@eve-horizon/cli 0.2.51 → 0.2.53

package/dist/index.js

@@ -51284,97 +51284,58 @@ Requires Docker Desktop; k3d and kubectl are auto-managed by the CLI.`,
       "eve analytics env-health --org org_xxx"
     ]
   },
-  ollama: {
-    description: "Manage inference targets, installs, models, aliases, and platform managed availability.",
-    usage: "eve ollama <subcommand> [options]",
+  endpoint: {
+    description: "Manage private endpoints \u2014 Tailscale-connected services accessible from within the K8s cluster.",
+    usage: "eve endpoint <subcommand> [options]",
     subcommands: {
-      targets: {
-        description: "List inference targets",
-        usage: "eve ollama targets [--scope-kind <platform|org|project>] [--scope-id <id>] [--json]"
-      },
-      target: {
-        description: "Manage a single target (add, rm, test, wake, pull, models)",
-        usage: "eve ollama target <add|rm|test|wake|pull|models> [options]",
-        options: [
-          "add: --name <name> --base-url <url> [--scope-kind <kind>] [--scope-id <id>] [--target-type <type>] [--transport-profile <profile>] [--api-key-ref <secret-ref>]",
-          "rm: <target-id>",
-          "test: <target-id>",
-          "wake: <target-id> [--wait true] [--timeout-ms <ms>]  \u2014 Trigger GPU wake via ASG. Without --wait, returns immediately with retry_after_seconds (caller must poll). With --wait, server polls every 2.5s until target is healthy or timeout (default 120s, ~65s typical cold start).",
-          "pull: <target-id> --model-id <id>  \u2014 Pull a model onto a remote Ollama target",
-          "models: <target-id>  \u2014 List models currently loaded on a remote target"
-        ]
-      },
-      models: {
-        description: "List canonical inference models",
-        usage: "eve ollama models [--json]"
-      },
-      model: {
-        description: "Create canonical inference model",
-        usage: "eve ollama model add --canonical <id> --provider <name> --slug <provider-model-slug>"
-      },
-      aliases: {
-        description: "List alias routes",
-        usage: "eve ollama aliases [--scope-kind <kind>] [--scope-id <id>] [--json]"
-      },
-      alias: {
-        description: "Set or remove alias route",
-        usage: "eve ollama alias <set|rm> [options]",
+      add: {
+        description: "Register a private endpoint backed by Tailscale",
+        usage: "eve endpoint add --name <name> --tailscale-hostname <fqdn> --port <port> --org <org_id> [--health-path <path>]",
         options: [
-          "set: --alias <name> --target-id <target-id> --model-id <model-id> [--scope-kind <kind>] [--scope-id <id>]",
-          "rm: --alias <name> [--scope-kind <kind>] [--scope-id <id>]"
+          "--name <name>                 DNS-safe endpoint name",
+          "--tailscale-hostname <fqdn>   Tailscale MagicDNS hostname (e.g., mac-mini.tail12345.ts.net)",
+          "--port <port>                 Service port (1-65535)",
+          "--org <id>                    Organization ID or slug",
+          '--health-path <path>          HTTP health check path (default: /v1/models, "none" to disable)'
+        ],
+        examples: [
+          "eve endpoint add --name lmstudio --tailscale-hostname mac-mini.tail12345.ts.net --port 1234 --org org_xxx"
         ]
       },
-      installs: {
-        description: "List target-model installs",
-        usage: "eve ollama installs [--target-id <id>] [--model-id <id>] [--json]"
+      list: {
+        description: "List registered endpoints for an org",
+        usage: "eve endpoint list --org <org_id>",
+        examples: ["eve endpoint list --org org_xxx"]
       },
-      install: {
-        description: "Install or remove model availability on a target",
-        usage: "eve ollama install <add|rm> --target-id <target-id> --model-id <model-id> [options]",
+      show: {
+        description: "Show endpoint details and optionally run a health check",
+        usage: "eve endpoint show <name> --org <org_id> [--verbose]",
         options: [
-          "add: --target-id <target-id> --model-id <model-id> [--requires-warm-start true|false] [--min-target-capacity <n>]",
-          "rm: --target-id <target-id> --model-id <model-id>"
-        ]
-      },
-      assignments: {
-        description: "Inspect target assignment/load and queue depth",
-        usage: "eve ollama assignments [--scope-kind <platform|org|project>] [--scope-id <id>] [--json]"
+          "--verbose   Run and display a health check"
+        ],
+        examples: ["eve endpoint show lmstudio --org org_xxx --verbose"]
       },
-      "route-policies": {
-        description: "List route policies by scope",
-        usage: "eve ollama route-policies [--scope-kind <platform|org|project>] [--scope-id <id>] [--json]"
+      remove: {
+        description: "Remove a private endpoint and its K8s Service",
+        usage: "eve endpoint remove <name> --org <org_id>",
+        examples: ["eve endpoint remove lmstudio --org org_xxx"]
       },
-      "route-policy": {
-        description: "Set or remove a route policy",
-        usage: "eve ollama route-policy <set|rm> [options]",
-        options: [
-          "set: --scope-kind <kind> [--scope-id <id>] --preferred-target-id <target-id> [--fallback-to-alias-target true|false]",
-          "rm: --scope-kind <kind> [--scope-id <id>]"
-        ]
+      health: {
+        description: "Run a health check against a private endpoint",
+        usage: "eve endpoint health <name> --org <org_id>",
+        examples: ["eve endpoint health lmstudio --org org_xxx"]
       },
-      managed: {
-        description: "List, publish, and unpublish platform-managed catalog models",
-        usage: "eve ollama managed <list|publish|unpublish> [options]",
-        options: [
-          "list: [--json]",
-          "publish: --canonical <id> --provider <name> --slug <provider_model_slug> --target-id <id> [--requires-warm-start true|false] [--enabled true|false] [--json]",
-          "unpublish: --canonical <id> [--json]"
-        ]
+      diagnose: {
+        description: "Run diagnostic checks on a private endpoint",
+        usage: "eve endpoint diagnose <name> --org <org_id>",
+        examples: ["eve endpoint diagnose lmstudio --org org_xxx"]
       }
     },
     examples: [
-      "eve ollama target add --name local --base-url http://localhost:11434 --scope-kind platform --target-type external_ollama",
-      "eve ollama target wake itgt_xxx --wait true              # Block until GPU target is healthy (~65s)",
-      "eve ollama target wake itgt_xxx --wait true --timeout-ms 180000  # Wait up to 3 minutes",
-      "eve ollama target wake itgt_xxx                          # Fire-and-forget (returns retry_after_seconds)",
-      "eve ollama target pull itgt_xxx --model-id imod_xxx      # Pull model onto remote target",
-      "eve ollama target models itgt_xxx                        # List models on remote target",
-      "eve ollama model add --canonical gpt-oss:120b --provider ollama --slug gpt-oss:120b",
-      "eve ollama install add --target-id itgt_xxx --model-id imod_xxx --min-target-capacity 1",
-      "eve ollama assignments --scope-kind platform",
-      "eve ollama managed list",
-      "eve ollama managed publish --canonical deepseek-r1 --provider ollama --slug deepseek-r1:latest --target-id itgt_xxx",
-      "eve ollama managed unpublish --canonical deepseek-r1"
+      "eve endpoint add --name lmstudio --tailscale-hostname mac-mini.tail12345.ts.net --port 1234 --org org_xxx",
+      "eve endpoint list --org org_xxx",
+      "eve endpoint show lmstudio --org org_xxx --verbose",
+      "eve endpoint diagnose lmstudio --org org_xxx"
     ]
   },
   migrate: {
@@ -51482,7 +51443,7 @@ function showMainHelp() {
   console.log("  auth       Authentication (login, logout, status)");
   console.log("  webhooks   Manage outbound webhook subscriptions");
   console.log("  analytics  Org analytics (jobs, pipelines, env health)");
-  console.log("  ollama     Manage inference targets, aliases, and model routes");
+  console.log("  endpoint   Manage private endpoints (Tailscale-connected services)");
   console.log("  access     Access control: permissions, roles, bindings, policy-as-code sync");
   console.log("  user       Look up user profiles and memberships");
   console.log("  admin      User and platform admin operations");
@@ -52546,7 +52507,7 @@ function buildQuery2(params) {
 }
 
 // src/commands/job.ts
-var import_child_process2 = require("child_process");
+var import_child_process4 = require("child_process");
 var import_fs = require("fs");
 var import_path = require("path");
 
@@ -56674,6 +56635,8 @@ var configSchema = external_exports.object({
   EVE_SLACK_CLIENT_ID: external_exports.string().optional(),
   EVE_SLACK_CLIENT_SECRET: external_exports.string().optional(),
   EVE_INTERNAL_API_KEY: external_exports.string().optional(),
+  EVE_GATEWAY_URL: external_exports.string().url().optional(),
+  // Internal gateway URL for outbound delivery (e.g., http://eve-gateway.eve.svc.cluster.local:4820)
   EVE_ORG_FS_LINK_TOKEN_SECRET: external_exports.string().optional(),
   EVE_ORG_FS_LINK_TOKEN_TTL_SECONDS: external_exports.coerce.number().int().min(60).default(900),
   EVE_SECRETS_MASTER_KEY: external_exports.string().optional(),
@@ -57708,7 +57671,9 @@ var JobHintsSchema = external_exports.object({
     thread_id: external_exports.string(),
     dispatch_mode: external_exports.string().optional()
   }).optional(),
-  gates: external_exports.array(external_exports.string()).optional()
+  gates: external_exports.array(external_exports.string()).optional(),
+  // App API awareness: names of project APIs the agent should have access to
+  app_apis: external_exports.array(external_exports.string()).optional()
 }).passthrough();
 var JobTargetSchema = external_exports.object({
   agent_slug: external_exports.string().optional(),
@@ -58872,10 +58837,17 @@ var WorkflowInvokeRequestSchema = external_exports.object({
   input: external_exports.record(external_exports.unknown()).optional()
   // User's workflow input payload
 }).optional();
+var WorkflowStepJobSchema = external_exports.object({
+  job_id: external_exports.string(),
+  step_name: external_exports.string(),
+  depends_on: external_exports.array(external_exports.string()).optional()
+});
 var WorkflowInvokeResponseSchema = external_exports.object({
   job_id: external_exports.string(),
-  status: external_exports.string()
-  // Job phase
+  status: external_exports.string(),
+  // Job phase (root job)
+  step_jobs: external_exports.array(WorkflowStepJobSchema).optional()
+  // Child step jobs in the DAG
 });
 var WorkflowInvokeResultSchema = external_exports.object({
   job_id: external_exports.string(),
@@ -59034,6 +59006,7 @@ var EventListResponseSchema = external_exports.object({
 var AgentSummarySchema = external_exports.object({
   id: external_exports.string(),
   slug: external_exports.string().nullable().optional(),
+  alias: external_exports.string().nullable().optional(),
   name: external_exports.string().nullable().optional(),
   description: external_exports.string().nullable().optional(),
   role: external_exports.string().nullable().optional(),
@@ -59057,6 +59030,7 @@ var OrgAgentDirectoryItemSchema = external_exports.object({
   project_name: external_exports.string(),
   agent_id: external_exports.string(),
   agent_slug: external_exports.string().nullable(),
+  agent_alias: external_exports.string().nullable().optional(),
   agent_name: external_exports.string().nullable().optional(),
   agent_description: external_exports.string().nullable().optional(),
   role: external_exports.string().nullable().optional(),
@@ -59117,6 +59091,7 @@ var VALID_TOOLCHAINS = ["python", "media", "rust", "java", "kotlin"];
 var AgentEntrySchema = external_exports.object({
   name: external_exports.string().optional(),
   slug: AgentSlugSchema.optional(),
+  alias: AgentSlugSchema.optional(),
   description: external_exports.string().optional(),
   role: external_exports.string().optional(),
   skill: external_exports.string().min(1),
@@ -59135,11 +59110,20 @@ var AgentsYamlSchema = external_exports.object({
 }).passthrough();
 var TeamDispatchSchema = external_exports.object({
   mode: external_exports.enum(["fanout", "council", "relay"]).optional(),
+  staged: external_exports.boolean().optional(),
   max_parallel: external_exports.number().int().min(1).optional(),
   merge_strategy: external_exports.string().optional(),
   lead_timeout: external_exports.number().int().positive().optional(),
   member_timeout: external_exports.number().int().positive().optional()
-}).passthrough();
+}).passthrough().superRefine((dispatch, ctx) => {
+  if (dispatch.staged === true && dispatch.mode !== "council") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["staged"],
+      message: "dispatch.staged=true is only valid when dispatch.mode is 'council'"
+    });
+  }
+});
 var TeamEntrySchema = external_exports.object({
   lead: external_exports.string().min(1),
   members: external_exports.array(external_exports.string()).optional(),
@@ -59173,6 +59157,7 @@ var AgentsSyncRequestSchema = external_exports.object({
   agents_yaml: external_exports.string().min(1, "agents yaml cannot be empty"),
   teams_yaml: external_exports.string().min(1, "teams yaml cannot be empty"),
   chat_yaml: external_exports.string().min(1, "chat yaml cannot be empty"),
+  x_eve_yaml: external_exports.string().optional(),
   pack_refs: external_exports.array(PackRefSchema).optional(),
   git_sha: external_exports.string().optional(),
   branch: external_exports.string().optional(),
@@ -59255,6 +59240,9 @@ var ThreadMessageResponseSchema = external_exports.object({
   actor_id: external_exports.string().nullable().optional(),
   body: external_exports.string(),
   job_id: external_exports.string().nullable().optional(),
+  delivery_status: external_exports.string().nullable().optional(),
+  delivery_error: external_exports.string().nullable().optional(),
+  delivered_at: external_exports.string().nullable().optional(),
   created_at: external_exports.string()
 });
 var ThreadMessageListResponseSchema = external_exports.object({
@@ -59370,6 +59358,15 @@ var ChatDispatchRequestSchema = ChatRouteRequestSchema.extend({
 var ChatDispatchResponseSchema = external_exports.object({
   job_ids: external_exports.array(external_exports.string())
 });
+var ChatDeliverRequestSchema = external_exports.object({
+  job_id: external_exports.string().min(1).optional(),
+  // optional for progress messages
+  thread_id: external_exports.string().min(1),
+  text: external_exports.string().min(1),
+  agent_id: external_exports.string().optional(),
+  progress: external_exports.boolean().optional()
+  // marks this as a progress update (not final result)
+});
 
 // ../shared/dist/schemas/integrations.js
 var IntegrationResponseSchema = external_exports.object({
@@ -60339,201 +60336,105 @@ var BatchValidateResponseSchema = external_exports.object({
   errors: external_exports.array(BatchValidationErrorSchema)
 });
 
-// ../shared/dist/schemas/managed-models.js
-var ManagedModelCapabilitySchema = external_exports.object({
-  streaming: external_exports.boolean(),
-  tool_calling: external_exports.boolean(),
-  reasoning: external_exports.boolean()
-});
-var ManagedModelConfigV1Schema = external_exports.object({
-  display_name: external_exports.string().min(1),
-  inference_provider: external_exports.string().min(1),
-  harness: external_exports.string().optional(),
-  api_model_id: external_exports.string().min(1),
-  base_url: external_exports.string().min(1),
-  auth_header: external_exports.string().min(1),
-  auth_scheme: external_exports.string(),
-  secret_ref: external_exports.string().min(1),
-  extra_headers: external_exports.record(external_exports.string()),
-  capabilities: ManagedModelCapabilitySchema
-}).passthrough();
-var ManagedModelConfigV2Schema = external_exports.object({
-  display_name: external_exports.string().min(1),
-  provider: external_exports.string().min(1),
-  api_model_id: external_exports.string().min(1),
-  capabilities: ManagedModelCapabilitySchema,
-  harness: external_exports.string().optional(),
-  base_url: external_exports.string().optional(),
-  secret_ref: external_exports.string().optional(),
-  extra_headers: external_exports.record(external_exports.string()).optional()
-}).passthrough();
-var ManagedModelConfigSchema = external_exports.union([
-  ManagedModelConfigV1Schema,
-  ManagedModelConfigV2Schema
-]);
-var ManagedModelRegistrySchema = external_exports.record(ManagedModelConfigSchema);
-
-// ../shared/dist/schemas/inference.js
-var InferenceScopeKindSchema = external_exports.enum(["platform", "org", "project"]);
-var InferenceTargetTypeSchema = external_exports.enum(["ollama_pool", "external_ollama", "openai_compat"]);
-var InferenceTransportProfileSchema = external_exports.enum(["ollama_api", "openai_compat"]);
-var InferenceTargetStatusSchema = external_exports.enum(["unknown", "healthy", "unhealthy", "waking", "draining", "disabled"]);
-var InferenceTargetSchema = external_exports.object({
+// ../shared/dist/schemas/chat-file.js
+var ChatFileSchema = external_exports.object({
+  /** Provider file ID */
   id: external_exports.string(),
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().nullable(),
+  /** Original filename */
   name: external_exports.string(),
-  target_type: InferenceTargetTypeSchema,
-  transport_profile: InferenceTransportProfileSchema,
-  base_url: external_exports.string(),
-  health_probe_url: external_exports.string().nullable(),
-  capacity: external_exports.number().int(),
-  max_concurrent_inflight: external_exports.number().int(),
-  status: InferenceTargetStatusSchema,
-  transport_metadata: external_exports.record(external_exports.unknown()),
-  created_by: external_exports.string().nullable(),
-  updated_by: external_exports.string().nullable(),
-  created_at: external_exports.string(),
-  updated_at: external_exports.string()
-});
-var InferenceModelSchema = external_exports.object({
-  id: external_exports.string(),
-  canonical_model_id: external_exports.string(),
-  provider: external_exports.string(),
-  provider_model_slug: external_exports.string(),
-  max_context: external_exports.number().int().nullable(),
-  supports_json_schema: external_exports.boolean(),
-  metadata: external_exports.record(external_exports.unknown()),
-  created_at: external_exports.string(),
-  updated_at: external_exports.string()
+  /** MIME type */
+  mimetype: external_exports.string().optional(),
+  /** URL — provider URL initially, then eve-storage:// after resolution */
+  url: external_exports.string().optional(),
+  /** File size in bytes */
+  size: external_exports.number().optional(),
+  /** Set after resolveFiles: original provider URL */
+  source_url: external_exports.string().optional(),
+  /** Set after resolveFiles: provider name */
+  source_provider: external_exports.string().optional(),
+  /** Set after resolveFiles: eve-storage key */
+  storage_key: external_exports.string().optional(),
+  /** Set when file resolution failed — reason code (e.g. 'auth_failed', 'content_mismatch') */
+  error: external_exports.string().optional()
 });
-var InferenceAliasSchema = external_exports.object({
-  id: external_exports.string(),
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().nullable(),
-  alias: external_exports.string(),
-  target_id: external_exports.string(),
-  model_id: external_exports.string(),
-  pin_model_id: external_exports.string().nullable(),
-  pinned_at: external_exports.string().nullable(),
-  created_by: external_exports.string().nullable(),
-  updated_by: external_exports.string().nullable(),
-  created_at: external_exports.string(),
-  updated_at: external_exports.string()
+var AttachmentIndexEntrySchema = external_exports.object({
+  /** Provider attachment ID, when available */
+  id: external_exports.string().optional(),
+  /** Original filename */
+  name: external_exports.string(),
+  /** Relative path from workspace root */
+  path: external_exports.string().nullable(),
+  /** MIME type (e.g. application/pdf) */
+  mimetype: external_exports.string().optional(),
+  /** File size in bytes */
+  size: external_exports.number().optional(),
+  /** Original provider URL */
+  source_url: external_exports.string().optional(),
+  /** Provider that supplied this file */
+  source_provider: external_exports.string().optional(),
+  /** Storage key for re-download/debug */
+  storage_key: external_exports.string().optional(),
+  /** Error code if file could not be downloaded */
+  error: external_exports.string().optional()
 });
-var InferenceInstallSchema = external_exports.object({
-  id: external_exports.string(),
-  target_id: external_exports.string(),
-  model_id: external_exports.string(),
-  requires_warm_start: external_exports.boolean(),
-  min_target_capacity: external_exports.number().int(),
-  allowed_scopes: external_exports.record(external_exports.unknown()),
-  route_hints: external_exports.record(external_exports.unknown()),
-  created_at: external_exports.string(),
-  updated_at: external_exports.string()
+var AttachmentIndexSchema = external_exports.object({
+  files: external_exports.array(AttachmentIndexEntrySchema)
+});
+var MAX_CHAT_FILE_SIZE = 50 * 1024 * 1024;
+var MAX_CHAT_TOTAL_SIZE = 100 * 1024 * 1024;
+
+// ../shared/dist/schemas/private-endpoint.js
+var PrivateEndpointProviderSchema = external_exports.enum(["tailscale"]);
+var PrivateEndpointStatusSchema = external_exports.enum(["pending", "ready", "error"]);
+var DNS_SAFE_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+var CreatePrivateEndpointRequestSchema = external_exports.object({
+  name: external_exports.string().min(1).max(53).regex(DNS_SAFE_REGEX, "Name must be DNS-safe: lowercase alphanumeric and hyphens, cannot start or end with a hyphen"),
+  provider: PrivateEndpointProviderSchema.optional().default("tailscale"),
+  hostname: external_exports.string().min(1, "Tailscale hostname is required"),
+  port: external_exports.number().int().min(1).max(65535),
+  health_path: external_exports.string().nullable().optional().default("/v1/models"),
+  metadata: external_exports.record(external_exports.unknown()).optional()
 });
-var InferenceRoutePolicySchema = external_exports.object({
+var PrivateEndpointResponseSchema = external_exports.object({
   id: external_exports.string(),
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().nullable(),
-  preferred_target_id: external_exports.string(),
-  fallback_to_alias_target: external_exports.boolean(),
-  created_by: external_exports.string().nullable(),
-  updated_by: external_exports.string().nullable(),
+  name: external_exports.string(),
+  org_id: external_exports.string(),
+  provider: external_exports.string(),
+  hostname: external_exports.string(),
+  port: external_exports.number(),
+  protocol: external_exports.string(),
+  status: PrivateEndpointStatusSchema,
+  status_msg: external_exports.string().nullable(),
+  k8s_svc_name: external_exports.string(),
+  k8s_namespace: external_exports.string(),
+  k8s_dns: external_exports.string().nullable(),
+  health_path: external_exports.string().nullable(),
+  cluster_url: external_exports.string().nullable(),
   created_at: external_exports.string(),
   updated_at: external_exports.string()
 });
-var InferenceManagedModelSchema = external_exports.object({
-  canonical_model_id: external_exports.string(),
-  provider: external_exports.string(),
-  provider_model_slug: external_exports.string(),
-  target_id: external_exports.string(),
-  requires_warm_start: external_exports.boolean().default(false),
-  enabled: external_exports.boolean().default(true)
-});
-var InferenceManagedModelsSchema = external_exports.record(InferenceManagedModelSchema);
-var UpsertInferenceManagedModelRequestSchema = external_exports.object({
-  canonical_model_id: external_exports.string(),
-  provider: external_exports.string(),
-  provider_model_slug: external_exports.string(),
-  target_id: external_exports.string(),
-  requires_warm_start: external_exports.boolean().optional().default(false),
-  enabled: external_exports.boolean().optional().default(true)
-});
-var InferenceManagedModelResponseSchema = external_exports.object({
-  canonical_model_id: external_exports.string(),
-  provider: external_exports.string(),
-  provider_model_slug: external_exports.string(),
-  target_id: external_exports.string(),
-  requires_warm_start: external_exports.boolean(),
-  enabled: external_exports.boolean()
-});
-var InferenceManagedModelListResponseSchema = external_exports.object({
-  data: external_exports.array(InferenceManagedModelResponseSchema)
+var PrivateEndpointListResponseSchema = external_exports.object({
+  data: external_exports.array(PrivateEndpointResponseSchema),
+  pagination: PaginationSchema
 });
-var InferenceManagedModelUpsertResponseSchema = external_exports.object({
-  data: InferenceManagedModelResponseSchema,
-  created_install: external_exports.boolean()
+var PrivateEndpointHealthSchema = external_exports.object({
+  endpoint: PrivateEndpointResponseSchema,
+  health: external_exports.object({
+    checked_at: external_exports.string(),
+    reachable: external_exports.boolean(),
+    http_status: external_exports.number().nullable(),
+    response_time_ms: external_exports.number().nullable(),
+    error: external_exports.string().nullable()
+  })
 });
-var CreateInferenceTargetRequestSchema = external_exports.object({
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().optional(),
-  name: external_exports.string().min(1),
-  target_type: InferenceTargetTypeSchema,
-  transport_profile: InferenceTransportProfileSchema.default("ollama_api"),
-  base_url: external_exports.string().min(1),
-  health_probe_url: external_exports.string().optional(),
-  capacity: external_exports.number().int().positive().optional(),
-  max_concurrent_inflight: external_exports.number().int().positive().optional(),
-  status: InferenceTargetStatusSchema.optional(),
-  transport_metadata: external_exports.record(external_exports.unknown()).optional()
-});
-var UpdateInferenceTargetRequestSchema = external_exports.object({
-  name: external_exports.string().min(1).optional(),
-  target_type: InferenceTargetTypeSchema.optional(),
-  transport_profile: InferenceTransportProfileSchema.optional(),
-  base_url: external_exports.string().min(1).optional(),
-  health_probe_url: external_exports.string().optional(),
-  capacity: external_exports.number().int().positive().optional(),
-  max_concurrent_inflight: external_exports.number().int().positive().optional(),
-  status: InferenceTargetStatusSchema.optional(),
-  transport_metadata: external_exports.record(external_exports.unknown()).optional()
-});
-var CreateInferenceModelRequestSchema = external_exports.object({
-  canonical_model_id: external_exports.string().min(1),
-  provider: external_exports.string().min(1),
-  provider_model_slug: external_exports.string().min(1),
-  max_context: external_exports.number().int().positive().optional(),
-  supports_json_schema: external_exports.boolean().optional(),
-  metadata: external_exports.record(external_exports.unknown()).optional()
+var PrivateEndpointDiagnoseSchema = external_exports.object({
+  endpoint: PrivateEndpointResponseSchema,
+  checks: external_exports.array(external_exports.object({
+    name: external_exports.string(),
+    passed: external_exports.boolean(),
+    detail: external_exports.string().nullable()
+  }))
 });
-var CreateInferenceInstallRequestSchema = external_exports.object({
-  requires_warm_start: external_exports.boolean().optional(),
-  min_target_capacity: external_exports.number().int().positive().optional(),
-  allowed_scopes: external_exports.record(external_exports.unknown()).optional(),
-  route_hints: external_exports.record(external_exports.unknown()).optional()
-});
-var UpsertInferenceRoutePolicyRequestSchema = external_exports.object({
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().optional(),
-  preferred_target_id: external_exports.string().min(1),
-  fallback_to_alias_target: external_exports.boolean().optional()
-});
-var UpsertInferenceAliasRequestSchema = external_exports.object({
-  scope_kind: InferenceScopeKindSchema,
-  scope_id: external_exports.string().optional(),
-  alias: external_exports.string().min(1),
-  target_id: external_exports.string().min(1),
-  model_id: external_exports.string().min(1),
-  pin_model_id: external_exports.string().optional()
-});
-var InferenceChatCompletionsRequestSchema = external_exports.object({
-  model: external_exports.string().min(1),
-  messages: external_exports.array(external_exports.record(external_exports.unknown())).min(1),
-  stream: external_exports.boolean().optional(),
-  project_id: external_exports.string().optional(),
-  org_id: external_exports.string().optional()
-}).passthrough();
 
 // ../shared/dist/observability.js
 var import_async_hooks = require("async_hooks");
@@ -60989,25 +60890,11 @@ for (const provider of PROVIDER_REGISTRY) {
 function getProvider(name) {
   return byName.get(name.trim().toLowerCase());
 }
-function deriveHarnessEnvMap() {
-  const map = {};
-  for (const provider of PROVIDER_REGISTRY) {
-    for (const harness of provider.harnesses.all) {
-      if (!map[harness]) {
-        map[harness] = { ...provider.harnesses.env_map };
-      }
-    }
-  }
-  return map;
-}
 
 // ../shared/dist/pricing/model-normalization.js
 function normalizeModelName(provider, model) {
   let m = model.trim();
-  if (m.startsWith("managed/")) {
-    m = m.slice("managed/".length);
-  }
-  if (m.includes("/") && !m.startsWith("managed/")) {
+  if (m.includes("/")) {
     m = m.split("/").slice(1).join("/");
   }
   const providerDef = getProvider(provider);
@@ -62612,13 +62499,8 @@ var DEFAULT_RESOURCE_CLASSES_V1 = {
   }
 };
 
-// ../shared/dist/pricing/managed-models.js
-var HARNESS_ENV_MAP = deriveHarnessEnvMap();
-
 // ../shared/dist/permissions.js
 var ALL_PERMISSIONS = [
-  // Inference
-  "inference:write",
   // Jobs
   "jobs:read",
   "jobs:write",
@@ -62672,6 +62554,9 @@ var ALL_PERMISSIONS = [
   "events:write",
   // Chat
   "chat:write",
+  // Private Endpoints
+  "endpoints:read",
+  "endpoints:write",
   // System
   "system:read",
   "system:admin"
@@ -62761,6 +62646,16 @@ function normalizeLogLine(line) {
   return { type: kind || "log", raw: line };
 }
 
+// ../shared/dist/invoke/git-utils.js
+var import_child_process2 = require("child_process");
+var import_util5 = require("util");
+var execFileAsync2 = (0, import_util5.promisify)(import_child_process2.execFile);
+
+// ../shared/dist/invoke/workspace-hooks.js
+var import_child_process3 = require("child_process");
+var import_util6 = require("util");
+var execFileAsync3 = (0, import_util6.promisify)(import_child_process3.execFile);
+
 // src/commands/job.ts
 async function handleJob(subcommand, positionals, flags, context2) {
   const json = Boolean(flags.json);
@@ -63017,87 +62912,12 @@ async function handleCreate(flags, context2, json) {
   }
   if (withApis) {
     const apiNames = withApis.split(",").map((n) => n.trim()).filter(Boolean);
-    const apiListResponse = await requestJson(
-      context2,
-      `/projects/${resolvedProjectId}/apis`
-    );
-    const availableApis = new Map(
-      (apiListResponse.data || []).map((a) => [a.name, { type: a.type, base_url: a.base_url }])
-    );
-    const missing2 = apiNames.filter((name) => !availableApis.has(name));
-    if (missing2.length > 0) {
-      throw new Error(
-        `APIs not found in project: ${missing2.join(", ")}
-Available APIs: ${[...availableApis.keys()].join(", ") || "(none)"}`
-      );
-    }
-    const contextArgs = [`--project ${resolvedProjectId}`];
-    if (envName) {
-      contextArgs.push(`--env ${envName}`);
-    }
-    const contextSuffix = contextArgs.join(" ");
-    const apiLines = apiNames.map((name) => {
-      const info = availableApis.get(name);
-      const type = info?.type ?? "openapi";
-      const baseUrl = info?.base_url || "<base_url>";
-      return `- \`${name}\` (${type})
-  - Use this runtime-safe Node helper for in-job API calls (no extra tools required).
-    \`\`\`bash
-    API_URL="${baseUrl}" node - <<'NODE'
-    const fs = require("fs");
-    const tokenFromJob = process.env.EVE_JOB_TOKEN;
-    const tokenFromCreds = () => {
-      const credsPath = \`\${process.env.HOME}/.eve/credentials.json\`;
-      if (!fs.existsSync(credsPath)) {
-        return undefined;
-      }
-      const creds = JSON.parse(fs.readFileSync(credsPath, "utf8"));
-      const apiKey = \`\${(process.env.EVE_API_URL || "").replace(/\\/+$/, "")}\`;
-      return creds.tokens?.[apiKey]?.access_token;
-    };
-    const token = tokenFromJob ?? tokenFromCreds();
-    const apiUrl = process.env.API_URL;
-    if (!apiUrl) {
-      throw new Error("Set API_URL before running the script.");
-    }
-    const method = process.env.EVE_APP_API_METHOD ?? "GET";
-    const path = process.env.EVE_APP_API_PATH ?? "/";
-    const bodyArg = process.env.EVE_APP_API_BODY;
-    if (!token) {
-      throw new Error("Missing token. Set EVE_JOB_TOKEN or keep ~/.eve/credentials.json for external shells.");
-    }
-    const options = {
-      method: method.toUpperCase(),
-      headers: {
-        Authorization: \`Bearer \${token}\`,
-        "Content-Type": "application/json",
-      },
-    };
-    if (bodyArg) {
-      options.body = bodyArg;
-    }
-    (async () => {
-      const response = await fetch(new URL(path, apiUrl).toString(), options);
-      const text = await response.text();
-      console.log(text);
-      if (!response.ok) {
-        process.exitCode = 1;
+    if (apiNames.length > 0) {
+      if (!body.hints || typeof body.hints !== "object") {
+        body.hints = {};
       }
-    })().catch((error) => {
-      console.error(error);
-      process.exit(1);
-    });
-    NODE
-    # Example:
-    #   API_URL="${baseUrl}" EVE_APP_API_METHOD=GET EVE_APP_API_PATH=/api/auth-config node - <<'NODE'
-    \`\`\`
-  - Discover endpoints with \`eve api spec ${name} ${contextSuffix}\` in your own shell (outside the job runtime).`;
-    });
-    body.description = body.description + `
-
----
-**Available App APIs:**
-${apiLines.join("\n")}`;
+      body.hints.app_apis = apiNames;
+    }
   }
   const response = await requestJson(context2, `/projects/${resolvedProjectId}/jobs`, {
     method: "POST",
@@ -65370,7 +65190,7 @@ async function handleRunnerLogs(positionals, flags, context2) {
     console.log(`No pod_name in runtime_meta, using label selector: job-id=${jobId}`);
     kubectlArgs = ["-n", "eve", "logs", "-f", "-l", `job-id=${jobId}`];
   }
-  const kubectl = (0, import_child_process2.spawn)("kubectl", kubectlArgs, {
+  const kubectl = (0, import_child_process4.spawn)("kubectl", kubectlArgs, {
     stdio: "inherit"
   });
   return new Promise((resolve8, reject) => {
@@ -74745,27 +74565,27 @@ async function handleUsers(flags, context2, json) {
     role: col("role", "Role"),
     created: col("created", "Created")
   };
-  const pad3 = (s, n) => s + " ".repeat(Math.max(0, n - s.length));
+  const pad2 = (s, n) => s + " ".repeat(Math.max(0, n - s.length));
   const header = [
-    pad3("Email", w.email),
-    pad3("Name", w.name),
-    pad3("Admin", w.admin),
-    pad3("Scope", w.scope),
-    pad3("Target", w.target),
-    pad3("Role", w.role),
-    pad3("Created", w.created)
+    pad2("Email", w.email),
+    pad2("Name", w.name),
+    pad2("Admin", w.admin),
+    pad2("Scope", w.scope),
+    pad2("Target", w.target),
+    pad2("Role", w.role),
+    pad2("Created", w.created)
   ].join("  ");
   console.log(header);
   console.log("-".repeat(header.length));
   for (const row of rows) {
     console.log([
-      pad3(row.email, w.email),
-      pad3(row.name, w.name),
-      pad3(row.admin, w.admin),
-      pad3(row.scope, w.scope),
-      pad3(row.target, w.target),
-      pad3(row.role, w.role),
-      pad3(row.created, w.created)
+      pad2(row.email, w.email),
+      pad2(row.name, w.name),
+      pad2(row.admin, w.admin),
+      pad2(row.scope, w.scope),
+      pad2(row.target, w.target),
+      pad2(row.role, w.role),
+      pad2(row.created, w.created)
     ].join("  "));
   }
   console.log("");
@@ -74958,7 +74778,7 @@ async function resolvePacksAndMerge(repoRoot, manifest, projectSlug) {
       agents_count: Object.keys(extractInnerMap(mergedAgents, "agents")).length,
       teams_count: Object.keys(extractInnerMap(mergedTeams, "teams")).length,
       routes_count: (mergedChat.routes ?? []).length,
-      profiles_count: Object.keys(mergedXEve?.profiles ?? {}).length,
+      profiles_count: Object.keys(mergedXEve?.agents?.profiles ?? {}).length,
       agents_hash: simpleHash(JSON.stringify(mergedAgents)),
       teams_hash: simpleHash(JSON.stringify(mergedTeams)),
       chat_hash: simpleHash(JSON.stringify(mergedChat))
@@ -74974,6 +74794,7 @@ async function resolvePacksAndMerge(repoRoot, manifest, projectSlug) {
     agentsYaml: (0, import_yaml3.stringify)(mergedAgents),
     teamsYaml: (0, import_yaml3.stringify)(mergedTeams),
     chatYaml: (0, import_yaml3.stringify)(mergedChat),
+    xEveYaml: Object.keys(mergedXEve).length > 0 ? (0, import_yaml3.stringify)(mergedXEve) : null,
     workflowsYaml: mergedWorkflows ? (0, import_yaml3.stringify)({
       workflows: mergedWorkflows,
       ...Object.keys(mergedXEve).length > 0 ? { x_eve: mergedXEve } : {}
@@ -75135,11 +74956,13 @@ async function handleAgents(subcommand, positionals, flags, context2) {
       let agentsYaml;
       let teamsYaml;
       let chatYaml;
+      let xEveYaml;
       let packRefs;
       if (packResult) {
         agentsYaml = packResult.agentsYaml;
         teamsYaml = packResult.teamsYaml;
         chatYaml = packResult.chatYaml;
+        xEveYaml = packResult.xEveYaml ?? void 0;
         packRefs = packResult.packRefs;
         if (packResult.workflowsYaml) {
           await requestJson(
@@ -75180,6 +75003,7 @@ async function handleAgents(subcommand, positionals, flags, context2) {
             agents_yaml: agentsYaml,
             teams_yaml: teamsYaml,
             chat_yaml: chatYaml,
+            ...xEveYaml ? { x_eve_yaml: xEveYaml } : {},
             git_sha: gitSha,
             branch,
             git_ref: gitRef,
@@ -76587,7 +76411,8 @@ async function handleThread(subcommand, positionals, flags, context2) {
           const dir = msg.direction === "outbound" ? "\u2192" : "\u2190";
           const time = new Date(msg.created_at).toLocaleTimeString();
           const jobRef = msg.job_id ? ` [job:${msg.job_id}]` : "";
-          console.log(`  ${dir} ${time} ${actor}${jobRef}`);
+          const delivery = msg.delivery_status === "delivered" ? " \u2713 delivered" : msg.delivery_status === "failed" ? ` \u2717 ${msg.delivery_error ?? "delivery failed"}` : msg.delivery_status === "pending" ? " \u23F3 pending" : "";
+          console.log(`  ${dir} ${time} ${actor}${jobRef}${delivery}`);
           try {
             const parsed = JSON.parse(msg.body);
             if (parsed.kind && parsed.body) {
@@ -76659,7 +76484,8 @@ async function handleThread(subcommand, positionals, flags, context2) {
             const dir = msg.direction === "outbound" ? "\u2192" : "\u2190";
             const time = new Date(msg.created_at).toLocaleTimeString();
             const jobRef = msg.job_id ? ` [job:${msg.job_id}]` : "";
-            process.stdout.write(`${dir} ${time} ${actor}${jobRef}: `);
+            const delivery = msg.delivery_status === "delivered" ? " \u2713" : msg.delivery_status === "failed" ? " \u2717" : "";
+            process.stdout.write(`${dir} ${time} ${actor}${jobRef}${delivery}: `);
             try {
               const parsed = JSON.parse(msg.body);
               if (parsed.kind && parsed.body) {
@@ -76880,70 +76706,6 @@ function normalizeRemoteSource(source) {
   return source;
 }
 
-// src/commands/models.ts
-async function handleModels(subcommand, positionals, flags, context2) {
-  const json = Boolean(flags.json);
-  switch (subcommand) {
-    case "list":
-    case void 0:
-      return handleList8(context2, json);
-    default:
-      throw new Error("Usage: eve models list [--json]");
-  }
-}
-async function handleList8(context2, json) {
-  const response = await requestJson(context2, "/models");
-  if (json) {
-    outputJson(response, json);
-    return;
-  }
-  if (response.byok) {
-    console.log("BYOK (Bring Your Own Key)");
-    console.log("========================");
-    console.log(`  ${response.byok.description}`);
-    console.log("");
-  }
-  if (response.managed.length === 0) {
-    console.log("No managed models available.");
-    return;
-  }
-  console.log("Managed Models (Platform-Hosted)");
-  console.log("================================");
-  console.log("");
-  const specWidth = Math.max(10, ...response.managed.map((m) => m.model_spec.length));
-  const nameWidth = Math.max(12, ...response.managed.map((m) => m.display_name.length));
-  const providerWidth = Math.max(8, ...response.managed.map((m) => m.inference_provider.length));
-  const header = [
-    padRight9("Model Spec", specWidth),
-    padRight9("Display Name", nameWidth),
-    padRight9("Provider", providerWidth),
-    "Capabilities"
-  ].join("  ");
-  console.log(header);
-  console.log("-".repeat(header.length));
-  for (const model of response.managed) {
-    const caps = [];
-    if (model.capabilities.streaming) caps.push("stream");
-    if (model.capabilities.tool_calling) caps.push("tools");
-    if (model.capabilities.reasoning) caps.push("reason");
-    const row = [
-      padRight9(model.model_spec, specWidth),
-      padRight9(model.display_name, nameWidth),
-      padRight9(model.inference_provider, providerWidth),
-      caps.join(", ")
-    ].join("  ");
-    console.log(row);
-  }
-  console.log("");
-  console.log(`Total: ${response.managed.length} managed model(s)`);
-  console.log("");
-  console.log('Usage: Set harness_options.model to the model spec (e.g. "managed/deepseek-r1")');
-}
-function padRight9(str, width) {
-  if (str.length >= width) return str;
-  return str + " ".repeat(width - str.length);
-}
-
 // src/commands/access.ts
 var import_node_fs16 = require("node:fs");
 var import_node_path16 = require("node:path");
@@ -79694,539 +79456,6 @@ async function handleAnalytics(subcommand, _positionals, flags, context2) {
   }
 }
 
-// src/commands/ollama.ts
-function asString(flags, key) {
-  const value = flags[key];
-  return typeof value === "string" ? value : void 0;
-}
-function requireString(flags, key) {
-  const value = asString(flags, key);
-  if (!value) throw new Error(`Missing required flag --${key}`);
-  return value;
-}
-function asBoolean(flags, key) {
-  const value = asString(flags, key);
-  if (value === void 0) return void 0;
-  return value === "true" || value === "1";
-}
-function normalizeManagedModelRows(payload) {
-  return Array.isArray(payload) ? payload : payload.data;
-}
-function looksLikeGatewayPath(baseUrl) {
-  try {
-    const parsed = new URL(baseUrl);
-    const path8 = parsed.pathname.toLowerCase();
-    return path8.includes("/inference/v1") || path8.endsWith("/v1");
-  } catch {
-    return false;
-  }
-}
-function printTable(headers, rows) {
-  const widths = headers.map((header, idx) => Math.max(header.length, ...rows.map((row) => row[idx]?.length ?? 0)));
-  const line = `+${widths.map((w) => "-".repeat(w + 2)).join("+")}+`;
-  console.log(line);
-  console.log(formatRow3(headers, widths));
-  console.log(line);
-  for (const row of rows) {
-    console.log(formatRow3(row, widths));
-  }
-  console.log(line);
-}
-function formatRow3(columns, widths) {
-  const padded = columns.map((value, idx) => ` ${pad2(value, widths[idx])} `);
-  return `|${padded.join("|")}|`;
-}
-function pad2(value, width) {
-  return value.length >= width ? value : `${value}${" ".repeat(width - value.length)}`;
-}
-async function handleOllama(subcommand, positionals, flags, context2) {
-  const json = Boolean(flags.json);
-  switch (subcommand) {
-    case "targets": {
-      const scopeKind = asString(flags, "scope-kind");
-      const scopeId = asString(flags, "scope-id");
-      const query = new URLSearchParams();
-      if (scopeKind) query.set("scope_kind", scopeKind);
-      if (scopeId) query.set("scope_id", scopeId);
-      const suffix = query.toString() ? `?${query.toString()}` : "";
-      const targets = await requestJson(context2, `/inference/targets${suffix}`);
-      if (json) {
-        outputJson(targets, json);
-        return;
-      }
-      if (targets.length === 0) {
-        console.log("No inference targets found.");
-        return;
-      }
-      printTable(
-        ["ID", "Name", "Scope", "Type", "Transport", "Status", "Base URL"],
-        targets.map((item) => [
-          item.id,
-          item.name,
-          item.scope_id ? `${item.scope_kind}:${item.scope_id}` : item.scope_kind,
-          item.target_type,
-          item.transport_profile,
-          item.status,
-          item.base_url
-        ])
-      );
-      return;
-    }
-    case "target": {
-      const action = positionals[0];
-      if (action === "add") {
-        const body = {
-          scope_kind: asString(flags, "scope-kind") ?? "platform",
-          name: requireString(flags, "name"),
-          target_type: asString(flags, "target-type") ?? "external_ollama",
-          transport_profile: asString(flags, "transport-profile") ?? "ollama_api",
-          base_url: requireString(flags, "base-url")
-        };
-        const scopeId = asString(flags, "scope-id");
-        if (scopeId) body.scope_id = scopeId;
-        const apiKeyRef = asString(flags, "api-key-ref");
-        if (apiKeyRef) {
-          body.transport_metadata = {
-            api_key_ref: apiKeyRef,
-            auth_header: asString(flags, "auth-header") ?? "Authorization",
-            auth_scheme: asString(flags, "auth-scheme") ?? "Bearer"
-          };
-        }
-        const created = await requestJson(context2, "/inference/targets", {
-          method: "POST",
-          body
-        });
-        outputJson(created, json);
-        if (!json) console.log(`Created target ${created.id}`);
-        return;
-      }
-      if (action === "rm") {
-        const targetId = positionals[1];
-        if (!targetId) throw new Error("Usage: eve ollama target rm <target-id>");
-        await requestJson(context2, `/inference/targets/${targetId}`, {
-          method: "DELETE"
-        });
-        if (!json) console.log(`Deleted target ${targetId}`);
-        return;
-      }
-      if (action === "test") {
-        const targetId = positionals[1];
-        if (!targetId) throw new Error("Usage: eve ollama target test <target-id>");
-        const result = await requestJson(context2, `/inference/targets/${targetId}/test`, {
-          method: "POST"
-        });
-        outputJson(result, json);
-        if (!json) console.log("Target test completed");
-        return;
-      }
-      if (action === "wake") {
-        const targetId = positionals[1];
-        if (!targetId) throw new Error("Usage: eve ollama target wake <target-id> [--wait=true] [--timeout-ms <ms>]");
-        const query = new URLSearchParams();
-        const wait = asString(flags, "wait");
-        const timeoutMs = asString(flags, "timeout-ms");
-        if (wait === "true" || wait === "1") query.set("wait", "true");
-        if (timeoutMs) query.set("timeout_ms", timeoutMs);
-        const suffix = query.toString() ? `?${query.toString()}` : "";
-        const result = await requestJson(context2, `/inference/targets/${targetId}/wake${suffix}`, {
-          method: "POST"
-        });
-        outputJson(result, json);
-        if (!json) {
-          const nextState = result.ready ? "ready" : result.state;
-          console.log(`Wake request state: ${result.state}`);
-          console.log(`Target: ${result.target_id}`);
-          if (result.waited_ms !== void 0) {
-            console.log(`Waited: ${result.waited_ms}ms`);
-          } else {
-            console.log(`Retry after: ${result.retry_after_seconds}s`);
-          }
-          console.log(`Message: ${result.message}`);
-          if (result.ready) {
-            console.log(`Wake result: ${nextState}`);
-          }
-        }
-        return;
-      }
-      if (action === "pull") {
-        const targetId = positionals[1];
-        if (!targetId) throw new Error("Usage: eve ollama target pull <target-id> --model-id <id>");
-        const modelId = requireString(flags, "model-id");
-        const query = new URLSearchParams();
-        query.set("model_id", modelId);
-        const result = await requestJson(
-          context2,
-          `/inference/targets/${targetId}/pull?${query.toString()}`,
-          { method: "POST" }
-        );
-        outputJson(result, json);
-        if (!json) {
-          if (result.ok) {
-            console.log(`Pull complete: ${result.model} on ${result.target}`);
-          } else {
-            console.error(`Pull failed: ${result.message}`);
-            process.exitCode = 1;
-          }
-        }
-        return;
-      }
-      if (action === "models") {
-        const targetId = positionals[1];
-        if (!targetId) throw new Error("Usage: eve ollama target models <target-id>");
-        const result = await requestJson(
-          context2,
-          `/inference/targets/${targetId}/remote-models`
-        );
-        if (json) {
-          outputJson(result, json);
-          return;
-        }
-        console.log(`Models on target "${result.target}":`);
-        if (result.models.length === 0) {
-          console.log("  (none)");
-          return;
-        }
-        printTable(
-          ["Name", "Size (GB)", "Modified"],
-          result.models.map((m) => [
-            m.name,
-            (m.size / 1e9).toFixed(1),
-            m.modified_at
-          ])
-        );
-        return;
-      }
-      throw new Error(
-        "Usage: eve ollama target <add|rm|test|wake|pull|models> ...\n  wake: <target-id> [--wait true] [--timeout-ms <ms>]  Trigger GPU wake (default timeout 120s with --wait)"
-      );
-    }
-    case "models": {
-      const models = await requestJson(context2, "/inference/models");
-      if (json) {
-        outputJson(models, json);
-        return;
-      }
-      if (models.length === 0) {
-        console.log("No inference models found.");
-        return;
-      }
-      printTable(
-        ["ID", "Canonical", "Provider", "Provider Slug"],
-        models.map((item) => [item.id, item.canonical_model_id, item.provider, item.provider_model_slug])
-      );
-      return;
-    }
-    case "model": {
-      const action = positionals[0];
-      if (action !== "add") throw new Error("Usage: eve ollama model add --canonical <id> --provider <name> --slug <provider-model-slug>");
-      const created = await requestJson(context2, "/inference/models", {
-        method: "POST",
-        body: {
-          canonical_model_id: requireString(flags, "canonical"),
-          provider: requireString(flags, "provider"),
-          provider_model_slug: requireString(flags, "slug")
-        }
-      });
-      outputJson(created, json);
-      if (!json) console.log(`Model available as ${created.id}`);
-      return;
-    }
-    case "aliases": {
-      const scopeKind = asString(flags, "scope-kind");
-      const scopeId = asString(flags, "scope-id");
-      const query = new URLSearchParams();
-      if (scopeKind) query.set("scope_kind", scopeKind);
-      if (scopeId) query.set("scope_id", scopeId);
-      const suffix = query.toString() ? `?${query.toString()}` : "";
-      const aliases = await requestJson(context2, `/inference/aliases${suffix}`);
-      if (json) {
-        outputJson(aliases, json);
-        return;
-      }
-      if (aliases.length === 0) {
-        console.log("No inference aliases found.");
-        return;
-      }
-      printTable(
-        ["Alias", "Scope", "Target ID", "Model ID"],
-        aliases.map((item) => [
-          item.alias,
-          item.scope_id ? `${item.scope_kind}:${item.scope_id}` : item.scope_kind,
-          item.target_id,
-          item.model_id
-        ])
-      );
-      return;
-    }
-    case "alias": {
-      const action = positionals[0];
-      if (action === "set") {
-        const alias = requireString(flags, "alias");
-        const targetId = requireString(flags, "target-id");
-        const modelId = requireString(flags, "model-id");
-        const scopeKind = asString(flags, "scope-kind") ?? "platform";
-        const scopeId = asString(flags, "scope-id");
-        const body = {
-          alias,
-          target_id: targetId,
-          model_id: modelId,
-          scope_kind: scopeKind
-        };
-        if (scopeId) body.scope_id = scopeId;
-        const saved = await requestJson(context2, "/inference/aliases", {
-          method: "POST",
-          body
-        });
-        outputJson(saved, json);
-        if (!json) console.log(`Alias ${alias} saved`);
-        return;
-      }
-      if (action === "rm") {
-        const scopeKind = asString(flags, "scope-kind") ?? "platform";
-        const alias = requireString(flags, "alias");
-        const scopeId = asString(flags, "scope-id");
-        const query = new URLSearchParams();
-        if (scopeId) query.set("scope_id", scopeId);
-        const suffix = query.toString() ? `?${query.toString()}` : "";
-        await requestJson(context2, `/inference/aliases/${scopeKind}/${alias}${suffix}`, {
-          method: "DELETE"
-        });
-        if (!json) console.log(`Alias ${alias} deleted`);
-        return;
-      }
-      throw new Error("Usage: eve ollama alias <set|rm> ...");
-    }
-    case "installs": {
-      const targetId = asString(flags, "target-id");
-      const modelId = asString(flags, "model-id");
-      const query = new URLSearchParams();
-      if (targetId) query.set("target_id", targetId);
-      if (modelId) query.set("model_id", modelId);
-      const suffix = query.toString() ? `?${query.toString()}` : "";
-      const installs = await requestJson(context2, `/inference/installs${suffix}`);
-      if (json) {
-        outputJson(installs, json);
-        return;
-      }
-      if (installs.length === 0) {
-        console.log("No inference installs found.");
-        return;
-      }
-      printTable(
-        ["ID", "Target ID", "Model ID", "Warm Start", "Min Capacity"],
-        installs.map((item) => [
-          item.id,
-          item.target_id,
-          item.model_id,
-          item.requires_warm_start ? "yes" : "no",
-          String(item.min_target_capacity)
-        ])
-      );
-      return;
-    }
-    case "assignments": {
-      const scopeKind = asString(flags, "scope-kind");
-      const scopeId = asString(flags, "scope-id");
-      const query = new URLSearchParams();
-      if (scopeKind) query.set("scope_kind", scopeKind);
-      if (scopeId) query.set("scope_id", scopeId);
-      const suffix = query.toString() ? `?${query.toString()}` : "";
-      const assignments = await requestJson(context2, `/inference/assignments${suffix}`);
-      if (json) {
-        outputJson(assignments, json);
-        return;
-      }
-      if (assignments.length === 0) {
-        console.log("No inference assignments found.");
-        return;
-      }
-      printTable(
-        ["Target", "Scope", "Inflight", "Queue", "Max Inflight", "Status"],
-        assignments.map((item) => [
-          item.target_name,
-          item.scope_id ? `${item.scope_kind}:${item.scope_id}` : item.scope_kind,
-          String(item.inflight),
-          String(item.queue_depth),
-          String(item.max_concurrent_inflight),
-          item.status
-        ])
-      );
-      return;
-    }
-    case "route-policies": {
-      const scopeKind = asString(flags, "scope-kind");
-      const scopeId = asString(flags, "scope-id");
-      const query = new URLSearchParams();
-      if (scopeKind) query.set("scope_kind", scopeKind);
-      if (scopeId) query.set("scope_id", scopeId);
-      const suffix = query.toString() ? `?${query.toString()}` : "";
-      const policies = await requestJson(context2, `/inference/route-policies${suffix}`);
-      if (json) {
-        outputJson(policies, json);
-        return;
-      }
-      if (policies.length === 0) {
-        console.log("No inference route policies found.");
-        return;
-      }
-      printTable(
-        ["Scope", "Preferred Target", "Fallback"],
-        policies.map((item) => [
-          item.scope_id ? `${item.scope_kind}:${item.scope_id}` : item.scope_kind,
-          item.preferred_target_id,
-          item.fallback_to_alias_target ? "yes" : "no"
-        ])
-      );
-      return;
-    }
-    case "route-policy": {
-      const action = positionals[0];
-      if (action === "set") {
-        const scopeKind = asString(flags, "scope-kind") ?? "platform";
-        const scopeId = asString(flags, "scope-id");
-        const preferredTargetId = requireString(flags, "preferred-target-id");
-        const fallback = asString(flags, "fallback-to-alias-target");
-        const body = {
-          scope_kind: scopeKind,
-          preferred_target_id: preferredTargetId
-        };
-        if (scopeId) body.scope_id = scopeId;
-        if (fallback !== void 0) body.fallback_to_alias_target = fallback === "true" || fallback === "1";
-        const saved = await requestJson(context2, "/inference/route-policies", {
-          method: "POST",
-          body
-        });
-        outputJson(saved, json);
-        if (!json) console.log("Route policy saved");
-        return;
-      }
-      if (action === "rm") {
-        const scopeKind = asString(flags, "scope-kind") ?? "platform";
-        const scopeId = asString(flags, "scope-id");
-        const query = new URLSearchParams();
-        if (scopeId) query.set("scope_id", scopeId);
-        const suffix = query.toString() ? `?${query.toString()}` : "";
-        await requestJson(context2, `/inference/route-policies/${scopeKind}${suffix}`, {
-          method: "DELETE"
-        });
-        if (!json) console.log("Route policy deleted");
-        return;
-      }
-      throw new Error("Usage: eve ollama route-policy <set|rm> [options]");
-    }
-    case "install": {
-      const action = positionals[0];
-      if (action === "add") {
-        const targetId = requireString(flags, "target-id");
-        const modelId = requireString(flags, "model-id");
-        const body = {};
-        const requiresWarmStart = asString(flags, "requires-warm-start");
-        if (requiresWarmStart !== void 0) {
-          body.requires_warm_start = requiresWarmStart === "true" || requiresWarmStart === "1";
-        }
-        const minTargetCapacity = asString(flags, "min-target-capacity");
-        if (minTargetCapacity) {
-          body.min_target_capacity = Number(minTargetCapacity);
-        }
-        const saved = await requestJson(context2, `/inference/targets/${targetId}/models/${modelId}`, {
-          method: "POST",
-          body
-        });
-        outputJson(saved, json);
-        if (!json) console.log(`Installed model ${modelId} on target ${targetId}`);
-        return;
-      }
-      if (action === "rm") {
-        const targetId = requireString(flags, "target-id");
-        const modelId = requireString(flags, "model-id");
-        await requestJson(context2, `/inference/targets/${targetId}/models/${modelId}`, {
-          method: "DELETE"
-        });
-        if (!json) console.log(`Removed model ${modelId} from target ${targetId}`);
-        return;
-      }
-      throw new Error("Usage: eve ollama install <add|rm> --target-id <id> --model-id <id>");
-    }
-    case "managed": {
-      const action = positionals[0];
-      if (action === "list") {
-        const response = await requestJson(
-          context2,
-          "/inference/managed-models"
-        );
-        const managed = normalizeManagedModelRows(response);
-        outputJson(managed, json);
-        if (json) return;
-        if (managed.length === 0) {
-          console.log("No managed models published.");
-          return;
-        }
-        printTable(
-          ["Canonical", "Provider", "Slug", "Target ID", "Warm Start", "Enabled"],
-          managed.map((item) => [
-            item.canonical_model_id,
-            item.provider,
-            item.provider_model_slug,
-            item.target_id,
-            item.requires_warm_start ? "yes" : "no",
-            item.enabled ? "yes" : "no"
-          ])
-        );
-        return;
-      }
-      if (action === "publish") {
-        const body = {
-          canonical_model_id: requireString(flags, "canonical"),
-          provider: requireString(flags, "provider"),
-          provider_model_slug: requireString(flags, "slug"),
-          target_id: requireString(flags, "target-id")
-        };
-        const requiresWarmStart = asBoolean(flags, "requires-warm-start");
-        const enabled = asBoolean(flags, "enabled");
-        const targetId = body.target_id;
-        const target = await requestJson(context2, `/inference/targets/${targetId}`);
-        if (target.transport_profile === "openai_compat" && looksLikeGatewayPath(target.base_url)) {
-          console.log("warning: openai_compat target base_url appears to include /v1-like gateway path.");
-        }
-        if (requiresWarmStart !== void 0) {
-          body.requires_warm_start = requiresWarmStart;
-        }
-        if (enabled !== void 0) {
-          body.enabled = enabled;
-        }
-        const result = await requestJson(context2, "/inference/managed-models", {
-          method: "POST",
-          body
-        });
-        outputJson(result, json);
-        if (!json) {
-          console.log(
-            `Published managed model ${result.data.canonical_model_id} (install ${result.created_install ? "created" : "already present"}), target ${result.data.target_id}`
-          );
-        }
-        return;
-      }
-      if (action === "unpublish") {
-        const canonicalModelId = requireString(flags, "canonical");
-        await requestJson(context2, `/inference/managed-models/${encodeURIComponent(canonicalModelId)}`, {
-          method: "DELETE"
-        });
-        const payload = { canonical_model_id: canonicalModelId };
-        outputJson(payload, json);
-        if (!json) {
-          console.log(`Unpublished managed model ${canonicalModelId}`);
-        }
-        return;
-      }
-      throw new Error("Usage: eve ollama managed <list|publish|unpublish> ...");
-    }
-    default:
-      throw new Error(
-        "Usage: eve ollama <targets|target|models|model|aliases|alias|installs|install|assignments|route-policies|route-policy|managed>"
-      );
-  }
-}
-
 // src/commands/ingest.ts
 var import_node_fs19 = require("node:fs");
 var import_node_path19 = require("node:path");
@@ -82234,6 +81463,170 @@ async function handleUser(subcommand, positionals, flags, context2) {
   }
 }
 
+// src/commands/endpoint.ts
+async function handleEndpoint(subcommand, positionals, flags, context2) {
+  const json = Boolean(flags.json);
+  const orgId = getStringFlag(flags, ["org"]) ?? context2.orgId;
+  if (!orgId) {
+    throw new Error("Missing --org flag or profile default org.");
+  }
+  const basePath = `/orgs/${orgId}/endpoints`;
+  switch (subcommand) {
+    case "add": {
+      const name = getStringFlag(flags, ["name"]) ?? positionals[0];
+      const hostname2 = getStringFlag(flags, ["tailscale-hostname", "hostname"]);
+      const portStr = getStringFlag(flags, ["port"]);
+      const healthPath = getStringFlag(flags, ["health-path"]);
+      if (!name || !hostname2 || !portStr) {
+        throw new Error(
+          "Usage: eve endpoint add --name <name> --tailscale-hostname <fqdn> --port <port> --org <org_id> [--health-path <path>]"
+        );
+      }
+      const port = parseInt(portStr, 10);
+      if (isNaN(port) || port < 1 || port > 65535) {
+        throw new Error("--port must be a valid port number (1-65535)");
+      }
+      const body = {
+        name,
+        provider: "tailscale",
+        hostname: hostname2,
+        port
+      };
+      if (healthPath !== void 0) {
+        body.health_path = healthPath === "none" ? null : healthPath;
+      }
+      const response = await requestJson(context2, basePath, {
+        method: "POST",
+        body
+      });
+      if (json) {
+        outputJson(response, true);
+      } else {
+        const clusterUrl = response.cluster_url ?? "unknown";
+        const status = response.status ?? "unknown";
+        console.log(`\u2713 Endpoint registered: ${name}`);
+        console.log(`  Status:      ${status}`);
+        console.log(`  Cluster URL: ${clusterUrl}`);
+        console.log(`  K8s Service: ${response.k8s_svc_name}.${response.k8s_namespace}`);
+        if (status === "error" && response.status_msg) {
+          console.log(`  Error:       ${response.status_msg}`);
+        }
+        console.log("");
+        console.log(`Use this URL in your secrets:`);
+        console.log(`  eve secrets set LLM_BASE_URL "${clusterUrl}/v1" --scope org --org ${orgId}`);
+      }
+      return;
+    }
+    case "list": {
+      const response = await requestJson(context2, basePath);
+      if (json) {
+        outputJson(response, true);
+      } else {
+        const data = response.data ?? [];
+        if (data.length === 0) {
+          console.log("No private endpoints registered.");
+        } else {
+          console.log(`Private endpoints for org ${orgId}:
+`);
+          for (const ep of data) {
+            const status = ep.status === "ready" ? "\u2713" : ep.status === "error" ? "\u2717" : "\u2026";
+            console.log(`  ${status} ${ep.name}  (${ep.hostname}:${ep.port})  [${ep.status}]`);
+            console.log(`    URL: ${ep.cluster_url ?? "pending"}`);
+          }
+        }
+      }
+      return;
+    }
+    case "show": {
+      const name = positionals[0] ?? getStringFlag(flags, ["name"]);
+      if (!name) {
+        throw new Error("Usage: eve endpoint show <name> --org <org_id>");
+      }
+      const verbose = Boolean(flags.verbose);
+      const response = await requestJson(context2, `${basePath}/${name}`);
+      if (json) {
+        outputJson(response, true);
+      } else {
+        console.log(`Name:        ${response.name}`);
+        console.log(`Org:         ${orgId}`);
+        console.log(`Provider:    ${response.provider}`);
+        console.log(`Hostname:    ${response.hostname}`);
+        console.log(`Port:        ${response.port}`);
+        console.log(`Status:      ${response.status}`);
+        console.log(`Cluster DNS: ${response.k8s_dns}:${response.port}`);
+        console.log(`Cluster URL: ${response.cluster_url}`);
+        if (response.status_msg) {
+          console.log(`Status Msg:  ${response.status_msg}`);
+        }
+        if (verbose && response.health_path) {
+          console.log("");
+          console.log("Running health check...");
+          try {
+            const health = await requestJson(
+              context2,
+              `${basePath}/${name}/health`
+            );
+            const h = health.health;
+            console.log(`  Last checked: ${h.checked_at}`);
+            if (h.reachable) {
+              console.log(`  HTTP GET ${response.health_path} \u2192 ${h.http_status} OK (${h.response_time_ms}ms)`);
+            } else {
+              console.log(`  Unreachable: ${h.error}`);
+            }
+          } catch (err) {
+            console.log(`  Health check failed: ${err instanceof Error ? err.message : err}`);
+          }
+        }
+      }
+      return;
+    }
+    case "remove": {
+      const name = positionals[0] ?? getStringFlag(flags, ["name"]);
+      if (!name) {
+        throw new Error("Usage: eve endpoint remove <name> --org <org_id>");
+      }
+      await requestJson(context2, `${basePath}/${name}`, { method: "DELETE" });
+      outputJson({ ok: true }, json, `\u2713 Endpoint '${name}' removed`);
+      return;
+    }
+    case "health": {
+      const name = positionals[0] ?? getStringFlag(flags, ["name"]);
+      if (!name) {
+        throw new Error("Usage: eve endpoint health <name> --org <org_id>");
+      }
+      const response = await requestJson(context2, `${basePath}/${name}/health`);
+      outputJson(response, json);
+      return;
+    }
+    case "diagnose": {
+      const name = positionals[0] ?? getStringFlag(flags, ["name"]);
+      if (!name) {
+        throw new Error("Usage: eve endpoint diagnose <name> --org <org_id>");
+      }
+      const response = await requestJson(
+        context2,
+        `${basePath}/${name}/diagnose`
+      );
+      if (json) {
+        outputJson(response, true);
+      } else {
+        console.log(`Diagnostics for endpoint '${name}':
+`);
+        for (const check of response.checks) {
+          const icon = check.passed ? "\u2713" : "\u2717";
+          const detail = check.detail ? ` \u2014 ${check.detail}` : "";
+          console.log(`  ${icon} ${check.name}${detail}`);
+        }
+      }
+      return;
+    }
+    default:
+      throw new Error(
+        "Usage: eve endpoint <add|list|show|remove|health|diagnose>\n\n  add       Register a private endpoint backed by Tailscale\n  list      List endpoints for an org\n  show      Show endpoint details\n  remove    Remove an endpoint\n  health    Run a health check\n  diagnose  Run diagnostics on an endpoint"
+      );
+  }
+}
+
 // src/index.ts
 function getCliVersion() {
   try {
@@ -82388,9 +81781,6 @@ async function main2() {
     case "migrate":
       await handleMigrate2(subcommand, rest, flags);
       return;
-    case "models":
-      await handleModels(subcommand, rest, flags, context2);
-      return;
     case "access":
       await handleAccess(subcommand, rest, flags, context2);
       return;
@@ -82417,9 +81807,6 @@ async function main2() {
     case "analytics":
       await handleAnalytics(subcommand, rest, flags, context2);
       return;
-    case "ollama":
-      await handleOllama(subcommand, rest, flags, context2);
-      return;
     case "ingest":
       await handleIngest(subcommand, rest, flags, context2);
       return;
@@ -82438,6 +81825,9 @@ async function main2() {
     case "user":
       await handleUser(subcommand, rest, flags, context2);
       return;
+    case "endpoint":
+      await handleEndpoint(subcommand, rest, flags, context2);
+      return;
     default:
       showMainHelp();
   }