@great-arrow/cli 0.1.64 → 0.1.65

package/dist/index.js

@@ -108,7 +108,7 @@ var require_polyfills = __commonJS({
       }
       if (platform2 === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename2(from, to, cb) {
+          function rename3(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -128,8 +128,8 @@ var require_polyfills = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
-          return rename2;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename3, fs$rename);
+          return rename3;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -172,14 +172,14 @@ var require_polyfills = __commonJS({
             path10,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
-            function(err, fd) {
-              if (err) {
-                if (callback) callback(err);
+            function(err2, fd) {
+              if (err2) {
+                if (callback) callback(err2);
                 return;
               }
-              fs7.fchmod(fd, mode, function(err2) {
+              fs7.fchmod(fd, mode, function(err3) {
                 fs7.close(fd, function(err22) {
-                  if (callback) callback(err2 || err22);
+                  if (callback) callback(err3 || err22);
                 });
               });
             }
@@ -377,9 +377,9 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs6.open(this.path, this.flags, this.mode, function(err, fd) {
-          if (err) {
-            self.emit("error", err);
+        fs6.open(this.path, this.flags, this.mode, function(err2, fd) {
+          if (err2) {
+            self.emit("error", err2);
             self.readable = false;
             return;
           }
@@ -488,8 +488,8 @@ var require_graceful_fs = __commonJS({
       publishQueue(fs6, queue);
       fs6.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs6, fd, function(err) {
-            if (!err) {
+          return fs$close.call(fs6, fd, function(err2) {
+            if (!err2) {
               resetQueue();
             }
             if (typeof cb === "function")
@@ -533,15 +533,15 @@ var require_graceful_fs = __commonJS({
       fs7.createReadStream = createReadStream;
       fs7.createWriteStream = createWriteStream;
       var fs$readFile = fs7.readFile;
-      fs7.readFile = readFile7;
-      function readFile7(path10, options, cb) {
+      fs7.readFile = readFile9;
+      function readFile9(path10, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path10, options, cb);
         function go$readFile(path11, options2, cb2, startTime) {
-          return fs$readFile(path11, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path11, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$readFile(path11, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$readFile, [path11, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -550,15 +550,15 @@ var require_graceful_fs = __commonJS({
         }
       }
       var fs$writeFile = fs7.writeFile;
-      fs7.writeFile = writeFile6;
-      function writeFile6(path10, data, options, cb) {
+      fs7.writeFile = writeFile7;
+      function writeFile7(path10, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path10, data, options, cb);
         function go$writeFile(path11, data2, options2, cb2, startTime) {
-          return fs$writeFile(path11, data2, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path11, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$writeFile(path11, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$writeFile, [path11, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -574,9 +574,9 @@ var require_graceful_fs = __commonJS({
           cb = options, options = null;
         return go$appendFile(path10, data, options, cb);
         function go$appendFile(path11, data2, options2, cb2, startTime) {
-          return fs$appendFile(path11, data2, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path11, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$appendFile(path11, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$appendFile, [path11, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -594,9 +594,9 @@ var require_graceful_fs = __commonJS({
         }
         return go$copyFile(src, dest, flags, cb);
         function go$copyFile(src2, dest2, flags2, cb2, startTime) {
-          return fs$copyFile(src2, dest2, flags2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$copyFile, [src2, dest2, flags2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$copyFile(src2, dest2, flags2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$copyFile, [src2, dest2, flags2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -627,12 +627,12 @@ var require_graceful_fs = __commonJS({
         };
         return go$readdir(path10, options, cb);
         function fs$readdirCallback(path11, options2, cb2, startTime) {
-          return function(err, files) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+          return function(err2, files) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
               enqueue([
                 go$readdir,
                 [path11, options2, cb2],
-                err,
+                err2,
                 startTime || Date.now(),
                 Date.now()
               ]);
@@ -640,7 +640,7 @@ var require_graceful_fs = __commonJS({
               if (files && files.sort)
                 files.sort();
               if (typeof cb2 === "function")
-                cb2.call(this, err, files);
+                cb2.call(this, err2, files);
             }
           };
         }
@@ -710,11 +710,11 @@ var require_graceful_fs = __commonJS({
       }
       function ReadStream$open() {
         var that = this;
-        open4(that.path, that.flags, that.mode, function(err, fd) {
-          if (err) {
+        open4(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
             if (that.autoClose)
               that.destroy();
-            that.emit("error", err);
+            that.emit("error", err2);
           } else {
             that.fd = fd;
             that.emit("open", fd);
@@ -730,10 +730,10 @@ var require_graceful_fs = __commonJS({
       }
       function WriteStream$open() {
         var that = this;
-        open4(that.path, that.flags, that.mode, function(err, fd) {
-          if (err) {
+        open4(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
             that.destroy();
-            that.emit("error", err);
+            that.emit("error", err2);
           } else {
             that.fd = fd;
             that.emit("open", fd);
@@ -753,9 +753,9 @@ var require_graceful_fs = __commonJS({
           cb = mode, mode = null;
         return go$open(path10, flags, mode, cb);
         function go$open(path11, flags2, mode2, cb2, startTime) {
-          return fs$open(path11, flags2, mode2, function(err, fd) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path11, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$open(path11, flags2, mode2, function(err2, fd) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$open, [path11, flags2, mode2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -789,7 +789,7 @@ var require_graceful_fs = __commonJS({
       var elem = fs6[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
-      var err = elem[2];
+      var err2 = elem[2];
       var startTime = elem[3];
       var lastTime = elem[4];
       if (startTime === void 0) {
@@ -799,7 +799,7 @@ var require_graceful_fs = __commonJS({
         debug("TIMEOUT", fn.name, args);
         var cb = args.pop();
         if (typeof cb === "function")
-          cb.call(null, err);
+          cb.call(null, err2);
       } else {
         var sinceAttempt = Date.now() - lastTime;
         var sinceStart = Math.max(lastTime - startTime, 1);
@@ -1367,7 +1367,7 @@ var require_ini = __commonJS({
     var eol = typeof process !== "undefined" && process.platform === "win32" ? "\r\n" : "\n";
     function encode3(obj, opt) {
       var children = [];
-      var out = "";
+      var out2 = "";
       if (typeof opt === "string") {
         opt = {
           section: opt,
@@ -1382,15 +1382,15 @@ var require_ini = __commonJS({
         var val = obj[k];
         if (val && Array.isArray(val)) {
           val.forEach(function(item) {
-            out += safe(k + "[]") + separator + safe(item) + "\n";
+            out2 += safe(k + "[]") + separator + safe(item) + "\n";
           });
         } else if (val && typeof val === "object")
           children.push(k);
         else
-          out += safe(k) + separator + safe(val) + eol;
+          out2 += safe(k) + separator + safe(val) + eol;
       });
-      if (opt.section && out.length)
-        out = "[" + safe(opt.section) + "]" + eol + out;
+      if (opt.section && out2.length)
+        out2 = "[" + safe(opt.section) + "]" + eol + out2;
       children.forEach(function(k, _, __) {
         var nk = dotSplit(k).join("\\.");
         var section = (opt.section ? opt.section + "." : "") + nk;
@@ -1398,11 +1398,11 @@ var require_ini = __commonJS({
           section,
           whitespace: opt.whitespace
         });
-        if (out.length && child.length)
-          out += eol;
-        out += child;
+        if (out2.length && child.length)
+          out2 += eol;
+        out2 += child;
       });
-      return out;
+      return out2;
     }
     function dotSplit(str) {
       return str.replace(/\1/g, "LITERAL\\1LITERAL").replace(/\\\./g, "
").split(/\./).map(function(part) {
@@ -1410,8 +1410,8 @@ var require_ini = __commonJS({
       });
     }
     function decode3(str) {
-      var out = {};
-      var p = out;
+      var out2 = {};
+      var p = out2;
       var section = null;
       var re = /^\[([^\]]*)\]$|^([^=]+)(=(.*))?$/i;
       var lines = str.split(/[\r\n]+/g);
@@ -1427,7 +1427,7 @@ var require_ini = __commonJS({
             p = {};
             return;
           }
-          p = out[section] = out[section] || {};
+          p = out2[section] = out2[section] || {};
           return;
         }
         var key = unsafe(match[2]);
@@ -1454,11 +1454,11 @@ var require_ini = __commonJS({
         else
           p[key] = value;
       });
-      Object.keys(out).filter(function(k, _, __) {
-        if (!out[k] || typeof out[k] !== "object" || Array.isArray(out[k]))
+      Object.keys(out2).filter(function(k, _, __) {
+        if (!out2[k] || typeof out2[k] !== "object" || Array.isArray(out2[k]))
           return false;
         var parts = dotSplit(k);
-        var p2 = out;
+        var p2 = out2;
         var l = parts.pop();
         var nl = l.replace(/\\\./g, ".");
         parts.forEach(function(part, _2, __2) {
@@ -1468,14 +1468,14 @@ var require_ini = __commonJS({
             p2[part] = {};
           p2 = p2[part];
         });
-        if (p2 === out && nl === l)
+        if (p2 === out2 && nl === l)
           return false;
-        p2[nl] = out[k];
+        p2[nl] = out2[k];
         return true;
       }).forEach(function(del, _, __) {
-        delete out[del];
+        delete out2[del];
       });
-      return out;
+      return out2;
     }
     function isQuoted(val) {
       return val.charAt(0) === '"' && val.slice(-1) === '"' || val.charAt(0) === "'" && val.slice(-1) === "'";
@@ -1610,7 +1610,7 @@ var require_utils = __commonJS({
       var content;
       try {
         return fs6.readFileSync(file3, "utf-8");
-      } catch (err) {
+      } catch (err2) {
         return;
       }
     };
@@ -1650,7 +1650,7 @@ var require_utils = __commonJS({
         try {
           fs6.statSync(file3);
           return file3;
-        } catch (err) {
+        } catch (err2) {
           if (path10.dirname(start) !== start)
             return find2(path10.dirname(start), rel2);
         }
@@ -1968,7 +1968,7 @@ var require_minimist = __commonJS({
 var require_rc = __commonJS({
   "node_modules/.pnpm/rc@1.2.8/node_modules/rc/index.js"(exports, module) {
     var cc = require_utils();
-    var join12 = __require("path").join;
+    var join13 = __require("path").join;
     var deepExtend = require_deep_extend();
     var etc = "/etc";
     var win = process.platform === "win32";
@@ -1993,15 +1993,15 @@ var require_rc = __commonJS({
       }
       if (!win)
         [
-          join12(etc, name23, "config"),
-          join12(etc, name23 + "rc")
+          join13(etc, name23, "config"),
+          join13(etc, name23 + "rc")
         ].forEach(addConfigFile);
       if (home)
         [
-          join12(home, ".config", name23, "config"),
-          join12(home, ".config", name23),
-          join12(home, "." + name23, "config"),
-          join12(home, "." + name23 + "rc")
+          join13(home, ".config", name23, "config"),
+          join13(home, ".config", name23),
+          join13(home, "." + name23, "config"),
+          join13(home, "." + name23 + "rc")
         ].forEach(addConfigFile);
       addConfigFile(cc.find("." + name23 + "rc"));
       if (env4.config) addConfigFile(env4.config);
@@ -2082,7 +2082,7 @@ var require_polyfills2 = __commonJS({
       }
       if (platform2 === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename2(from, to, cb) {
+          function rename3(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -2102,8 +2102,8 @@ var require_polyfills2 = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename2, fs$rename);
-          return rename2;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename3, fs$rename);
+          return rename3;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -2146,14 +2146,14 @@ var require_polyfills2 = __commonJS({
             path10,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
-            function(err, fd) {
-              if (err) {
-                if (callback) callback(err);
+            function(err2, fd) {
+              if (err2) {
+                if (callback) callback(err2);
                 return;
               }
-              fs7.fchmod(fd, mode, function(err2) {
+              fs7.fchmod(fd, mode, function(err3) {
                 fs7.close(fd, function(err22) {
-                  if (callback) callback(err2 || err22);
+                  if (callback) callback(err3 || err22);
                 });
               });
             }
@@ -2351,9 +2351,9 @@ var require_legacy_streams2 = __commonJS({
           });
           return;
         }
-        fs6.open(this.path, this.flags, this.mode, function(err, fd) {
-          if (err) {
-            self.emit("error", err);
+        fs6.open(this.path, this.flags, this.mode, function(err2, fd) {
+          if (err2) {
+            self.emit("error", err2);
             self.readable = false;
             return;
           }
@@ -2462,8 +2462,8 @@ var require_graceful_fs2 = __commonJS({
       publishQueue(fs6, queue);
       fs6.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs6, fd, function(err) {
-            if (!err) {
+          return fs$close.call(fs6, fd, function(err2) {
+            if (!err2) {
               resetQueue();
             }
             if (typeof cb === "function")
@@ -2507,15 +2507,15 @@ var require_graceful_fs2 = __commonJS({
       fs7.createReadStream = createReadStream;
       fs7.createWriteStream = createWriteStream;
       var fs$readFile = fs7.readFile;
-      fs7.readFile = readFile7;
-      function readFile7(path10, options, cb) {
+      fs7.readFile = readFile9;
+      function readFile9(path10, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$readFile(path10, options, cb);
         function go$readFile(path11, options2, cb2, startTime) {
-          return fs$readFile(path11, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path11, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$readFile(path11, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$readFile, [path11, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2524,15 +2524,15 @@ var require_graceful_fs2 = __commonJS({
         }
       }
       var fs$writeFile = fs7.writeFile;
-      fs7.writeFile = writeFile6;
-      function writeFile6(path10, data, options, cb) {
+      fs7.writeFile = writeFile7;
+      function writeFile7(path10, data, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
         return go$writeFile(path10, data, options, cb);
         function go$writeFile(path11, data2, options2, cb2, startTime) {
-          return fs$writeFile(path11, data2, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path11, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$writeFile(path11, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$writeFile, [path11, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2548,9 +2548,9 @@ var require_graceful_fs2 = __commonJS({
           cb = options, options = null;
         return go$appendFile(path10, data, options, cb);
         function go$appendFile(path11, data2, options2, cb2, startTime) {
-          return fs$appendFile(path11, data2, options2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path11, data2, options2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$appendFile(path11, data2, options2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$appendFile, [path11, data2, options2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2568,9 +2568,9 @@ var require_graceful_fs2 = __commonJS({
         }
         return go$copyFile(src, dest, flags, cb);
         function go$copyFile(src2, dest2, flags2, cb2, startTime) {
-          return fs$copyFile(src2, dest2, flags2, function(err) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$copyFile, [src2, dest2, flags2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$copyFile(src2, dest2, flags2, function(err2) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$copyFile, [src2, dest2, flags2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2601,12 +2601,12 @@ var require_graceful_fs2 = __commonJS({
         };
         return go$readdir(path10, options, cb);
         function fs$readdirCallback(path11, options2, cb2, startTime) {
-          return function(err, files) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
+          return function(err2, files) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
               enqueue([
                 go$readdir,
                 [path11, options2, cb2],
-                err,
+                err2,
                 startTime || Date.now(),
                 Date.now()
               ]);
@@ -2614,7 +2614,7 @@ var require_graceful_fs2 = __commonJS({
               if (files && files.sort)
                 files.sort();
               if (typeof cb2 === "function")
-                cb2.call(this, err, files);
+                cb2.call(this, err2, files);
             }
           };
         }
@@ -2684,11 +2684,11 @@ var require_graceful_fs2 = __commonJS({
       }
       function ReadStream$open() {
         var that = this;
-        open4(that.path, that.flags, that.mode, function(err, fd) {
-          if (err) {
+        open4(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
             if (that.autoClose)
               that.destroy();
-            that.emit("error", err);
+            that.emit("error", err2);
           } else {
             that.fd = fd;
             that.emit("open", fd);
@@ -2704,10 +2704,10 @@ var require_graceful_fs2 = __commonJS({
       }
       function WriteStream$open() {
         var that = this;
-        open4(that.path, that.flags, that.mode, function(err, fd) {
-          if (err) {
+        open4(that.path, that.flags, that.mode, function(err2, fd) {
+          if (err2) {
             that.destroy();
-            that.emit("error", err);
+            that.emit("error", err2);
           } else {
             that.fd = fd;
             that.emit("open", fd);
@@ -2727,9 +2727,9 @@ var require_graceful_fs2 = __commonJS({
           cb = mode, mode = null;
         return go$open(path10, flags, mode, cb);
         function go$open(path11, flags2, mode2, cb2, startTime) {
-          return fs$open(path11, flags2, mode2, function(err, fd) {
-            if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path11, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+          return fs$open(path11, flags2, mode2, function(err2, fd) {
+            if (err2 && (err2.code === "EMFILE" || err2.code === "ENFILE"))
+              enqueue([go$open, [path11, flags2, mode2, cb2], err2, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2763,7 +2763,7 @@ var require_graceful_fs2 = __commonJS({
       var elem = fs6[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
-      var err = elem[2];
+      var err2 = elem[2];
       var startTime = elem[3];
       var lastTime = elem[4];
       if (startTime === void 0) {
@@ -2773,7 +2773,7 @@ var require_graceful_fs2 = __commonJS({
         debug("TIMEOUT", fn.name, args);
         var cb = args.pop();
         if (typeof cb === "function")
-          cb.call(null, err);
+          cb.call(null, err2);
       } else {
         var sinceAttempt = Date.now() - lastTime;
         var sinceStart = Math.max(lastTime - startTime, 1);
@@ -2808,10 +2808,10 @@ var require_ca_file = __commonJS({
         const delim = "-----END CERTIFICATE-----";
         const output2 = contents.split(delim).filter((ca) => Boolean(ca.trim())).map((ca) => `${ca.trimLeft()}${delim}`);
         return output2;
-      } catch (err) {
-        if (err.code === "ENOENT")
+      } catch (err2) {
+        if (err2.code === "ENOENT")
           return void 0;
-        throw err;
+        throw err2;
       }
     }
     exports.readCAFileSync = readCAFileSync;
@@ -2963,7 +2963,7 @@ var require_config_chain = __commonJS({
         try {
           fs6.statSync(file2);
           return file2;
-        } catch (err) {
+        } catch (err2) {
           if (path10.dirname(start) !== start)
             return find2(path10.dirname(start), rel2);
         }
@@ -3000,7 +3000,7 @@ var require_config_chain = __commonJS({
       var content;
       try {
         content = fs6.readFileSync(file2, "utf-8");
-      } catch (err) {
+      } catch (err2) {
         return;
       }
       return parse3(content, file2, "json");
@@ -3193,12 +3193,12 @@ var require_envKeyToSetting = __commonJS({
       const secondPart = x.substr(colonIndex + 1);
       return `${firstPart}:${normalize2(secondPart)}`;
     };
-    function normalize2(s) {
-      s = s.toLowerCase();
-      if (s === "_authtoken") return "_authToken";
-      let r = s[0];
-      for (let i = 1; i < s.length; i++) {
-        r += s[i] === "_" ? "-" : s[i];
+    function normalize2(s2) {
+      s2 = s2.toLowerCase();
+      if (s2 === "_authtoken") return "_authToken";
+      let r = s2[0];
+      for (let i = 1; i < s2.length; i++) {
+        r += s2[i] === "_" ? "-" : s2[i];
       }
       return r;
     }
@@ -3339,11 +3339,11 @@ var require_util = __commonJS({
           if (files.includes("node_modules") || files.includes("package.json") || files.includes("package.json5") || files.includes("package.yaml") || files.includes("pnpm-workspace.yaml")) {
             return name24;
           }
-          const dirname8 = path10.dirname(name24);
-          if (dirname8 === name24) {
+          const dirname9 = path10.dirname(name24);
+          if (dirname9 === name24) {
             return original;
           }
-          return find(dirname8, original);
+          return find(dirname9, original);
         } catch (error62) {
           if (name24 === original) {
             if (error62.code === "ENOENT") {
@@ -4032,8 +4032,8 @@ var require_clean = __commonJS({
     "use strict";
     var parse3 = require_parse();
     var clean = (version2, options) => {
-      const s = parse3(version2.trim().replace(/^[=v]+/, ""), options);
-      return s ? s.version : null;
+      const s2 = parse3(version2.trim().replace(/^[=v]+/, ""), options);
+      return s2 ? s2.version : null;
     };
     module.exports = clean;
   }
@@ -5474,22 +5474,22 @@ var require_ini2 = __commonJS({
           keys.filter((k) => obj[k] === null || Array.isArray(obj[k]) || typeof obj[k] !== "object").map((k) => Array.isArray(obj[k]) ? `${k}[]` : k).concat([""]).reduce((a, b) => safe(a).length >= safe(b).length ? a : b)
         ).length;
       }
-      let out = "";
+      let out2 = "";
       const arraySuffix = opt.bracketedArray ? "[]" : "";
       for (const k of keys) {
         const val = obj[k];
         if (val && Array.isArray(val)) {
           for (const item of val) {
-            out += safe(`${k}${arraySuffix}`).padEnd(padToChars, " ") + separator + safe(item) + eol;
+            out2 += safe(`${k}${arraySuffix}`).padEnd(padToChars, " ") + separator + safe(item) + eol;
           }
         } else if (val && typeof val === "object") {
           children.push(k);
         } else {
-          out += safe(k).padEnd(padToChars, " ") + separator + safe(val) + eol;
+          out2 += safe(k).padEnd(padToChars, " ") + separator + safe(val) + eol;
         }
       }
-      if (opt.section && out.length) {
-        out = "[" + safe(opt.section) + "]" + (opt.newline ? eol + eol : eol) + out;
+      if (opt.section && out2.length) {
+        out2 = "[" + safe(opt.section) + "]" + (opt.newline ? eol + eol : eol) + out2;
       }
       for (const k of children) {
         const nk = splitSections(k, ".").join("\\.");
@@ -5498,12 +5498,12 @@ var require_ini2 = __commonJS({
           ...opt,
           section
         });
-        if (out.length && child.length) {
-          out += eol;
+        if (out2.length && child.length) {
+          out2 += eol;
         }
-        out += child;
+        out2 += child;
       }
-      return out;
+      return out2;
     };
     function splitSections(str, separator) {
       var lastMatchIndex = 0;
@@ -5526,8 +5526,8 @@ var require_ini2 = __commonJS({
     }
     var decode3 = (str, opt = {}) => {
       opt.bracketedArray = opt.bracketedArray !== false;
-      const out = /* @__PURE__ */ Object.create(null);
-      let p = out;
+      const out2 = /* @__PURE__ */ Object.create(null);
+      let p = out2;
       let section = null;
       const re = /^\[([^\]]*)\]\s*$|^([^=]+)(=(.*))?$/i;
       const lines = str.split(/[\r\n]+/g);
@@ -5546,7 +5546,7 @@ var require_ini2 = __commonJS({
             p = /* @__PURE__ */ Object.create(null);
             continue;
           }
-          p = out[section] = out[section] || /* @__PURE__ */ Object.create(null);
+          p = out2[section] = out2[section] || /* @__PURE__ */ Object.create(null);
           continue;
         }
         const keyRaw = unsafe(match[2]);
@@ -5577,12 +5577,12 @@ var require_ini2 = __commonJS({
         }
       }
       const remove = [];
-      for (const k of Object.keys(out)) {
-        if (!hasOwnProperty.call(out, k) || typeof out[k] !== "object" || Array.isArray(out[k])) {
+      for (const k of Object.keys(out2)) {
+        if (!hasOwnProperty.call(out2, k) || typeof out2[k] !== "object" || Array.isArray(out2[k])) {
           continue;
         }
         const parts = splitSections(k, ".");
-        p = out;
+        p = out2;
         const l = parts.pop();
         const nl = l.replace(/\\\./g, ".");
         for (const part of parts) {
@@ -5594,16 +5594,16 @@ var require_ini2 = __commonJS({
           }
           p = p[part];
         }
-        if (p === out && nl === l) {
+        if (p === out2 && nl === l) {
           continue;
         }
-        p[nl] = out[k];
+        p[nl] = out2[k];
         remove.push(k);
       }
       for (const del of remove) {
-        delete out[del];
+        delete out2[del];
       }
-      return out;
+      return out2;
     };
     var isQuoted = (val) => {
       return val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'");
@@ -7475,9 +7475,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
     if (fn) {
       this._exitCallback = fn;
     } else {
-      this._exitCallback = (err) => {
-        if (err.code !== "commander.executeSubCommandAsync") {
-          throw err;
+      this._exitCallback = (err2) => {
+        if (err2.code !== "commander.executeSubCommandAsync") {
+          throw err2;
         } else {
         }
       };
@@ -7553,12 +7553,12 @@ Expecting one of '${allowedValues.join("', '")}'`);
   _callParseArg(target, value, previous, invalidArgumentMessage) {
     try {
       return target.parseArg(value, previous);
-    } catch (err) {
-      if (err.code === "commander.invalidArgument") {
-        const message = `${invalidArgumentMessage} ${err.message}`;
-        this.error(message, { exitCode: err.exitCode, code: err.code });
+    } catch (err2) {
+      if (err2.code === "commander.invalidArgument") {
+        const message = `${invalidArgumentMessage} ${err2.message}`;
+        this.error(message, { exitCode: err2.exitCode, code: err2.code });
       }
-      throw err;
+      throw err2;
     }
   }
   /**
@@ -8149,14 +8149,14 @@ Expecting one of '${allowedValues.join("', '")}'`);
         );
       }
     });
-    proc.on("error", (err) => {
-      if (err.code === "ENOENT") {
+    proc.on("error", (err2) => {
+      if (err2.code === "ENOENT") {
         this._checkForMissingExecutable(
           executableFile,
           executableDir,
           subcommand._name
         );
-      } else if (err.code === "EACCES") {
+      } else if (err2.code === "EACCES") {
         throw new Error(`'${executableFile}' not executable`);
       }
       if (!exitCallback) {
@@ -8167,7 +8167,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           "commander.executeSubCommandAsync",
           "(error)"
         );
-        wrappedError.nestedError = err;
+        wrappedError.nestedError = err2;
         exitCallback(wrappedError);
       }
     });
@@ -8794,11 +8794,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
   _excessArguments(receivedArgs) {
     if (this._allowExcessArguments) return;
     const expected = this.registeredArguments.length;
-    const s = expected === 1 ? "" : "s";
+    const s2 = expected === 1 ? "" : "s";
     const received = receivedArgs.length;
     const forSubcommand = this.parent ? ` for '${this.name()}'` : "";
     const details = receivedArgs.join(", ");
-    const message = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s} but got ${received}: ${details}.`;
+    const message = `error: too many arguments${forSubcommand}. Expected ${expected} argument${s2} but got ${received}: ${details}.`;
     this.error(message, { code: "commander.excessArguments" });
   }
   /**
@@ -9373,6 +9373,25 @@ function classifyRequestFailure(error62) {
   }
   return { kind, message, hint: FAILURE_HINTS[kind] };
 }
+var SERVER_CODE = /^[a-z][a-z0-9_]{0,63}$/;
+function withServerCode(error62, body) {
+  try {
+    const code = JSON.parse(body)?.error;
+    if (typeof code === "string" && SERVER_CODE.test(code)) {
+      Object.defineProperty(error62, "serverCode", {
+        value: code,
+        enumerable: false
+      });
+    }
+  } catch {
+    return error62;
+  }
+  return error62;
+}
+function serverCodeOf(error62) {
+  const code = error62?.serverCode;
+  return typeof code === "string" ? code : null;
+}
 function authError(message, hint) {
   return new CliError(
     message,
@@ -9418,7 +9437,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.64";
+var CLI_VERSION = "0.1.65";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9436,9 +9455,9 @@ import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 
 // src/lib/debug.ts
-function debugSwallow(scope, err) {
+function debugSwallow(scope, err2) {
   if (!process.env.GAD_DEBUG) return;
-  const detail = err instanceof Error ? err.stack ?? err.message : String(err);
+  const detail = err2 instanceof Error ? err2.stack ?? err2.message : String(err2);
   process.stderr.write(`gad: [debug] ${scope} swallowed: ${detail}
 `);
 }
@@ -9446,81 +9465,91 @@ function debugSwallow(scope, err) {
 // src/lib/keychain.ts
 var SERVICE = "GreatArrowDigital";
 var ACCOUNT = "api-token";
-function credentialFilePath() {
-  return join(homedir(), ".great-arrow", "credential");
+function slotFilePath(account) {
+  if (account === ACCOUNT) return join(homedir(), ".great-arrow", "credential");
+  return join(homedir(), ".great-arrow", "slots", encodeURIComponent(account));
 }
-async function loadEntry() {
+async function loadEntry(account) {
   try {
     const { AsyncEntry } = await import("@napi-rs/keyring");
-    return new AsyncEntry(SERVICE, ACCOUNT);
+    return new AsyncEntry(SERVICE, account);
   } catch {
     return null;
   }
 }
-async function readFileFallback() {
+async function readFileFallback(account) {
   try {
-    const raw = await readFile(credentialFilePath(), "utf-8");
+    const raw = await readFile(slotFilePath(account), "utf-8");
     const trimmed = raw.trim();
     return trimmed === "" ? null : trimmed;
   } catch {
     return null;
   }
 }
-async function getToken() {
-  const entry = await loadEntry();
+async function getSecretSlot(account) {
+  const entry = await loadEntry(account);
   if (entry) {
     try {
       const value = await entry.getPassword();
       if (value) return value;
-    } catch (err) {
-      debugSwallow("keychain.getToken", err);
+    } catch (err2) {
+      debugSwallow("keychain.getSecretSlot", err2);
     }
   }
-  return readFileFallback();
+  return readFileFallback(account);
 }
-async function setToken(token) {
-  const entry = await loadEntry();
+async function setSecretSlot(account, value) {
+  const entry = await loadEntry(account);
   if (entry) {
     try {
-      await entry.setPassword(token);
-      await removeFileFallback();
+      await entry.setPassword(value);
+      await removeFileFallback(account);
       return true;
-    } catch (err) {
-      debugSwallow("keychain.setToken", err);
+    } catch (err2) {
+      debugSwallow("keychain.setSecretSlot", err2);
     }
     try {
       await entry.deletePassword();
-    } catch (err) {
-      debugSwallow("keychain.setToken(delete stale)", err);
+    } catch (err2) {
+      debugSwallow("keychain.setSecretSlot(delete stale)", err2);
       return false;
     }
   }
   try {
-    const path10 = credentialFilePath();
+    const path10 = slotFilePath(account);
     await mkdir(dirname(path10), { recursive: true, mode: 448 });
-    await writeFile(path10, token, { mode: 384 });
+    await writeFile(path10, value, { mode: 384 });
     return true;
   } catch {
     return false;
   }
 }
-async function deleteToken() {
-  const entry = await loadEntry();
+async function deleteSecretSlot(account) {
+  const entry = await loadEntry(account);
   if (entry) {
     try {
       await entry.deletePassword();
-    } catch (err) {
-      debugSwallow("keychain.deleteToken", err);
+    } catch (err2) {
+      debugSwallow("keychain.deleteSecretSlot", err2);
     }
   }
-  await removeFileFallback();
+  await removeFileFallback(account);
+}
+function getToken() {
+  return getSecretSlot(ACCOUNT);
+}
+function setToken(token) {
+  return setSecretSlot(ACCOUNT, token);
 }
-async function removeFileFallback() {
+function deleteToken() {
+  return deleteSecretSlot(ACCOUNT);
+}
+async function removeFileFallback(account) {
   try {
-    await unlink(credentialFilePath());
-  } catch (err) {
-    if (err?.code !== "ENOENT") {
-      debugSwallow("keychain.removeFileFallback", err);
+    await unlink(slotFilePath(account));
+  } catch (err2) {
+    if (err2?.code !== "ENOENT") {
+      debugSwallow("keychain.removeFileFallback", err2);
     }
   }
 }
@@ -9585,8 +9614,8 @@ function writeCliLocator(home = homedir2(), entry = process.argv[1]) {
     let resolved = entry;
     try {
       resolved = realpathSync(entry);
-    } catch (err) {
-      debugSwallow("cli-locator.realpath", err);
+    } catch (err2) {
+      debugSwallow("cli-locator.realpath", err2);
     }
     mkdirSync(dir, { recursive: true });
     writeFileSync(
@@ -9600,8 +9629,8 @@ function writeCliLocator(home = homedir2(), entry = process.argv[1]) {
     );
     chmodSync(tmp, 384);
     renameSync(tmp, target);
-  } catch (err) {
-    debugSwallow("cli-locator.write", err);
+  } catch (err2) {
+    debugSwallow("cli-locator.write", err2);
     try {
       rmSync(tmp, { force: true });
     } catch (cleanupErr) {
@@ -9699,8 +9728,8 @@ async function loadConfig() {
     const content = await readFile2(configPath, "utf-8");
     const parsed = parseConfig(content);
     return { ...DEFAULTS, ...stripEmpty(parsed) };
-  } catch (err) {
-    if (isNodeError2(err) && err.code === "ENOENT") {
+  } catch (err2) {
+    if (isNodeError2(err2) && err2.code === "ENOENT") {
       return { ...DEFAULTS };
     }
     return { ...DEFAULTS };
@@ -9737,8 +9766,8 @@ function stripEmpty(config2) {
     result.telemetry_enabled = config2.telemetry_enabled;
   return result;
 }
-function isNodeError2(err) {
-  return err instanceof Error && "code" in err;
+function isNodeError2(err2) {
+  return err2 instanceof Error && "code" in err2;
 }
 
 // src/lib/oauth/pkce.ts
@@ -9770,8 +9799,8 @@ var DEFAULT_CALLBACK_PORT = 51789;
 var CALLBACK_PATH = "/callback";
 var LOOPBACK_HOST = "127.0.0.1";
 var DEFAULT_TIMEOUT_MS = 12e4;
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+function escapeHtml(s2) {
+  return s2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 var CLOSE_TAB_HTML = (ok, detail) => `<!doctype html>
 <html><head><meta charset="utf-8"><title>Great Arrow CLI</title>
@@ -9782,12 +9811,12 @@ h1{font-size:1.25rem;margin:0 0 .5rem}p{color:#9a9aa3;margin:0}</style></head>
 <body><div class="card"><h1>${ok ? "\u2713 Signed in to Great Arrow" : "\u2717 Sign-in failed"}</h1>
 <p>${escapeHtml(detail)}</p></div></body></html>`;
 function listen(port) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const server = createServer();
     server.on("error", reject);
     server.listen(port, LOOPBACK_HOST, () => {
       const addr = server.address();
-      resolve4({ server, port: addr.port });
+      resolve5({ server, port: addr.port });
     });
   });
 }
@@ -9812,7 +9841,7 @@ async function startLoopbackServer(opts) {
     port,
     close: () => server.close(),
     waitForCallback({ timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-      return new Promise((resolve4, reject) => {
+      return new Promise((resolve5, reject) => {
         const timer = setTimeout(() => {
           server.close();
           reject(new Error("Timed out waiting for the browser callback."));
@@ -9852,7 +9881,7 @@ async function startLoopbackServer(opts) {
               "You can close this tab and return to your terminal."
             )
           );
-          settle2(() => resolve4({ code, state }));
+          settle2(() => resolve5({ code, state }));
         });
       });
     }
@@ -10137,16 +10166,16 @@ async function confirm(message) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
       const normalized = answer.trim().toLowerCase();
-      resolve4(normalized === "y" || normalized === "yes");
+      resolve5(normalized === "y" || normalized === "yes");
     });
   });
 }
-function stripControlChars(s) {
-  return String(s).replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
+function stripControlChars(s2) {
+  return String(s2).replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
 }
 
 // src/lib/formatter.ts
@@ -10307,8 +10336,8 @@ function createFormatter(options) {
 var DEFAULT_API_URL = "https://www.greatarrow.ai";
 function isLegacyApiUrl(value) {
   try {
-    const hostname5 = new URL(value).hostname.toLowerCase();
-    return hostname5 === "www.greatarrowdigital.com" || hostname5 === "greatarrowdigital.com";
+    const hostname6 = new URL(value).hostname.toLowerCase();
+    return hostname6 === "www.greatarrowdigital.com" || hostname6 === "greatarrowdigital.com";
   } catch {
     return false;
   }
@@ -10328,10 +10357,10 @@ function maskToken(token) {
 }
 function openBrowser(url2) {
   if (!/^https?:\/\//i.test(url2)) return Promise.resolve(false);
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const platform2 = process.platform;
     const [cmd, args] = platform2 === "darwin" ? ["open", [url2]] : platform2 === "win32" ? ["cmd", ["/c", "start", "", url2]] : ["xdg-open", [url2]];
-    execFile(cmd, args, (error62) => resolve4(!error62));
+    execFile(cmd, args, (error62) => resolve5(!error62));
   });
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Great Arrow Digital account").option(
@@ -10394,8 +10423,8 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       fmt.success(
         "Signed in. Your session will refresh automatically \u2014 no need to log in again."
       );
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
+    } catch (err2) {
+      const msg = err2 instanceof Error ? err2.message : String(err2);
       fmt.error(`Login failed: ${msg}`);
       fmt.info(
         `You can also run \`gad login --token <token>\` with a token from ${apiUrl}/install/cli`
@@ -10436,8 +10465,8 @@ async function acquireRefreshLock() {
   const path10 = refreshLockPath();
   try {
     await mkdir3(join4(homedir4(), ".great-arrow"), { recursive: true });
-  } catch (err) {
-    debugSwallow("refresh-lock.mkdir", err);
+  } catch (err2) {
+    debugSwallow("refresh-lock.mkdir", err2);
   }
   const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
   for (; ; ) {
@@ -10446,8 +10475,8 @@ async function acquireRefreshLock() {
       await handle.writeFile(String(process.pid));
       await handle.close();
       return true;
-    } catch (err) {
-      if (err.code !== "EEXIST") {
+    } catch (err2) {
+      if (err2.code !== "EEXIST") {
         throw networkError(
           "Could not lock session renewal.",
           "Check local credential storage and retry; your session has been kept."
@@ -10458,8 +10487,8 @@ async function acquireRefreshLock() {
     if (age > REFRESH_LOCK_STALE_MS) {
       try {
         await rm(path10, { force: true });
-      } catch (err) {
-        debugSwallow("refresh-lock.stale-rm", err);
+      } catch (err2) {
+        debugSwallow("refresh-lock.stale-rm", err2);
       }
       continue;
     }
@@ -10470,16 +10499,16 @@ async function acquireRefreshLock() {
 async function releaseRefreshLock() {
   try {
     await rm(refreshLockPath(), { force: true });
-  } catch (err) {
-    debugSwallow("refresh-lock.release", err);
+  } catch (err2) {
+    debugSwallow("refresh-lock.release", err2);
   }
 }
 async function storedPairOtherThan(ours) {
   let stored = null;
   try {
     stored = await loadStoredCredential();
-  } catch (err) {
-    debugSwallow("refresh.reread", err);
+  } catch (err2) {
+    debugSwallow("refresh.reread", err2);
   }
   if (stored?.kind !== "oauth") {
     throw authError(
@@ -10643,8 +10672,8 @@ async function doRefresh(credential) {
       );
     }
     return refreshed;
-  } catch (err) {
-    if (err instanceof RefreshRejected) {
+  } catch (err2) {
+    if (err2 instanceof RefreshRejected) {
       const theirs = await storedPairOtherThan(current);
       if (theirs) {
         if (Date.now() < theirs.accessExpiresAt) return theirs;
@@ -10656,7 +10685,7 @@ async function doRefresh(credential) {
       await clearStoredCredential();
       throw sessionExpired();
     }
-    throw err;
+    throw err2;
   } finally {
     if (held) await releaseRefreshLock();
   }
@@ -10943,14 +10972,14 @@ function luhnValid(candidate) {
 }
 var SECRET_TOKEN_RE = /\b(?:gad_[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9-]{20,}|Bearer\s+[A-Za-z0-9._~+/=-]{8,})\b/gi;
 var SENSITIVE_QUERY_VALUE_RE = /((?:^|[?&])(?:code|token|token_hash|data_step_token|passkey_proof|access_token|refresh_token|id_token|api_key|apikey|api_secret|apisecret|key|secret|client_secret|password|state|sig|signature|t)=)[^&#\s]+/gi;
-function scrubPiiFromText(s) {
-  return s.replace(EMAIL_RE, "[redacted-email]").replace(
+function scrubPiiFromText(s2) {
+  return s2.replace(EMAIL_RE, "[redacted-email]").replace(
     CREDIT_CARD_RE,
     (m) => luhnValid(m) ? "[redacted-credit-card]" : m
   ).replace(SSN_RE, "[redacted-ssn]").replace(PHONE_RE, "[redacted-phone]");
 }
-function scrubTelemetryText(s) {
-  return scrubPiiFromText(s).replace(SENSITIVE_QUERY_VALUE_RE, "$1[redacted]").replace(
+function scrubTelemetryText(s2) {
+  return scrubPiiFromText(s2).replace(SENSITIVE_QUERY_VALUE_RE, "$1[redacted]").replace(
     SECRET_TOKEN_RE,
     (match) => match.toLowerCase().startsWith("bearer ") ? "Bearer [redacted]" : "[redacted-secret]"
   );
@@ -10979,11 +11008,11 @@ function redact(value, depth = 0) {
   if (Array.isArray(value))
     return value.slice(0, 20).map((v) => redact(v, depth + 1));
   if (value && typeof value === "object") {
-    const out = {};
+    const out2 = {};
     for (const [key, v] of Object.entries(value).slice(0, 30)) {
-      out[key] = /token|secret|password|authorization|cookie|email/i.test(key) ? "[redacted]" : redact(v, depth + 1);
+      out2[key] = /token|secret|password|authorization|cookie|email/i.test(key) ? "[redacted]" : redact(v, depth + 1);
     }
-    return out;
+    return out2;
   }
   return value;
 }
@@ -11026,8 +11055,8 @@ async function captureCliEvent(input2) {
     );
     if (!response.ok)
       debugSwallow("telemetry.send", new Error(`HTTP ${response.status}`));
-  } catch (err) {
-    debugSwallow("telemetry.send", err);
+  } catch (err2) {
+    debugSwallow("telemetry.send", err2);
   }
 }
 
@@ -11043,8 +11072,8 @@ function getCommandWorkspaceTarget(options = {}) {
 }
 
 // ../local-runtime/src/abortable.ts
-function abortable(run2, signal) {
-  return new Promise((resolve4, reject) => {
+function abortable(run3, signal) {
+  return new Promise((resolve5, reject) => {
     const abort = () => {
       signal.removeEventListener("abort", abort);
       reject(signal.reason ?? new Error("Local operation stopped"));
@@ -11053,11 +11082,11 @@ function abortable(run2, signal) {
     signal.addEventListener("abort", abort, { once: true });
     Promise.resolve().then(() => {
       signal.throwIfAborted();
-      return run2();
-    }).then(resolve4, reject).finally(() => signal.removeEventListener("abort", abort));
+      return run3();
+    }).then(resolve5, reject).finally(() => signal.removeEventListener("abort", abort));
   });
 }
-async function withLocalDeadline(deadlineMs, run2, parentSignal) {
+async function withLocalDeadline(deadlineMs, run3, parentSignal) {
   if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= 0 || deadlineMs > 36e5)
     throw new Error("Invalid local operation deadline");
   const controller = new AbortController();
@@ -11067,7 +11096,7 @@ async function withLocalDeadline(deadlineMs, run2, parentSignal) {
     deadlineMs
   );
   try {
-    return await abortable(() => run2(signal), signal);
+    return await abortable(() => run3(signal), signal);
   } finally {
     clearTimeout(timer);
   }
@@ -11313,7 +11342,7 @@ function describeError(error62) {
   return String(error62);
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 var GadClient = class {
   token;
@@ -11438,16 +11467,22 @@ var GadClient = class {
     const status = response.status;
     const body = await response.text().catch(() => "");
     if (status === 403) {
-      throw new CliError(
-        "Permission denied (HTTP 403).",
-        1 /* AUTH_ERROR */,
-        "Check this connection's scopes and workspace permissions at /account/connections."
+      throw withServerCode(
+        new CliError(
+          "Permission denied (HTTP 403).",
+          1 /* AUTH_ERROR */,
+          "Check this connection's scopes and workspace permissions at /account/connections."
+        ),
+        body
       );
     }
     if (status === 401) {
-      throw authError(
-        `Authentication failed (HTTP ${status}).`,
-        "Run 'gad login' to re-authenticate, or check your GAD_TOKEN."
+      throw withServerCode(
+        authError(
+          `Authentication failed (HTTP ${status}).`,
+          "Run 'gad login' to re-authenticate, or check your GAD_TOKEN."
+        ),
+        body
       );
     }
     if (status >= 500) {
@@ -11457,10 +11492,13 @@ var GadClient = class {
       );
     }
     const message = body ? `Request failed (HTTP ${status}): ${body.slice(0, 200)}` : `Request failed (HTTP ${status}).`;
-    throw new CliError(
-      message,
-      mapErrorToExitCode(status),
-      "Check the command usage with --help."
+    throw withServerCode(
+      new CliError(
+        message,
+        mapErrorToExitCode(status),
+        "Check the command usage with --help."
+      ),
+      body
     );
   }
   /**
@@ -11685,6 +11723,38 @@ var GadClient = class {
     }
     return this.handleResponse(response);
   }
+  /**
+   * Make a DELETE request to a REST API endpoint. Like POST, it is retried
+   * only when the connection never reached the server.
+   */
+  async delete(path10) {
+    const url2 = `${this.apiUrl}${path10}`;
+    const headers = this.buildHeaders();
+    delete headers["Content-Type"];
+    let response;
+    try {
+      response = await this.fetchWithRetry(
+        url2,
+        { method: "DELETE", headers },
+        void 0,
+        "connection-only"
+      );
+    } catch (error62) {
+      if (error62 instanceof CliError) throw error62;
+      void captureCliEvent({
+        apiUrl: this.apiUrl,
+        token: this.token,
+        name: "network_error",
+        error: error62,
+        context: { method: "DELETE", path: path10 }
+      });
+      throw networkError(
+        `Network error on DELETE ${path10}.`,
+        "Check your internet connection or run 'gad doctor'."
+      );
+    }
+    return this.handleResponse(response);
+  }
 };
 
 // src/lib/global-opts.ts
@@ -11778,10 +11848,10 @@ ${tryThese.map((t) => `  \u2022 ${t}`).join("\n")}`
 
 // src/lib/stdin.ts
 function readStream(stream) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const chunks = [];
     stream.on("data", (chunk) => chunks.push(chunk));
-    stream.on("end", () => resolve4(Buffer.concat(chunks).toString("utf8")));
+    stream.on("end", () => resolve5(Buffer.concat(chunks).toString("utf8")));
     stream.on("error", reject);
   });
 }
@@ -12323,8 +12393,8 @@ function text(value) {
 }
 function formatTodoDetail(todo) {
   const assignees = Array.isArray(todo.assignees) ? todo.assignees.map((a) => `${text(a.displayName)} (${text(a.type)})`).join(", ") : "";
-  const run2 = todo.lastRun ?? null;
-  const lastRun = run2 ? `${text(run2.status)} \u2014 ${text(run2.agentName)}` : "";
+  const run3 = todo.lastRun ?? null;
+  const lastRun = run3 ? `${text(run3.status)} \u2014 ${text(run3.agentName)}` : "";
   return {
     id: text(todo.id),
     title: text(todo.title),
@@ -12460,8 +12530,8 @@ var todo_default = todoCommand;
 import { execFileSync } from "node:child_process";
 
 // src/lib/claim-preflight.ts
-function normalize(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+function normalize(s2) {
+  return s2.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 }
 function mentions(haystack, normSlug) {
   if (!haystack || !normSlug) return false;
@@ -12549,8 +12619,8 @@ var claimCommand = new Command("claim").description("Preflight + atomically clai
           todos.push(
             ...asArray(await client2.mcpCall("todo_list", { status }))
           );
-        } catch (err) {
-          debugSwallow(`claim.preflight(${status})`, err);
+        } catch (err2) {
+          debugSwallow(`claim.preflight(${status})`, err2);
         }
       }
       let activeClaims = [];
@@ -12559,8 +12629,8 @@ var claimCommand = new Command("claim").description("Preflight + atomically clai
         activeClaims = Array.isArray(
           intro?.activeClaims
         ) ? intro.activeClaims : [];
-      } catch (err) {
-        debugSwallow("claim.preflight(introspect)", err);
+      } catch (err2) {
+        debugSwallow("claim.preflight(introspect)", err2);
         activeClaims = [];
       }
       const conflicts = findPreflightConflicts({
@@ -12649,8 +12719,8 @@ function run(command, args, cwd) {
       timeout: LOCAL_COMMAND_TIMEOUT_MS
     });
     return { status: 0, stdout, stderr: "", timedOut: false };
-  } catch (err) {
-    const e = err;
+  } catch (err2) {
+    const e = err2;
     return {
       status: e.status ?? 1,
       stdout: e.stdout ?? "",
@@ -12665,7 +12735,7 @@ function git(args, cwd) {
 var WORKTREE_STATUS_CONCURRENCY = 8;
 var WORKTREE_STATUS_TIMEOUT_MS = 2e3;
 function gitAsync(args, cwd) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     execFile2(
       "git",
       args,
@@ -12676,7 +12746,7 @@ function gitAsync(args, cwd) {
         timeout: WORKTREE_STATUS_TIMEOUT_MS
       },
       (error62, stdout, stderr) => {
-        resolve4({
+        resolve5({
           status: error62 ? 1 : 0,
           stdout: stdout ?? "",
           stderr: stderr ?? "",
@@ -13181,12 +13251,12 @@ import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { basename, dirname as dirname3, isAbsolute, join as join5, resolve } from "node:path";
 var realExec = (cmd, args, opts) => {
-  const out = execFileSync3(cmd, args, {
+  const out2 = execFileSync3(cmd, args, {
     cwd: opts?.cwd,
     encoding: "utf8",
     stdio: opts?.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
   });
-  return typeof out === "string" ? out : "";
+  return typeof out2 === "string" ? out2 : "";
 };
 function assertCleanTree(statusPorcelain) {
   if (statusPorcelain.trim().length === 0) return;
@@ -14478,19 +14548,19 @@ function collectConfiguredHooks(scope, file2, content) {
   }
   const hooks = asObject(asObject(parsed)?.hooks ?? null);
   if (!hooks) return [];
-  const out = [];
+  const out2 = [];
   for (const [event, groups] of Object.entries(hooks)) {
     if (!Array.isArray(groups)) continue;
     for (const group of groups) {
       if (!group || !Array.isArray(group.hooks)) continue;
       for (const hook of group.hooks) {
         if (hook && typeof hook.command === "string" && hook.command.trim()) {
-          out.push({ scope, file: file2, event, command: hook.command });
+          out2.push({ scope, file: file2, event, command: hook.command });
         }
       }
     }
   }
-  return out;
+  return out2;
 }
 function nodeScriptTarget(command) {
   const m = command.match(/\bnode\s+(?:"([^"]+)"|'([^']+)'|(\S+))/);
@@ -14785,11 +14855,11 @@ async function ensureHookCredential(opts) {
           status: verified ? "pass" : "fail",
           message: verified ? "Rewritten token authenticates" : `Rewritten token still failing (HTTP ${status})`
         });
-      } catch (err) {
+      } catch (err2) {
         checks.push({
           name: "Hook credential: after repair",
           status: "warn",
-          message: `Rewrote the token but could not re-probe it (${err instanceof Error ? err.message : String(err)})`,
+          message: `Rewrote the token but could not re-probe it (${err2 instanceof Error ? err2.message : String(err2)})`,
           hint: "Re-run `gad doctor` once the network is reachable to confirm."
         });
       }
@@ -16335,9 +16405,9 @@ async function resolveBridgeAuth(options = {}) {
       apiUrl: (apiUrlOverride || stored.apiUrl).replace(/\/$/, ""),
       source: "stored"
     };
-  } catch (err) {
-    if (err instanceof CliError && err.code === 1 /* AUTH_ERROR */ && /expired/i.test(err.message)) {
-      throw err;
+  } catch (err2) {
+    if (err2 instanceof CliError && err2.code === 1 /* AUTH_ERROR */ && /expired/i.test(err2.message)) {
+      throw err2;
     }
     throw missingTokenError();
   }
@@ -16429,9 +16499,9 @@ async function forwardLine(line, config2) {
       return rpcError(id, -32603, "Upstream MCP endpoint returned non-JSON");
     }
     return text3.trim();
-  } catch (err) {
+  } catch (err2) {
     if (isNotification) return null;
-    const message = err instanceof Error ? err.message : String(err);
+    const message = err2 instanceof Error ? err2.message : String(err2);
     return rpcError(
       id,
       -32603,
@@ -16472,8 +16542,8 @@ async function runStdioBridge(options) {
       if (response) writeLine(response);
     });
   });
-  await new Promise((resolve4) => {
-    rl.on("close", () => resolve4());
+  await new Promise((resolve5) => {
+    rl.on("close", () => resolve5());
   });
 }
 
@@ -16506,7 +16576,7 @@ async function enableSuggestTools(home, deps = {}) {
   return { verified: credential.verified };
 }
 async function applySuggestToolsChoice(choice2, home = homedir6(), deps = {}) {
-  const out = deps.out ?? createFormatter({
+  const out2 = deps.out ?? createFormatter({
     json: false,
     quiet: false,
     isTTY: isTTY(),
@@ -16516,7 +16586,7 @@ async function applySuggestToolsChoice(choice2, home = homedir6(), deps = {}) {
   const outcome = await runSuggestHookOptIn({
     choice: choice2,
     interactive: deps.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY),
-    print: (line) => out.info(line),
+    print: (line) => out2.info(line),
     confirm: deps.confirm ?? confirm,
     enable: async () => {
       verified = (await enableSuggestTools(home, deps)).verified;
@@ -16525,10 +16595,10 @@ async function applySuggestToolsChoice(choice2, home = homedir6(), deps = {}) {
   });
   const { settingsPath } = suggestHookPaths(home);
   if (outcome === "enabled") {
-    out.success(`Tool suggestions ON (registered in ${settingsPath}).`);
-    if (!verified) out.warn(HOOK_CREDENTIAL_FIX_LINE);
+    out2.success(`Tool suggestions ON (registered in ${settingsPath}).`);
+    if (!verified) out2.warn(HOOK_CREDENTIAL_FIX_LINE);
   } else if (outcome === "disabled") {
-    out.success("Tool suggestions OFF (our hook entry removed).");
+    out2.success("Tool suggestions OFF (our hook entry removed).");
   }
   return outcome;
 }
@@ -16596,12 +16666,12 @@ var CLIENT_IDS = {
 };
 async function mcpJsonAtRiskOfCommit(dir) {
   try {
-    const { execFile: execFile4 } = await import("node:child_process");
+    const { execFile: execFile5 } = await import("node:child_process");
     const { promisify: promisify2 } = await import("node:util");
-    const run2 = promisify2(execFile4);
-    await run2("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
+    const run3 = promisify2(execFile5);
+    await run3("git", ["rev-parse", "--is-inside-work-tree"], { cwd: dir });
     try {
-      await run2("git", ["check-ignore", "-q", ".mcp.json"], { cwd: dir });
+      await run3("git", ["check-ignore", "-q", ".mcp.json"], { cwd: dir });
       return false;
     } catch {
       return true;
@@ -16691,33 +16761,33 @@ async function pathExists(path10) {
   }
 }
 async function installCodexConfig(apiUrl, token, repoUrl) {
-  const { homedir: homedir10 } = await import("node:os");
-  const { join: join12 } = await import("node:path");
-  const { chmod: chmod2, copyFile: copyFile3, mkdir: mkdir8, readFile: readFile7, writeFile: writeFile6 } = await import("node:fs/promises");
-  const codexDir = join12(homedir10(), ".codex");
-  const configPath = join12(codexDir, "config.toml");
-  const envPath = join12(codexDir, ".env");
+  const { homedir: homedir11 } = await import("node:os");
+  const { join: join13 } = await import("node:path");
+  const { chmod: chmod3, copyFile: copyFile3, mkdir: mkdir9, readFile: readFile9, writeFile: writeFile7 } = await import("node:fs/promises");
+  const codexDir = join13(homedir11(), ".codex");
+  const configPath = join13(codexDir, "config.toml");
+  const envPath = join13(codexDir, ".env");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  await mkdir8(codexDir, { recursive: true });
-  const existingConfig = await pathExists(configPath) ? await readFile7(configPath, "utf8") : "";
+  await mkdir9(codexDir, { recursive: true });
+  const existingConfig = await pathExists(configPath) ? await readFile9(configPath, "utf8") : "";
   if (existingConfig.trim()) {
     await copyFile3(configPath, `${configPath}.bak.${timestamp}`);
   }
-  await writeFile6(
+  await writeFile7(
     configPath,
     upsertCodexServerBlock(existingConfig, apiUrl, repoUrl),
     "utf8"
   );
-  const existingEnv = await pathExists(envPath) ? await readFile7(envPath, "utf8") : "";
+  const existingEnv = await pathExists(envPath) ? await readFile9(envPath, "utf8") : "";
   if (existingEnv.trim()) {
     await copyFile3(envPath, `${envPath}.bak.${timestamp}`);
   }
-  await writeFile6(
+  await writeFile7(
     envPath,
     upsertEnvValue(existingEnv, "GREAT_ARROW_TOKEN", token),
     "utf8"
   );
-  await chmod2(envPath, 384);
+  await chmod3(envPath, 384);
   return { configPath, envPath };
 }
 var startCommand = new Command("start").description(
@@ -16846,8 +16916,8 @@ async function checkDns(apiUrl, verbose, c) {
     if (verbose) process.stdout.write(`${c.green("\u2713")}
 `);
     return { check: "DNS Resolution", status: "pass", detail: url2.hostname };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "failed";
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : "failed";
     if (verbose) process.stdout.write(`${c.red("\u2717")} ${msg}
 `);
     return { check: "DNS Resolution", status: "fail", detail: msg };
@@ -16871,8 +16941,8 @@ async function checkEdgePing(apiUrl, verbose, c) {
     if (verbose) process.stdout.write(`${c.yellow("\u26A0")} ${detail}
 `);
     return { check: "Edge Ping", status: "warn", detail };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "failed";
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : "failed";
     if (verbose) process.stdout.write(`${c.red("\u2717")} ${msg}
 `);
     return { check: "Edge Ping", status: "fail", detail: msg };
@@ -16894,8 +16964,8 @@ async function checkJsonRpc(client2, verbose, c) {
     if (verbose) process.stdout.write(`${c.green("\u2713")} ${detail}
 `);
     return { check: "JSON-RPC Handshake", status: "pass", detail };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : "failed";
+  } catch (err2) {
+    const msg = err2 instanceof Error ? err2.message : "failed";
     if (verbose) process.stdout.write(`${c.red("\u2717")} ${msg}
 `);
     return { check: "JSON-RPC Handshake", status: "fail", detail: msg };
@@ -17005,15 +17075,15 @@ var installCommand = new Command("install").description("Generate MCP configurat
         process.stdout.write(configJson2 + "\n");
         return;
       }
-      const { homedir: homedir10 } = await import("node:os");
-      const { join: join13 } = await import("node:path");
-      const { mkdir: mkdir8, readFile: readFile7, writeFile: writeFile7 } = await import("node:fs/promises");
-      const geminiDir = join13(homedir10(), ".gemini");
-      const mcpPath = join13(geminiDir, "settings.json");
-      await mkdir8(geminiDir, { recursive: true });
+      const { homedir: homedir11 } = await import("node:os");
+      const { join: join14 } = await import("node:path");
+      const { mkdir: mkdir9, readFile: readFile9, writeFile: writeFile8 } = await import("node:fs/promises");
+      const geminiDir = join14(homedir11(), ".gemini");
+      const mcpPath = join14(geminiDir, "settings.json");
+      await mkdir9(geminiDir, { recursive: true });
       let existingConfig = {};
       try {
-        const content = await readFile7(mcpPath, "utf-8");
+        const content = await readFile9(mcpPath, "utf-8");
         existingConfig = JSON.parse(content);
       } catch {
         existingConfig = {};
@@ -17025,20 +17095,20 @@ var installCommand = new Command("install").description("Generate MCP configurat
           ...config3.mcpServers
         }
       };
-      await writeFile7(
+      await writeFile8(
         mcpPath,
         JSON.stringify(existingConfig, null, 2) + "\n",
         "utf-8"
       );
       fmt.success(`Wrote gemini MCP config to ${mcpPath}`);
-      const agyMcpDir = join13(
+      const agyMcpDir = join14(
         geminiDir,
         "antigravity-cli",
         "mcp",
         MCP_SERVER_NAME
       );
-      await mkdir8(agyMcpDir, { recursive: true });
-      const instructionsPath = join13(agyMcpDir, "instructions.md");
+      await mkdir9(agyMcpDir, { recursive: true });
+      const instructionsPath = join14(agyMcpDir, "instructions.md");
       const instructionsContent = `You are connected to greatarrow.ai - the user's private workspace memory + integrations brain.
 
 CRITICAL DIRECTIVE (MANDATORY STANDARD):
@@ -17054,7 +17124,7 @@ THREE-LAYER LIVE TASK TRACKING:
 - Maintain client-native harness plans, Great Arrow Kanban cards (\`todo_create\`, \`todo_update\`), and resume states.
 
 Always assume full autonomy to leverage these tools to their maximum extent.`;
-      await writeFile7(instructionsPath, instructionsContent, "utf-8");
+      await writeFile8(instructionsPath, instructionsContent, "utf-8");
       fmt.success(`Wrote gemini MCP instructions to ${instructionsPath}`);
       return;
     }
@@ -17069,10 +17139,10 @@ Always assume full autonomy to leverage these tools to their maximum extent.`;
       process.stdout.write(configJson + "\n");
       return;
     }
-    const { writeFile: writeFile6 } = await import("node:fs/promises");
-    const { join: join12 } = await import("node:path");
-    const outputPath = join12(process.cwd(), ".mcp.json");
-    await writeFile6(outputPath, configJson + "\n", { mode: 384 });
+    const { writeFile: writeFile7 } = await import("node:fs/promises");
+    const { join: join13 } = await import("node:path");
+    const outputPath = join13(process.cwd(), ".mcp.json");
+    await writeFile7(outputPath, configJson + "\n", { mode: 384 });
     fmt.success(`Wrote ${clientName} MCP config to .mcp.json`);
     if (await mcpJsonAtRiskOfCommit(process.cwd())) {
       fmt.warn(
@@ -17088,9 +17158,9 @@ var KEYCHAIN_SERVICE = "GreatArrowDigital";
 var KEYCHAIN_ACCOUNT = "api-token";
 var OAUTH_CRED_FILENAME = "oauth-credential.json";
 async function readIfExists(path10) {
-  const { readFile: readFile7 } = await import("node:fs/promises");
+  const { readFile: readFile9 } = await import("node:fs/promises");
   try {
-    return await readFile7(path10, "utf8");
+    return await readFile9(path10, "utf8");
   } catch {
     return null;
   }
@@ -17105,13 +17175,13 @@ async function readKeychainOnly() {
   }
 }
 async function resolveProxyScript(override) {
-  const { homedir: homedir10 } = await import("node:os");
-  const { join: join12 } = await import("node:path");
+  const { homedir: homedir11 } = await import("node:os");
+  const { join: join13 } = await import("node:path");
   const candidates = [
     override,
     process.env.GAD_PROXY_SCRIPT,
-    join12(homedir10(), ".great-arrow", "mcp-server.mjs"),
-    join12(process.cwd(), "scripts", "mcp-server.mjs")
+    join13(homedir11(), ".great-arrow", "mcp-server.mjs"),
+    join13(process.cwd(), "scripts", "mcp-server.mjs")
   ].filter((c) => Boolean(c));
   for (const candidate of candidates) {
     if (await pathExists(candidate)) return candidate;
@@ -17119,11 +17189,11 @@ async function resolveProxyScript(override) {
   return null;
 }
 async function runProxyDiagnostics(scriptPath) {
-  const { execFile: execFile4 } = await import("node:child_process");
+  const { execFile: execFile5 } = await import("node:child_process");
   const { promisify: promisify2 } = await import("node:util");
-  const run2 = promisify2(execFile4);
+  const run3 = promisify2(execFile5);
   try {
-    const { stdout } = await run2(
+    const { stdout } = await run3(
       process.execPath,
       [scriptPath, "--print-diagnostics"],
       { timeout: 1e4, maxBuffer: 1024 * 1024 }
@@ -17135,22 +17205,22 @@ async function runProxyDiagnostics(scriptPath) {
   }
 }
 async function findLegacyStores(cwd) {
-  const { join: join12 } = await import("node:path");
+  const { join: join13 } = await import("node:path");
   const { readdir } = await import("node:fs/promises");
   const dirs = /* @__PURE__ */ new Set([cwd]);
   try {
-    const worktreeRoot = join12(cwd, ".claude", "worktrees");
+    const worktreeRoot = join13(cwd, ".claude", "worktrees");
     for (const entry of await readdir(worktreeRoot, { withFileTypes: true })) {
-      if (entry.isDirectory()) dirs.add(join12(worktreeRoot, entry.name));
+      if (entry.isDirectory()) dirs.add(join13(worktreeRoot, entry.name));
     }
-  } catch (err) {
-    debugSwallow("mcp.findLegacyStores(worktrees)", err);
+  } catch (err2) {
+    debugSwallow("mcp.findLegacyStores(worktrees)", err2);
   }
   try {
-    const { execFile: execFile4 } = await import("node:child_process");
+    const { execFile: execFile5 } = await import("node:child_process");
     const { promisify: promisify2 } = await import("node:util");
-    const run2 = promisify2(execFile4);
-    const { stdout } = await run2("git", ["worktree", "list", "--porcelain"], {
+    const run3 = promisify2(execFile5);
+    const { stdout } = await run3("git", ["worktree", "list", "--porcelain"], {
       cwd,
       timeout: 5e3
     });
@@ -17158,23 +17228,23 @@ async function findLegacyStores(cwd) {
       if (line.startsWith("worktree "))
         dirs.add(line.slice("worktree ".length));
     }
-  } catch (err) {
-    debugSwallow("mcp.findLegacyStores(git)", err);
+  } catch (err2) {
+    debugSwallow("mcp.findLegacyStores(git)", err2);
   }
   const stores = [];
   for (const dir of dirs) {
-    const path10 = join12(dir, ".mcp", OAUTH_CRED_FILENAME);
+    const path10 = join13(dir, ".mcp", OAUTH_CRED_FILENAME);
     const raw = await readIfExists(path10);
     if (raw !== null) stores.push({ path: path10, raw });
   }
   return stores;
 }
 async function scanConnections() {
-  const { homedir: homedir10 } = await import("node:os");
-  const { join: join12 } = await import("node:path");
-  const home = homedir10();
+  const { homedir: homedir11 } = await import("node:os");
+  const { join: join13 } = await import("node:path");
+  const home = homedir11();
   const hookSettings = await readIfExists(
-    join12(home, ".claude", "settings.json")
+    join13(home, ".claude", "settings.json")
   );
   const hooksInstalled = hookSettings ? hasGreatArrowHooks(hookSettings) : false;
   const entries = [];
@@ -17207,29 +17277,29 @@ async function probeEndpoint() {
   }
 }
 async function applyMigration(plan) {
-  const { homedir: homedir10 } = await import("node:os");
-  const { join: join12 } = await import("node:path");
-  const { mkdir: mkdir8, rename: rename2, writeFile: writeFile6 } = await import("node:fs/promises");
+  const { homedir: homedir11 } = await import("node:os");
+  const { join: join13 } = await import("node:path");
+  const { mkdir: mkdir9, rename: rename3, writeFile: writeFile7 } = await import("node:fs/promises");
   const applied = [];
-  const dir = join12(homedir10(), ".great-arrow");
-  await mkdir8(dir, { recursive: true, mode: 448 });
+  const dir = join13(homedir11(), ".great-arrow");
+  await mkdir9(dir, { recursive: true, mode: 448 });
   if (plan.seedFrom) {
     const raw = await readIfExists(plan.seedFrom);
     if (raw !== null) {
-      const target = join12(dir, OAUTH_CRED_FILENAME);
+      const target = join13(dir, OAUTH_CRED_FILENAME);
       const tmp = `${target}.tmp`;
-      await writeFile6(tmp, raw, { mode: 384 });
-      await rename2(tmp, target);
+      await writeFile7(tmp, raw, { mode: 384 });
+      await rename3(tmp, target);
       applied.push(`Copied ${plan.seedFrom} \u2192 ${target}`);
     }
   }
   if (plan.syncKeychainToFile) {
     const raw = await readKeychainOnly();
     if (raw) {
-      const target = join12(dir, "credential");
+      const target = join13(dir, "credential");
       const tmp = `${target}.tmp`;
-      await writeFile6(tmp, raw, { mode: 384 });
-      await rename2(tmp, target);
+      await writeFile7(tmp, raw, { mode: 384 });
+      await rename3(tmp, target);
       applied.push(`Wrote the keychain credential to ${target}`);
     }
   }
@@ -17252,19 +17322,19 @@ var doctorSubcommand = new Command("doctor").description(
       noColor: false
     });
     const c = createColor(jsonFlag);
-    const { homedir: homedir10 } = await import("node:os");
-    const { join: join12 } = await import("node:path");
-    const home = homedir10();
+    const { homedir: homedir11 } = await import("node:os");
+    const { join: join13 } = await import("node:path");
+    const home = homedir11();
     const proxyPath = await resolveProxyScript(options.proxy);
     const diagnostics = proxyPath ? await runProxyDiagnostics(proxyPath) : null;
     const entries = await scanConnections();
     const duplicates = detectDuplicates(entries);
     const keychain = await readKeychainOnly();
     const credentialFile = await readIfExists(
-      join12(home, ".great-arrow", "credential")
+      join13(home, ".great-arrow", "credential")
     );
     const userStore = await readIfExists(
-      join12(home, ".great-arrow", OAUTH_CRED_FILENAME)
+      join13(home, ".great-arrow", OAUTH_CRED_FILENAME)
     );
     const legacyStores = await findLegacyStores(process.cwd());
     const findings = [
@@ -17404,9 +17474,9 @@ async function runSmokeTest(client2, test) {
     await client2.mcpCall(test.tool, test.args);
     const durationMs = Math.round(performance.now() - start);
     return { name: test.name, tool: test.tool, status: "pass", durationMs };
-  } catch (err) {
+  } catch (err2) {
     const durationMs = Math.round(performance.now() - start);
-    const error62 = err instanceof Error ? err.message : "Unknown error";
+    const error62 = err2 instanceof Error ? err2.message : "Unknown error";
     return {
       name: test.name,
       tool: test.tool,
@@ -17931,8 +18001,8 @@ async function maybeShowGlanceFooter(argv) {
       token: auth.token,
       keys: printed
     });
-  } catch (err) {
-    debugSwallow("glance-footer", err);
+  } catch (err2) {
+    debugSwallow("glance-footer", err2);
   }
 }
 function shouldRunGlanceFooter(argv) {
@@ -18161,6 +18231,17 @@ function normalizeGlance(raw) {
         dismissKey: r.dismissKey
       } : null;
     })(),
+    // Same rule: both counts must be counts, or the line is dropped.
+    keyRotation: (() => {
+      const raw2 = obj.keyRotation;
+      if (typeof raw2 !== "object" || raw2 === null) return null;
+      const r = raw2;
+      const count2 = (v) => typeof v === "number" && Number.isInteger(v) && v >= 0;
+      return count2(r.needsYou) && count2(r.pendingDevices) ? {
+        needsYou: r.needsYou,
+        pendingDevices: r.pendingDevices
+      } : null;
+    })(),
     ...(() => {
       const raw2 = obj.landing;
       if (typeof raw2 !== "object" || raw2 === null) return {};
@@ -18195,9 +18276,9 @@ function asNullableString(value) {
 function normalizeTodaySections(raw) {
   return raw.flatMap((section) => {
     if (typeof section !== "object" || section === null) return [];
-    const s = section;
-    if (typeof s.key !== "string" || typeof s.title !== "string") return [];
-    const rows = asArray2(s.rows).flatMap((row) => {
+    const s2 = section;
+    if (typeof s2.key !== "string" || typeof s2.title !== "string") return [];
+    const rows = asArray2(s2.rows).flatMap((row) => {
       if (typeof row !== "object" || row === null) return [];
       const r = row;
       if (typeof r.id !== "string" || typeof r.title !== "string") return [];
@@ -18212,7 +18293,7 @@ function normalizeTodaySections(raw) {
         }
       ];
     });
-    return rows.length > 0 ? [{ key: s.key, title: s.title, rows }] : [];
+    return rows.length > 0 ? [{ key: s2.key, title: s2.title, rows }] : [];
   });
 }
 function asArray2(value) {
@@ -18688,8 +18769,8 @@ function createLocalDeviceLocator(scope, directory = join10(homedir9(), ".great-
     let file2;
     try {
       file2 = await open2(path10, constants.O_RDONLY | constants.O_NOFOLLOW);
-    } catch (err) {
-      if (err.code === "ENOENT") return null;
+    } catch (err2) {
+      if (err2.code === "ENOENT") return null;
       throw new Error("Device locator could not be read");
     }
     try {
@@ -20786,10 +20867,10 @@ function defineLazyInternal(inst, key, compute) {
           Object.defineProperty(this, key, { configurable: true, writable: true, value });
         broke = broke || outer;
         return value;
-      } catch (err) {
+      } catch (err2) {
         delete this[key];
         broke = broke || outer;
-        throw err;
+        throw err2;
       }
     },
     set(value) {
@@ -22212,9 +22293,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname5) {
-  hostname5.lastIndex = 0;
-  return hostname5.test(url2.hostname);
+function urlHostnameOk(url2, hostname6) {
+  hostname6.lastIndex = 0;
+  return hostname6.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -23406,7 +23487,7 @@ function handleIntersectionResults(result, left, right) {
   const unrecKeys = /* @__PURE__ */ new Map();
   let unrecIssue;
   const keyIssues = /* @__PURE__ */ new Map();
-  const collect2 = (iss, side) => {
+  const collect3 = (iss, side) => {
     let keys;
     if (iss.code === "unrecognized_keys" && !iss.path?.length) {
       unrecIssue ?? (unrecIssue = iss);
@@ -23427,11 +23508,11 @@ function handleIntersectionResults(result, left, right) {
     return true;
   };
   for (const iss of left.issues) {
-    if (!collect2(iss, "l"))
+    if (!collect3(iss, "l"))
       result.issues.push(iss);
   }
   for (const iss of right.issues) {
-    if (!collect2(iss, "r"))
+    if (!collect3(iss, "r"))
       result.issues.push(iss);
   }
   const bothKeys = [...unrecKeys].filter(([, f]) => f.l && f.r).map(([k]) => k);
@@ -24255,7 +24336,7 @@ function partPattern(schema) {
   if (def.options) {
     const sources = def.options.map(partPattern);
     if (sources.every(Boolean))
-      return `^(${sources.map((s) => cleanRegex(s)).join("|")})$`;
+      return `^(${sources.map((s2) => cleanRegex(s2)).join("|")})$`;
   }
   return leafPattern(schema);
 }
@@ -24453,7 +24534,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve4) {
+function isRecursive(inst, stack, resolve5) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -24463,7 +24544,7 @@ function isRecursive(inst, stack, resolve4) {
   let result = NONE;
   const check2 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve4);
+      const answer = isRecursive(child, stack, resolve5);
       if (answer > result)
         result = answer;
     }
@@ -24474,7 +24555,7 @@ function isRecursive(inst, stack, resolve4) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve4) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve5) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -24538,7 +24619,7 @@ function isRecursive(inst, stack, resolve4) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve4 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -32357,9 +32438,9 @@ function compile(schema, options) {
     const clone2 = withParser(schema, parser);
     clone2._zod.bag.validator = compileValidator(schema, parser);
     return clone2;
-  } catch (err) {
+  } catch (err2) {
     if (options?.strict)
-      throw err;
+      throw err2;
     return schema;
   }
 }
@@ -32377,9 +32458,9 @@ function withParser(schema, parser) {
     if (ctx && isBackEdge(ctx, payload.value)) {
       return originalRun(payload, ctx);
     }
-    const out = parser(payload.value);
-    if (out !== INVALID) {
-      payload.value = out;
+    const out2 = parser(payload.value);
+    if (out2 !== INVALID) {
+      payload.value = out2;
       return payload;
     }
     if (ctx)
@@ -32400,9 +32481,9 @@ function installCompiledUserMethods(target, source, parser) {
   if (typeof sourceAny.safeParse === "function") {
     const originalSafeParse = sourceAny.safeParse;
     targetAny.safeParse = (data, params) => {
-      const out = parser(data);
-      if (out !== INVALID) {
-        return { success: true, data: out };
+      const out2 = parser(data);
+      if (out2 !== INVALID) {
+        return { success: true, data: out2 };
       }
       return originalSafeParse(data, params);
     };
@@ -32410,9 +32491,9 @@ function installCompiledUserMethods(target, source, parser) {
   if (typeof sourceAny.parse === "function") {
     const originalParse = sourceAny.parse;
     targetAny.parse = (data, params) => {
-      const out = parser(data);
-      if (out !== INVALID) {
-        return out;
+      const out2 = parser(data);
+      if (out2 !== INVALID) {
+        return out2;
       }
       return originalParse(data, params);
     };
@@ -32449,8 +32530,8 @@ ${code}
   try {
     const factory = new F(...constantNames, factoryCode);
     fn = factory(...constantValues);
-  } catch (err) {
-    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err.message})`);
+  } catch (err2) {
+    throw new ZodCompileUnsupportedError(`this schema (generated code failed to evaluate: ${err2.message})`);
   }
   if (options?.debug) {
     fn.code = fullCode;
@@ -32488,9 +32569,9 @@ function compileChild(doc, ctx, schema, accessor, needsValue = true) {
   const varCounter = ctx.varCounter;
   try {
     return generateCheck(doc, ctx, schema, accessor, needsValue);
-  } catch (err) {
-    if (!(err instanceof ZodCompileUnsupportedError) || !err.islandable)
-      throw err;
+  } catch (err2) {
+    if (!(err2 instanceof ZodCompileUnsupportedError) || !err2.islandable)
+      throw err2;
     doc.content.length = contentLen;
     if (ctx.constants.size > constantCount) {
       const trailing = Array.from(ctx.constants.keys()).slice(constantCount);
@@ -33173,13 +33254,13 @@ function generateObjectCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`const ${outputVar} = {};`);
     for (const k of allKeys) {
       const kx = keyExpr(k);
-      const out = propOutputs.get(k);
+      const out2 = propOutputs.get(k);
       if (dropsWhenAbsent(propShape[k])) {
-        doc.write(`if (${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
+        doc.write(`if (${kx} in ${accessor}) ${outputVar}[${kx}] = ${out2};`);
       } else if (mayOmitUndefined(propShape[k])) {
-        doc.write(`if (${out} !== undefined || ${kx} in ${accessor}) ${outputVar}[${kx}] = ${out};`);
+        doc.write(`if (${out2} !== undefined || ${kx} in ${accessor}) ${outputVar}[${kx}] = ${out2};`);
       } else {
-        doc.write(`${outputVar}[${kx}] = ${out};`);
+        doc.write(`${outputVar}[${kx}] = ${out2};`);
       }
     }
   }
@@ -34811,11 +34892,11 @@ function _catch(Class2, innerType, catchValue) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _pipe(Class2, in_, out) {
+function _pipe(Class2, in_, out2) {
   return new Class2({
     type: "pipe",
     in: in_,
-    out
+    out: out2
   });
 }
 // @__NO_SIDE_EFFECTS__
@@ -37930,11 +38011,11 @@ var ZodPipe = /* @__PURE__ */ $constructor("ZodPipe", (inst, def) => {
   inst.in = def.in;
   inst.out = def.out;
 });
-function pipe(in_, out) {
+function pipe(in_, out2) {
   return new ZodPipe({
     type: "pipe",
     in: in_,
-    out
+    out: out2
     // ...util.normalizeParams(params),
   });
 }
@@ -37942,11 +38023,11 @@ var ZodCodec = /* @__PURE__ */ $constructor("ZodCodec", (inst, def) => {
   ZodPipe.init(inst, def);
   $ZodCodec.init(inst, def);
 });
-function codec(in_, out, params) {
+function codec(in_, out2, params) {
   return new ZodCodec({
     type: "pipe",
     in: in_,
-    out,
+    out: out2,
     transform: params.decode,
     reverseTransform: params.encode
   });
@@ -38784,12 +38865,12 @@ function convertSchema(schema, ctx) {
   let baseSchema = convertBaseSchema(schema, ctx);
   const hasExplicitType = schema.type || schema.enum !== void 0 || schema.const !== void 0;
   if (schema.anyOf && Array.isArray(schema.anyOf)) {
-    const options = schema.anyOf.map((s) => convertSchema(s, ctx));
+    const options = schema.anyOf.map((s2) => convertSchema(s2, ctx));
     const anyOfUnion = z.union(options);
     baseSchema = hasExplicitType ? z.intersection(baseSchema, anyOfUnion) : anyOfUnion;
   }
   if (schema.oneOf && Array.isArray(schema.oneOf)) {
-    const options = schema.oneOf.map((s) => convertSchema(s, ctx));
+    const options = schema.oneOf.map((s2) => convertSchema(s2, ctx));
     const oneOfUnion = z.xor(options);
     baseSchema = hasExplicitType ? z.intersection(baseSchema, oneOfUnion) : oneOfUnion;
   }
@@ -38889,24 +38970,24 @@ function visit(schema, fnOrHandlers) {
     return h ? h(node2, rewritten) : node2;
   };
   const cache = /* @__PURE__ */ new Map();
-  function run2(s) {
-    const cached2 = cache.get(s);
+  function run3(s2) {
+    const cached2 = cache.get(s2);
     if (cached2 === RESOLVING) {
       return new $ZodLazy({
         type: "lazy",
-        getter: () => cache.get(s)
+        getter: () => cache.get(s2)
       });
     }
     if (cached2 !== void 0)
       return cached2;
-    cache.set(s, RESOLVING);
-    const inner = mapInner(s);
-    const mapped = fn(inner, inner !== s);
-    cache.set(s, mapped);
+    cache.set(s2, RESOLVING);
+    const inner = mapInner(s2);
+    const mapped = fn(inner, inner !== s2);
+    cache.set(s2, mapped);
     return mapped;
   }
-  function mapInner(s) {
-    const def = s._zod.def;
+  function mapInner(s2) {
+    const def = s2._zod.def;
     const kind = def.type;
     switch (kind) {
       case "object": {
@@ -38915,67 +38996,67 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newShape = {};
         for (const k of keys) {
-          const mapped = run2(oldShape[k]);
+          const mapped = run3(oldShape[k]);
           if (mapped !== oldShape[k])
             changed = true;
           newShape[k] = mapped;
         }
         let newCatchall = def.catchall;
         if (def.catchall) {
-          newCatchall = run2(def.catchall);
+          newCatchall = run3(def.catchall);
           if (newCatchall !== def.catchall)
             changed = true;
         }
-        return changed ? clone(s, { ...def, shape: newShape, catchall: newCatchall }) : s;
+        return changed ? clone(s2, { ...def, shape: newShape, catchall: newCatchall }) : s2;
       }
       case "array": {
-        const mapped = run2(def.element);
-        return mapped === def.element ? s : clone(s, { ...def, element: mapped });
+        const mapped = run3(def.element);
+        return mapped === def.element ? s2 : clone(s2, { ...def, element: mapped });
       }
       case "tuple": {
         const oldItems = def.items;
         let changed = false;
         const newItems = [];
         for (const item of oldItems) {
-          const mapped = run2(item);
+          const mapped = run3(item);
           if (mapped !== item)
             changed = true;
           newItems.push(mapped);
         }
         let newRest = def.rest;
         if (def.rest) {
-          newRest = run2(def.rest);
+          newRest = run3(def.rest);
           if (newRest !== def.rest)
             changed = true;
         }
-        return changed ? clone(s, { ...def, items: newItems, rest: newRest }) : s;
+        return changed ? clone(s2, { ...def, items: newItems, rest: newRest }) : s2;
       }
       case "record":
       case "map": {
-        const newKey = run2(def.keyType);
-        const newVal = run2(def.valueType);
-        return newKey === def.keyType && newVal === def.valueType ? s : clone(s, { ...def, keyType: newKey, valueType: newVal });
+        const newKey = run3(def.keyType);
+        const newVal = run3(def.valueType);
+        return newKey === def.keyType && newVal === def.valueType ? s2 : clone(s2, { ...def, keyType: newKey, valueType: newVal });
       }
       case "set": {
-        const newVal = run2(def.valueType);
-        return newVal === def.valueType ? s : clone(s, { ...def, valueType: newVal });
+        const newVal = run3(def.valueType);
+        return newVal === def.valueType ? s2 : clone(s2, { ...def, valueType: newVal });
       }
       case "union": {
         const oldOptions = def.options;
         let changed = false;
         const newOptions = [];
         for (const opt of oldOptions) {
-          const mapped = run2(opt);
+          const mapped = run3(opt);
           if (mapped !== opt)
             changed = true;
           newOptions.push(mapped);
         }
-        return changed ? clone(s, { ...def, options: newOptions }) : s;
+        return changed ? clone(s2, { ...def, options: newOptions }) : s2;
       }
       case "intersection": {
-        const newLeft = run2(def.left);
-        const newRight = run2(def.right);
-        return newLeft === def.left && newRight === def.right ? s : clone(s, { ...def, left: newLeft, right: newRight });
+        const newLeft = run3(def.left);
+        const newRight = run3(def.right);
+        return newLeft === def.left && newRight === def.right ? s2 : clone(s2, { ...def, left: newLeft, right: newRight });
       }
       case "optional":
       case "nullable":
@@ -38986,23 +39067,23 @@ function visit(schema, fnOrHandlers) {
       case "nonoptional":
       case "promise":
       case "success": {
-        const newInner = run2(def.innerType);
-        return newInner === def.innerType ? s : clone(s, { ...def, innerType: newInner });
+        const newInner = run3(def.innerType);
+        return newInner === def.innerType ? s2 : clone(s2, { ...def, innerType: newInner });
       }
       case "pipe": {
-        const newIn = run2(def.in);
-        const newOut = run2(def.out);
-        return newIn === def.in && newOut === def.out ? s : clone(s, { ...def, in: newIn, out: newOut });
+        const newIn = run3(def.in);
+        const newOut = run3(def.out);
+        return newIn === def.in && newOut === def.out ? s2 : clone(s2, { ...def, in: newIn, out: newOut });
       }
       case "function": {
-        const newInput = run2(def.input);
-        const newOutput = run2(def.output);
-        return newInput === def.input && newOutput === def.output ? s : clone(s, { ...def, input: newInput, output: newOutput });
+        const newInput = run3(def.input);
+        const newOutput = run3(def.output);
+        return newInput === def.input && newOutput === def.output ? s2 : clone(s2, { ...def, input: newInput, output: newOutput });
       }
       case "lazy": {
         const original = def.getter;
         const { _cachedInner, ...rest } = def;
-        return clone(s, { ...rest, getter: () => run2(original()) });
+        return clone(s2, { ...rest, getter: () => run3(original()) });
       }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
@@ -39026,24 +39107,24 @@ function visit(schema, fnOrHandlers) {
       case "file":
       case "transform":
       case "custom":
-        return s;
+        return s2;
       default: {
         kind;
-        return s;
+        return s2;
       }
     }
   }
-  return run2(schema);
+  return run3(schema);
 }
 
 // ../../node_modules/zod/v4/classic/deep-partial.js
 function deepPartial(schema) {
   return visit(schema, {
-    object: (s) => s.partial(),
+    object: (s2) => s2.partial(),
     // Every partialed option now admits `undefined`, which the constructor rejects as a duplicate.
-    union: (s) => {
-      const def = s._zod.def;
-      return def.discriminator === void 0 ? s : union(def.options);
+    union: (s2) => {
+      const def = s2._zod.def;
+      return def.discriminator === void 0 ? s2 : union(def.options);
     }
   });
 }
@@ -39063,18 +39144,18 @@ function inSide(def) {
 }
 function input(schema) {
   return visit(schema, {
-    pipe: (s) => inSide(s._zod.def),
+    pipe: (s2) => inSide(s2._zod.def),
     // A default value belongs to the output side, so a rewritten inner type leaves it stranded. `.default()` widens the declared input type with `undefined`, and `optional` is what carries that across.
-    default: (s, rewritten) => rewritten ? optional(s._zod.def.innerType) : s,
+    default: (s2, rewritten) => rewritten ? optional(s2._zod.def.innerType) : s2,
     // A catch value is output-side too, but `.catch()` leaves the declared input type alone, so the inner schema stands on its own.
-    catch: (s, rewritten) => rewritten ? s._zod.def.innerType : s
+    catch: (s2, rewritten) => rewritten ? s2._zod.def.innerType : s2
   });
 }
 function output(schema) {
   return visit(schema, {
-    pipe: (s) => outSide(s._zod.def),
+    pipe: (s2) => outSide(s2._zod.def),
     // A prefault value is fed through the schema, which makes it input-side, so a rewritten inner type leaves it stranded.
-    prefault: (s, rewritten) => rewritten ? s._zod.def.innerType : s
+    prefault: (s2, rewritten) => rewritten ? s2._zod.def.innerType : s2
   });
 }
 
@@ -39534,12 +39615,12 @@ var ParseStatus = class _ParseStatus {
   }
   static mergeArray(status, results) {
     const arrayValue = [];
-    for (const s of results) {
-      if (s.status === "aborted")
+    for (const s2 of results) {
+      if (s2.status === "aborted")
         return INVALID2;
-      if (s.status === "dirty")
+      if (s2.status === "dirty")
         status.dirty();
-      arrayValue.push(s.value);
+      arrayValue.push(s2.value);
     }
     return { status: status.value, value: arrayValue };
   }
@@ -39736,8 +39817,8 @@ var ZodType2 = class {
         } : {
           issues: ctx.common.issues
         };
-      } catch (err) {
-        if (err?.message?.toLowerCase()?.includes("encountered")) {
+      } catch (err2) {
+        if (err2?.message?.toLowerCase()?.includes("encountered")) {
           this["~standard"].async = true;
         }
         ctx.common = {
@@ -43260,34 +43341,34 @@ function validateDownloadUrl(url2) {
       message: `URL scheme must be http, https, or data, got ${parsed.protocol}`
     });
   }
-  const hostname5 = parsed.hostname.toLowerCase().replace(/\.+$/, "");
-  if (!hostname5) {
+  const hostname6 = parsed.hostname.toLowerCase().replace(/\.+$/, "");
+  if (!hostname6) {
     throw new DownloadError({
       url: url2,
       message: `URL must have a hostname`
     });
   }
-  if (hostname5 === "localhost" || hostname5.endsWith(".local") || hostname5.endsWith(".localhost") || hostname5.endsWith(".internal")) {
+  if (hostname6 === "localhost" || hostname6.endsWith(".local") || hostname6.endsWith(".localhost") || hostname6.endsWith(".internal")) {
     throw new DownloadError({
       url: url2,
-      message: `URL with hostname ${hostname5} is not allowed`
+      message: `URL with hostname ${hostname6} is not allowed`
     });
   }
-  if (hostname5.startsWith("[") && hostname5.endsWith("]")) {
-    const ipv63 = hostname5.slice(1, -1);
+  if (hostname6.startsWith("[") && hostname6.endsWith("]")) {
+    const ipv63 = hostname6.slice(1, -1);
     if (isPrivateIPv6(ipv63)) {
       throw new DownloadError({
         url: url2,
-        message: `URL with IPv6 address ${hostname5} is not allowed`
+        message: `URL with IPv6 address ${hostname6} is not allowed`
       });
     }
     return;
   }
-  if (isIPv4(hostname5)) {
-    if (isPrivateIPv4(hostname5)) {
+  if (isIPv4(hostname6)) {
+    if (isPrivateIPv4(hostname6)) {
       throw new DownloadError({
         url: url2,
-        message: `URL with IP address ${hostname5} is not allowed`
+        message: `URL with IP address ${hostname6} is not allowed`
       });
     }
   }
@@ -43295,18 +43376,18 @@ function validateDownloadUrl(url2) {
 function validateDownloadAddress({
   address,
   family,
-  hostname: hostname5
+  hostname: hostname6
 }) {
   const isUnsafe = family === 4 ? !isIPv4(address) || isPrivateIPv4(address) : family === 6 ? isPrivateIPv6(address) : true;
   if (isUnsafe) {
     throw new DownloadError({
-      url: hostname5,
-      message: `Hostname ${hostname5} resolved to disallowed IP address ${address}`
+      url: hostname6,
+      message: `Hostname ${hostname6} resolved to disallowed IP address ${address}`
     });
   }
 }
-function isIPv4(hostname5) {
-  const parts = hostname5.split(".");
+function isIPv4(hostname6) {
+  const parts = hostname6.split(".");
   if (parts.length !== 4) return false;
   return parts.every((part) => {
     const num = Number(part);
@@ -43391,8 +43472,8 @@ function isPrivateIPv6(ip) {
   return false;
 }
 function createSafeLookup(lookup) {
-  return ((hostname5, options, callback) => {
-    lookup(hostname5, { ...options, all: true }, (error62, addresses) => {
+  return ((hostname6, options, callback) => {
+    lookup(hostname6, { ...options, all: true }, (error62, addresses) => {
       if (error62) {
         callback(error62);
         return;
@@ -43400,10 +43481,10 @@ function createSafeLookup(lookup) {
       try {
         const [firstAddress] = addresses;
         if (firstAddress == null) {
-          throw new Error(`Hostname ${hostname5} did not resolve to an address`);
+          throw new Error(`Hostname ${hostname6} did not resolve to an address`);
         }
         for (const { address, family } of addresses) {
-          validateDownloadAddress({ address, family, hostname: hostname5 });
+          validateDownloadAddress({ address, family, hostname: hostname6 });
         }
         if (options.all === true) {
           callback(null, addresses);
@@ -47105,9 +47186,9 @@ function createAsyncIterableStream(source) {
        * @param err The error to throw.
        * @returns A promise that rejects with the provided error.
        */
-      async throw(err) {
+      async throw(err2) {
         await cleanup(true);
-        throw err;
+        throw err2;
       }
     };
   };
@@ -47711,9 +47792,9 @@ function platformFetch(apiUrl, transport, engineFetch) {
     if (input2 instanceof Request)
       throw new Error("Local turn transport requires an explicit request path");
     const raw = String(input2);
-    const relative = raw.startsWith("/");
+    const relative2 = raw.startsWith("/");
     const target = new URL(raw, platform2);
-    if (!relative && target.origin !== platform2.origin)
+    if (!relative2 && target.origin !== platform2.origin)
       return engineFetch(input2, init);
     if (target.origin !== platform2.origin || !target.pathname.startsWith("/api/") || target.username || target.password || target.hash)
       throw new Error("Local turn requests must use a platform API path");
@@ -47890,18 +47971,18 @@ function argumentsAsText(value) {
 function readOllamaToolCalls(message) {
   const raw = message?.tool_calls;
   if (!Array.isArray(raw)) return [];
-  const out = [];
+  const out2 = [];
   raw.forEach((entry, position) => {
     if (!entry || typeof entry !== "object") return;
     const fn = entry.function;
     if (typeof fn?.name !== "string") return;
-    out.push({
+    out2.push({
       position,
       name: fn.name,
       argumentsFragment: argumentsAsText(fn.arguments)
     });
   });
-  return out;
+  return out2;
 }
 function readOllamaLine(line) {
   let parsed;
@@ -47926,19 +48007,19 @@ function readOllamaLine(line) {
 function readOpenAiToolCalls(deltaObj) {
   const raw = deltaObj?.tool_calls;
   if (!Array.isArray(raw)) return [];
-  const out = [];
+  const out2 = [];
   raw.forEach((entry, fallbackPosition) => {
     if (!entry || typeof entry !== "object") return;
     const row = entry;
     const fn = row.function;
-    out.push({
+    out2.push({
       position: typeof row.index === "number" ? row.index : fallbackPosition,
       id: typeof row.id === "string" ? row.id : void 0,
       name: typeof fn?.name === "string" ? fn.name : void 0,
       argumentsFragment: typeof fn?.arguments === "string" ? fn.arguments : void 0
     });
   });
-  return out;
+  return out2;
 }
 function readOpenAiLine(line) {
   if (!line.startsWith("data:")) return null;
@@ -48184,11 +48265,11 @@ function origin(apiUrl) {
 function appAwareFetch(apiUrl, token, base, getToken2) {
   return async (input2, init) => {
     const target = typeof input2 === "string" ? input2 : String(input2);
-    const relative = target.startsWith("/") && !target.startsWith("//");
-    if (!relative && !target.startsWith(`${origin(apiUrl)}/`))
+    const relative2 = target.startsWith("/") && !target.startsWith("//");
+    if (!relative2 && !target.startsWith(`${origin(apiUrl)}/`))
       return base(input2, init);
     const currentToken = getToken2 ? await renewToken(getToken2) : token;
-    return base(relative ? `${origin(apiUrl)}${target}` : target, {
+    return base(relative2 ? `${origin(apiUrl)}${target}` : target, {
       ...init,
       headers: {
         ...init?.headers,
@@ -48316,10 +48397,10 @@ async function askForTheTurn(opts) {
       };
     response = received.response;
     responseText = received.text;
-  } catch (err) {
+  } catch (err2) {
     throw new LocalTurnFailed(
       "handoff",
-      opts.signal?.aborted ? "Stopped this request." : err instanceof Error && err.name === "AbortError" ? "Great Arrow did not answer in time." : cloudSessionId ? "Great Arrow\u2019s reply was interrupted." : "Could not reach Great Arrow.",
+      opts.signal?.aborted ? "Stopped this request." : err2 instanceof Error && err2.name === "AbortError" ? "Great Arrow did not answer in time." : cloudSessionId ? "Great Arrow\u2019s reply was interrupted." : "Could not reach Great Arrow.",
       false,
       cloudSessionId
     );
@@ -48509,17 +48590,17 @@ function firstString(...candidates) {
 }
 function collect(entries, read) {
   if (!Array.isArray(entries)) return [];
-  const out = [];
+  const out2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of entries) {
-    if (out.length >= MAX_LOCAL_MODELS) break;
+    if (out2.length >= MAX_LOCAL_MODELS) break;
     if (!entry || typeof entry !== "object") continue;
     const { id, label, contextLength } = read(entry);
     if (!isValidLocalModelId(id)) continue;
     if (seen.has(id)) continue;
     if (isEmbeddingOnlyModelId(id)) continue;
     seen.add(id);
-    out.push({
+    out2.push({
       id,
       label: typeof label === "string" && label.length > 0 ? label : id,
       // Never assumed. A model is only marked tool-capable once the provider
@@ -48529,7 +48610,7 @@ function collect(entries, read) {
       contextLength: positiveInt(contextLength)
     });
   }
-  return out;
+  return out2;
 }
 function normalizeOllamaTags(json3) {
   if (!json3 || typeof json3 !== "object") return [];
@@ -48634,10 +48715,10 @@ async function findInstalledModels(opts) {
   let response;
   try {
     response = await ask(doFetch, url2, { method: "GET" }, timeoutMs);
-  } catch (err) {
+  } catch (err2) {
     throw new LocalAppUnreachable(
       opts.baseUrl,
-      err instanceof Error && err.name === "AbortError" ? "It did not answer in time." : "Nothing answered there."
+      err2 instanceof Error && err2.name === "AbortError" ? "It did not answer in time." : "Nothing answered there."
     );
   }
   if (!response.ok) {
@@ -48730,15 +48811,15 @@ function checkCommand() {
     let models;
     try {
       models = await findInstalledModels({ baseUrl, provider });
-    } catch (err) {
-      if (err instanceof LocalAppUnreachable) {
+    } catch (err2) {
+      if (err2 instanceof LocalAppUnreachable) {
         throw new CliError(
-          `Could not reach ${LOCAL_PROVIDER_PRESETS[provider].label} at ${err.baseUrl}. ${err.message}`,
+          `Could not reach ${LOCAL_PROVIDER_PRESETS[provider].label} at ${err2.baseUrl}. ${err2.message}`,
           2 /* NETWORK_ERROR */,
           `Start it on this computer and try again, or point somewhere else with --url.`
         );
       }
-      throw err;
+      throw err2;
     }
     const saved = await client2.mcpCall(
       "model_local_set",
@@ -48927,15 +49008,15 @@ function askHereCommand() {
         timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
         ...g.json ? {} : { onWords: (delta) => process.stdout.write(delta) }
       });
-    } catch (err) {
-      if (err instanceof LocalTurnFailed) {
+    } catch (err2) {
+      if (err2 instanceof LocalTurnFailed) {
         throw new CliError(
-          err.message,
+          err2.message,
           2 /* NETWORK_ERROR */,
-          err.closed ? void 0 : "Your conversation may show this one as unfinished."
+          err2.closed ? void 0 : "Your conversation may show this one as unfinished."
         );
       }
-      throw err;
+      throw err2;
     } finally {
       process.off("SIGINT", stop2);
     }
@@ -49220,8 +49301,8 @@ function statusCommand3() {
     let result;
     try {
       result = await client2.mcpCall("glance", {});
-    } catch (err) {
-      if (err instanceof CliError) throw err;
+    } catch (err2) {
+      if (err2 instanceof CliError) throw err2;
       fmt.error(
         "Couldn't reach Great Arrow. Check your connection, or run 'gad doctor'."
       );
@@ -49255,7 +49336,7 @@ function renderStatus2(payload, plain, apiUrl) {
     lines.push(c.badge(` ${payload.workspace} `));
     lines.push("");
   }
-  const hasAny = payload.needsYou.length > 0 || payload.topGoal !== null || payload.integrations.length > 0 || payload.agents.length > 0 || Boolean(payload.healthTriage) || Boolean(payload.credentialRotation) || Boolean(payload.landing) || payload.warRoom !== null && payload.warRoom.priorityCount > 0;
+  const hasAny = payload.needsYou.length > 0 || payload.topGoal !== null || payload.integrations.length > 0 || payload.agents.length > 0 || Boolean(payload.healthTriage) || Boolean(payload.credentialRotation) || Boolean(payload.keyRotation) || Boolean(payload.landing) || payload.warRoom !== null && payload.warRoom.priorityCount > 0;
   if (!hasAny) {
     lines.push(
       `${c.green("\u2713")} You're all clear \u2014 nothing needs you right now.`
@@ -49329,6 +49410,17 @@ function renderStatus2(payload, plain, apiUrl) {
     if (url2) lines.push(`      ${c.dim("\u2192")} ${link("Open rotation", url2)}`);
     lines.push("");
   }
+  if (payload.keyRotation) {
+    const k = payload.keyRotation;
+    lines.push(c.bold("Key rotation"));
+    lines.push(
+      `  ${k.needsYou} need you \xB7 ${k.pendingDevices} machine updates pending`
+    );
+    const url2 = glanceItemUrl("/settings/key-rotation", apiUrl);
+    if (url2)
+      lines.push(`      ${c.dim("\u2192")} ${link("Open key rotation", url2)}`);
+    lines.push("");
+  }
   if (payload.landing) {
     lines.push(c.bold("Merge queue"));
     for (const r of payload.landing.repos) {
@@ -49385,8 +49477,8 @@ function browserLaunchCommand(url2, platform2 = process.platform) {
 function openBrowser2(url2) {
   const command = browserLaunchCommand(url2);
   if (!command) return Promise.resolve(false);
-  return new Promise((resolve4) => {
-    execFile3(command.file, command.args, (error62) => resolve4(!error62));
+  return new Promise((resolve5) => {
+    execFile3(command.file, command.args, (error62) => resolve5(!error62));
   });
 }
 function toSurfaceRow(value) {
@@ -49644,6 +49736,1166 @@ function callCommand() {
   });
 }
 
+// src/commands/keys.ts
+import { createInterface as createInterface3 } from "node:readline";
+import { Writable } from "node:stream";
+
+// src/lib/keys-apply.ts
+import { spawn } from "node:child_process";
+import {
+  chmod as chmod2,
+  mkdir as mkdir8,
+  readFile as readFile7,
+  realpath,
+  rename as rename2,
+  stat as stat2,
+  writeFile as writeFile6
+} from "node:fs/promises";
+import { homedir as homedir10 } from "node:os";
+import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute3, join as join12, relative, sep } from "node:path";
+var GH_APPLY_TIMEOUT_MS = 3e4;
+var GIT_APPLY_TIMEOUT_MS = 3e4;
+function runWithStdin(file2, args, input2, timeoutMs) {
+  return new Promise((resolve5) => {
+    let settled = false;
+    const done = (o) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve5(o);
+    };
+    let child;
+    try {
+      child = spawn(file2, args, { stdio: ["pipe", "ignore", "ignore"] });
+    } catch {
+      resolve5("not_found");
+      return;
+    }
+    const timer = setTimeout(() => {
+      child.kill("SIGKILL");
+      done("timeout");
+    }, timeoutMs);
+    child.on(
+      "error",
+      (err2) => done(
+        err2.code === "ENOENT" ? "not_found" : "failed"
+      )
+    );
+    child.on("close", (code) => done(code === 0 ? "ok" : "failed"));
+    child.stdin?.on("error", () => done("failed"));
+    child.stdin?.end(input2);
+  });
+}
+async function applyGhCli(value) {
+  const outcome = await runWithStdin(
+    "gh",
+    ["auth", "login", "--hostname", "github.com", "--with-token"],
+    value,
+    GH_APPLY_TIMEOUT_MS
+  );
+  if (outcome === "ok") return { ok: true, code: "applied" };
+  return { ok: false, code: `gh_${outcome}` };
+}
+async function applyGitCredential(value, helper) {
+  if (helper === "gh") return { ok: true, code: "via_gh" };
+  const rejected = await runWithStdin(
+    "git",
+    ["credential", "reject"],
+    "protocol=https\nhost=github.com\n\n",
+    GIT_APPLY_TIMEOUT_MS
+  );
+  if (rejected === "not_found" || rejected === "timeout") {
+    return { ok: false, code: `git_${rejected}` };
+  }
+  const approved = await runWithStdin(
+    "git",
+    ["credential", "approve"],
+    `protocol=https
+host=github.com
+username=x-access-token
+password=${value}
+
+`,
+    GIT_APPLY_TIMEOUT_MS
+  );
+  if (approved === "ok") return { ok: true, code: "applied" };
+  return { ok: false, code: `git_${approved}` };
+}
+function expandHome(path10) {
+  if (path10 === "~") return homedir10();
+  if (path10.startsWith("~/")) return join12(homedir10(), path10.slice(2));
+  return path10;
+}
+function escapeRegExp(s2) {
+  return s2.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+}
+function unquote(raw) {
+  const t = raw.trim();
+  if (t.length >= 2) {
+    const q = t[0];
+    if ((q === '"' || q === "'") && t.endsWith(q)) {
+      return { inner: t.slice(1, -1), quote: q };
+    }
+  }
+  return { inner: t, quote: "" };
+}
+function formatEnvValue(value, quote) {
+  const needsDouble = /[\n\r]/.test(value);
+  if (quote === "'" && !needsDouble && !value.includes("'")) {
+    return `'${value}'`;
+  }
+  if (quote !== "" || needsDouble || /[\s#"'`$\\]/.test(value)) {
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+    return `"${escaped}"`;
+  }
+  return value;
+}
+async function writeAtomic(path10, content, mode) {
+  const tmp = `${path10}.tmp`;
+  await writeFile6(tmp, content, { mode });
+  await chmod2(tmp, mode);
+  await rename2(tmp, path10);
+}
+async function applyEnvFile(path10, key, value) {
+  const file2 = expandHome(path10);
+  let original;
+  let mode = 384;
+  try {
+    original = await readFile7(file2, "utf8");
+    mode = (await stat2(file2)).mode & 511;
+  } catch (err2) {
+    if (err2?.code !== "ENOENT") {
+      return { ok: false, code: "env_read_failed" };
+    }
+    original = null;
+  }
+  const lineRe = new RegExp(
+    `^(\\s*(?:export\\s+)?${escapeRegExp(key)}\\s*=\\s*)(.*?)(\\r?)$`
+  );
+  const lines = original === null ? [] : original.split("\n");
+  let found = false;
+  for (const [i, line] of lines.entries()) {
+    const m = lineRe.exec(line);
+    if (!m) continue;
+    const head = m[1] ?? "";
+    const raw = m[2] ?? "";
+    const cr = m[3] ?? "";
+    const { inner, quote } = unquote(raw);
+    if (inner.startsWith("op://")) {
+      return { ok: true, code: "reference_reread" };
+    }
+    lines[i] = `${head}${formatEnvValue(value, quote)}${cr}`;
+    found = true;
+  }
+  if (!found) {
+    const entry = `${key}=${formatEnvValue(value, "")}`;
+    if (lines.length === 0) {
+      lines.push(entry, "");
+    } else if (lines[lines.length - 1] === "") {
+      lines.splice(lines.length - 1, 0, entry);
+    } else {
+      lines.push(entry);
+    }
+  }
+  try {
+    await writeAtomic(file2, lines.join("\n"), mode);
+  } catch {
+    return { ok: false, code: "env_write_failed" };
+  }
+  return { ok: true, code: "applied" };
+}
+async function applySshKey(path10, privatePem) {
+  const file2 = expandHome(path10);
+  const content = privatePem.endsWith("\n") ? privatePem : `${privatePem}
+`;
+  try {
+    await mkdir8(dirname8(file2), { recursive: true, mode: 448 });
+    await writeAtomic(file2, content, 384);
+  } catch {
+    return { ok: false, code: "ssh_write_failed" };
+  }
+  return { ok: true, code: "applied" };
+}
+function envTargetRefusal(path10, key, reported) {
+  if (!isAbsolute3(path10)) return { ok: false, code: "target_invalid" };
+  const known = reported.some((r) => r.path === path10 && r.key === key);
+  return known ? null : { ok: false, code: "target_not_reported" };
+}
+var SSH_NOT_A_KEY = /* @__PURE__ */ new Set([
+  "authorized_keys",
+  "authorized_keys2",
+  "config",
+  "known_hosts"
+]);
+async function sshTargetRefusal(path10, sshDir = join12(homedir10(), ".ssh")) {
+  const file2 = expandHome(path10);
+  if (!isAbsolute3(file2)) return { ok: false, code: "target_invalid" };
+  if (SSH_NOT_A_KEY.has(basename2(file2))) {
+    return { ok: false, code: "target_not_a_key" };
+  }
+  let root;
+  let parent;
+  try {
+    root = await realpath(sshDir);
+    parent = await realpath(dirname8(file2));
+  } catch {
+    return { ok: false, code: "target_outside_ssh_dir" };
+  }
+  const rel = relative(root, parent);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute3(rel)) {
+    return { ok: false, code: "target_outside_ssh_dir" };
+  }
+  return null;
+}
+async function applyUpdate(targetKind, targetRef, value, scope) {
+  try {
+    switch (targetKind) {
+      case "machine_gh_cli":
+        return await applyGhCli(value);
+      case "machine_git_credential":
+        return await applyGitCredential(value, targetRef.helper ?? "other");
+      case "machine_env_file": {
+        if (!targetRef.path || !targetRef.key) {
+          return { ok: false, code: "target_invalid" };
+        }
+        const refused = envTargetRefusal(
+          targetRef.path,
+          targetRef.key,
+          scope.reported
+        );
+        if (refused) return refused;
+        return await applyEnvFile(targetRef.path, targetRef.key, value);
+      }
+      case "machine_ssh_key": {
+        if (!targetRef.path) return { ok: false, code: "target_invalid" };
+        const refused = await sshTargetRefusal(targetRef.path, scope.sshDir);
+        if (refused) return refused;
+        return await applySshKey(targetRef.path, value);
+      }
+      default:
+        return { ok: false, code: "unsupported_target" };
+    }
+  } catch {
+    return { ok: false, code: "apply_error" };
+  }
+}
+
+// src/lib/keys-device.ts
+import { execFile as execFile4 } from "node:child_process";
+import { readFile as readFile8 } from "node:fs/promises";
+import { hostname as hostname5 } from "node:os";
+import { resolve as resolve4 } from "node:path";
+
+// src/lib/keys-envelope.ts
+import {
+  createDecipheriv,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync
+} from "node:crypto";
+var DEVICE_ENVELOPE_INFO = "gad:key-rotation-device:v1";
+var MAGIC = Buffer.from("kd1", "ascii");
+var KEY_LEN = 32;
+var IV_LEN = 12;
+var TAG_LEN = 16;
+var HEADER_LEN = MAGIC.length + KEY_LEN + IV_LEN + TAG_LEN;
+var SPKI_PREFIX = Buffer.from("302a300506032b656e032100", "hex");
+var PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+var EnvelopeError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+    this.name = "EnvelopeError";
+  }
+  code;
+};
+function rawKey(b64) {
+  const raw = Buffer.from(b64, "base64");
+  if (raw.length !== KEY_LEN || raw.toString("base64") !== b64) {
+    throw new EnvelopeError("device_key_invalid");
+  }
+  return raw;
+}
+function rawPublic(key) {
+  const der = key.export({ format: "der", type: "spki" });
+  return Buffer.from(der.subarray(der.length - KEY_LEN));
+}
+function rawPrivate(key) {
+  const der = key.export({ format: "der", type: "pkcs8" });
+  return Buffer.from(der.subarray(der.length - KEY_LEN));
+}
+function generateDeviceKeyPair() {
+  const pair = generateKeyPairSync("x25519");
+  return {
+    publicKey: rawPublic(pair.publicKey).toString("base64"),
+    privateKey: rawPrivate(pair.privateKey).toString("base64")
+  };
+}
+function openFromServer(sealed, devicePrivateKeyB64) {
+  if (sealed.length < HEADER_LEN || !sealed.subarray(0, MAGIC.length).equals(MAGIC)) {
+    throw new EnvelopeError("envelope_invalid");
+  }
+  const priv = createPrivateKey({
+    key: Buffer.concat([PKCS8_PREFIX, rawKey(devicePrivateKeyB64)]),
+    format: "der",
+    type: "pkcs8"
+  });
+  const devicePub = rawPublic(createPublicKey(priv));
+  let o = MAGIC.length;
+  const ephPub = Buffer.from(sealed.subarray(o, o += KEY_LEN));
+  const iv = sealed.subarray(o, o += IV_LEN);
+  const tag = sealed.subarray(o, o += TAG_LEN);
+  const ct = sealed.subarray(o);
+  let shared;
+  try {
+    shared = diffieHellman({
+      privateKey: priv,
+      publicKey: createPublicKey({
+        key: Buffer.concat([SPKI_PREFIX, ephPub]),
+        format: "der",
+        type: "spki"
+      })
+    });
+  } catch {
+    throw new EnvelopeError("envelope_invalid");
+  }
+  if (shared.every((b) => b === 0)) {
+    throw new EnvelopeError("envelope_invalid");
+  }
+  const key = Buffer.from(
+    hkdfSync(
+      "sha256",
+      shared,
+      Buffer.concat([ephPub, devicePub]),
+      Buffer.from(DEVICE_ENVELOPE_INFO, "utf8"),
+      KEY_LEN
+    )
+  );
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ct), decipher.final()]).toString(
+      "utf8"
+    );
+  } catch {
+    throw new EnvelopeError("envelope_invalid");
+  }
+}
+
+// src/lib/keys-handoff.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// src/lib/keys-paths.ts
+function keyRotationPath() {
+  return "/settings/key-rotation";
+}
+function keyRotationRunPath(runId) {
+  return `/settings/key-rotation/runs/${encodeURIComponent(runId)}`;
+}
+function keyRotationHandoffPath(jti) {
+  return `/settings/key-rotation/handoff/${encodeURIComponent(jti)}`;
+}
+
+// src/lib/keys-handoff.ts
+var HANDOFF_POLL_INTERVAL_MS = 2e3;
+var HANDOFF_DEADLINE_MS = 5 * 6e4;
+var BROWSER_LAUNCH_TIMEOUT_MS = 5e3;
+function openInBrowser(url2) {
+  const command = browserLaunchCommand(url2);
+  if (!command) return Promise.resolve(false);
+  return new Promise((resolve5) => {
+    let settled = false;
+    const done = (ok) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve5(ok);
+    };
+    const timer = setTimeout(() => done(false), BROWSER_LAUNCH_TIMEOUT_MS);
+    timer.unref?.();
+    try {
+      const child = spawn2(command.file, command.args, {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.once("error", () => done(false));
+      child.once("spawn", () => {
+        child.unref();
+        done(true);
+      });
+    } catch {
+      done(false);
+    }
+  });
+}
+var defaultSleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+function stepUpError(message, hint) {
+  return new CliError(message, 1 /* AUTH_ERROR */, hint);
+}
+async function requestBrowserStepUp(client2, kind, subjectId, opts = {}) {
+  const openUrl = opts.openUrl ?? openInBrowser;
+  const notify = opts.notify ?? ((line) => process.stderr.write(`${line}
+`));
+  const sleep2 = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const interval = opts.pollIntervalMs ?? HANDOFF_POLL_INTERVAL_MS;
+  const deadline = now() + (opts.deadlineMs ?? HANDOFF_DEADLINE_MS);
+  const created = await client2.post("/api/key-rotation/handoffs", {
+    kind,
+    subjectId
+  });
+  const jti = typeof created?.jti === "string" ? created.jti : null;
+  if (!jti || !/^[A-Za-z0-9-]{1,64}$/.test(jti)) {
+    throw stepUpError("The server did not return a browser approval.");
+  }
+  const url2 = `${client2.apiOrigin}${keyRotationHandoffPath(jti)}`;
+  notify(`Approve this in your browser (passkey or two-step code): ${url2}`);
+  if (!await openUrl(url2)) {
+    notify("Couldn't launch a browser. Open the URL above to approve.");
+  }
+  while (now() < deadline) {
+    const polled = await client2.get(
+      `/api/key-rotation/handoffs/${encodeURIComponent(jti)}`
+    );
+    const status = polled?.status;
+    if (status === "approved") {
+      if (typeof polled.token === "string" && polled.token.length > 0) {
+        return polled.token;
+      }
+      throw stepUpError(
+        "This approval was already collected by another request.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "consumed") {
+      throw stepUpError(
+        "This approval was already used.",
+        "Run the command again to request a new approval."
+      );
+    }
+    if (status === "expired") {
+      throw stepUpError(
+        "The browser approval expired.",
+        "Run the command again and approve within 5 minutes."
+      );
+    }
+    await sleep2(interval);
+  }
+  throw stepUpError(
+    "Timed out waiting for the browser approval.",
+    "Run the command again and approve within 5 minutes."
+  );
+}
+
+// src/lib/keys-device.ts
+var DEFAULT_ENV_FILE = ".env.local";
+var DETECT_TIMEOUT_MS = 5e3;
+var MAX_ENV_KEYS = 500;
+var REPORT_KEY = /^[A-Z_][A-Z0-9_]{0,127}$/;
+var REPORT_PATH = /^[ -~]{1,200}$/;
+var TOKEN_SHAPED = /[A-Za-z0-9]{33,}/;
+var SECRET_PREFIX = /(gh[pousr]_|github_pat_|-----BEGIN)/;
+var UUID5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function deviceSlot(workspaceId) {
+  return `key-rotation-device:${workspaceId}`;
+}
+function parseReported(v) {
+  if (!Array.isArray(v)) return [];
+  return v.flatMap((r) => {
+    const o = r;
+    return typeof o?.path === "string" && typeof o.key === "string" ? [{ path: o.path, key: o.key }] : [];
+  });
+}
+function parsePending(v) {
+  const o = v;
+  if (typeof o?.publicKey !== "string" || typeof o.privateKey !== "string") {
+    return null;
+  }
+  return {
+    enrollmentId: typeof o.enrollmentId === "string" ? o.enrollmentId : null,
+    publicKey: o.publicKey,
+    privateKey: o.privateKey,
+    reported: parseReported(o.reported)
+  };
+}
+async function loadDevice(workspaceId) {
+  const raw = await getSecretSlot(deviceSlot(workspaceId));
+  if (!raw) return null;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed?.v !== 1 || typeof parsed.privateKey !== "string" || typeof parsed.publicKey !== "string") {
+      return null;
+    }
+    return {
+      v: 1,
+      deviceId: typeof parsed.deviceId === "string" ? parsed.deviceId : null,
+      enrollmentId: typeof parsed.enrollmentId === "string" ? parsed.enrollmentId : null,
+      publicKey: parsed.publicKey,
+      privateKey: parsed.privateKey,
+      reported: parseReported(parsed.reported),
+      pendingReplacement: parsePending(parsed.pendingReplacement)
+    };
+  } catch {
+    return null;
+  }
+}
+async function saveDevice(workspaceId, device) {
+  if (!await setSecretSlot(deviceSlot(workspaceId), JSON.stringify(device))) {
+    throw new CliError(
+      "Could not store this machine's device key in the keychain.",
+      3 /* VALIDATION_ERROR */,
+      "Unlock your keychain (or check ~/.great-arrow permissions) and try again."
+    );
+  }
+}
+async function requireEnrolledDevice(workspaceId) {
+  const device = await loadDevice(workspaceId);
+  if (!device?.deviceId) {
+    throw new CliError(
+      "This machine is not enrolled for key rotation in this workspace.",
+      3 /* VALIDATION_ERROR */,
+      "Run 'gad keys enroll' first."
+    );
+  }
+  return { ...device, deviceId: device.deviceId };
+}
+function nameOk(s2) {
+  return !TOKEN_SHAPED.test(s2) && !SECRET_PREFIX.test(s2);
+}
+function isOpReference(rawValue) {
+  const t = rawValue.trim();
+  const q = t[0];
+  const inner = t.length >= 2 && (q === '"' || q === "'") && t.endsWith(q) ? t.slice(1, -1) : t;
+  return inner.startsWith("op://");
+}
+async function scanEnvKeys(paths) {
+  const out2 = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    const path10 = resolve4(p);
+    if (seen.has(path10)) continue;
+    seen.add(path10);
+    if (!REPORT_PATH.test(path10) || !nameOk(path10)) continue;
+    let text3;
+    try {
+      text3 = await readFile8(path10, "utf8");
+    } catch {
+      continue;
+    }
+    for (const line of text3.split(/\r?\n/)) {
+      const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*=(.*)$/.exec(
+        line
+      );
+      const key = m?.[1];
+      if (!key || !REPORT_KEY.test(key)) continue;
+      out2.push({ path: path10, key, isReference: isOpReference(m?.[2] ?? "") });
+      if (out2.length >= MAX_ENV_KEYS) return out2;
+    }
+  }
+  return out2;
+}
+function helperKind(raw) {
+  const v = raw.trim();
+  if (!v) return null;
+  if (/\bgh(\.exe)?\s+auth\s+git-credential\b/.test(v)) return "gh";
+  if (/osxkeychain/.test(v)) return "osxkeychain";
+  if (/^store\b/.test(v)) return "store";
+  return "other";
+}
+function run2(file2, args) {
+  return new Promise((done) => {
+    execFile4(
+      file2,
+      args,
+      { timeout: DETECT_TIMEOUT_MS, encoding: "utf8" },
+      (error62, stdout) => done(error62 ? null : String(stdout))
+    );
+  });
+}
+async function detectGhCli() {
+  return await run2("gh", ["--version"]) !== null;
+}
+async function detectGitHelper() {
+  const out2 = await run2("git", [
+    "config",
+    "--get-urlmatch",
+    "credential.helper",
+    "https://github.com"
+  ]);
+  return out2 === null ? null : helperKind(out2);
+}
+async function buildDeviceReport(envFiles) {
+  const [envKeys, ghCli, gitHelper] = await Promise.all([
+    scanEnvKeys([...envFiles, DEFAULT_ENV_FILE]),
+    detectGhCli(),
+    detectGitHelper()
+  ]);
+  return { envKeys, ghCli, gitHelper };
+}
+function defaultDeviceLabel() {
+  const label = hostname5().replace(/[^ -~]/g, "-").slice(0, 80).trim();
+  return label && nameOk(label) ? label : "this machine";
+}
+async function enroll(client2, workspaceId, opts = {}) {
+  const existing = await loadDevice(workspaceId);
+  const replacing = existing?.deviceId ? existing : null;
+  if (replacing && !opts.replace) {
+    throw new CliError(
+      "This machine is already enrolled for key rotation in this workspace.",
+      3 /* VALIDATION_ERROR */,
+      "Run 'gad keys pending' to see its updates, or 'gad keys enroll --replace' to enroll it again with a new key."
+    );
+  }
+  const label = opts.label ?? defaultDeviceLabel();
+  const report = await (opts.report ?? buildDeviceReport)(opts.envFiles ?? []);
+  const pair = generateDeviceKeyPair();
+  const pending = {
+    enrollmentId: null,
+    publicKey: pair.publicKey,
+    privateKey: pair.privateKey,
+    reported: report.envKeys.map(({ path: path10, key }) => ({ path: path10, key }))
+  };
+  const savePending = () => saveDevice(
+    workspaceId,
+    replacing ? { ...replacing, pendingReplacement: { ...pending } } : {
+      v: 1,
+      deviceId: null,
+      enrollmentId: pending.enrollmentId,
+      publicKey: pending.publicKey,
+      privateKey: pending.privateKey,
+      reported: pending.reported,
+      pendingReplacement: null
+    }
+  );
+  await savePending();
+  const begun = await client2.post("/api/key-rotation/devices", {
+    label,
+    publicKey: pair.publicKey,
+    report
+  });
+  const enrollmentId = typeof begun?.enrollmentId === "string" && UUID5.test(begun.enrollmentId) ? begun.enrollmentId : null;
+  if (!enrollmentId) {
+    throw new CliError(
+      "The server did not start the enrollment.",
+      2 /* NETWORK_ERROR */
+    );
+  }
+  pending.enrollmentId = enrollmentId;
+  await savePending();
+  const approvalToken = await (opts.stepUp ?? requestBrowserStepUp)(
+    client2,
+    "device_enroll",
+    enrollmentId
+  );
+  const done = await client2.post(`/api/key-rotation/devices/${enrollmentId}`, {
+    action: "enroll",
+    approvalToken
+  });
+  const deviceId = typeof done?.deviceId === "string" && UUID5.test(done.deviceId) ? done.deviceId : null;
+  if (!deviceId) {
+    throw new CliError(
+      "The server did not complete the enrollment.",
+      2 /* NETWORK_ERROR */
+    );
+  }
+  await saveDevice(workspaceId, {
+    v: 1,
+    deviceId,
+    enrollmentId,
+    publicKey: pending.publicKey,
+    privateKey: pending.privateKey,
+    reported: pending.reported,
+    pendingReplacement: null
+  });
+  let replaced = null;
+  if (replacing?.deviceId && replacing.deviceId !== deviceId) {
+    try {
+      await client2.delete(`/api/key-rotation/devices/${replacing.deviceId}`);
+      replaced = { deviceId: replacing.deviceId, revoked: true };
+    } catch {
+      replaced = { deviceId: replacing.deviceId, revoked: false };
+    }
+  }
+  return { deviceId, report, replaced };
+}
+
+// src/commands/keys.ts
+var UUID6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function patRequired(apiUrl) {
+  return authError(
+    "gad keys needs a personal access token; this sign-in is an OAuth session.",
+    `Create a token at ${apiUrl}/install/cli, then run 'gad login --token <PAT>'.`
+  );
+}
+function keyRotationError(error62, apiUrl) {
+  switch (serverCodeOf(error62)) {
+    case "oauth_not_allowed":
+      return patRequired(apiUrl);
+    case "web_session_required":
+      return new CliError(
+        "This key-rotation action is only available in a signed-in browser.",
+        1 /* AUTH_ERROR */,
+        `Open ${apiUrl}${keyRotationPath()} to do it there.`
+      );
+    case "step_up_required":
+      return new CliError(
+        "The browser approval was missing, expired or already used.",
+        1 /* AUTH_ERROR */,
+        "Run the command again and approve it in your browser."
+      );
+    default:
+      return error62;
+  }
+}
+function keysClient(inner, apiUrl) {
+  const mapped = async (call) => {
+    try {
+      return await call();
+    } catch (e) {
+      throw keyRotationError(e, apiUrl);
+    }
+  };
+  return {
+    apiOrigin: new URL(apiUrl).origin,
+    get: (path10, params) => mapped(() => inner.get(path10, params)),
+    post: (path10, body) => mapped(() => inner.post(path10, body)),
+    delete: (path10) => mapped(() => inner.delete(path10))
+  };
+}
+async function keysContext() {
+  const auth = await resolveAuth();
+  const apiUrl = auth.apiUrl.replace(/\/$/, "");
+  if (auth.tokenType === "oauth") throw patRequired(apiUrl);
+  const probe = new GadClient({
+    token: auth.token,
+    getToken: auth.getToken,
+    apiUrl: auth.apiUrl
+  });
+  const value = await probe.mcpCall("workspace_introspect", {}, 5e3);
+  const workspaceId = value?.workspace?.id;
+  if (value?.error || !workspaceId || !UUID6.test(workspaceId)) {
+    throw validationError(
+      "GreatArrow.ai could not confirm your workspace.",
+      "Run 'gad whoami', or choose one with 'gad --workspace <id>'."
+    );
+  }
+  return {
+    client: keysClient(
+      new GadClient({
+        token: auth.token,
+        getToken: auth.getToken,
+        apiUrl: auth.apiUrl,
+        workspaceId
+      }),
+      apiUrl
+    ),
+    workspaceId,
+    apiUrl
+  };
+}
+function requireRunId(runId) {
+  if (!UUID6.test(runId)) {
+    throw validationError(
+      `'${stripControlChars(runId)}' is not a run id.`,
+      "Copy the run id from 'gad keys list' or the run page."
+    );
+  }
+  return runId.toLowerCase();
+}
+var s = (v) => typeof v === "string" ? stripControlChars(v) : "";
+function out(line) {
+  process.stdout.write(`${line}
+`);
+}
+function err(line) {
+  process.stderr.write(`${line}
+`);
+}
+function listCommand4() {
+  return new Command("list").description("List the credentials registered for key rotation").action(async (_opts, command) => {
+    const g = globalOutputOpts(command);
+    const { client: client2 } = await keysContext();
+    const res = await client2.get("/api/key-rotation/credentials");
+    const rows = Array.isArray(res?.credentials) ? res.credentials : [];
+    if (g.json) {
+      out(JSON.stringify(rows));
+      return;
+    }
+    if (rows.length === 0) {
+      out(
+        "No credentials registered. Add one under Settings \u2192 Key rotation."
+      );
+      return;
+    }
+    const c = createColor(g.noColor || g.quiet);
+    for (const r of rows) {
+      const flags = [
+        r.openLeak === true ? c.red("leak") : "",
+        typeof r.liveRunId === "string" ? `run ${s(r.liveRunId)}` : ""
+      ].filter(Boolean).join(" \xB7 ");
+      out(
+        `${c.bold(s(r.label))} ${c.dim(s(r.kind))}  ${s(r.id)}  usages ${typeof r.usageCount === "number" ? r.usageCount : 0}  rotated ${s(r.lastRotatedAt) || "never"}` + (flags ? `  ${flags}` : "")
+      );
+    }
+  });
+}
+function statusCommand4() {
+  return new Command("status").description("Show one rotation run: steps, checklist and devices").argument("<run>", "Run id").action(async (runArg, _opts, command) => {
+    const g = globalOutputOpts(command);
+    const runId = requireRunId(runArg);
+    const { client: client2, apiUrl } = await keysContext();
+    const res = await client2.get(`/api/key-rotation/runs/${runId}`);
+    const run3 = res?.run ?? {};
+    if (g.json) {
+      out(JSON.stringify(run3));
+      return;
+    }
+    const c = createColor(g.noColor || g.quiet);
+    out(
+      `${c.bold(`Run ${runId}`)}  ${s(run3.state)}` + (s(run3.waitingOn) ? c.dim(`  waiting on ${s(run3.waitingOn)}`) : "")
+    );
+    for (const st of run3.steps ?? []) {
+      const detail = s(st.detailCode);
+      out(
+        `  ${s(st.step)} ${c.dim(s(st.targetKind))}  ${s(st.status)}` + (detail ? c.dim(` (${detail})`) : "")
+      );
+    }
+    const open4 = (run3.checklist ?? []).filter((i) => i.ticked !== true);
+    if (open4.length > 0) {
+      out(c.yellow("Checklist (tick these in the browser):"));
+      for (const item of open4) {
+        out(`  \u2610 ${s(item.label)}  ${c.cyan(s(item.href))}`);
+      }
+    }
+    for (const d of run3.devices ?? []) {
+      out(`  device ${s(d.label)}  ${s(d.state)}`);
+    }
+    out(c.dim(`${apiUrl}${keyRotationRunPath(runId)}`));
+  });
+}
+function collect2(value, previous) {
+  return [...previous, value];
+}
+function enrollCommand() {
+  return new Command("enroll").description(
+    "Enroll this machine to receive rotated keys (approve in the browser)"
+  ).option("--label <label>", "Device label (defaults to the host name)").option(
+    "--env-file <path>",
+    "An env file to report key NAMES from (repeatable; ./.env.local is always included)",
+    collect2,
+    []
+  ).option(
+    "--replace",
+    "Enroll again with a new key, replacing this machine's"
+  ).action(async (opts, command) => {
+    const g = globalOutputOpts(command);
+    const { client: client2, workspaceId } = await keysContext();
+    const { deviceId, report, replaced } = await enroll(client2, workspaceId, {
+      ...typeof opts.label === "string" ? { label: opts.label } : {},
+      envFiles: Array.isArray(opts.envFile) ? opts.envFile : [],
+      replace: opts.replace === true
+    });
+    if (g.json) {
+      out(JSON.stringify({ deviceId, report, replaced }));
+    } else {
+      out(`Enrolled this machine as device ${deviceId}.`);
+      out(
+        `Reported ${report.envKeys.length} env key name(s), gh CLI ${report.ghCli ? "found" : "not found"}, git helper ${report.gitHelper ?? "none"}.`
+      );
+      if (replaced?.revoked) {
+        out(
+          `Revoked the device it replaced (${replaced.deviceId}); its queued updates expired.`
+        );
+        out(
+          "Usages confirmed for that device still point at it: confirm them for this one under Settings \u2192 Key rotation."
+        );
+      }
+    }
+    if (replaced && !replaced.revoked) {
+      throw new CliError(
+        `Enrolled, but the device it replaced (${replaced.deviceId}) could not be revoked.`,
+        2 /* NETWORK_ERROR */,
+        "Revoke it under Settings \u2192 Key rotation; updates sealed to it can no longer be opened on this machine."
+      );
+    }
+  });
+}
+function toUpdateRow(v) {
+  if (typeof v !== "object" || v === null) return null;
+  const r = v;
+  if (typeof r.id !== "string" || !UUID6.test(r.id)) return null;
+  const ref = {};
+  if (typeof r.targetRef === "object" && r.targetRef !== null) {
+    for (const [k, val] of Object.entries(r.targetRef)) {
+      if (typeof val === "string") ref[k] = val;
+    }
+  }
+  return {
+    id: r.id,
+    runId: typeof r.runId === "string" ? r.runId : "",
+    targetKind: typeof r.targetKind === "string" ? r.targetKind : "",
+    targetRef: ref
+  };
+}
+function describeTarget(u) {
+  const ref = u.targetRef;
+  switch (u.targetKind) {
+    case "machine_env_file":
+      return `${s(ref.key)} in ${s(ref.path)}`;
+    case "machine_ssh_key":
+      return `SSH key ${s(ref.path)}`;
+    case "machine_git_credential":
+      return `git credential (${s(ref.helper)})`;
+    case "machine_gh_cli":
+      return "gh CLI login";
+    default:
+      return s(u.targetKind);
+  }
+}
+async function listUpdates(client2, deviceId) {
+  const res = await client2.get(
+    `/api/key-rotation/devices/${deviceId}/updates`
+  );
+  return (Array.isArray(res?.updates) ? res.updates : []).map(toUpdateRow).filter((u) => u !== null);
+}
+function pendingCommand() {
+  return new Command("pending").description("List the key updates queued for this machine").action(async (_opts, command) => {
+    const g = globalOutputOpts(command);
+    const { client: client2, workspaceId } = await keysContext();
+    const device = await requireEnrolledDevice(workspaceId);
+    const updates = await listUpdates(client2, device.deviceId);
+    if (g.json) {
+      out(JSON.stringify(updates));
+      return;
+    }
+    if (updates.length === 0) {
+      out("No key updates are waiting for this machine.");
+      return;
+    }
+    for (const u of updates) out(`  ${describeTarget(u)}  ${u.id}`);
+    out("Run 'gad keys apply' to apply them.");
+  });
+}
+async function ack(client2, deviceId, updateId, result) {
+  await client2.post(
+    `/api/key-rotation/devices/${deviceId}/updates/${updateId}`,
+    {
+      action: "ack",
+      ok: result.ok,
+      detailCode: result.code
+    }
+  );
+}
+async function fetchOpenApply(client2, device, u, approvalToken) {
+  let sealed;
+  try {
+    const fetched = await client2.post(
+      `/api/key-rotation/devices/${device.deviceId}/updates/${u.id}`,
+      { action: "fetch", approvalToken }
+    );
+    if (typeof fetched?.sealedPayload !== "string") {
+      return { ack: false, ok: false, code: "fetch_failed" };
+    }
+    sealed = fetched.sealedPayload;
+  } catch {
+    return { ack: false, ok: false, code: "fetch_failed" };
+  }
+  let value;
+  try {
+    value = openFromServer(Buffer.from(sealed, "base64"), device.privateKey);
+  } catch (e) {
+    return {
+      ack: true,
+      ok: false,
+      code: e instanceof EnvelopeError ? e.code : "envelope_invalid"
+    };
+  }
+  const result = await applyUpdate(u.targetKind, u.targetRef, value, {
+    reported: device.reported
+  });
+  return { ack: true, ...result };
+}
+async function applyBatch(client2, device, updates) {
+  if (updates.length === 0) return [];
+  const approvalToken = await requestBrowserStepUp(
+    client2,
+    "device_apply",
+    device.deviceId
+  );
+  const results = [];
+  for (const u of updates) {
+    const { ack: shouldAck, ...result } = await fetchOpenApply(
+      client2,
+      device,
+      u,
+      approvalToken
+    );
+    if (!shouldAck) {
+      results.push({ id: u.id, targetKind: u.targetKind, ...result });
+      continue;
+    }
+    try {
+      await ack(client2, device.deviceId, u.id, result);
+      results.push({ id: u.id, targetKind: u.targetKind, ...result });
+    } catch {
+      results.push({
+        id: u.id,
+        targetKind: u.targetKind,
+        ok: false,
+        code: "ack_failed"
+      });
+    }
+  }
+  return results;
+}
+function applyCommand() {
+  return new Command("apply").description(
+    "Apply the key updates queued for this machine (one browser approval)"
+  ).option("--yes", "Apply without the local confirmation prompt").action(async (opts, command) => {
+    const g = globalOutputOpts(command);
+    const { client: client2, workspaceId } = await keysContext();
+    const device = await requireEnrolledDevice(workspaceId);
+    const updates = await listUpdates(client2, device.deviceId);
+    if (updates.length === 0) {
+      if (g.json) out("[]");
+      else out("No key updates are waiting for this machine.");
+      return;
+    }
+    if (opts.yes !== true) {
+      if (!process.stdin.isTTY) {
+        throw validationError(
+          "Refusing to apply key updates without confirmation.",
+          "Run 'gad keys apply --yes' in a script."
+        );
+      }
+      for (const u of updates) err(`  ${describeTarget(u)}`);
+      if (!await confirm(`Apply ${updates.length} key update(s)?`)) {
+        err("Nothing applied.");
+        return;
+      }
+    }
+    const results = await applyBatch(client2, device, updates);
+    if (g.json) {
+      out(JSON.stringify(results));
+    } else {
+      const c = createColor(g.noColor || g.quiet);
+      for (const r of results) {
+        const u = updates.find((x) => x.id === r.id);
+        const where = u ? describeTarget(u) : r.targetKind;
+        out(`${r.ok ? c.green("\u2713") : c.red("\u2717")} ${where}  ${c.dim(r.code)}`);
+      }
+    }
+    const failed = results.filter((r) => !r.ok).length;
+    if (failed > 0) {
+      throw new CliError(
+        `${failed} of ${results.length} key update(s) failed on this machine.`,
+        3 /* VALIDATION_ERROR */,
+        "An update that could not be fetched stays queued: run 'gad keys apply' again. The run page shows every other failed step."
+      );
+    }
+  });
+}
+function readHiddenFromTty(prompt, io = {
+  input: process.stdin,
+  output: process.stderr
+}) {
+  let muted = false;
+  const sink = new Writable({
+    write(chunk, encoding, callback) {
+      if (!muted) io.output.write(chunk, encoding);
+      callback();
+    }
+  });
+  const rl = createInterface3({
+    input: io.input,
+    output: sink,
+    terminal: true
+  });
+  io.output.write(prompt);
+  muted = true;
+  return new Promise((resolve5, reject) => {
+    const lines = [];
+    let pem = false;
+    const finish = () => {
+      rl.close();
+      io.output.write("\n");
+      resolve5(lines.join("\n"));
+    };
+    rl.on("line", (line) => {
+      if (lines.length === 0) pem = /^-----BEGIN /.test(line.trim());
+      lines.push(line);
+      if (!pem || /^-----END .*-----\s*$/.test(line.trim())) finish();
+    });
+    rl.on("SIGINT", () => {
+      rl.close();
+      reject(new CliError("Paste cancelled.", 3 /* VALIDATION_ERROR */));
+    });
+  });
+}
+function pasteRefusal(error62, apiUrl, runId) {
+  const code = serverCodeOf(error62);
+  if (code !== null && (code === "invalid_grants" || code === "storage_token_missing" || code.startsWith("onepassword_"))) {
+    return new CliError(
+      "This run needs its 1Password access granted again, which the CLI cannot send.",
+      3 /* VALIDATION_ERROR */,
+      `Paste the key on the run page instead: ${apiUrl}${keyRotationRunPath(runId)}`
+    );
+  }
+  return error62;
+}
+function pasteCommand() {
+  return new Command("paste").description(
+    "Paste the new PAT or App private key for a run (no echo; browser step-up)"
+  ).argument("<run>", "Run id").option("--stdin", "Read the value from piped stdin instead of a prompt").action(async (runArg, opts, command) => {
+    const g = globalOutputOpts(command);
+    const runId = requireRunId(runArg);
+    const fromStdin = opts.stdin === true;
+    if (!fromStdin && !process.stdin.isTTY) {
+      throw validationError(
+        "Refusing to read a key from a non-interactive stdin.",
+        "Pass --stdin to read the value from a pipe."
+      );
+    }
+    const { client: client2, apiUrl } = await keysContext();
+    const approvalToken = await requestBrowserStepUp(client2, "paste", runId);
+    const raw = fromStdin ? await readStream(process.stdin) : await readHiddenFromTty("Paste the new key (input hidden): ");
+    const value = raw.trim();
+    if (!value) {
+      throw validationError("Nothing was pasted.");
+    }
+    try {
+      await client2.post(`/api/key-rotation/runs/${runId}/paste`, {
+        value,
+        approvalToken
+      });
+    } catch (e) {
+      throw pasteRefusal(e, apiUrl, runId);
+    }
+    if (g.json) out(JSON.stringify({ ok: true, runId }));
+    else out("Pasted. The run continues on GreatArrow.ai.");
+  });
+}
+function approveCommand() {
+  return new Command("approve").description("Open a run's approval page in the browser").argument("<run>", "Run id").action(async (runArg, _opts, command) => {
+    const g = globalOutputOpts(command);
+    const runId = requireRunId(runArg);
+    const auth = await resolveAuth();
+    const url2 = `${auth.apiUrl.replace(/\/$/, "")}${keyRotationRunPath(runId)}`;
+    if (g.json) {
+      out(JSON.stringify({ url: url2 }));
+      return;
+    }
+    const opened = await openInBrowser(url2);
+    out(url2);
+    if (!opened) err("Couldn't launch a browser \u2014 open the URL above.");
+  });
+}
+function keysCommand() {
+  return new Command("keys").description("Rotate leaked or expiring keys (GreatArrow.ai key rotation)").addCommand(listCommand4()).addCommand(statusCommand4()).addCommand(enrollCommand()).addCommand(pendingCommand()).addCommand(applyCommand()).addCommand(pasteCommand()).addCommand(approveCommand());
+}
+
 // src/lib/completions.ts
 var COMMANDS = [
   "login",
@@ -49898,7 +51150,7 @@ function completionsCommand() {
 
 // node_modules/.pnpm/update-notifier@7.3.1/node_modules/update-notifier/update-notifier.js
 import process11 from "node:process";
-import { spawn } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import path9 from "node:path";
 import { format } from "node:util";
@@ -49974,7 +51226,7 @@ var retryifyAsync = (fn, options) => {
           throw error62;
         const delay2 = Math.round(interval * Math.random());
         if (delay2 > 0) {
-          const delayPromise = new Promise((resolve4) => setTimeout(resolve4, delay2));
+          const delayPromise = new Promise((resolve5) => setTimeout(resolve5, delay2));
           return delayPromise.then(() => attempt.apply(void 0, args));
         } else {
           return attempt.apply(void 0, args);
@@ -50233,14 +51485,14 @@ var Temp = {
     }
   },
   truncate: (filePath) => {
-    const basename2 = path3.basename(filePath);
-    if (basename2.length <= LIMIT_BASENAME_LENGTH)
+    const basename3 = path3.basename(filePath);
+    if (basename3.length <= LIMIT_BASENAME_LENGTH)
       return filePath;
-    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename2);
+    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename3);
     if (!truncable)
       return filePath;
-    const truncationLength = basename2.length - LIMIT_BASENAME_LENGTH;
-    return `${filePath.slice(0, -basename2.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
+    const truncationLength = basename3.length - LIMIT_BASENAME_LENGTH;
+    return `${filePath.slice(0, -basename3.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
   }
 };
 node_default(Temp.purgeSyncAll);
@@ -51540,14 +52792,14 @@ var TimeoutError = class extends Error {
 
 // node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/timeout.js
 async function timeout(request, init, abortController, options) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const timeoutId = setTimeout(() => {
       if (abortController) {
         abortController.abort();
       }
       reject(new TimeoutError(request));
     }, options.timeout);
-    void options.fetch(request, init).then(resolve4).catch(reject).then(() => {
+    void options.fetch(request, init).then(resolve5).catch(reject).then(() => {
       clearTimeout(timeoutId);
     });
   });
@@ -51555,7 +52807,7 @@ async function timeout(request, init, abortController, options) {
 
 // node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/delay.js
 async function delay(ms, { signal }) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     if (signal) {
       signal.throwIfAborted();
       signal.addEventListener("abort", abortHandler, { once: true });
@@ -51566,7 +52818,7 @@ async function delay(ms, { signal }) {
     }
     const timeoutId = setTimeout(() => {
       signal?.removeEventListener("abort", abortHandler);
-      resolve4();
+      resolve5();
     }, ms);
   });
 }
@@ -52868,7 +54120,7 @@ var makeContentText = (text3, { padding, width, textAlignment, height }) => {
       const createdLines = wrapAnsi(line, max, { hard: true });
       const alignedLines = (0, import_ansi_align.default)(createdLines, { align: textAlignment });
       const alignedLinesArray = alignedLines.split("\n");
-      const longestLength = Math.max(...alignedLinesArray.map((s) => stringWidth(s)));
+      const longestLength = Math.max(...alignedLinesArray.map((s2) => stringWidth(s2)));
       for (const alignedLine of alignedLinesArray) {
         let paddedLine;
         switch (textAlignment) {
@@ -53195,7 +54447,7 @@ var UpdateNotifier = class {
     if (Date.now() - this.config.get("lastUpdateCheck") < this.#updateCheckInterval) {
       return;
     }
-    spawn(process11.execPath, [path9.join(__dirname3, "check.js"), JSON.stringify(this.#options)], {
+    spawn3(process11.execPath, [path9.join(__dirname3, "check.js"), JSON.stringify(this.#options)], {
       detached: true,
       stdio: "ignore"
     }).unref();
@@ -53318,6 +54570,7 @@ program2.addCommand(askCommand());
 program2.addCommand(localCommand());
 program2.addCommand(runtimeCommand());
 program2.addCommand(smokeCommand());
+program2.addCommand(keysCommand());
 program2.addCommand(openCommand());
 program2.addCommand(completionsCommand());
 try {