@inf-monkeys-tech/monkeys-cli 0.12.12 → 0.12.14

package/oclif.manifest.json

@@ -1658,6 +1658,158 @@
       ],
       "strict": true
     },
+    "data:asset:aggregate": {
+      "aliases": [],
+      "args": {},
+      "description": "Aggregate assets through the published Studio contract with bounded metrics and group pagination.",
+      "enableJsonFlag": false,
+      "flags": {
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-file",
+          "summary": "Aggregate query JSON file",
+          "type": "option"
+        },
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-json",
+          "summary": "Aggregate query JSON object containing metrics and optional filters",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "ontology": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "ontology",
+          "required": true,
+          "summary": "Ontology ID",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 50,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "perspective": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "perspective",
+          "options": [
+            "kernel",
+            "studio"
+          ],
+          "summary": "Use only this Data perspective; when omitted, read queries use Studio first and may fall back to Kernel",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Authenticated Studio Team context",
+          "type": "option"
+        },
+        "view": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "view",
+          "required": true,
+          "summary": "Readable View ID in the Ontology",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "data:asset:aggregate",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "data",
+        "asset",
+        "aggregate.js"
+      ],
+      "strict": true
+    },
     "data:asset:attachment:download": {
       "aliases": [],
       "args": {
@@ -11989,78 +12141,41 @@
       ],
       "strict": true
     },
-    "identity:get": {
+    "group:create": {
       "aliases": [],
-      "args": {
-        "id": {
-          "description": "User or Agent identity ID",
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Get one user or Agent identity through the selected authentication surface.",
+      "args": {},
+      "description": "Create a custom permission group with no implicit permissions.",
       "enableJsonFlag": false,
       "flags": {
-        "jq": {
-          "char": "q",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
-          "type": "option"
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
         },
-        "output": {
-          "default": "json",
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "output",
-          "options": [
-            "json",
-            "pretty",
-            "table",
-            "ndjson",
-            "csv",
-            "text"
-          ],
-          "summary": "Output format",
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
           "type": "option"
         },
-        "subscription": {
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "subscription",
-          "summary": "Subscription name",
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
           "type": "option"
         },
-        "yes": {
-          "allowNo": false,
-          "char": "y",
-          "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "identity:get",
-      "isESM": true,
-      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
-      "pluginName": "@inf-monkeys-tech/monkeys-cli",
-      "pluginType": "core",
-      "relativePath": [
-        "dist",
-        "commands",
-        "identity",
-        "get.js"
-      ],
-      "strict": true
-    },
-    "identity:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List users and Agent identities visible through the selected authentication surface.",
-      "enableJsonFlag": false,
-      "flags": {
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12069,13 +12184,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "keyword": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "keyword",
-          "summary": "Filter by name, email, phone, nickname, or ID",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12115,7 +12223,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -12129,46 +12237,41 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
-        "scope": {
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "scope",
-          "options": [
-            "system",
-            "team"
-          ],
-          "summary": "Agent scope filter on Kernel endpoints",
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
           "type": "option"
         },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
-          "type": "option"
-        },
-        "user-type": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "user-type",
-          "options": [
-            "human",
-            "agent"
-          ],
-          "summary": "Identity type filter on Kernel endpoints",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "identity:list",
+      "id": "group:create",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12176,26 +12279,30 @@
       "relativePath": [
         "dist",
         "commands",
-        "identity",
-        "list.js"
+        "group",
+        "create.js"
       ],
       "strict": true
     },
-    "install": {
+    "group:delete": {
       "aliases": [],
-      "args": {},
-      "description": "Install this exact CLI release globally and synchronize its exact official Skills.",
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Delete an empty custom group. There is no restore endpoint.",
       "enableJsonFlag": false,
-      "examples": [
-        "npx @inf-monkeys-tech/monkeys-cli@latest install",
-        "pnpm dlx @inf-monkeys-tech/monkeys-cli@latest install --package-manager pnpm",
-        "<%= config.bin %> install --dry-run"
-      ],
       "flags": {
         "dry-run": {
           "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
           "name": "dry-run",
-          "summary": "Validate and return the exact installation plan without changing anything",
+          "summary": "Preview only; send no mutation request",
           "type": "boolean"
         },
         "jq": {
@@ -12222,29 +12329,78 @@
           "summary": "Output format",
           "type": "option"
         },
-        "package-manager": {
-          "default": "npm",
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "package-manager",
-          "options": [
-            "npm",
-            "pnpm"
-          ],
-          "summary": "Global package manager that will own the installation",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "install",
+      "id": "group:delete",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12252,20 +12408,21 @@
       "relativePath": [
         "dist",
         "commands",
-        "install.js"
+        "group",
+        "delete.js"
       ],
       "strict": true
     },
-    "post-review:get": {
+    "group:get": {
       "aliases": [],
       "args": {
-        "jobId": {
-          "description": "Post-review Job ID",
-          "name": "jobId",
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
           "required": true
         }
       },
-      "description": "Query the current Team's Workflow post-review records by precise Job ID.",
+      "description": "Get a Kernel permission group and its permissions.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -12295,21 +12452,15 @@
         "refresh": {
           "allowNo": false,
           "name": "refresh",
-          "summary": "Refresh OpenAPI binding information",
+          "summary": "Refresh the published API contract",
           "type": "boolean"
         },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
-          "type": "option"
-        },
-        "team": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "team",
-          "summary": "Team ID",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -12322,7 +12473,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "post-review:get",
+      "id": "group:get",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12330,31 +12481,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "post-review",
+        "group",
         "get.js"
       ],
       "strict": true
     },
-    "post-review:list": {
+    "group:list": {
       "aliases": [],
       "args": {},
-      "description": "Query the current Team's Workflow post-review job.",
+      "description": "List Kernel permission groups, including system-group protection.",
       "enableJsonFlag": false,
       "flags": {
-        "created-from": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "created-from",
-          "summary": "Job creation time lower bound (millisecond timestamp)",
-          "type": "option"
-        },
-        "created-to": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "created-to",
-          "summary": "Job creation time upper bound (millisecond timestamp)",
-          "type": "option"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12363,30 +12500,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "order": {
-          "default": "DESC",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "order",
-          "options": [
-            "ASC",
-            "DESC"
-          ],
-          "summary": "Sorting direction",
-          "type": "option"
-        },
-        "order-by": {
-          "default": "createdTimestamp",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "order-by",
-          "options": [
-            "createdTimestamp",
-            "updatedTimestamp"
-          ],
-          "summary": "sort field",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12440,68 +12553,18 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
-        "policy": {
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "policy",
-          "summary": "Policy ID, repeatable (up to 100)",
-          "type": "option"
-        },
         "refresh": {
           "allowNo": false,
           "name": "refresh",
-          "summary": "Refresh OpenAPI binding information",
+          "summary": "Refresh the published API contract",
           "type": "boolean"
         },
-        "review-execution": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "review-execution",
-          "summary": "Review Workflow Execution ID",
-          "type": "option"
-        },
-        "source-execution": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "source-execution",
-          "summary": "Source Workflow Execution ID",
-          "type": "option"
-        },
-        "status": {
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "status",
-          "options": [
-            "NOT_REQUIRED",
-            "PENDING",
-            "RUNNING",
-            "PASSED",
-            "REJECTED",
-            "FAILED",
-            "SKIPPED"
-          ],
-          "summary": "review status, repeatable",
-          "type": "option"
-        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
-          "type": "option"
-        },
-        "team": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "team",
-          "summary": "Team ID",
-          "type": "option"
-        },
-        "workflow": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "workflow",
-          "summary": "Source or Review Workflow ID",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -12514,7 +12577,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "post-review:list",
+      "id": "group:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12522,42 +12585,52 @@
       "relativePath": [
         "dist",
         "commands",
-        "post-review",
+        "group",
         "list.js"
       ],
       "strict": true
     },
-    "schema": {
+    "group:member:add": {
       "aliases": [],
       "args": {
-        "path": {
-          "description": "Command path, for example workflow run",
-          "multiple": true,
-          "name": "path"
+        "id": {
+          "description": "Exact group ID",
+          "name": "id",
+          "required": true
         }
       },
-      "description": "Inspect command arguments, flags, output, risk, dry-run, confirmation, or an OpenAPI operation.",
+      "description": "Add direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
-        "include-legacy": {
+        "dry-run": {
           "allowNo": false,
-          "name": "include-legacy",
-          "summary": "Allow viewing ungoverned legacy OpenAPI operations",
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
           "type": "boolean"
         },
-        "jq": {
-          "char": "q",
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
           "type": "option"
         },
-        "operation-id": {
+        "jq": {
+          "char": "q",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "operation-id",
-          "summary": "Inspect an OpenAPI operationId instead of a local command",
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
         "output": {
@@ -12576,37 +12649,92 @@
           "summary": "Output format",
           "type": "option"
         },
-        "refresh": {
+        "page-all": {
           "allowNo": false,
-          "name": "refresh",
-          "summary": "Force conditional refresh of OpenAPI",
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
           "type": "boolean"
         },
-        "subscription": {
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "subscription",
-          "summary": "Subscription name used for OpenAPI discovery",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
           "type": "option"
         },
-        "team": {
-          "hasDynamicHelp": false,
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
           "multiple": false,
-          "name": "team",
-          "summary": "Team ID used for OpenAPI discovery",
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "schema",
+      "id": "group:member:add",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12614,14 +12742,22 @@
       "relativePath": [
         "dist",
         "commands",
-        "schema.js"
+        "group",
+        "member",
+        "add.js"
       ],
       "strict": true
     },
-    "skills:list": {
+    "group:member:list": {
       "aliases": [],
-      "args": {},
-      "description": "List the official Agent Skills embedded in this exact CLI package version.",
+      "args": {
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "List directly assigned members of a Kernel permission group.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -12632,6 +12768,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Search direct members",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12685,6 +12828,20 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -12695,7 +12852,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:list",
+      "id": "group:member:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12703,32 +12860,53 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
+        "group",
+        "member",
         "list.js"
       ],
       "strict": true
     },
-    "skills:read": {
+    "group:member:remove": {
       "aliases": [],
       "args": {
-        "name": {
-          "description": "Bundled Skill name",
-          "name": "name",
+        "id": {
+          "description": "Exact group ID",
+          "name": "id",
           "required": true
-        },
-        "resource": {
-          "default": "SKILL.md",
-          "description": "Relative resource path inside the Skill",
-          "name": "resource"
         }
       },
-      "description": "Read an embedded same-version Skill entry point or reference without locating the npm package.",
+      "description": "Remove direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
-      "examples": [
-        "<%= config.bin %> skills read monkeys-shared",
-        "<%= config.bin %> skills read monkeys-data references/data-read.md --jq .data.content"
-      ],
       "flags": {
+        "all-members": {
+          "allowNo": false,
+          "name": "all-members",
+          "summary": "Enumerate all direct members into a dry-run plan only",
+          "type": "boolean"
+        },
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
+          "type": "option"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12753,17 +12931,92 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:read",
+      "id": "group:member:remove",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12771,15 +13024,22 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "read.js"
+        "group",
+        "member",
+        "remove.js"
       ],
       "strict": true
     },
-    "skills:status": {
+    "group:permission:list": {
       "aliases": [],
-      "args": {},
-      "description": "Compare the installed Skill synchronization state with this CLI package version and embedded checksums.",
+      "args": {
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "List permissions configured on a group; use --page-all for the complete set.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -12806,6 +13066,57 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -12816,7 +13127,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:status",
+      "id": "group:permission:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12824,23 +13135,53 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "status.js"
+        "group",
+        "permission",
+        "list.js"
       ],
       "strict": true
     },
-    "skills:sync": {
+    "group:permission:set": {
       "aliases": [],
-      "args": {},
-      "description": "Synchronize all embedded official Skills to Agent discovery and record their exact CLI version and checksums.",
-      "enableJsonFlag": false,
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Replace the complete custom-group permission set; explicit [] clears it.",
+      "enableJsonFlag": false,
       "flags": {
-        "check": {
+        "dry-run": {
           "allowNo": false,
-          "name": "check",
-          "summary": "Only compare synchronization state; do not install Skills",
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
           "type": "boolean"
         },
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
+          "type": "option"
+        },
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
+          "type": "option"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12865,17 +13206,78 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:sync",
+      "id": "group:permission:set",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12883,67 +13285,51 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "sync.js"
+        "group",
+        "permission",
+        "set.js"
       ],
       "strict": true
     },
-    "subscription:add": {
+    "group:update": {
       "aliases": [],
-      "args": {},
-      "description": "Add a Subscription that binds Deployment, Tenant, and Secret references.",
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Update explicit metadata fields of a custom permission group.",
       "enableJsonFlag": false,
       "flags": {
-        "credential-fingerprint": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "credential-fingerprint",
-          "summary": "Non-Secret SHA-256 credential fingerprint",
-          "type": "option"
-        },
-        "credential-kind": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "credential-kind",
-          "options": [
-            "api_key",
-            "account_session"
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
           ],
-          "required": true,
-          "summary": "Credential type",
-          "type": "option"
-        },
-        "default-team": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "default-team",
-          "summary": "Default Team ID",
-          "type": "option"
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
         },
-        "deployment": {
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "deployment",
-          "required": true,
-          "summary": "Deployment name",
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
           "type": "option"
         },
-        "expected-principal": {
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "expected-principal",
-          "summary": "Expected principal ID",
-          "type": "option"
-        },
-        "expected-surface": {
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "expected-surface",
-          "options": [
-            "studio",
-            "kernel"
-          ],
-          "summary": "Expected authentication Surface, repeatable",
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
           "type": "option"
         },
         "jq": {
@@ -12954,14 +13340,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12978,33 +13356,78 @@
           "summary": "Output format",
           "type": "option"
         },
-        "secret-ref": {
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "secret-ref",
-          "required": true,
-          "summary": "env:, keyring: or account Session-specific session-file: reference",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
           "type": "option"
         },
-        "tenant": {
+        "page-limit": {
+          "default": 20,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "tenant",
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
           "required": true,
-          "summary": "Tenant Host",
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:add",
+      "id": "group:update",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13012,15 +13435,21 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "add.js"
+        "group",
+        "update.js"
       ],
       "strict": true
     },
-    "subscription:current": {
+    "identity:get": {
       "aliases": [],
-      "args": {},
-      "description": "Displays the current manually configured Subscription.",
+      "args": {
+        "id": {
+          "description": "User or Agent identity ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get one user or Agent identity through the selected authentication surface.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13047,6 +13476,13 @@
           "summary": "Output format",
           "type": "option"
         },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13057,7 +13493,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:current",
+      "id": "identity:get",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13065,15 +13501,15 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "current.js"
-      ],
+        "identity",
+        "get.js"
+      ],
       "strict": true
     },
-    "subscription:list": {
+    "identity:list": {
       "aliases": [],
       "args": {},
-      "description": "List all Subscriptions.",
+      "description": "List users and Agent identities visible through the selected authentication surface.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13084,6 +13520,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Filter by name, email, phone, nickname, or ID",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13137,6 +13580,35 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "scope": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "scope",
+          "options": [
+            "system",
+            "team"
+          ],
+          "summary": "Agent scope filter on Kernel endpoints",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "user-type": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "user-type",
+          "options": [
+            "human",
+            "agent"
+          ],
+          "summary": "Identity type filter on Kernel endpoints",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13147,7 +13619,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:list",
+      "id": "identity:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13155,17 +13627,28 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
+        "identity",
         "list.js"
       ],
       "strict": true
     },
-    "subscription:remove": {
+    "install": {
       "aliases": [],
       "args": {},
-      "description": "Deleting the Subscription; does not delete the credentials in the Secret Store.",
+      "description": "Install this exact CLI release globally and synchronize its exact official Skills.",
       "enableJsonFlag": false,
+      "examples": [
+        "npx @inf-monkeys-tech/monkeys-cli@latest install",
+        "pnpm dlx @inf-monkeys-tech/monkeys-cli@latest install --package-manager pnpm",
+        "<%= config.bin %> install --dry-run"
+      ],
       "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "name": "dry-run",
+          "summary": "Validate and return the exact installation plan without changing anything",
+          "type": "boolean"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13174,14 +13657,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13198,6 +13673,18 @@
           "summary": "Output format",
           "type": "option"
         },
+        "package-manager": {
+          "default": "npm",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "package-manager",
+          "options": [
+            "npm",
+            "pnpm"
+          ],
+          "summary": "Global package manager that will own the installation",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13208,7 +13695,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:remove",
+      "id": "install",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13216,15 +13703,14 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "remove.js"
+        "install.js"
       ],
       "strict": true
     },
-    "subscription:show": {
+    "permission:list": {
       "aliases": [],
       "args": {},
-      "description": "Display the non-Secret configuration of a Subscription.",
+      "description": "List the existing Kernel permission catalog.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13235,14 +13721,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13259,6 +13737,57 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13269,7 +13798,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:show",
+      "id": "permission:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13277,15 +13806,21 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "show.js"
+        "permission",
+        "list.js"
       ],
       "strict": true
     },
-    "subscription:test": {
+    "post-review:get": {
       "aliases": [],
-      "args": {},
-      "description": "Network Authentication Subscription's Deployment, Credential, Team, Principal, and Surface.",
+      "args": {
+        "jobId": {
+          "description": "Post-review Job ID",
+          "name": "jobId",
+          "required": true
+        }
+      },
+      "description": "Query the current Team's Workflow post-review records by precise Job ID.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13296,13 +13831,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13319,11 +13847,24 @@
           "summary": "Output format",
           "type": "option"
         },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh OpenAPI binding information",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "team": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "team",
-          "summary": "Team ID used for this verification",
+          "summary": "Team ID",
           "type": "option"
         },
         "yes": {
@@ -13336,7 +13877,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:test",
+      "id": "post-review:get",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13344,91 +13885,221 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "test.js"
+        "post-review",
+        "get.js"
       ],
       "strict": true
     },
-    "subscription:update": {
+    "post-review:list": {
       "aliases": [],
       "args": {},
-      "description": "Update a Subscription; clearing optional fields must use the explicit clear flag.",
+      "description": "Query the current Team's Workflow post-review job.",
       "enableJsonFlag": false,
       "flags": {
-        "clear-credential-fingerprint": {
-          "allowNo": false,
-          "name": "clear-credential-fingerprint",
-          "summary": "Clear credential fingerprint",
-          "type": "boolean"
-        },
-        "clear-default-team": {
-          "allowNo": false,
-          "name": "clear-default-team",
-          "summary": "Clear default Team",
-          "type": "boolean"
-        },
-        "clear-expected-principal": {
-          "allowNo": false,
-          "name": "clear-expected-principal",
-          "summary": "Clear expected principal",
-          "type": "boolean"
-        },
-        "clear-expected-surfaces": {
-          "allowNo": false,
-          "name": "clear-expected-surfaces",
-          "summary": "Clear expected authentication Surfaces",
-          "type": "boolean"
-        },
-        "credential-fingerprint": {
+        "created-from": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "credential-fingerprint",
-          "summary": "New SHA-256 credential fingerprint",
+          "name": "created-from",
+          "summary": "Job creation time lower bound (millisecond timestamp)",
           "type": "option"
         },
-        "credential-kind": {
+        "created-to": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "credential-kind",
-          "options": [
-            "api_key",
-            "account_session"
-          ],
-          "summary": "New credential type",
+          "name": "created-to",
+          "summary": "Job creation time upper bound (millisecond timestamp)",
           "type": "option"
         },
-        "default-team": {
+        "jq": {
+          "char": "q",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "default-team",
-          "summary": "New default Team ID",
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "deployment": {
+        "order": {
+          "default": "DESC",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "deployment",
-          "summary": "New Deployment name",
+          "name": "order",
+          "options": [
+            "ASC",
+            "DESC"
+          ],
+          "summary": "Sorting direction",
           "type": "option"
         },
-        "expected-principal": {
+        "order-by": {
+          "default": "createdTimestamp",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "expected-principal",
-          "summary": "New expected principal ID",
+          "name": "order-by",
+          "options": [
+            "createdTimestamp",
+            "updatedTimestamp"
+          ],
+          "summary": "sort field",
           "type": "option"
         },
-        "expected-surface": {
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "policy": {
           "hasDynamicHelp": false,
           "multiple": true,
-          "name": "expected-surface",
+          "name": "policy",
+          "summary": "Policy ID, repeatable (up to 100)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh OpenAPI binding information",
+          "type": "boolean"
+        },
+        "review-execution": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "review-execution",
+          "summary": "Review Workflow Execution ID",
+          "type": "option"
+        },
+        "source-execution": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "source-execution",
+          "summary": "Source Workflow Execution ID",
+          "type": "option"
+        },
+        "status": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "status",
           "options": [
-            "studio",
-            "kernel"
+            "NOT_REQUIRED",
+            "PENDING",
+            "RUNNING",
+            "PASSED",
+            "REJECTED",
+            "FAILED",
+            "SKIPPED"
           ],
-          "summary": "New expected authentication Surface, repeatable",
+          "summary": "review status, repeatable",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID",
+          "type": "option"
+        },
+        "workflow": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "workflow",
+          "summary": "Source or Review Workflow ID",
           "type": "option"
         },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "post-review:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "post-review",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "schema": {
+      "aliases": [],
+      "args": {
+        "path": {
+          "description": "Command path, for example workflow run",
+          "multiple": true,
+          "name": "path"
+        }
+      },
+      "description": "Inspect command arguments, flags, output, risk, dry-run, confirmation, or an OpenAPI operation.",
+      "enableJsonFlag": false,
+      "flags": {
+        "include-legacy": {
+          "allowNo": false,
+          "name": "include-legacy",
+          "summary": "Allow viewing ungoverned legacy OpenAPI operations",
+          "type": "boolean"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13437,12 +14108,11 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
+        "operation-id": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
+          "name": "operation-id",
+          "summary": "Inspect an OpenAPI operationId instead of a local command",
           "type": "option"
         },
         "output": {
@@ -13461,18 +14131,24 @@
           "summary": "Output format",
           "type": "option"
         },
-        "secret-ref": {
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Force conditional refresh of OpenAPI",
+          "type": "boolean"
+        },
+        "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "secret-ref",
-          "summary": "New env:, keyring: or account Session-specific session-file: reference",
+          "name": "subscription",
+          "summary": "Subscription name used for OpenAPI discovery",
           "type": "option"
         },
-        "tenant": {
+        "team": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "tenant",
-          "summary": "New Tenant Host",
+          "name": "team",
+          "summary": "Team ID used for OpenAPI discovery",
           "type": "option"
         },
         "yes": {
@@ -13485,7 +14161,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:update",
+      "id": "schema",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13493,15 +14169,14 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "update.js"
+        "schema.js"
       ],
       "strict": true
     },
-    "subscription:use": {
+    "skills:list": {
       "aliases": [],
       "args": {},
-      "description": "Set the current Subscription used by the manual terminal.",
+      "description": "List the official Agent Skills embedded in this exact CLI package version.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13512,41 +14187,1427 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
+        "output": {
+          "default": "json",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "skills:read": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Bundled Skill name",
+          "name": "name",
+          "required": true
+        },
+        "resource": {
+          "default": "SKILL.md",
+          "description": "Relative resource path inside the Skill",
+          "name": "resource"
+        }
+      },
+      "description": "Read an embedded same-version Skill entry point or reference without locating the npm package.",
+      "enableJsonFlag": false,
+      "examples": [
+        "<%= config.bin %> skills read monkeys-shared",
+        "<%= config.bin %> skills read monkeys-data references/data-read.md --jq .data.content"
+      ],
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:read",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "read.js"
+      ],
+      "strict": true
+    },
+    "skills:status": {
+      "aliases": [],
+      "args": {},
+      "description": "Compare the installed Skill synchronization state with this CLI package version and embedded checksums.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:status",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "status.js"
+      ],
+      "strict": true
+    },
+    "skills:sync": {
+      "aliases": [],
+      "args": {},
+      "description": "Synchronize all embedded official Skills to Agent discovery and record their exact CLI version and checksums.",
+      "enableJsonFlag": false,
+      "flags": {
+        "check": {
+          "allowNo": false,
+          "name": "check",
+          "summary": "Only compare synchronization state; do not install Skills",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:sync",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "sync.js"
+      ],
+      "strict": true
+    },
+    "subscription:add": {
+      "aliases": [],
+      "args": {},
+      "description": "Add a Subscription that binds Deployment, Tenant, and Secret references.",
+      "enableJsonFlag": false,
+      "flags": {
+        "credential-fingerprint": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-fingerprint",
+          "summary": "Non-Secret SHA-256 credential fingerprint",
+          "type": "option"
+        },
+        "credential-kind": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-kind",
+          "options": [
+            "api_key",
+            "account_session"
+          ],
+          "required": true,
+          "summary": "Credential type",
+          "type": "option"
+        },
+        "default-team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "default-team",
+          "summary": "Default Team ID",
+          "type": "option"
+        },
+        "deployment": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "deployment",
+          "required": true,
+          "summary": "Deployment name",
+          "type": "option"
+        },
+        "expected-principal": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "expected-principal",
+          "summary": "Expected principal ID",
+          "type": "option"
+        },
+        "expected-surface": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "expected-surface",
+          "options": [
+            "studio",
+            "kernel"
+          ],
+          "summary": "Expected authentication Surface, repeatable",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "secret-ref": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "secret-ref",
+          "required": true,
+          "summary": "env:, keyring: or account Session-specific session-file: reference",
+          "type": "option"
+        },
+        "tenant": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "tenant",
+          "required": true,
+          "summary": "Tenant Host",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:add",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "add.js"
+      ],
+      "strict": true
+    },
+    "subscription:current": {
+      "aliases": [],
+      "args": {},
+      "description": "Displays the current manually configured Subscription.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:current",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "current.js"
+      ],
+      "strict": true
+    },
+    "subscription:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List all Subscriptions.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "subscription:remove": {
+      "aliases": [],
+      "args": {},
+      "description": "Deleting the Subscription; does not delete the credentials in the Secret Store.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:remove",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "remove.js"
+      ],
+      "strict": true
+    },
+    "subscription:show": {
+      "aliases": [],
+      "args": {},
+      "description": "Display the non-Secret configuration of a Subscription.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:show",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "show.js"
+      ],
+      "strict": true
+    },
+    "subscription:test": {
+      "aliases": [],
+      "args": {},
+      "description": "Network Authentication Subscription's Deployment, Credential, Team, Principal, and Surface.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID used for this verification",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:test",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "test.js"
+      ],
+      "strict": true
+    },
+    "subscription:update": {
+      "aliases": [],
+      "args": {},
+      "description": "Update a Subscription; clearing optional fields must use the explicit clear flag.",
+      "enableJsonFlag": false,
+      "flags": {
+        "clear-credential-fingerprint": {
+          "allowNo": false,
+          "name": "clear-credential-fingerprint",
+          "summary": "Clear credential fingerprint",
+          "type": "boolean"
+        },
+        "clear-default-team": {
+          "allowNo": false,
+          "name": "clear-default-team",
+          "summary": "Clear default Team",
+          "type": "boolean"
+        },
+        "clear-expected-principal": {
+          "allowNo": false,
+          "name": "clear-expected-principal",
+          "summary": "Clear expected principal",
+          "type": "boolean"
+        },
+        "clear-expected-surfaces": {
+          "allowNo": false,
+          "name": "clear-expected-surfaces",
+          "summary": "Clear expected authentication Surfaces",
+          "type": "boolean"
+        },
+        "credential-fingerprint": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-fingerprint",
+          "summary": "New SHA-256 credential fingerprint",
+          "type": "option"
+        },
+        "credential-kind": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-kind",
+          "options": [
+            "api_key",
+            "account_session"
+          ],
+          "summary": "New credential type",
+          "type": "option"
+        },
+        "default-team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "default-team",
+          "summary": "New default Team ID",
+          "type": "option"
+        },
+        "deployment": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "deployment",
+          "summary": "New Deployment name",
+          "type": "option"
+        },
+        "expected-principal": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "expected-principal",
+          "summary": "New expected principal ID",
+          "type": "option"
+        },
+        "expected-surface": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "expected-surface",
+          "options": [
+            "studio",
+            "kernel"
+          ],
+          "summary": "New expected authentication Surface, repeatable",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "secret-ref": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "secret-ref",
+          "summary": "New env:, keyring: or account Session-specific session-file: reference",
+          "type": "option"
+        },
+        "tenant": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "tenant",
+          "summary": "New Tenant Host",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:update",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "update.js"
+      ],
+      "strict": true
+    },
+    "subscription:use": {
+      "aliases": [],
+      "args": {},
+      "description": "Set the current Subscription used by the manual terminal.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:use",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "use.js"
+      ],
+      "strict": true
+    },
+    "team:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Team ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get one Team visible through the selected Subscription.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "team:get",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "team",
+        "get.js"
+      ],
+      "strict": true
+    },
+    "team:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List Teams visible through the selected Subscription and authentication surface.",
+      "enableJsonFlag": false,
+      "flags": {
+        "include-builtin": {
+          "allowNo": false,
+          "name": "include-builtin",
+          "summary": "Include built-in Teams when supported",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Filter by Team name, owner, or ID",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "team:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "team",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "update": {
+      "aliases": [],
+      "args": {},
+      "description": "Check or install the latest version of monkeys CLI and synchronize all official Skills with the same version.",
+      "enableJsonFlag": false,
+      "examples": [
+        "<%= config.bin %> update --check",
+        "<%= config.bin %> update --dry-run",
+        "<%= config.bin %> update"
+      ],
+      "flags": {
+        "check": {
+          "allowNo": false,
+          "name": "check",
+          "summary": "Only check for updates; do not install anything",
+          "type": "boolean"
+        },
+        "dry-run": {
+          "allowNo": false,
+          "name": "dry-run",
+          "summary": "Validate the update and return the exact installation plan without changing anything",
+          "type": "boolean"
+        },
+        "finalize": {
+          "allowNo": false,
+          "exclusive": [
+            "check",
+            "dry-run",
+            "force"
+          ],
+          "hidden": true,
+          "name": "finalize",
+          "type": "boolean"
+        },
+        "finalize-source": {
+          "dependsOn": [
+            "finalize"
+          ],
+          "hasDynamicHelp": false,
+          "hidden": true,
+          "multiple": false,
+          "name": "finalize-source",
+          "options": [
+            "install",
+            "update"
+          ],
+          "type": "option"
+        },
+        "force": {
+          "allowNo": false,
+          "name": "force",
+          "summary": "Reinstall CLI and Skills even if already on the latest version",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "update",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "update.js"
+      ],
+      "strict": true
+    },
+    "user:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get a safe Kernel platform-user profile.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "user:get",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "user",
+        "get.js"
+      ],
+      "strict": true
+    },
+    "user:group:add": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Exact user ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Add direct group memberships using exact IDs or a reviewed frozen plan.",
+      "enableJsonFlag": false,
+      "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
           "type": "option"
         },
-        "output": {
-          "default": "json",
+        "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "output",
-          "options": [
-            "json",
-            "pretty",
-            "table",
-            "ndjson",
-            "csv",
-            "text"
-          ],
-          "summary": "Output format",
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:use",
+      "id": "user:group:add",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13554,21 +15615,22 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "use.js"
+        "user",
+        "group",
+        "add.js"
       ],
       "strict": true
     },
-    "team:get": {
+    "user:group:list": {
       "aliases": [],
       "args": {
         "id": {
-          "description": "Team ID",
+          "description": "Exact target ID",
           "name": "id",
           "required": true
         }
       },
-      "description": "Get one Team visible through the selected Subscription.",
+      "description": "List direct and mapped groups separately for a Kernel user.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13595,11 +15657,55 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -13612,7 +15718,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "team:get",
+      "id": "user:group:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13620,36 +15726,53 @@
       "relativePath": [
         "dist",
         "commands",
-        "team",
-        "get.js"
+        "user",
+        "group",
+        "list.js"
       ],
       "strict": true
     },
-    "team:list": {
+    "user:group:remove": {
       "aliases": [],
-      "args": {},
-      "description": "List Teams visible through the selected Subscription and authentication surface.",
+      "args": {
+        "id": {
+          "description": "Exact user ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Remove direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
-        "include-builtin": {
+        "dry-run": {
           "allowNo": false,
-          "name": "include-builtin",
-          "summary": "Include built-in Teams when supported",
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
           "type": "boolean"
         },
-        "jq": {
-          "char": "q",
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
           "type": "option"
         },
-        "keyword": {
+        "jq": {
+          "char": "q",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "keyword",
-          "summary": "Filter by Team name, owner, or ID",
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
         "output": {
@@ -13691,7 +15814,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -13705,24 +15828,55 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
+          "type": "option"
+        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "team:list",
+      "id": "user:group:remove",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13730,65 +15884,18 @@
       "relativePath": [
         "dist",
         "commands",
-        "team",
-        "list.js"
+        "user",
+        "group",
+        "remove.js"
       ],
       "strict": true
     },
-    "update": {
+    "user:list": {
       "aliases": [],
       "args": {},
-      "description": "Check or install the latest version of monkeys CLI and synchronize all official Skills with the same version.",
+      "description": "List Kernel platform users (not Studio share-target identities).",
       "enableJsonFlag": false,
-      "examples": [
-        "<%= config.bin %> update --check",
-        "<%= config.bin %> update --dry-run",
-        "<%= config.bin %> update"
-      ],
       "flags": {
-        "check": {
-          "allowNo": false,
-          "name": "check",
-          "summary": "Only check for updates; do not install anything",
-          "type": "boolean"
-        },
-        "dry-run": {
-          "allowNo": false,
-          "name": "dry-run",
-          "summary": "Validate the update and return the exact installation plan without changing anything",
-          "type": "boolean"
-        },
-        "finalize": {
-          "allowNo": false,
-          "exclusive": [
-            "check",
-            "dry-run",
-            "force"
-          ],
-          "hidden": true,
-          "name": "finalize",
-          "type": "boolean"
-        },
-        "finalize-source": {
-          "dependsOn": [
-            "finalize"
-          ],
-          "hasDynamicHelp": false,
-          "hidden": true,
-          "multiple": false,
-          "name": "finalize-source",
-          "options": [
-            "install",
-            "update"
-          ],
-          "type": "option"
-        },
-        "force": {
-          "allowNo": false,
-          "name": "force",
-          "summary": "Reinstall CLI and Skills even if already on the latest version",
-          "type": "boolean"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13797,6 +15904,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Search supported user fields",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13813,6 +15927,68 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "user-type": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "user-type",
+          "options": [
+            "human",
+            "agent"
+          ],
+          "summary": "User type",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13823,7 +15999,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "update",
+      "id": "user:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13831,7 +16007,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "update.js"
+        "user",
+        "list.js"
       ],
       "strict": true
     },
@@ -14677,5 +16854,5 @@
       "strict": true
     }
   },
-  "version": "0.12.12"
+  "version": "0.12.14"
 }