@knowttl/artium-axi 0.0.4 → 0.0.6

package/bin/artium-axi.mjs

@@ -19692,7 +19692,7 @@ var definitions = {
   PASSWORD_FILE_INVALID: { status: 400, message: "The password file is missing or unreadable.", next: "Supply a readable UTF-8 password file containing the exact password, without an added newline." },
   BOOTSTRAP_INCONSISTENT: { status: 503, message: "The store contains data without a bootstrap marker.", next: "Stop the server and restore a consistent bootstrapped store and matching master key." },
   RECOVERY_FAILED: { status: 500, message: "Administrator recovery did not complete.", next: "Use an existing local username in a bootstrapped store, check the matching master key and inspect local storage." },
-  PASSWORD_INVALID: { status: 400, message: "The password does not meet the local password rules.", next: "Use 15 to 128 Unicode code points, at most 512 UTF-8 bytes, and avoid common passwords." },
+  PASSWORD_INVALID: { status: 400, message: "The password must be non-empty and at most 512 UTF-8 bytes.", next: "Enter a password of at most 512 UTF-8 bytes." },
   SIGN_IN_FAILED: { status: 401, message: "The username or password is incorrect.", next: "Check your username and password." },
   SSO_STATE_INVALID: { status: 400, message: "The SSO sign-in request expired or was already used.", next: "Start a new sign-in from this browser." },
   SSO_TOKEN_INVALID: { status: 401, message: "The identity provider response could not be verified.", next: "Start a new sign-in or ask an administrator to check provider settings." },
@@ -19711,7 +19711,7 @@ var definitions = {
   MAINTENANCE_BUSY: { status: 503, message: "The store is held by another server or maintenance process.", next: "Stop the server and wait for maintenance to finish before retrying." },
   MAINTENANCE_UNAVAILABLE: { status: 503, message: "The store maintenance lock is unavailable.", next: "Check data-volume capacity and permissions." },
   ROTATION_FAILED: { status: 500, message: "Master key rotation did not complete.", next: "Keep both keys. Inspect the durable key_rotations receipt and restart with its latest new_key_id, or the old key if no rotation committed." },
-  CLIENT_CONFIG_INVALID: { status: 400, message: "The CLI server configuration is invalid.", next: "Set ARTIUM_AXI_URL to an HTTPS URL; optionally set ARTIUM_AXI_CA_FILE. Windows requires APPDATA." },
+  CLIENT_CONFIG_INVALID: { status: 400, message: "The CLI server configuration is invalid.", next: "Set ARTIUM_AXI_URL to an HTTPS URL; optionally set ARTIUM_AXI_CA_FILE." },
   SESSION_STORAGE_UNAVAILABLE: { status: 500, message: "Secure CLI session storage is unavailable.", next: "Check your configuration folder permissions and capacity, then sign in again." },
   SESSION_SERVER_MISMATCH: { status: 400, message: "The stored session belongs to a different server.", next: "Restore ARTIUM_AXI_URL or use artium-axi logout before signing in to the new server." },
   SESSION_BUSY: { status: 503, message: "Another CLI process holds the session lock.", next: "Wait for the other CLI process. If all CLI processes exited, remove the session.lock directory in your artium-axi configuration folder." },
@@ -19729,9 +19729,14 @@ var definitions = {
   TOOL_DISABLED: { status: 403, message: "The tool is disabled.", next: "Ask the administrator to enable the tool." },
   TOOL_NOT_GRANTED: { status: 403, message: "The user has no role granting this tool.", next: "Ask the administrator to assign a role granting the tool." },
   MASTER_KEY_INVALID: { status: 503, message: "The master key is missing or invalid.", next: "Supply a 32-byte master key file or a base64 master key." },
-  CREDENTIAL_INVALID: { status: 503, message: "A stored credential could not be authenticated or contains malformed JSON.", next: "Restore the matching master key and an intact credential store containing valid credential JSON." },
+  CREDENTIAL_INVALID: { status: 503, message: "The stored credential is invalid.", next: "Ask an administrator to check the named field, matching master key and credential JSON, then save and test again." },
   FLAG_BLOCKED: { status: 400, message: "The arguments override the managed tool boundary.", next: "Remove destination, tenant, credential or local configuration overrides." },
-  CREDENTIAL_UNAVAILABLE: { status: 503, message: "The tool credential is unavailable.", next: "Ask the administrator to check the tool configuration and stored credentials." },
+  CREDENTIAL_NOT_CONFIGURED: { status: 503, message: "No credential is configured for the tool.", next: "Ask an administrator to save a credential and run Test credential." },
+  UPSTREAM_AUTH_FAILED: { status: 503, message: "The upstream service rejected the credential.", next: "Ask an administrator to check the provider code, identity, secret expiry and permissions, then test again." },
+  UPSTREAM_NETWORK_FAILED: { status: 503, message: "The upstream service could not be reached.", next: "Ask an administrator to check DNS, routing, firewall rules and the diagnostic host and stage." },
+  UPSTREAM_TLS_FAILED: { status: 503, message: "The upstream certificate could not be verified.", next: "Ask an administrator to check the host, certificate chain and trusted CA configuration." },
+  TOOL_REJECTED_INPUT: { status: 503, message: "The tool rejected its configuration or arguments.", next: "Ask an administrator to correct the field or combination named by the tool and test again." },
+  TOOL_FAILED: { status: 503, message: "The tool exited unsuccessfully.", next: "Ask an administrator to inspect the diagnostic message and hint from Test credential." },
   INVALID_INPUT: { status: 400, message: "The request input is invalid.", next: "Check the request fields and content type." },
   UNSUPPORTED_INPUT: { status: 400, message: "The input file is not a matching upload.", next: "Upload the file using a reviewed input-file flag." },
   SECRET_IN_OUTPUT: { status: 500, message: "A known secret was detected in tool output.", next: "Check upstream output redaction before retrying." },
@@ -19758,6 +19763,7 @@ var ArtiumError = class extends Error {
   }
   code;
   requestId;
+  diagnostic;
   source;
   next;
 };
@@ -19776,10 +19782,7 @@ var inputLimits = {
   files: 8
 };
 var byteLength = (value) => new TextEncoder().encode(value).length;
-var passwordSchema = external_exports.string().refine((value) => {
-  const length = [...value].length;
-  return length >= 15 && length <= 128 && byteLength(value) <= 512;
-}, "Expected 15 to 128 Unicode code points and at most 512 UTF-8 bytes");
+var passwordSchema = external_exports.string().min(1).refine((value) => byteLength(value) <= 512, "Expected at most 512 UTF-8 bytes");
 var passwordChangeSchema = external_exports.strictObject({ newPassword: external_exports.string(), currentPassword: external_exports.string().optional() });
 var loginSchema = external_exports.strictObject({ username: external_exports.string(), password: external_exports.string() });
 var refreshSchema = external_exports.strictObject({ refreshToken: external_exports.string().min(1) });
@@ -19823,7 +19826,7 @@ var meResponseSchema = external_exports.strictObject({
   accessExpiresAt: external_exports.number().int()
 });
 var accountId = external_exports.string().min(1);
-var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi"]);
+var toolSchema = external_exports.enum(["falcon-axi", "vectra-axi", "az-axi", "mg-axi", "ldap-axi", "ado-axi"]);
 var skillsResponseSchema = external_exports.strictObject({ skills: external_exports.array(external_exports.strictObject({
   name: toolSchema,
   content: external_exports.string().min(1)
@@ -20044,6 +20047,7 @@ var adminAuditRoute = {
 };
 var nativeSettingsSchemas = {
   "ldap-axi": external_exports.strictObject({}),
+  "ado-axi": external_exports.strictObject({ allowWrites: external_exports.boolean().optional() }),
   "mg-axi": external_exports.strictObject({ preview: external_exports.boolean().optional(), writes: external_exports.strictObject({
     allowWrites: external_exports.boolean(),
     operations: external_exports.array(external_exports.string().min(1).max(256)).min(1).max(64)
@@ -20061,8 +20065,21 @@ var nativeSettingsSchemas = {
     allowWrites: external_exports.boolean().optional()
   })
 };
+var diagnosticSchema = external_exports.strictObject({
+  stage: external_exports.enum(["configuration", "token acquisition", "DNS", "TCP", "TLS", "authentication", "tool run"]),
+  message: external_exports.string().max(4096),
+  toolCode: external_exports.string().max(80).optional(),
+  providerCode: external_exports.string().max(80).optional(),
+  hint: external_exports.string().max(4096).optional(),
+  host: external_exports.string().max(4096).optional(),
+  issuer: external_exports.string().max(4096).optional(),
+  trust: external_exports.enum(["self-signed", "untrusted"]).optional(),
+  checkedAt: external_exports.number().int().optional(),
+  credentialRevision: external_exports.number().int().nullable().optional()
+});
 var healthSchema = external_exports.strictObject({
   status: external_exports.enum(["unconfigured", "unknown", "ok", "error", "disabled"]),
+  diagnostic: diagnosticSchema.optional(),
   readOnly: external_exports.boolean().default(true),
   checkedAt: external_exports.number().int().nullable(),
   credentialRevision: external_exports.number().int().nullable(),
@@ -20085,7 +20102,9 @@ var adminCredentialSchema = external_exports.strictObject({
   metadata: external_exports.record(external_exports.string(), external_exports.unknown()),
   revision: external_exports.number().int().nonnegative(),
   updatedAt: external_exports.number().int().nullable(),
-  updatedBy: accountId.nullable()
+  updatedBy: accountId.nullable(),
+  // Save/replacement reports name fields and changes, never submitted values.
+  normalizations: external_exports.array(external_exports.strictObject({ field: external_exports.string(), reason: external_exports.string() })).optional()
 });
 var adminToolParamsSchema = external_exports.strictObject({ tool: toolSchema });
 var adminToolRoutes = {
@@ -20133,11 +20152,14 @@ var adminToolRoutes = {
   // Certificate auth for Azure/Graph also accepts value.certificatePem containing one
   // certificate and matching unencrypted private key; the host derives the fingerprint.
   // Omitted optional non-secret fields are removed; explicit empty or null secrets are invalid.
-  // Changing mode, kind, auth, tenantId, clientId or origin requires new secrets.
+  // Changing mode, kind, auth, tenantId, clientId, origin or org requires new secrets.
   // Native settings are retained; edits belong to patch above and are rejected inside value here.
   // Both current revisions are required (credential revision 0 before first save);
   // stale edits fail with REVISION_CONFLICT without mutation.
   // PUT remains a complete replacement of credentials and native settings.
+  // Profile-backed saves and replacements normalize rejected input using schema
+  // rules before validation. Already valid values remain byte for byte unchanged.
+  // INVALID_INPUT names invalid fields and rules without echoing their values.
   save: {
     method: "PATCH",
     path: "/v1/admin/tools/:tool/credential",
@@ -20438,7 +20460,8 @@ var errorResponseSchema = external_exports.strictObject({
     source: external_exports.literal("artium-axi"),
     message: external_exports.string().min(1).refine((value) => !/[\r\n\0]/.test(value)),
     next: external_exports.string().min(1),
-    requestId: external_exports.string().min(1)
+    requestId: external_exports.string().min(1),
+    diagnostic: diagnosticSchema.optional()
   })
 });
 var runResponseSchema = external_exports.union([runSuccessSchema, errorResponseSchema]);
@@ -20452,7 +20475,7 @@ import { rootCertificates } from "node:tls";
 // package.json
 var package_default = {
   name: "artium-axi",
-  version: "0.0.4",
+  version: "0.0.6",
   private: true,
   license: "MIT",
   type: "module",
@@ -20484,11 +20507,13 @@ var package_default = {
     "hygiene:check": "node scripts/hygiene-check.mjs"
   },
   devDependencies: {
+    "@actions/expressions": "0.3.61",
     "@types/better-sqlite3": "9.6.0",
     "@types/node": "22.20.5",
     esbuild: "0.28.2",
     typescript: "5.9.3",
-    vitest: "4.1.0"
+    vitest: "4.1.0",
+    yaml: "2.9.1"
   },
   pnpm: {
     onlyBuiltDependencies: [
@@ -20525,7 +20550,7 @@ import { randomUUID } from "node:crypto";
 function sessionPath(platform = process.platform, environment = process.env, home = homedir()) {
   const paths = platform === "win32" ? win32 : { join };
   const base = platform === "win32" ? environment.APPDATA : environment.XDG_CONFIG_HOME || join(home, ".config");
-  if (!base) throw new ArtiumError("CLIENT_CONFIG_INVALID");
+  if (!base) throw new ArtiumError("CLIENT_CONFIG_INVALID", void 0, "Set APPDATA to your writable roaming configuration folder, then sign in again.");
   return paths.join(base, "artium-axi", "session.json");
 }
 function restrictWindowsAcl(path, directory) {
@@ -20636,21 +20661,24 @@ var SessionStore = class {
 // src/cli/http.ts
 var DEFAULT_REQUEST_DEADLINE_MS = 9e4;
 var Client = class {
-  constructor(environment = process.env, managed2) {
+  constructor(environment = process.env, managed2, requestDeadlineMs = DEFAULT_REQUEST_DEADLINE_MS) {
     this.environment = environment;
     this.managed = managed2;
+    this.requestDeadlineMs = requestDeadlineMs;
     try {
       const url2 = new URL(environment.ARTIUM_AXI_URL);
       if (url2.username || url2.password || url2.href.includes("?") || url2.href.includes("#") || url2.protocol !== "https:" && !(url2.protocol === "http:" && environment.ARTIUM_AXI_TEST_HTTP === "1" && ["localhost", "127.0.0.1", "[::1]"].includes(url2.hostname))) throw new Error();
       this.serverUrl = url2.href.replace(/\/$/, "");
       if (!managed2) this.storedSessions = new SessionStore(this.serverUrl, sessionPath(process.platform, environment));
-    } catch {
+    } catch (error62) {
+      if (error62 instanceof ArtiumError) throw error62;
       throw new ArtiumError("CLIENT_CONFIG_INVALID");
     }
     managed2?.checkServer(this.serverUrl);
   }
   environment;
   managed;
+  requestDeadlineMs;
   serverUrl;
   storedSessions;
   get sessions() {
@@ -20668,7 +20696,7 @@ var Client = class {
     }
     const body = input2 === void 0 ? void 0 : JSON.stringify(input2);
     const controller = new AbortController();
-    const deadline = setTimeout(() => controller.abort(), DEFAULT_REQUEST_DEADLINE_MS);
+    const deadline = setTimeout(() => controller.abort(), this.requestDeadlineMs);
     const url2 = new URL(`${this.serverUrl}${path}`);
     const result = await new Promise((resolve3, reject) => {
       const request = (url2.protocol === "https:" ? httpsRequest : httpRequest)(url2, {
@@ -20821,7 +20849,8 @@ async function readPassword(stdin, environmentVariable) {
 }
 
 // src/cli/doctor.ts
-async function doctor(createClient = () => new Client(), write = (text2) => {
+var DIAGNOSTIC_REQUEST_DEADLINE_MS = 5e3;
+async function doctor(createClient = (deadline) => new Client(process.env, void 0, deadline), write = (text2) => {
   process.stdout.write(text2);
 }) {
   let failure2;
@@ -20832,21 +20861,23 @@ async function doctor(createClient = () => new Client(), write = (text2) => {
   };
   let client;
   try {
-    client = createClient();
+    client = createClient(DIAGNOSTIC_REQUEST_DEADLINE_MS);
   } catch (error62) {
     for (const name of ["server address", "certificate", "token", "CLI version"]) line(name, false, "CLIENT_CONFIG_INVALID");
     throw error62;
   }
+  let addressOk = false;
   try {
     const live = await client.request("/health/live", "GET");
-    const ok = !!live && typeof live === "object" && "status" in live && live.status === "ok";
-    line("server address", ok);
+    addressOk = !!live && typeof live === "object" && "status" in live && live.status === "ok";
+    line("server address", addressOk);
     line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : "test HTTP", new ArtiumError("CLIENT_CONFIG_INVALID"));
   } catch (error62) {
     const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
     line("server address", cause.code === "CERTIFICATE_INVALID", cause.code, cause);
     line("certificate", client.certificateVerified, client.certificateVerified ? void 0 : cause.code, cause);
   }
+  if (!addressOk && failure2) throw failure2;
   let versionOk = true;
   let versionError;
   try {
@@ -20872,7 +20903,7 @@ async function doctor(createClient = () => new Client(), write = (text2) => {
         tool.name,
         tool.status === "ok",
         tool.status,
-        new ArtiumError(tool.status === "unconfigured" || tool.status === "error" ? "CREDENTIAL_UNAVAILABLE" : tool.status === "disabled" ? "TOOL_DISABLED" : "SERVER_UNAVAILABLE")
+        new ArtiumError(tool.status === "unconfigured" ? "CREDENTIAL_NOT_CONFIGURED" : tool.status === "error" ? "TOOL_FAILED" : tool.status === "disabled" ? "TOOL_DISABLED" : "SERVER_UNAVAILABLE")
       );
     } catch (error62) {
       const cause = error62 instanceof ArtiumError ? error62 : new ArtiumError("INVALID_RESPONSE");
@@ -22889,24 +22920,104 @@ var commands = {
     purpose: "Read directory data with the managed LDAP bind identity.",
     flags: ["Arguments after ldap-axi are forwarded upstream, including --help."],
     example: `artium-axi ldap-axi ${ldap_axi_default.discovery.example.join(" ")}`
+  },
+  "ado-axi": {
+    usage: "artium-axi ado-axi [<args>]",
+    purpose: "Run Azure DevOps commands with a managed PAT.",
+    flags: ["Arguments after ado-axi include --help. Organization and credentials are managed by Artium; api is GET only; writes are off by default."],
+    example: "artium-axi ado-axi project list --limit 1"
+  },
+  "az-axi": {
+    usage: "artium-axi az-axi [<args>]",
+    purpose: "Run Azure commands with your managed identity.",
+    flags: ["Arguments after az-axi are forwarded upstream, including --help."],
+    example: "artium-axi az-axi sub list"
+  },
+  "mg-axi": {
+    usage: "artium-axi mg-axi [<args>]",
+    purpose: "Run Microsoft Graph commands with your managed identity.",
+    flags: ["Arguments after mg-axi are forwarded upstream, including --help."],
+    example: "artium-axi mg-axi entra user list"
+  },
+  "managed-session": {
+    usage: "artium-axi --managed-session <command> [<args>]",
+    purpose: "Let a caller supply and persist sessions through private pipes.",
+    flags: [],
+    example: "artium-axi --managed-session whoami"
   }
 };
 function commandHelp(command) {
   const entry = commands[command];
   const flags = [
-    command === "falcon-axi" || command === "vectra-axi" || command === "ldap-axi" ? "--help before the tool name (default false)" : "--help (default false)",
+    toolSchema.safeParse(command).success ? "--help before the tool name (default false)" : "--help (default false)",
     ...entry.flags,
-    "--managed-session before the command (default false; login and authenticated calls; session JSON on inherited pipe fd 3, new sessions and rotations as JSON lines on private pipe fd 4; no session file)",
+    "--managed-session before the command (default false; caller-owned sessions; see artium-axi --managed-session --help)"
+  ];
+  const protocol = [
+    "Session JSON on inherited pipe fd 3, new sessions and rotations as JSON lines on private pipe fd 4; no session file.",
     "Managed input: {serverUrl, accessToken, refreshToken?}; close fd 3 after JSON (64 KiB maximum). Output: {serverUrl, status, accessToken, refreshToken, accessExpiresAt, familyExpiresAt} per rotation, before retry, including on later failure.",
     "Managed login: fd 3 is unused; fd 4 must be a writable private pipe/socket. Local sign-in requires --username <username> --password-stdin with protected inherited stdin; password argv and ARTIUM_AXI_PASSWORD are refused. SSO uses login --sso and displays browser approval instructions immediately. New sessions use the rotation envelope; password-change-required returns {serverUrl, status, passwordChangeToken, passwordChangeExpiresAt} on fd 4 and exits 1.",
     "Managed exits: 0 success; 2 invalid JSON/descriptors or refused passwd/logout/setup; 1 authentication/transport failure; tool exit codes pass through. Only TOKEN_EXPIRED permits one refresh/retry; without refreshToken or on refusal, return control to the caller."
   ];
-  return `usage: ${entry.usage}
-purpose: ${entry.purpose}
-flags[${flags.length}]:
+  const purposes = command === "home" ? `commands[${Object.keys(commands).length - 2}]{command,purpose}:
+${Object.entries(commands).filter(([name]) => name !== "home" && name !== "managed-session").map(([name, value]) => `  ${name},${JSON.stringify(value.purpose)}`).join("\n")}
+` : "";
+  return `purpose: ${entry.purpose}
+usage: ${entry.usage}
+${purposes}flags[${flags.length}]:
 ${flags.map((flag) => `  - ${JSON.stringify(flag)}`).join("\n")}
 example: ${entry.example}
-`;
+` + (command === "login" || command === "managed-session" ? `managedSession[${protocol.length}]:
+${protocol.map((line) => `  - ${JSON.stringify(line)}`).join("\n")}
+` : "");
+}
+function validateArguments(args, prefixHelp) {
+  const command = args[0];
+  if (command === "tools") args = [...args.filter((arg) => arg !== "--help"), ...args.filter((arg) => arg === "--help")];
+  const rootFlags = "--help, --version, --managed-session (before the command)";
+  const rootCommands = Object.keys(commands).filter((name) => name !== "home" && name !== "managed-session" && name !== "tools show").join(", ");
+  function fail(token, level2, choices2) {
+    const kind = token?.startsWith("-") ? "flag" : "argument";
+    const message = token === void 0 ? `Missing argument for ${level2}.` : command === "login" || command === "passwd" ? `Unexpected argument at position ${args.indexOf(token) + 1} for ${level2}. Password arguments are refused.` : `Unknown or unexpected ${kind} ${JSON.stringify(kind === "flag" ? token.split("=")[0] : token)} for ${level2}.`;
+    throw new ArtiumError("INVALID_INPUT", message, choices2);
+  }
+  if (!command) return;
+  if (command === "--version" && args.length === 1) return;
+  if (!Object.hasOwn(commands, command) || command === "home" || command === "managed-session" || command === "tools show") {
+    fail(command, "artium-axi", `Valid commands: ${rootCommands}. Valid flags: ${rootFlags}.`);
+  }
+  if (toolSchema.safeParse(command).success) {
+    if (prefixHelp && args.length > 1) fail(args[1], command, `Use artium-axi --help ${command} for local help; artium-axi ${command} --help for upstream flags.`);
+    return;
+  }
+  let level = command;
+  let start = 1;
+  if (command === "tools" && args[1] === "show") {
+    level = "tools show";
+    start = 2;
+  }
+  const entry = commands[level];
+  const validFlags = ["--help", ...entry.flags.map((flag) => flag.split(" ")[0])];
+  const choices = `Valid flags for ${level}: ${validFlags.join(", ")}.` + (level === "tools" ? " Valid subcommands: show <tool>." : level === "tools show" ? ` Valid tools: ${toolSchema.options.join(", ")}.` : "");
+  let tool = false;
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = start; index < args.length; index++) {
+    const token = args[index];
+    if (level === "tools show" && !token.startsWith("-") && !tool) {
+      if (!toolSchema.safeParse(token).success) fail(token, level, choices);
+      tool = true;
+    } else {
+      if (!validFlags.includes(token) || seen.has(token)) fail(token, level, choices);
+      seen.add(token);
+      if (token === "--username" || token === "--host") {
+        const value = args[index + 1];
+        if (!value) fail(value, `${level} ${token}`, `Supply ${token} ${token === "--host" ? "<claude|codex|opencode|pi>" : "<username>"}. ${choices}`);
+        if (token === "--host" && !["claude", "codex", "opencode", "pi"].includes(value)) fail(value, `${level} --host`, `Valid hosts: claude, codex, opencode, pi. Use ${entry.usage}.`);
+        index++;
+      }
+    }
+  }
+  if (level === "tools show" && !tool && !seen.has("--help") && !prefixHelp) fail(void 0, level, choices);
 }
 function helpCommand(args, prefixHelp = false) {
   if (args[0] === "setup" && args.includes("--help")) {
@@ -22917,7 +23028,7 @@ function helpCommand(args, prefixHelp = false) {
     }
     return "setup";
   }
-  if (args[0] === "falcon-axi" || args[0] === "vectra-axi" || args[0] === "ldap-axi") return prefixHelp && args.length === 2 ? args[0] : void 0;
+  if (toolSchema.safeParse(args[0]).success) return prefixHelp && args.length === 2 ? args[0] : void 0;
   if (args[0] === "login" || args[0] === "passwd") {
     if (args[0] === "login" && args.length === 3 && args.includes("--sso") && args.includes("--help")) return "login";
     let requested = false;
@@ -32347,189 +32458,1255 @@ var mg_axi_default = {
   ]
 };
 
-// src/shared/tool-manifests.ts
-var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default };
-
-// node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
-var NULL_LITERAL = "null";
-var DELIMITERS = {
-  comma: ",",
-  tab: "	",
-  pipe: "|"
-};
-var DEFAULT_DELIMITER = DELIMITERS.comma;
-function escapeString(value) {
-  return value.replace(/\\/g, `\\\\`).replace(/"/g, `\\"`).replace(/\n/g, `\\n`).replace(/\r/g, `\\r`).replace(/\t/g, `\\t`).replace(/[\u0000-\u001F]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
-}
-function unescapeString(value) {
-  let unescaped = "";
-  let i = 0;
-  while (i < value.length) {
-    if (value[i] === "\\") {
-      if (i + 1 >= value.length) throw new SyntaxError("Invalid escape sequence: backslash at end of string");
-      const next = value[i + 1];
-      if (next === "n") {
-        unescaped += "\n";
-        i += 2;
-        continue;
-      }
-      if (next === "t") {
-        unescaped += "	";
-        i += 2;
-        continue;
-      }
-      if (next === "r") {
-        unescaped += "\r";
-        i += 2;
-        continue;
-      }
-      if (next === "\\") {
-        unescaped += "\\";
-        i += 2;
-        continue;
-      }
-      if (next === '"') {
-        unescaped += '"';
-        i += 2;
-        continue;
-      }
-      if (next === "u") {
-        if (i + 6 > value.length) throw new SyntaxError(`Invalid escape sequence: truncated \\u escape at "${value.slice(i, i + 6)}"`);
-        const hex3 = value.slice(i + 2, i + 6);
-        if (!/^[0-9a-f]{4}$/i.test(hex3)) throw new SyntaxError(`Invalid escape sequence: \\u must be followed by 4 hex digits, got "${hex3}"`);
-        const codeUnit = Number.parseInt(hex3, 16);
-        if (codeUnit >= 55296 && codeUnit <= 57343) throw new SyntaxError(`Invalid escape sequence: \\u${hex3} is a lone surrogate; supplementary code points MUST appear as literal UTF-8`);
-        unescaped += String.fromCodePoint(codeUnit);
-        i += 6;
-        continue;
-      }
-      throw new SyntaxError(`Invalid escape sequence: \\${next}`);
-    }
-    unescaped += value[i];
-    i++;
-  }
-  return unescaped;
-}
-function findClosingQuote(content, start) {
-  let i = start + 1;
-  while (i < content.length) {
-    if (content[i] === "\\" && i + 1 < content.length) {
-      i += 2;
-      continue;
-    }
-    if (content[i] === '"') return i;
-    i++;
-  }
-  return -1;
-}
-function findUnquotedChar(content, char, start = 0) {
-  let inQuotes = false;
-  let i = start;
-  while (i < content.length) {
-    if (content[i] === "\\" && i + 1 < content.length && inQuotes) {
-      i += 2;
-      continue;
-    }
-    if (content[i] === '"') {
-      inQuotes = !inQuotes;
-      i++;
-      continue;
-    }
-    if (content[i] === char && !inQuotes) return i;
-    i++;
-  }
-  return -1;
-}
-var ToonDecodeError = class extends SyntaxError {
-  constructor(message, context) {
-    const prefix = context?.line !== void 0 ? `Line ${context.line}: ` : "";
-    super(prefix + message, context?.cause !== void 0 ? { cause: context.cause } : void 0);
-    this.name = "ToonDecodeError";
-    this.line = context?.line;
-    this.source = context?.source;
-  }
-};
-function withLine(line, fn) {
-  try {
-    return fn();
-  } catch (error62) {
-    if (error62 instanceof ToonDecodeError) throw error62;
-    if (error62 instanceof Error) throw new ToonDecodeError(error62.message, {
-      line: line.lineNumber,
-      source: line.raw,
-      cause: error62
-    });
-    throw error62;
-  }
-}
-var NUMERIC_LITERAL_PATTERN = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i;
-function isBooleanOrNullLiteral(token) {
-  return token === "true" || token === "false" || token === "null";
-}
-function isNumericLiteral(token) {
-  if (!token) return false;
-  if (!NUMERIC_LITERAL_PATTERN.test(token)) return false;
-  const numericValue = Number(token);
-  return !Number.isNaN(numericValue) && Number.isFinite(numericValue);
-}
-function parseArrayHeaderLine(content, defaultDelimiter, strict = false) {
-  const trimmedToken = content.trimStart();
-  let bracketStart = -1;
-  if (trimmedToken.startsWith('"')) {
-    const closingQuoteIndex = findClosingQuote(trimmedToken, 0);
-    if (closingQuoteIndex === -1) return;
-    if (!trimmedToken.slice(closingQuoteIndex + 1).startsWith("[")) return;
-    const keyEndIndex = content.length - trimmedToken.length + closingQuoteIndex + 1;
-    bracketStart = content.indexOf("[", keyEndIndex);
-  } else bracketStart = findUnquotedChar(content, "[");
-  if (bracketStart === -1) return;
-  const bracketEnd = findUnquotedChar(content, "]", bracketStart);
-  if (bracketEnd === -1) return;
-  let colonIndex = bracketEnd + 1;
-  let braceEnd = colonIndex;
-  const braceStart = findUnquotedChar(content, "{", bracketEnd);
-  if (braceStart !== -1 && braceStart < findUnquotedChar(content, ":", bracketEnd)) {
-    const gapBeforeBrace = content.slice(bracketEnd + 1, braceStart);
-    if (gapBeforeBrace !== "") {
-      if (strict) {
-        const trimmedGap = gapBeforeBrace.trim();
-        throw new SyntaxError(trimmedGap === "" ? `Unexpected whitespace between bracket and fields segment` : `Unexpected content "${trimmedGap}" between bracket and fields segment`);
-      }
-      return;
+// tools/inventories/ado-axi.json
+var ado_axi_default = {
+  generatedBy: "scripts/ado-inventory.mjs",
+  tool: "ado-axi",
+  version: "0.4.6",
+  integrity: "sha512-DThi4K9uO/jz93QQMBXtpnCXeHaYsOWSt6TFdYGhnqDN8aScow3bwbhVTIg4KEMVT0KHPYPdH00V9UOPX0c2fA==",
+  parserEvidence: "Reviewed published dispatch switches, aliases and command flag constants",
+  sources: [
+    {
+      path: "dist/bin/ado-axi.js",
+      sha256: "d3786fe4009b1543c1118eb94dc1c84130806cc7d5e09d674eccdad3eb2351cf"
+    },
+    {
+      path: "dist/lib/auth.js",
+      sha256: "287d52a41b3412a8c716fa39bbf1c2a1fa0f5dd18728e23bbedc9cc1fd20e947"
+    },
+    {
+      path: "dist/lib/client.js",
+      sha256: "de6ffea225b2ffc3ff31de67431dfd20625f1d42e9575ffa05d79bcdeb534feb"
+    },
+    {
+      path: "dist/lib/args.js",
+      sha256: "f61e2fd78a259f8bcf1e1a3d89933e1c123778bcc63f3c667efba11a2915c758"
+    },
+    {
+      path: "dist/lib/argv.js",
+      sha256: "3c5015cd2ecde9249714f97c59bb365e1f8242573c643ca608bf3863126bcc81"
+    },
+    {
+      path: "dist/lib/config.js",
+      sha256: "32afbb32fa0f06056436e0d856d0f251c407f31850ff7d9a89dc57ff2c43ce8d"
+    },
+    {
+      path: "dist/lib/adoUrl.js",
+      sha256: "d75adff40b6c501e3f3c8bef747a53d128b597ec24da692e7ddec00f4658c4cc"
+    },
+    {
+      path: "dist/lib/stdin.js",
+      sha256: "5cd2b7c7aedf02df9778f6566a19bc837cfba367a7e25c4fe626f8ec0077d959"
+    },
+    {
+      path: "dist/lib/context.js",
+      sha256: "0ddc87da536069a2399545bd0f98860e3fad64d32fd78242ca7fcb500a301276"
+    },
+    {
+      path: "dist/commands/api.js",
+      sha256: "538d9d4139d88f52eb07a7bb753695a0e81013b7834fd948a1c84b2e9f9914ff"
+    },
+    {
+      path: "dist/commands/config.js",
+      sha256: "653a3fec29463b38c59039bf29d3d08f02cb9018e2f2eaf6ad147888eab6d665"
+    },
+    {
+      path: "dist/commands/doctor.js",
+      sha256: "106f5e1d7f29735f0905096add34939826a831e93719fedeee5e8b535fd98731"
+    },
+    {
+      path: "dist/commands/home.js",
+      sha256: "b5913e4c692e2ec6b63e004e457a97381c445c91185a400db13649df1e6d50a7"
+    },
+    {
+      path: "dist/commands/pipeline.js",
+      sha256: "152885bd4f9dc67855b64fbbca8e5b9e0d46d07ec6b5abc3a393ed29b620bc3b"
+    },
+    {
+      path: "dist/commands/pr.js",
+      sha256: "7b4f81ce93f18c1079294e71237be8e85a4c71313ae0bceac50b0245324d8772"
+    },
+    {
+      path: "dist/commands/ref.js",
+      sha256: "b87a5c738721b8d6f453044258a6e95eaea067e4c2dd5321f605c79aa6411d09"
+    },
+    {
+      path: "dist/commands/repo.js",
+      sha256: "8d446c3bc69a6a5bf36dca02a5e05748098a78269d9078f90da9169b15a5049d"
+    },
+    {
+      path: "dist/commands/test.js",
+      sha256: "b151392b7a6ae7b9cba8031da66b86dfc3811b01413ee25b4a4f0ef7cd5fa384"
+    },
+    {
+      path: "dist/commands/workItem.js",
+      sha256: "38adf6d7b86ff4809cd3a8402ad894286f6f23e750fdbf303d4a4abb31215058"
+    },
+    {
+      path: "axi-sdk-js/dist/cli.js",
+      sha256: "7bda640cc33a6f5226e60b7df2ef7ea8c765431c0e89a267273993370bdd8121"
     }
-    const foundBraceEnd = findUnquotedChar(content, "}", braceStart);
-    if (foundBraceEnd !== -1) braceEnd = foundBraceEnd + 1;
-  }
-  colonIndex = findUnquotedChar(content, ":", Math.max(bracketEnd, braceEnd));
-  if (colonIndex === -1) return;
-  const gapStart = Math.max(bracketEnd + 1, braceEnd);
-  const gapBeforeColon = content.slice(gapStart, colonIndex);
-  if (gapBeforeColon !== "") {
-    if (strict) {
-      const trimmedGap = gapBeforeColon.trim();
-      throw new SyntaxError(trimmedGap === "" ? `Unexpected whitespace between bracket segment and colon` : `Unexpected content "${trimmedGap}" between bracket segment and colon`);
+  ],
+  adapterBoundary: {
+    unsafeOverrides: [
+      "org",
+      "profile",
+      "config"
+    ],
+    blockedCommands: [
+      "config",
+      "update"
+    ],
+    nativeWrites: "host-classified",
+    inputs: {
+      stdin: "unsupported",
+      files: "unsupported"
     }
-    return;
-  }
-  let key;
-  if (bracketStart > 0) {
-    const rawKey = content.slice(0, bracketStart).trim();
-    key = rawKey.startsWith('"') ? parseStringLiteral(rawKey) : rawKey;
-  }
-  const afterColon = content.slice(colonIndex + 1).trim();
-  const bracketContent = content.slice(bracketStart + 1, bracketEnd);
-  let parsedBracket;
-  try {
-    parsedBracket = parseBracketSegment(bracketContent, defaultDelimiter);
-  } catch (error62) {
-    if (strict) throw error62;
-    return;
-  }
-  const { length, delimiter } = parsedBracket;
-  let fields;
-  if (braceStart !== -1 && braceStart < colonIndex) {
-    const foundBraceEnd = findUnquotedChar(content, "}", braceStart);
-    if (foundBraceEnd !== -1 && foundBraceEnd < colonIndex) {
+  },
+  aliases: {
+    wi: "work-item",
+    workitem: "work-item",
+    "work-items": "work-item",
+    prs: "pr",
+    pipelines: "pipeline",
+    tests: "test",
+    repos: "repo",
+    refs: "ref",
+    projects: "project"
+  },
+  discovery: {
+    commands: [
+      "work-item",
+      "pr",
+      "pipeline",
+      "test",
+      "repo",
+      "ref",
+      "project",
+      "api",
+      "doctor"
+    ],
+    example: [
+      "project",
+      "list",
+      "--limit",
+      "1"
+    ],
+    help: "ado-axi project list [--name <filter>] [--limit <n>] [--fields <fields>]\napi accepts relative paths and GET only. Writes are off by default; administrators control allowWrites. No stdin or files. For pipeline watch use --timeout 50 or less.\n"
+  },
+  suggestionFields: [
+    "help"
+  ],
+  format: "TOON",
+  commands: [
+    {
+      command: "home",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "doctor",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "work-item list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        state: "value",
+        type: "value",
+        "assigned-to": "value",
+        iteration: "value",
+        area: "value",
+        tag: "value",
+        search: "value",
+        query: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "work-item get",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        comments: "boolean",
+        relations: "boolean"
+      },
+      positionals: 1,
+      aliases: [
+        "work-item view"
+      ]
+    },
+    {
+      command: "work-item create",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        type: "value",
+        title: "value",
+        description: "value",
+        "description-format": "value",
+        "assigned-to": "value",
+        area: "value",
+        iteration: "value",
+        parent: "value",
+        tags: "value",
+        set: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "work-item update",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        title: "value",
+        state: "value",
+        "assigned-to": "value",
+        area: "value",
+        iteration: "value",
+        description: "value",
+        "description-format": "value",
+        tags: "value",
+        "add-tags": "value",
+        "remove-tags": "value",
+        set: "value",
+        reason: "value",
+        "if-rev": "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "work-item comment",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        body: "value",
+        format: "value"
+      },
+      positionals: 2,
+      aliases: []
+    },
+    {
+      command: "work-item link list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      aliases: [
+        "work-item links list"
+      ]
+    },
+    {
+      command: "work-item link add",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        parent: "value",
+        child: "value",
+        related: "value",
+        pr: "value",
+        commit: "value",
+        branch: "value",
+        repo: "value",
+        comment: "value",
+        "if-rev": "value"
+      },
+      positionals: 1,
+      aliases: [
+        "work-item links add"
+      ]
+    },
+    {
+      command: "pr list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        status: "value",
+        creator: "value",
+        reviewer: "value",
+        target: "value",
+        source: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "pr get",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        id: "value",
+        threads: "boolean",
+        commits: "boolean"
+      },
+      positionals: 1,
+      aliases: [
+        "pr view",
+        "pr comments",
+        "pr threads"
+      ]
+    },
+    {
+      command: "pr create",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        source: "value",
+        target: "value",
+        title: "value",
+        description: "value",
+        reviewers: "value",
+        "work-items": "value",
+        draft: "boolean",
+        "auto-complete": "boolean"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "pr update",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        title: "value",
+        description: "value",
+        draft: "boolean",
+        "auto-complete": "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr complete",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        squash: "boolean",
+        "delete-source-branch": "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr abandon",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr checks",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr diff",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      aliases: [
+        "pr changes"
+      ]
+    },
+    {
+      command: "pr reviewers",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        reviewer: "value",
+        required: "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr reviewer list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        reviewer: "value",
+        required: "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr reviewer add",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        reviewer: "value",
+        required: "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr reviewer remove",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        reviewer: "value",
+        required: "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr approve",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        vote: "value"
+      },
+      positionals: 1,
+      aliases: [
+        "pr vote"
+      ]
+    },
+    {
+      command: "pr comment",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        body: "value",
+        thread: "value",
+        file: "value",
+        line: "value"
+      },
+      positionals: 2,
+      aliases: []
+    },
+    {
+      command: "pr thread list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        limit: "value",
+        id: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pr thread resolve",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        thread: "value",
+        status: "value",
+        id: "value"
+      },
+      positionals: 2,
+      aliases: []
+    },
+    {
+      command: "pr thread reopen",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        thread: "value",
+        status: "value",
+        id: "value"
+      },
+      positionals: 2,
+      aliases: []
+    },
+    {
+      command: "pr thread reply",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        thread: "value",
+        body: "value",
+        status: "value",
+        id: "value",
+        resolve: "boolean"
+      },
+      positionals: 3,
+      aliases: []
+    },
+    {
+      command: "pipeline list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        limit: "value",
+        name: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "pipeline runs",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        pipeline: "value",
+        branch: "value",
+        status: "value",
+        result: "value",
+        "requested-for": "value",
+        limit: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "pipeline run",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        pipeline: "value",
+        branch: "value",
+        variables: "value",
+        parameters: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pipeline logs",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        log: "value",
+        tail: "value",
+        "failed-only": "boolean"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "pipeline timeline",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      aliases: [
+        "pipeline steps"
+      ]
+    },
+    {
+      command: "pipeline watch",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        interval: "value",
+        timeout: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "test results",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        run: "value",
+        outcome: "value",
+        limit: "value"
+      },
+      positionals: 1,
+      aliases: [
+        "test failures"
+      ]
+    },
+    {
+      command: "repo list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        name: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "repo branches",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        limit: "value",
+        name: "value"
+      },
+      positionals: 1,
+      aliases: []
+    },
+    {
+      command: "repo file",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        path: "value",
+        ref: "value",
+        commit: "value",
+        limit: "value"
+      },
+      positionals: 2,
+      aliases: [
+        "repo cat"
+      ]
+    },
+    {
+      command: "ref list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        name: "value",
+        limit: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "ref create",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        name: "value",
+        source: "value",
+        "source-object-id": "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "ref delete",
+      effect: "write",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        repo: "value",
+        name: "value",
+        "old-object-id": "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "project list",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        limit: "value",
+        name: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "api",
+      effect: "read",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value",
+        method: "value",
+        body: "value",
+        query: "value",
+        "api-version": "value",
+        host: "value",
+        limit: "value",
+        "content-type": "value",
+        "no-project": "boolean",
+        raw: "boolean"
+      },
+      positionals: 2,
+      aliases: []
+    },
+    {
+      command: "config",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "config list",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "config show",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "config path",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "config init",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "config add",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    },
+    {
+      command: "update",
+      effect: "blocked",
+      flags: {
+        profile: "value",
+        org: "value",
+        project: "value",
+        config: "value",
+        help: "boolean",
+        full: "boolean",
+        fields: "value"
+      },
+      positionals: 0,
+      aliases: []
+    }
+  ]
+};
+
+// src/shared/tool-manifests.ts
+var toolManifests = { "falcon-axi": falcon_axi_default, "vectra-axi": vectra_axi_default, "az-axi": az_axi_default, "mg-axi": mg_axi_default, "ldap-axi": ldap_axi_default, "ado-axi": ado_axi_default };
+
+// node_modules/.pnpm/@toon-format+toon@2.3.1/node_modules/@toon-format/toon/dist/index.mjs
+var NULL_LITERAL = "null";
+var DELIMITERS = {
+  comma: ",",
+  tab: "	",
+  pipe: "|"
+};
+var DEFAULT_DELIMITER = DELIMITERS.comma;
+function escapeString(value) {
+  return value.replace(/\\/g, `\\\\`).replace(/"/g, `\\"`).replace(/\n/g, `\\n`).replace(/\r/g, `\\r`).replace(/\t/g, `\\t`).replace(/[\u0000-\u001F]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function unescapeString(value) {
+  let unescaped = "";
+  let i = 0;
+  while (i < value.length) {
+    if (value[i] === "\\") {
+      if (i + 1 >= value.length) throw new SyntaxError("Invalid escape sequence: backslash at end of string");
+      const next = value[i + 1];
+      if (next === "n") {
+        unescaped += "\n";
+        i += 2;
+        continue;
+      }
+      if (next === "t") {
+        unescaped += "	";
+        i += 2;
+        continue;
+      }
+      if (next === "r") {
+        unescaped += "\r";
+        i += 2;
+        continue;
+      }
+      if (next === "\\") {
+        unescaped += "\\";
+        i += 2;
+        continue;
+      }
+      if (next === '"') {
+        unescaped += '"';
+        i += 2;
+        continue;
+      }
+      if (next === "u") {
+        if (i + 6 > value.length) throw new SyntaxError(`Invalid escape sequence: truncated \\u escape at "${value.slice(i, i + 6)}"`);
+        const hex3 = value.slice(i + 2, i + 6);
+        if (!/^[0-9a-f]{4}$/i.test(hex3)) throw new SyntaxError(`Invalid escape sequence: \\u must be followed by 4 hex digits, got "${hex3}"`);
+        const codeUnit = Number.parseInt(hex3, 16);
+        if (codeUnit >= 55296 && codeUnit <= 57343) throw new SyntaxError(`Invalid escape sequence: \\u${hex3} is a lone surrogate; supplementary code points MUST appear as literal UTF-8`);
+        unescaped += String.fromCodePoint(codeUnit);
+        i += 6;
+        continue;
+      }
+      throw new SyntaxError(`Invalid escape sequence: \\${next}`);
+    }
+    unescaped += value[i];
+    i++;
+  }
+  return unescaped;
+}
+function findClosingQuote(content, start) {
+  let i = start + 1;
+  while (i < content.length) {
+    if (content[i] === "\\" && i + 1 < content.length) {
+      i += 2;
+      continue;
+    }
+    if (content[i] === '"') return i;
+    i++;
+  }
+  return -1;
+}
+function findUnquotedChar(content, char, start = 0) {
+  let inQuotes = false;
+  let i = start;
+  while (i < content.length) {
+    if (content[i] === "\\" && i + 1 < content.length && inQuotes) {
+      i += 2;
+      continue;
+    }
+    if (content[i] === '"') {
+      inQuotes = !inQuotes;
+      i++;
+      continue;
+    }
+    if (content[i] === char && !inQuotes) return i;
+    i++;
+  }
+  return -1;
+}
+var ToonDecodeError = class extends SyntaxError {
+  constructor(message, context) {
+    const prefix = context?.line !== void 0 ? `Line ${context.line}: ` : "";
+    super(prefix + message, context?.cause !== void 0 ? { cause: context.cause } : void 0);
+    this.name = "ToonDecodeError";
+    this.line = context?.line;
+    this.source = context?.source;
+  }
+};
+function withLine(line, fn) {
+  try {
+    return fn();
+  } catch (error62) {
+    if (error62 instanceof ToonDecodeError) throw error62;
+    if (error62 instanceof Error) throw new ToonDecodeError(error62.message, {
+      line: line.lineNumber,
+      source: line.raw,
+      cause: error62
+    });
+    throw error62;
+  }
+}
+var NUMERIC_LITERAL_PATTERN = /^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i;
+function isBooleanOrNullLiteral(token) {
+  return token === "true" || token === "false" || token === "null";
+}
+function isNumericLiteral(token) {
+  if (!token) return false;
+  if (!NUMERIC_LITERAL_PATTERN.test(token)) return false;
+  const numericValue = Number(token);
+  return !Number.isNaN(numericValue) && Number.isFinite(numericValue);
+}
+function parseArrayHeaderLine(content, defaultDelimiter, strict = false) {
+  const trimmedToken = content.trimStart();
+  let bracketStart = -1;
+  if (trimmedToken.startsWith('"')) {
+    const closingQuoteIndex = findClosingQuote(trimmedToken, 0);
+    if (closingQuoteIndex === -1) return;
+    if (!trimmedToken.slice(closingQuoteIndex + 1).startsWith("[")) return;
+    const keyEndIndex = content.length - trimmedToken.length + closingQuoteIndex + 1;
+    bracketStart = content.indexOf("[", keyEndIndex);
+  } else bracketStart = findUnquotedChar(content, "[");
+  if (bracketStart === -1) return;
+  const bracketEnd = findUnquotedChar(content, "]", bracketStart);
+  if (bracketEnd === -1) return;
+  let colonIndex = bracketEnd + 1;
+  let braceEnd = colonIndex;
+  const braceStart = findUnquotedChar(content, "{", bracketEnd);
+  if (braceStart !== -1 && braceStart < findUnquotedChar(content, ":", bracketEnd)) {
+    const gapBeforeBrace = content.slice(bracketEnd + 1, braceStart);
+    if (gapBeforeBrace !== "") {
+      if (strict) {
+        const trimmedGap = gapBeforeBrace.trim();
+        throw new SyntaxError(trimmedGap === "" ? `Unexpected whitespace between bracket and fields segment` : `Unexpected content "${trimmedGap}" between bracket and fields segment`);
+      }
+      return;
+    }
+    const foundBraceEnd = findUnquotedChar(content, "}", braceStart);
+    if (foundBraceEnd !== -1) braceEnd = foundBraceEnd + 1;
+  }
+  colonIndex = findUnquotedChar(content, ":", Math.max(bracketEnd, braceEnd));
+  if (colonIndex === -1) return;
+  const gapStart = Math.max(bracketEnd + 1, braceEnd);
+  const gapBeforeColon = content.slice(gapStart, colonIndex);
+  if (gapBeforeColon !== "") {
+    if (strict) {
+      const trimmedGap = gapBeforeColon.trim();
+      throw new SyntaxError(trimmedGap === "" ? `Unexpected whitespace between bracket segment and colon` : `Unexpected content "${trimmedGap}" between bracket segment and colon`);
+    }
+    return;
+  }
+  let key;
+  if (bracketStart > 0) {
+    const rawKey = content.slice(0, bracketStart).trim();
+    key = rawKey.startsWith('"') ? parseStringLiteral(rawKey) : rawKey;
+  }
+  const afterColon = content.slice(colonIndex + 1).trim();
+  const bracketContent = content.slice(bracketStart + 1, bracketEnd);
+  let parsedBracket;
+  try {
+    parsedBracket = parseBracketSegment(bracketContent, defaultDelimiter);
+  } catch (error62) {
+    if (strict) throw error62;
+    return;
+  }
+  const { length, delimiter } = parsedBracket;
+  let fields;
+  if (braceStart !== -1 && braceStart < colonIndex) {
+    const foundBraceEnd = findUnquotedChar(content, "}", braceStart);
+    if (foundBraceEnd !== -1 && foundBraceEnd < colonIndex) {
       const fieldsContent = content.slice(braceStart + 1, foundBraceEnd);
       const mismatchedDelimiter = findUnquotedMismatchedDelimiter(fieldsContent, delimiter);
       if (mismatchedDelimiter !== void 0) {
@@ -33720,7 +34897,8 @@ var managedFlags = {
   "vectra-axi": vectra_axi_default.adapterBoundary.unsafeOverrides,
   "az-axi": az_axi_default.adapterBoundary.unsafeOverrides,
   "mg-axi": mg_axi_default.adapterBoundary.unsafeOverrides,
-  "ldap-axi": ldap_axi_default.adapterBoundary.unsafeOverrides
+  "ldap-axi": ldap_axi_default.adapterBoundary.unsafeOverrides,
+  "ado-axi": ado_axi_default.adapterBoundary.unsafeOverrides
 };
 var ldapHelp = /^(?:Read Active Directory and LDAPv3 directories\.|(?:entry (?:search|show)|auth status) |Usage: (?:artium-axi )?ldap-axi )/m;
 var ldapCommands = ldap_axi_default.commands.filter((route) => route.command !== "home").map((route) => route.command);
@@ -33740,7 +34918,7 @@ function rewriteSuggestions(output3, tool, truncated = false) {
   const flags = managedFlags[tool];
   if (!flags) return output3;
   const executable = new RegExp(`^(?:artium-axi |npx -y @knowttl/)?${tool}(?=\\s|$)`);
-  if (executable.test(output3.replace(/^[ \t]*(?:(?:Command|Native operation|Examples): )?/, "")) || tool === "ldap-axi" && ldapHelp.test(output3)) return hostedHelp(output3, tool, flags, true);
+  if (executable.test(output3.replace(/^[ \t]*(?:(?:Command|Native operation|Examples|Usage): )?/, "")) || tool === "ldap-axi" && ldapHelp.test(output3)) return hostedHelp(output3, tool, flags, true);
   let spans;
   let unknownOutcome = false;
   try {
@@ -33764,9 +34942,9 @@ function rewriteSuggestions(output3, tool, truncated = false) {
     return output3;
   }
   for (const span of [...spans].reverse()) {
-    const value = hostedHelp(span.value, tool, flags, /^[ \t]*(?:Command|Native operation|Examples):/m.test(span.value));
+    const value = hostedHelp(span.value, tool, flags, /^[ \t]*(?:Command|Native operation|Examples|Usage):/m.test(span.value));
     if (value === span.value) continue;
-    output3 = output3.slice(0, span.start) + (span.quoted || tool === "ldap-axi" && /[,\r\n]/.test(value) ? JSON.stringify(value) : value) + output3.slice(span.start + span.raw.length);
+    output3 = output3.slice(0, span.start) + (span.quoted || ["ldap-axi", "ado-axi"].includes(tool) && /[,\r\n]/.test(value) ? JSON.stringify(value) : value) + output3.slice(span.start + span.raw.length);
   }
   spans = (output3.trimStart().startsWith("{") ? jsonHelp(output3) : toonHelp(output3)).spans;
   if (spans.some((span) => /\\[`'"]/.test(span.value))) return output3;
@@ -33841,6 +35019,15 @@ function managedFlagRanges(command, tool) {
   return ranges;
 }
 function hostedHelp(help, tool, flags, commands2) {
+  if (tool === "ado-axi") {
+    const guidance = "Artium manages the organization, profile, config and PAT. api accepts relative paths and GET only. Writes are off by default; administrators control allowWrites. No stdin or files. Use pipeline watch --timeout 50 or less.";
+    if (/^(?:Usage: |(?:Run|Use) [`'"]?)?(?:artium-axi )?ado-axi api(?:\s|$)/.test(help)) {
+      help = "ado-axi api [GET] <relative-path> [--method GET] [--query <query>] [--api-version <version>] [--host dev|vsrm|vssps|almsearch] [--no-project] [--raw] [--limit <n>] [--full] [--fields <fields>]\n";
+    }
+    help = help.replace(/\n"built-in":\n[\s\S]*$/, "").split("\n").filter((line) => /^\s*(?:(?:Run|Use) [`'"]?|Usage: )?(?:artium-axi )?ado-axi (?!config\b|update\b)/.test(line) || !/(?:\bado-axi (?:config|update)\b|\baz (?:CLI )?login\b|\baz login\b|\bADO_[A-Z_]+\b|\bPAT\b.*\benv\b|stdin|piped|--profile|--org\b|--config\b)/i.test(line)).map((line) => line.replace(/<path\|url>/g, "<relative-path>").replace(/--timeout 1800/g, "--timeout 50").replace(/^([ \t]*MSYS_NO_PATHCONV=1 )ado-axi(?=\s|$)/, "$1artium-axi ado-axi").replace("raw REST escape hatch for everything else", "GET-only REST calls").replace(/ \| config\b/g, "")).join("\n");
+    if (!help.trim()) help = guidance;
+    else if (commands2 && !help.includes(guidance)) help = help.trimEnd() + "\n" + guidance + "\n";
+  }
   const selectors = flags.join("|");
   if (tool === "ldap-axi" && !commands2 && !/^(?:Run|Use) [`'"]?(?:artium-axi )?ldap-axi\b/.test(help)) {
     help = help.replace(
@@ -34424,18 +35611,14 @@ function output2(stream, text2) {
   else process[stream].write(text2);
 }
 async function main(args) {
-  const managedMode = args[0] === "--managed-session";
-  if (managedMode) {
-    args = args.slice(1);
-    if (["passwd", "logout", "setup"].includes(args[0])) {
-      throw new ArtiumError(
-        "INVALID_INPUT",
-        "This command is unavailable in managed session mode.",
-        "The caller manages session persistence, password changes and revocation."
-      );
-    }
-    managed = await ManagedSession.read(args[0] === "login");
+  if (args.length === 2 && args.includes("--managed-session") && args.includes("--help")) {
+    output2("stdout", commandHelp("managed-session"));
+    return;
   }
+  const localArgs = args[0] === "--managed-session" ? args.slice(1) : args;
+  validateArguments(localArgs[0] === "--help" ? localArgs.slice(1) : localArgs, localArgs[0] === "--help");
+  const managedMode = args[0] === "--managed-session";
+  if (managedMode) args = args.slice(1);
   if (args.length === 1 && args[0] === "--version") {
     output2("stdout", `${cliVersion}
 `);
@@ -34450,13 +35633,23 @@ async function main(args) {
     output2("stdout", commandHelp(help));
     return;
   }
+  if (managedMode) {
+    if (["passwd", "logout", "setup"].includes(args[0])) {
+      throw new ArtiumError(
+        "INVALID_INPUT",
+        "This command is unavailable in managed session mode.",
+        "The caller manages session persistence, password changes and revocation."
+      );
+    }
+    managed = await ManagedSession.read(args[0] === "login");
+  }
   if (command === "setup") {
     output2("stdout", await setup(args.slice(1)));
     return;
   }
   if (command === "doctor") {
     if (args.length !== 1) throw new ArtiumError("INVALID_INPUT", void 0, "Use artium-axi doctor.");
-    if (managed) await doctor(() => new Client(process.env, managed), (text2) => output2("stdout", text2));
+    if (managed) await doctor((deadline) => new Client(process.env, managed, deadline), (text2) => output2("stdout", text2));
     else await doctor();
     return;
   }