchema = z139.object({
+  teams: z139.array(teamMetricSchema),
+  start_date: z139.string(),
+  end_date: z139.string(),
+  truncated: z139.boolean(),
+  total_teams: z139.number(),
+  org_member_count: z139.number()
 });
 function registerTeamsOrgMetrics(teams) {
   teams.command("org-metrics <org-id>").description("Show per-team run metrics across an organization").option("--start-date <date>", "window start (ISO 8601, default 7d ago)").option("--end-date <date>", "window end (ISO 8601, default now)").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function orgMetricsAction(orgId, options) {
@@ -36810,20 +37522,20 @@ ${total_teams} teams${suffix} \xB7 ${org_member_count} org members`
 __name(registerTeamsOrgMetrics, "registerTeamsOrgMetrics");
 
 // src/commands/teams/org-usage.ts
-import { z as z139 } from "zod";
+import { z as z140 } from "zod";
 var GRANULARITIES = ["day", "week", "month"];
 var DEFAULT_LOOKBACK_MS = 30 * 24 * 60 * 60 * 1e3;
-var bucketSchema = z139.object({
-  period: z139.string(),
-  total_runs: z139.number(),
-  scheduled_runs: z139.number(),
-  on_demand_runs: z139.number()
-});
-var usageChartResponseSchema = z139.object({
-  buckets: z139.array(bucketSchema),
-  granularity: z139.enum(GRANULARITIES),
-  truncated: z139.boolean(),
-  total_teams: z139.number()
+var bucketSchema = z140.object({
+  period: z140.string(),
+  total_runs: z140.number(),
+  scheduled_runs: z140.number(),
+  on_demand_runs: z140.number()
+});
+var usageChartResponseSchema = z140.object({
+  buckets: z140.array(bucketSchema),
+  granularity: z140.enum(GRANULARITIES),
+  truncated: z140.boolean(),
+  total_teams: z140.number()
 });
 function registerTeamsOrgUsage(teams) {
   teams.command("org-usage <org-id>").description("Show org-wide run volume over time (scheduled vs on-demand)").option("--start-date <date>", "window start (ISO 8601, default 30d ago)").option("--end-date <date>", "window end (ISO 8601, default now)").option(
@@ -36882,17 +37594,17 @@ function registerTeamsOrgUsage(teams) {
 __name(registerTeamsOrgUsage, "registerTeamsOrgUsage");
 
 // src/commands/teams/org.ts
-import { z as z140 } from "zod";
-var orgTeamSchema = z140.object({
-  id: z140.string(),
-  name: z140.string(),
-  userIsMember: z140.boolean(),
-  userRole: z140.string().nullable(),
-  memberCount: z140.number()
+import { z as z141 } from "zod";
+var orgTeamSchema = z141.object({
+  id: z141.string(),
+  name: z141.string(),
+  userIsMember: z141.boolean(),
+  userRole: z141.string().nullable(),
+  memberCount: z141.number()
 });
-var listOrgTeamsResponseSchema = z140.object({
-  teams: z140.array(orgTeamSchema),
-  total: z140.number()
+var listOrgTeamsResponseSchema = z141.object({
+  teams: z141.array(orgTeamSchema),
+  total: z141.number()
 });
 var SORT_BY_VALUES = ["createdAt", "name"];
 function registerTeamsOrg(teams) {
@@ -36953,17 +37665,17 @@ function registerTeamsOrg(teams) {
 __name(registerTeamsOrg, "registerTeamsOrg");
 
 // src/commands/teams/orgs.ts
-import { z as z141 } from "zod";
-var orgMembershipSchema = z141.object({
-  organization: z141.object({
-    id: z141.string(),
-    name: z141.string()
+import { z as z142 } from "zod";
+var orgMembershipSchema = z142.object({
+  organization: z142.object({
+    id: z142.string(),
+    name: z142.string()
   }),
-  role: z141.string(),
-  memberCount: z141.number()
+  role: z142.string(),
+  memberCount: z142.number()
 });
-var listMyOrganizationsResponseSchema = z141.object({
-  memberships: z141.array(orgMembershipSchema)
+var listMyOrganizationsResponseSchema = z142.object({
+  memberships: z142.array(orgMembershipSchema)
 });
 function registerTeamsOrgs(teams) {
   teams.command("orgs").description("List the organizations you belong to and your role in each").option("--json", "output raw JSON from the API").action(/* @__PURE__ */ __name(async function orgsAction(options) {
@@ -37010,7 +37722,6 @@ function registerTeams(program) {
   registerTeamsOrg(teams);
   registerTeamsOrgs(teams);
   registerTeamsCreateOrgTeam(teams);
-  registerTeamsInviteOrgMember(teams);
   registerTeamsOrgInsights(teams);
   registerTeamsOrgMetrics(teams);
   registerTeamsOrgUsage(teams);
@@ -37141,7 +37852,7 @@ __name(isStandaloneBinary, "isStandaloneBinary");
 import { createRequire } from "node:module";
 function getPackageMeta() {
   if (true) {
-    return { name: "@duvoai/cli", version: "1.45.3" };
+    return { name: "@duvoai/cli", version: "1.46.0" };
   }
   const require2 = createRequire(import.meta.url);
   const raw = require2("../../package.json");
@@ -37372,15 +38083,25 @@ __name(updateNpmInstall, "updateNpmInstall");
 function registerWhoami(program) {
   program.command("whoami").description(
     "Print the active profile, the authenticated user's name and email, the team ID that subsequent commands will act on, and the auth type"
-  ).action(/* @__PURE__ */ __name(async function whoamiAction() {
+  ).option("--json", "output machine-readable JSON").action(/* @__PURE__ */ __name(async function whoamiAction(options) {
     const resolved = await requireAuthenticatedConfig(this);
+    const user = await fetchUser(resolved);
+    const teamId = await resolveActiveTeamId(resolved, getTeamFlag(this));
+    if (options.json) {
+      printJson({
+        profile: resolved.profileName,
+        user,
+        team: teamId,
+        authType: resolved.authType
+      });
+      return;
+    }
     const profileLabel = resolved.profileName ?? "(env-only, no stored profile)";
     console.log(`Profile   ${profileLabel}`);
-    const userLine = await fetchUserLine(resolved);
-    if (userLine !== null) {
+    if (user !== null) {
+      const userLine = user.name ? `${user.name} <${user.email}>` : user.email;
       console.log(`User      ${userLine}`);
     }
-    const teamId = await resolveActiveTeamId(resolved, getTeamFlag(this));
     if (teamId !== null) {
       console.log(`Team      ${teamId}`);
     }
@@ -37389,7 +38110,7 @@ function registerWhoami(program) {
   }, "whoamiAction"));
 }
 __name(registerWhoami, "registerWhoami");
-async function fetchUserLine(config) {
+async function fetchUser(config) {
   try {
     const raw = await httpRequest({
       method: "GET",
@@ -37401,13 +38122,13 @@ async function fetchUserLine(config) {
     if (!parsed.success) {
       return null;
     }
-    const { name, email } = parsed.data.profile;
-    return name ? `${name} <${email}>` : email;
+    const { id, name, email } = parsed.data.profile;
+    return { id, name, email };
   } catch {
     return null;
   }
 }
-__name(fetchUserLine, "fetchUserLine");
+__name(fetchUser, "fetchUser");
 async function resolveActiveTeamId(config, override) {
   try {
     return await resolveRequiredTeamId(config, { override });
@@ -37555,7 +38276,7 @@ function createProgram() {
     "use a specific profile for this invocation (overrides default profile)"
   ).option(
     "--team <id>",
-    "use a specific team for this invocation (overrides DUVO_TEAM_ID and profile default; API-key profiles are pinned to the key's team, so a different value is rejected by the server)"
+    "use a specific team for this invocation (overrides DUVO_TEAM_ID and profile default; team-scoped API keys stay pinned to the key's team)"
   ).addOption(
     new Option2(
       "--no-update-notifier",
@@ -37604,6 +38325,7 @@ ${notice}` : "";
   registerSuggestions(program);
   registerTeam(program);
   registerTeams(program);
+  registerInvite(program);
   registerSecrets(program);
   registerCredentials(program);
   registerRevisionSecrets(program);