@inf-monkeys-tech/monkeys-cli 0.12.13 → 0.12.14

package/oclif.manifest.json

@@ -12141,18 +12141,41 @@
       ],
       "strict": true
     },
-    "identity:get": {
+    "group:create": {
       "aliases": [],
-      "args": {
-        "id": {
-          "description": "User or Agent identity ID",
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Get one user or Agent identity through the selected authentication surface.",
+      "args": {},
+      "description": "Create a custom permission group with no implicit permissions.",
       "enableJsonFlag": false,
       "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
+          "type": "option"
+        },
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
+          "type": "option"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12177,24 +12200,78 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "identity:get",
+      "id": "group:create",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12202,17 +12279,32 @@
       "relativePath": [
         "dist",
         "commands",
-        "identity",
-        "get.js"
+        "group",
+        "create.js"
       ],
       "strict": true
     },
-    "identity:list": {
+    "group:delete": {
       "aliases": [],
-      "args": {},
-      "description": "List users and Agent identities visible through the selected authentication surface.",
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Delete an empty custom group. There is no restore endpoint.",
       "enableJsonFlag": false,
       "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12221,13 +12313,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "keyword": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "keyword",
-          "summary": "Filter by name, email, phone, nickname, or ID",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12267,7 +12352,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -12281,46 +12366,41 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
-        "scope": {
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "scope",
-          "options": [
-            "system",
-            "team"
-          ],
-          "summary": "Agent scope filter on Kernel endpoints",
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
           "type": "option"
         },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
-          "type": "option"
-        },
-        "user-type": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "user-type",
-          "options": [
-            "human",
-            "agent"
-          ],
-          "summary": "Identity type filter on Kernel endpoints",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "identity:list",
+      "id": "group:delete",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12328,28 +12408,23 @@
       "relativePath": [
         "dist",
         "commands",
-        "identity",
-        "list.js"
+        "group",
+        "delete.js"
       ],
       "strict": true
     },
-    "install": {
+    "group:get": {
       "aliases": [],
-      "args": {},
-      "description": "Install this exact CLI release globally and synchronize its exact official Skills.",
+      "args": {
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get a Kernel permission group and its permissions.",
       "enableJsonFlag": false,
-      "examples": [
-        "npx @inf-monkeys-tech/monkeys-cli@latest install",
-        "pnpm dlx @inf-monkeys-tech/monkeys-cli@latest install --package-manager pnpm",
-        "<%= config.bin %> install --dry-run"
-      ],
       "flags": {
-        "dry-run": {
-          "allowNo": false,
-          "name": "dry-run",
-          "summary": "Validate and return the exact installation plan without changing anything",
-          "type": "boolean"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12374,16 +12449,18 @@
           "summary": "Output format",
           "type": "option"
         },
-        "package-manager": {
-          "default": "npm",
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "package-manager",
-          "options": [
-            "npm",
-            "pnpm"
-          ],
-          "summary": "Global package manager that will own the installation",
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -12396,7 +12473,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "install",
+      "id": "group:get",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12404,20 +12481,15 @@
       "relativePath": [
         "dist",
         "commands",
-        "install.js"
+        "group",
+        "get.js"
       ],
       "strict": true
     },
-    "post-review:get": {
+    "group:list": {
       "aliases": [],
-      "args": {
-        "jobId": {
-          "description": "Post-review Job ID",
-          "name": "jobId",
-          "required": true
-        }
-      },
-      "description": "Query the current Team's Workflow post-review records by precise Job ID.",
+      "args": {},
+      "description": "List Kernel permission groups, including system-group protection.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -12444,24 +12516,55 @@
           "summary": "Output format",
           "type": "option"
         },
-        "refresh": {
+        "page-all": {
           "allowNo": false,
-          "name": "refresh",
-          "summary": "Refresh OpenAPI binding information",
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
           "type": "boolean"
         },
-        "subscription": {
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "subscription",
-          "summary": "Subscription name",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
           "type": "option"
         },
-        "team": {
+        "page-limit": {
+          "default": 20,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "team",
-          "summary": "Team ID",
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -12474,7 +12577,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "post-review:get",
+      "id": "group:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12482,29 +12585,44 @@
       "relativePath": [
         "dist",
         "commands",
-        "post-review",
-        "get.js"
+        "group",
+        "list.js"
       ],
       "strict": true
     },
-    "post-review:list": {
+    "group:member:add": {
       "aliases": [],
-      "args": {},
-      "description": "Query the current Team's Workflow post-review job.",
+      "args": {
+        "id": {
+          "description": "Exact group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Add direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
-        "created-from": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "ids": {
           "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "created-from",
-          "summary": "Job creation time lower bound (millisecond timestamp)",
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
           "type": "option"
         },
-        "created-to": {
+        "ids-file": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "created-to",
-          "summary": "Job creation time upper bound (millisecond timestamp)",
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
           "type": "option"
         },
         "jq": {
@@ -12515,30 +12633,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "order": {
-          "default": "DESC",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "order",
-          "options": [
-            "ASC",
-            "DESC"
-          ],
-          "summary": "Sorting direction",
-          "type": "option"
-        },
-        "order-by": {
-          "default": "createdTimestamp",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "order-by",
-          "options": [
-            "createdTimestamp",
-            "updatedTimestamp"
-          ],
-          "summary": "sort field",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12578,7 +12672,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -12592,81 +12686,55 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
-        "policy": {
+        "plan-file": {
           "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "policy",
-          "summary": "Policy ID, repeatable (up to 100)",
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
           "type": "option"
         },
         "refresh": {
           "allowNo": false,
           "name": "refresh",
-          "summary": "Refresh OpenAPI binding information",
+          "summary": "Refresh the published API contract",
           "type": "boolean"
         },
-        "review-execution": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "review-execution",
-          "summary": "Review Workflow Execution ID",
-          "type": "option"
-        },
-        "source-execution": {
+        "report": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "source-execution",
-          "summary": "Source Workflow Execution ID",
-          "type": "option"
-        },
-        "status": {
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "status",
-          "options": [
-            "NOT_REQUIRED",
-            "PENDING",
-            "RUNNING",
-            "PASSED",
-            "REJECTED",
-            "FAILED",
-            "SKIPPED"
-          ],
-          "summary": "review status, repeatable",
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
           "type": "option"
         },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
-          "type": "option"
-        },
-        "team": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "team",
-          "summary": "Team ID",
-          "type": "option"
-        },
-        "workflow": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "workflow",
-          "summary": "Source or Review Workflow ID",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "post-review:list",
+      "id": "group:member:add",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12674,29 +12742,24 @@
       "relativePath": [
         "dist",
         "commands",
-        "post-review",
-        "list.js"
+        "group",
+        "member",
+        "add.js"
       ],
       "strict": true
     },
-    "schema": {
+    "group:member:list": {
       "aliases": [],
       "args": {
-        "path": {
-          "description": "Command path, for example workflow run",
-          "multiple": true,
-          "name": "path"
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
         }
       },
-      "description": "Inspect command arguments, flags, output, risk, dry-run, confirmation, or an OpenAPI operation.",
+      "description": "List directly assigned members of a Kernel permission group.",
       "enableJsonFlag": false,
       "flags": {
-        "include-legacy": {
-          "allowNo": false,
-          "name": "include-legacy",
-          "summary": "Allow viewing ungoverned legacy OpenAPI operations",
-          "type": "boolean"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12705,11 +12768,11 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "operation-id": {
+        "keyword": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "operation-id",
-          "summary": "Inspect an OpenAPI operationId instead of a local command",
+          "name": "keyword",
+          "summary": "Search direct members",
           "type": "option"
         },
         "output": {
@@ -12728,24 +12791,55 @@
           "summary": "Output format",
           "type": "option"
         },
-        "refresh": {
+        "page-all": {
           "allowNo": false,
-          "name": "refresh",
-          "summary": "Force conditional refresh of OpenAPI",
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
           "type": "boolean"
         },
-        "subscription": {
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "subscription",
-          "summary": "Subscription name used for OpenAPI discovery",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
           "type": "option"
         },
-        "team": {
+        "page-limit": {
+          "default": 20,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "team",
-          "summary": "Team ID used for OpenAPI discovery",
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -12758,7 +12852,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "schema",
+      "id": "group:member:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12766,16 +12860,53 @@
       "relativePath": [
         "dist",
         "commands",
-        "schema.js"
+        "group",
+        "member",
+        "list.js"
       ],
       "strict": true
     },
-    "skills:list": {
+    "group:member:remove": {
       "aliases": [],
-      "args": {},
-      "description": "List the official Agent Skills embedded in this exact CLI package version.",
+      "args": {
+        "id": {
+          "description": "Exact group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Remove direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
+        "all-members": {
+          "allowNo": false,
+          "name": "all-members",
+          "summary": "Enumerate all direct members into a dry-run plan only",
+          "type": "boolean"
+        },
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
+          "type": "option"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -12823,7 +12954,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -12837,17 +12968,55 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:list",
+      "id": "group:member:remove",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12855,31 +13024,1612 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "list.js"
+        "group",
+        "member",
+        "remove.js"
       ],
       "strict": true
     },
-    "skills:read": {
+    "group:permission:list": {
       "aliases": [],
       "args": {
-        "name": {
-          "description": "Bundled Skill name",
-          "name": "name",
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
           "required": true
-        },
-        "resource": {
-          "default": "SKILL.md",
-          "description": "Relative resource path inside the Skill",
+        }
+      },
+      "description": "List permissions configured on a group; use --page-all for the complete set.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "group:permission:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "group",
+        "permission",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "group:permission:set": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Replace the complete custom-group permission set; explicit [] clears it.",
+      "enableJsonFlag": false,
+      "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
+          "type": "option"
+        },
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
+          "name": "yes",
+          "summary": "Confirm this privileged operation",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "group:permission:set",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "group",
+        "permission",
+        "set.js"
+      ],
+      "strict": true
+    },
+    "group:update": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Exact custom-group ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Update explicit metadata fields of a custom permission group.",
+      "enableJsonFlag": false,
+      "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
+        },
+        "input-file": {
+          "exclusive": [
+            "input-json"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-file",
+          "summary": "JSON request body file (maximum 10 MiB)",
+          "type": "option"
+        },
+        "input-json": {
+          "exclusive": [
+            "input-file"
+          ],
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "input-json",
+          "summary": "Explicit strict JSON request body",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 100,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "snapshot": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "snapshot",
+          "summary": "New file for the before-state snapshot (never overwritten)",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
+          "name": "yes",
+          "summary": "Confirm this privileged operation",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "group:update",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "group",
+        "update.js"
+      ],
+      "strict": true
+    },
+    "identity:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "User or Agent identity ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get one user or Agent identity through the selected authentication surface.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "identity:get",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "identity",
+        "get.js"
+      ],
+      "strict": true
+    },
+    "identity:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List users and Agent identities visible through the selected authentication surface.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Filter by name, email, phone, nickname, or ID",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "scope": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "scope",
+          "options": [
+            "system",
+            "team"
+          ],
+          "summary": "Agent scope filter on Kernel endpoints",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "user-type": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "user-type",
+          "options": [
+            "human",
+            "agent"
+          ],
+          "summary": "Identity type filter on Kernel endpoints",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "identity:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "identity",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "install": {
+      "aliases": [],
+      "args": {},
+      "description": "Install this exact CLI release globally and synchronize its exact official Skills.",
+      "enableJsonFlag": false,
+      "examples": [
+        "npx @inf-monkeys-tech/monkeys-cli@latest install",
+        "pnpm dlx @inf-monkeys-tech/monkeys-cli@latest install --package-manager pnpm",
+        "<%= config.bin %> install --dry-run"
+      ],
+      "flags": {
+        "dry-run": {
+          "allowNo": false,
+          "name": "dry-run",
+          "summary": "Validate and return the exact installation plan without changing anything",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "package-manager": {
+          "default": "npm",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "package-manager",
+          "options": [
+            "npm",
+            "pnpm"
+          ],
+          "summary": "Global package manager that will own the installation",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "install",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "install.js"
+      ],
+      "strict": true
+    },
+    "permission:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List the existing Kernel permission catalog.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "permission:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "permission",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "post-review:get": {
+      "aliases": [],
+      "args": {
+        "jobId": {
+          "description": "Post-review Job ID",
+          "name": "jobId",
+          "required": true
+        }
+      },
+      "description": "Query the current Team's Workflow post-review records by precise Job ID.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh OpenAPI binding information",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "post-review:get",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "post-review",
+        "get.js"
+      ],
+      "strict": true
+    },
+    "post-review:list": {
+      "aliases": [],
+      "args": {},
+      "description": "Query the current Team's Workflow post-review job.",
+      "enableJsonFlag": false,
+      "flags": {
+        "created-from": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "created-from",
+          "summary": "Job creation time lower bound (millisecond timestamp)",
+          "type": "option"
+        },
+        "created-to": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "created-to",
+          "summary": "Job creation time upper bound (millisecond timestamp)",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "order": {
+          "default": "DESC",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "order",
+          "options": [
+            "ASC",
+            "DESC"
+          ],
+          "summary": "Sorting direction",
+          "type": "option"
+        },
+        "order-by": {
+          "default": "createdTimestamp",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "order-by",
+          "options": [
+            "createdTimestamp",
+            "updatedTimestamp"
+          ],
+          "summary": "sort field",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "policy": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "policy",
+          "summary": "Policy ID, repeatable (up to 100)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh OpenAPI binding information",
+          "type": "boolean"
+        },
+        "review-execution": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "review-execution",
+          "summary": "Review Workflow Execution ID",
+          "type": "option"
+        },
+        "source-execution": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "source-execution",
+          "summary": "Source Workflow Execution ID",
+          "type": "option"
+        },
+        "status": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "status",
+          "options": [
+            "NOT_REQUIRED",
+            "PENDING",
+            "RUNNING",
+            "PASSED",
+            "REJECTED",
+            "FAILED",
+            "SKIPPED"
+          ],
+          "summary": "review status, repeatable",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID",
+          "type": "option"
+        },
+        "workflow": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "workflow",
+          "summary": "Source or Review Workflow ID",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "post-review:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "post-review",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "schema": {
+      "aliases": [],
+      "args": {
+        "path": {
+          "description": "Command path, for example workflow run",
+          "multiple": true,
+          "name": "path"
+        }
+      },
+      "description": "Inspect command arguments, flags, output, risk, dry-run, confirmation, or an OpenAPI operation.",
+      "enableJsonFlag": false,
+      "flags": {
+        "include-legacy": {
+          "allowNo": false,
+          "name": "include-legacy",
+          "summary": "Allow viewing ungoverned legacy OpenAPI operations",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "operation-id": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "operation-id",
+          "summary": "Inspect an OpenAPI operationId instead of a local command",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Force conditional refresh of OpenAPI",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name used for OpenAPI discovery",
+          "type": "option"
+        },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID used for OpenAPI discovery",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "schema",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "schema.js"
+      ],
+      "strict": true
+    },
+    "skills:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List the official Agent Skills embedded in this exact CLI package version.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:list",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "list.js"
+      ],
+      "strict": true
+    },
+    "skills:read": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "Bundled Skill name",
+          "name": "name",
+          "required": true
+        },
+        "resource": {
+          "default": "SKILL.md",
+          "description": "Relative resource path inside the Skill",
           "name": "resource"
         }
       },
-      "description": "Read an embedded same-version Skill entry point or reference without locating the npm package.",
+      "description": "Read an embedded same-version Skill entry point or reference without locating the npm package.",
+      "enableJsonFlag": false,
+      "examples": [
+        "<%= config.bin %> skills read monkeys-shared",
+        "<%= config.bin %> skills read monkeys-data references/data-read.md --jq .data.content"
+      ],
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:read",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "read.js"
+      ],
+      "strict": true
+    },
+    "skills:status": {
+      "aliases": [],
+      "args": {},
+      "description": "Compare the installed Skill synchronization state with this CLI package version and embedded checksums.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:status",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "status.js"
+      ],
+      "strict": true
+    },
+    "skills:sync": {
+      "aliases": [],
+      "args": {},
+      "description": "Synchronize all embedded official Skills to Agent discovery and record their exact CLI version and checksums.",
+      "enableJsonFlag": false,
+      "flags": {
+        "check": {
+          "allowNo": false,
+          "name": "check",
+          "summary": "Only compare synchronization state; do not install Skills",
+          "type": "boolean"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "skills:sync",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "skills",
+        "sync.js"
+      ],
+      "strict": true
+    },
+    "subscription:add": {
+      "aliases": [],
+      "args": {},
+      "description": "Add a Subscription that binds Deployment, Tenant, and Secret references.",
+      "enableJsonFlag": false,
+      "flags": {
+        "credential-fingerprint": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-fingerprint",
+          "summary": "Non-Secret SHA-256 credential fingerprint",
+          "type": "option"
+        },
+        "credential-kind": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "credential-kind",
+          "options": [
+            "api_key",
+            "account_session"
+          ],
+          "required": true,
+          "summary": "Credential type",
+          "type": "option"
+        },
+        "default-team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "default-team",
+          "summary": "Default Team ID",
+          "type": "option"
+        },
+        "deployment": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "deployment",
+          "required": true,
+          "summary": "Deployment name",
+          "type": "option"
+        },
+        "expected-principal": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "expected-principal",
+          "summary": "Expected principal ID",
+          "type": "option"
+        },
+        "expected-surface": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "expected-surface",
+          "options": [
+            "studio",
+            "kernel"
+          ],
+          "summary": "Expected authentication Surface, repeatable",
+          "type": "option"
+        },
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "secret-ref": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "secret-ref",
+          "required": true,
+          "summary": "env:, keyring: or account Session-specific session-file: reference",
+          "type": "option"
+        },
+        "tenant": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "tenant",
+          "required": true,
+          "summary": "Tenant Host",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:add",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "add.js"
+      ],
+      "strict": true
+    },
+    "subscription:current": {
+      "aliases": [],
+      "args": {},
+      "description": "Displays the current manually configured Subscription.",
       "enableJsonFlag": false,
-      "examples": [
-        "<%= config.bin %> skills read monkeys-shared",
-        "<%= config.bin %> skills read monkeys-data references/data-read.md --jq .data.content"
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:current",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "current.js"
       ],
+      "strict": true
+    },
+    "subscription:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List all Subscriptions.",
+      "enableJsonFlag": false,
       "flags": {
         "jq": {
           "char": "q",
@@ -12905,6 +14655,43 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -12915,7 +14702,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:read",
+      "id": "subscription:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12923,15 +14710,76 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "read.js"
+        "subscription",
+        "list.js"
       ],
       "strict": true
     },
-    "skills:status": {
+    "subscription:remove": {
       "aliases": [],
       "args": {},
-      "description": "Compare the installed Skill synchronization state with this CLI package version and embedded checksums.",
+      "description": "Deleting the Subscription; does not delete the credentials in the Secret Store.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "subscription:remove",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "subscription",
+        "remove.js"
+      ],
+      "strict": true
+    },
+    "subscription:show": {
+      "aliases": [],
+      "args": {},
+      "description": "Display the non-Secret configuration of a Subscription.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -12942,6 +14790,14 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -12968,7 +14824,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:status",
+      "id": "subscription:show",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -12976,23 +14832,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "status.js"
+        "subscription",
+        "show.js"
       ],
       "strict": true
     },
-    "skills:sync": {
+    "subscription:test": {
       "aliases": [],
       "args": {},
-      "description": "Synchronize all embedded official Skills to Agent discovery and record their exact CLI version and checksums.",
+      "description": "Network Authentication Subscription's Deployment, Credential, Team, Principal, and Surface.",
       "enableJsonFlag": false,
       "flags": {
-        "check": {
-          "allowNo": false,
-          "name": "check",
-          "summary": "Only compare synchronization state; do not install Skills",
-          "type": "boolean"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13001,6 +14851,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13017,6 +14874,13 @@
           "summary": "Output format",
           "type": "option"
         },
+        "team": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "team",
+          "summary": "Team ID used for this verification",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13027,7 +14891,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "skills:sync",
+      "id": "subscription:test",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13035,22 +14899,46 @@
       "relativePath": [
         "dist",
         "commands",
-        "skills",
-        "sync.js"
+        "subscription",
+        "test.js"
       ],
       "strict": true
     },
-    "subscription:add": {
+    "subscription:update": {
       "aliases": [],
       "args": {},
-      "description": "Add a Subscription that binds Deployment, Tenant, and Secret references.",
+      "description": "Update a Subscription; clearing optional fields must use the explicit clear flag.",
       "enableJsonFlag": false,
       "flags": {
+        "clear-credential-fingerprint": {
+          "allowNo": false,
+          "name": "clear-credential-fingerprint",
+          "summary": "Clear credential fingerprint",
+          "type": "boolean"
+        },
+        "clear-default-team": {
+          "allowNo": false,
+          "name": "clear-default-team",
+          "summary": "Clear default Team",
+          "type": "boolean"
+        },
+        "clear-expected-principal": {
+          "allowNo": false,
+          "name": "clear-expected-principal",
+          "summary": "Clear expected principal",
+          "type": "boolean"
+        },
+        "clear-expected-surfaces": {
+          "allowNo": false,
+          "name": "clear-expected-surfaces",
+          "summary": "Clear expected authentication Surfaces",
+          "type": "boolean"
+        },
         "credential-fingerprint": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "credential-fingerprint",
-          "summary": "Non-Secret SHA-256 credential fingerprint",
+          "summary": "New SHA-256 credential fingerprint",
           "type": "option"
         },
         "credential-kind": {
@@ -13061,30 +14949,28 @@
             "api_key",
             "account_session"
           ],
-          "required": true,
-          "summary": "Credential type",
+          "summary": "New credential type",
           "type": "option"
         },
         "default-team": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "default-team",
-          "summary": "Default Team ID",
+          "summary": "New default Team ID",
           "type": "option"
         },
         "deployment": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "deployment",
-          "required": true,
-          "summary": "Deployment name",
+          "summary": "New Deployment name",
           "type": "option"
         },
         "expected-principal": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "expected-principal",
-          "summary": "Expected principal ID",
+          "summary": "New expected principal ID",
           "type": "option"
         },
         "expected-surface": {
@@ -13095,7 +14981,7 @@
             "studio",
             "kernel"
           ],
-          "summary": "Expected authentication Surface, repeatable",
+          "summary": "New expected authentication Surface, repeatable",
           "type": "option"
         },
         "jq": {
@@ -13134,16 +15020,14 @@
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "secret-ref",
-          "required": true,
-          "summary": "env:, keyring: or account Session-specific session-file: reference",
+          "summary": "New env:, keyring: or account Session-specific session-file: reference",
           "type": "option"
         },
         "tenant": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "tenant",
-          "required": true,
-          "summary": "Tenant Host",
+          "summary": "New Tenant Host",
           "type": "option"
         },
         "yes": {
@@ -13156,7 +15040,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:add",
+      "id": "subscription:update",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13165,14 +15049,14 @@
         "dist",
         "commands",
         "subscription",
-        "add.js"
+        "update.js"
       ],
       "strict": true
     },
-    "subscription:current": {
+    "subscription:use": {
       "aliases": [],
       "args": {},
-      "description": "Displays the current manually configured Subscription.",
+      "description": "Set the current Subscription used by the manual terminal.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13183,6 +15067,14 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "name": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "name",
+          "required": true,
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13209,7 +15101,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:current",
+      "id": "subscription:use",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13218,16 +15110,88 @@
         "dist",
         "commands",
         "subscription",
-        "current.js"
+        "use.js"
       ],
       "strict": true
     },
-    "subscription:list": {
+    "team:get": {
+      "aliases": [],
+      "args": {
+        "id": {
+          "description": "Team ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get one Team visible through the selected Subscription.",
+      "enableJsonFlag": false,
+      "flags": {
+        "jq": {
+          "char": "q",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
+          "type": "option"
+        },
+        "output": {
+          "default": "json",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "output",
+          "options": [
+            "json",
+            "pretty",
+            "table",
+            "ndjson",
+            "csv",
+            "text"
+          ],
+          "summary": "Output format",
+          "type": "option"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
+        "yes": {
+          "allowNo": false,
+          "char": "y",
+          "name": "yes",
+          "summary": "Confirm destructive or privileged operations",
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "team:get",
+      "isESM": true,
+      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
+      "pluginName": "@inf-monkeys-tech/monkeys-cli",
+      "pluginType": "core",
+      "relativePath": [
+        "dist",
+        "commands",
+        "team",
+        "get.js"
+      ],
+      "strict": true
+    },
+    "team:list": {
       "aliases": [],
       "args": {},
-      "description": "List all Subscriptions.",
+      "description": "List Teams visible through the selected Subscription and authentication surface.",
       "enableJsonFlag": false,
       "flags": {
+        "include-builtin": {
+          "allowNo": false,
+          "name": "include-builtin",
+          "summary": "Include built-in Teams when supported",
+          "type": "boolean"
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13236,6 +15200,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Filter by Team name, owner, or ID",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13289,6 +15260,13 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "summary": "Subscription name",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13299,7 +15277,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:list",
+      "id": "team:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13307,78 +15285,65 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
+        "team",
         "list.js"
       ],
       "strict": true
     },
-    "subscription:remove": {
+    "update": {
       "aliases": [],
       "args": {},
-      "description": "Deleting the Subscription; does not delete the credentials in the Secret Store.",
+      "description": "Check or install the latest version of monkeys CLI and synchronize all official Skills with the same version.",
       "enableJsonFlag": false,
+      "examples": [
+        "<%= config.bin %> update --check",
+        "<%= config.bin %> update --dry-run",
+        "<%= config.bin %> update"
+      ],
       "flags": {
-        "jq": {
-          "char": "q",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
-          "type": "option"
+        "check": {
+          "allowNo": false,
+          "name": "check",
+          "summary": "Only check for updates; do not install anything",
+          "type": "boolean"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
+        "dry-run": {
+          "allowNo": false,
+          "name": "dry-run",
+          "summary": "Validate the update and return the exact installation plan without changing anything",
+          "type": "boolean"
         },
-        "output": {
-          "default": "json",
+        "finalize": {
+          "allowNo": false,
+          "exclusive": [
+            "check",
+            "dry-run",
+            "force"
+          ],
+          "hidden": true,
+          "name": "finalize",
+          "type": "boolean"
+        },
+        "finalize-source": {
+          "dependsOn": [
+            "finalize"
+          ],
           "hasDynamicHelp": false,
+          "hidden": true,
           "multiple": false,
-          "name": "output",
+          "name": "finalize-source",
           "options": [
-            "json",
-            "pretty",
-            "table",
-            "ndjson",
-            "csv",
-            "text"
+            "install",
+            "update"
           ],
-          "summary": "Output format",
           "type": "option"
         },
-        "yes": {
+        "force": {
           "allowNo": false,
-          "char": "y",
-          "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "name": "force",
+          "summary": "Reinstall CLI and Skills even if already on the latest version",
           "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "subscription:remove",
-      "isESM": true,
-      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
-      "pluginName": "@inf-monkeys-tech/monkeys-cli",
-      "pluginType": "core",
-      "relativePath": [
-        "dist",
-        "commands",
-        "subscription",
-        "remove.js"
-      ],
-      "strict": true
-    },
-    "subscription:show": {
-      "aliases": [],
-      "args": {},
-      "description": "Display the non-Secret configuration of a Subscription.",
-      "enableJsonFlag": false,
-      "flags": {
+        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13387,14 +15352,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13421,7 +15378,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:show",
+      "id": "update",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13429,15 +15386,20 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "show.js"
+        "update.js"
       ],
       "strict": true
     },
-    "subscription:test": {
+    "user:get": {
       "aliases": [],
-      "args": {},
-      "description": "Network Authentication Subscription's Deployment, Credential, Team, Principal, and Surface.",
+      "args": {
+        "id": {
+          "description": "Exact target ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Get a safe Kernel platform-user profile.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13448,13 +15410,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13471,11 +15426,18 @@
           "summary": "Output format",
           "type": "option"
         },
-        "team": {
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "team",
-          "summary": "Team ID used for this verification",
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -13488,7 +15450,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:test",
+      "id": "user:get",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13496,89 +15458,44 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "test.js"
+        "user",
+        "get.js"
       ],
       "strict": true
     },
-    "subscription:update": {
+    "user:group:add": {
       "aliases": [],
-      "args": {},
-      "description": "Update a Subscription; clearing optional fields must use the explicit clear flag.",
+      "args": {
+        "id": {
+          "description": "Exact user ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Add direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
-        "clear-credential-fingerprint": {
-          "allowNo": false,
-          "name": "clear-credential-fingerprint",
-          "summary": "Clear credential fingerprint",
-          "type": "boolean"
-        },
-        "clear-default-team": {
-          "allowNo": false,
-          "name": "clear-default-team",
-          "summary": "Clear default Team",
-          "type": "boolean"
-        },
-        "clear-expected-principal": {
-          "allowNo": false,
-          "name": "clear-expected-principal",
-          "summary": "Clear expected principal",
-          "type": "boolean"
-        },
-        "clear-expected-surfaces": {
+        "dry-run": {
           "allowNo": false,
-          "name": "clear-expected-surfaces",
-          "summary": "Clear expected authentication Surfaces",
-          "type": "boolean"
-        },
-        "credential-fingerprint": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "credential-fingerprint",
-          "summary": "New SHA-256 credential fingerprint",
-          "type": "option"
-        },
-        "credential-kind": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "credential-kind",
-          "options": [
-            "api_key",
-            "account_session"
+          "exclusive": [
+            "yes"
           ],
-          "summary": "New credential type",
-          "type": "option"
-        },
-        "default-team": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "default-team",
-          "summary": "New default Team ID",
-          "type": "option"
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
+          "type": "boolean"
         },
-        "deployment": {
+        "ids": {
           "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "deployment",
-          "summary": "New Deployment name",
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
           "type": "option"
         },
-        "expected-principal": {
+        "ids-file": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "expected-principal",
-          "summary": "New expected principal ID",
-          "type": "option"
-        },
-        "expected-surface": {
-          "hasDynamicHelp": false,
-          "multiple": true,
-          "name": "expected-surface",
-          "options": [
-            "studio",
-            "kernel"
-          ],
-          "summary": "New expected authentication Surface, repeatable",
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
           "type": "option"
         },
         "jq": {
@@ -13589,14 +15506,6 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
-        "name": {
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
-          "type": "option"
-        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13613,92 +15522,92 @@
           "summary": "Output format",
           "type": "option"
         },
-        "secret-ref": {
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "secret-ref",
-          "summary": "New env:, keyring: or account Session-specific session-file: reference",
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
           "type": "option"
         },
-        "tenant": {
+        "page-limit": {
+          "default": 20,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "tenant",
-          "summary": "New Tenant Host",
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
           "type": "option"
         },
-        "yes": {
-          "allowNo": false,
-          "char": "y",
-          "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "subscription:update",
-      "isESM": true,
-      "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
-      "pluginName": "@inf-monkeys-tech/monkeys-cli",
-      "pluginType": "core",
-      "relativePath": [
-        "dist",
-        "commands",
-        "subscription",
-        "update.js"
-      ],
-      "strict": true
-    },
-    "subscription:use": {
-      "aliases": [],
-      "args": {},
-      "description": "Set the current Subscription used by the manual terminal.",
-      "enableJsonFlag": false,
-      "flags": {
-        "jq": {
-          "char": "q",
+        "page-size": {
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
+          "name": "page-size",
+          "summary": "Results requested per page",
           "type": "option"
         },
-        "name": {
+        "page-token": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "name",
-          "required": true,
-          "summary": "Subscription name",
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
           "type": "option"
         },
-        "output": {
-          "default": "json",
+        "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "output",
-          "options": [
-            "json",
-            "pretty",
-            "table",
-            "ndjson",
-            "csv",
-            "text"
-          ],
-          "summary": "Output format",
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "subscription:use",
+      "id": "user:group:add",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13706,21 +15615,22 @@
       "relativePath": [
         "dist",
         "commands",
-        "subscription",
-        "use.js"
+        "user",
+        "group",
+        "add.js"
       ],
       "strict": true
     },
-    "team:get": {
+    "user:group:list": {
       "aliases": [],
       "args": {
         "id": {
-          "description": "Team ID",
+          "description": "Exact target ID",
           "name": "id",
           "required": true
         }
       },
-      "description": "Get one Team visible through the selected Subscription.",
+      "description": "List direct and mapped groups separately for a Kernel user.",
       "enableJsonFlag": false,
       "flags": {
         "jq": {
@@ -13747,11 +15657,55 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
@@ -13764,7 +15718,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "team:get",
+      "id": "user:group:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13772,36 +15726,53 @@
       "relativePath": [
         "dist",
         "commands",
-        "team",
-        "get.js"
+        "user",
+        "group",
+        "list.js"
       ],
       "strict": true
     },
-    "team:list": {
+    "user:group:remove": {
       "aliases": [],
-      "args": {},
-      "description": "List Teams visible through the selected Subscription and authentication surface.",
+      "args": {
+        "id": {
+          "description": "Exact user ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Remove direct group memberships using exact IDs or a reviewed frozen plan.",
       "enableJsonFlag": false,
       "flags": {
-        "include-builtin": {
+        "dry-run": {
           "allowNo": false,
-          "name": "include-builtin",
-          "summary": "Include built-in Teams when supported",
+          "exclusive": [
+            "yes"
+          ],
+          "name": "dry-run",
+          "summary": "Preview only; send no mutation request",
           "type": "boolean"
         },
-        "jq": {
-          "char": "q",
+        "ids": {
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "name": "ids",
+          "summary": "Exact counterpart IDs: group IDs for user scope, user IDs for group scope",
+          "type": "option"
+        },
+        "ids-file": {
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "jq",
-          "summary": "Filter the JSON result with a jq expression",
+          "name": "ids-file",
+          "summary": "JSON array of exact counterpart IDs",
           "type": "option"
         },
-        "keyword": {
+        "jq": {
+          "char": "q",
           "hasDynamicHelp": false,
           "multiple": false,
-          "name": "keyword",
-          "summary": "Filter by Team name, owner, or ID",
+          "name": "jq",
+          "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
         "output": {
@@ -13843,7 +15814,7 @@
           "type": "option"
         },
         "page-size": {
-          "default": 20,
+          "default": 100,
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "page-size",
@@ -13857,24 +15828,55 @@
           "summary": "Opaque token returned as pageInfo.nextPageToken",
           "type": "option"
         },
+        "plan-file": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-file",
+          "summary": "Reviewed frozen plan; required for bulk execution",
+          "type": "option"
+        },
+        "plan-out": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "plan-out",
+          "summary": "New file for the dry-run frozen plan (never overwritten)",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "report": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "report",
+          "summary": "New file for the initial recovery report; receipt paths are returned",
+          "type": "option"
+        },
         "subscription": {
           "hasDynamicHelp": false,
           "multiple": false,
           "name": "subscription",
-          "summary": "Subscription name",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
           "type": "option"
         },
         "yes": {
           "allowNo": false,
           "char": "y",
+          "exclusive": [
+            "dry-run"
+          ],
           "name": "yes",
-          "summary": "Confirm destructive or privileged operations",
+          "summary": "Confirm this privileged operation",
           "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "team:list",
+      "id": "user:group:remove",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13882,65 +15884,18 @@
       "relativePath": [
         "dist",
         "commands",
-        "team",
-        "list.js"
+        "user",
+        "group",
+        "remove.js"
       ],
       "strict": true
     },
-    "update": {
+    "user:list": {
       "aliases": [],
       "args": {},
-      "description": "Check or install the latest version of monkeys CLI and synchronize all official Skills with the same version.",
+      "description": "List Kernel platform users (not Studio share-target identities).",
       "enableJsonFlag": false,
-      "examples": [
-        "<%= config.bin %> update --check",
-        "<%= config.bin %> update --dry-run",
-        "<%= config.bin %> update"
-      ],
       "flags": {
-        "check": {
-          "allowNo": false,
-          "name": "check",
-          "summary": "Only check for updates; do not install anything",
-          "type": "boolean"
-        },
-        "dry-run": {
-          "allowNo": false,
-          "name": "dry-run",
-          "summary": "Validate the update and return the exact installation plan without changing anything",
-          "type": "boolean"
-        },
-        "finalize": {
-          "allowNo": false,
-          "exclusive": [
-            "check",
-            "dry-run",
-            "force"
-          ],
-          "hidden": true,
-          "name": "finalize",
-          "type": "boolean"
-        },
-        "finalize-source": {
-          "dependsOn": [
-            "finalize"
-          ],
-          "hasDynamicHelp": false,
-          "hidden": true,
-          "multiple": false,
-          "name": "finalize-source",
-          "options": [
-            "install",
-            "update"
-          ],
-          "type": "option"
-        },
-        "force": {
-          "allowNo": false,
-          "name": "force",
-          "summary": "Reinstall CLI and Skills even if already on the latest version",
-          "type": "boolean"
-        },
         "jq": {
           "char": "q",
           "hasDynamicHelp": false,
@@ -13949,6 +15904,13 @@
           "summary": "Filter the JSON result with a jq expression",
           "type": "option"
         },
+        "keyword": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "keyword",
+          "summary": "Search supported user fields",
+          "type": "option"
+        },
         "output": {
           "default": "json",
           "hasDynamicHelp": false,
@@ -13965,6 +15927,68 @@
           "summary": "Output format",
           "type": "option"
         },
+        "page-all": {
+          "allowNo": false,
+          "name": "page-all",
+          "summary": "Fetch consecutive pages automatically",
+          "type": "boolean"
+        },
+        "page-delay": {
+          "default": 0,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-delay",
+          "summary": "Delay between automatic page requests in milliseconds",
+          "type": "option"
+        },
+        "page-limit": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-limit",
+          "summary": "Maximum pages fetched with --page-all",
+          "type": "option"
+        },
+        "page-size": {
+          "default": 20,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-size",
+          "summary": "Results requested per page",
+          "type": "option"
+        },
+        "page-token": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "page-token",
+          "summary": "Opaque token returned as pageInfo.nextPageToken",
+          "type": "option"
+        },
+        "refresh": {
+          "allowNo": false,
+          "name": "refresh",
+          "summary": "Refresh the published API contract",
+          "type": "boolean"
+        },
+        "subscription": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "subscription",
+          "required": true,
+          "summary": "Explicit Kernel Subscription name (global scope, no Team)",
+          "type": "option"
+        },
+        "user-type": {
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "name": "user-type",
+          "options": [
+            "human",
+            "agent"
+          ],
+          "summary": "User type",
+          "type": "option"
+        },
         "yes": {
           "allowNo": false,
           "char": "y",
@@ -13975,7 +15999,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "update",
+      "id": "user:list",
       "isESM": true,
       "pluginAlias": "@inf-monkeys-tech/monkeys-cli",
       "pluginName": "@inf-monkeys-tech/monkeys-cli",
@@ -13983,7 +16007,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "update.js"
+        "user",
+        "list.js"
       ],
       "strict": true
     },
@@ -14829,5 +16854,5 @@
       "strict": true
     }
   },
-  "version": "0.12.13"
+  "version": "0.12.14"
 }