@overaihq/cli 0.13.8 → 0.14.1

package/dist/index.js

@@ -5,10 +5,10 @@ import {
 import {
   itemFilterExpressionRootSchema,
   webPageConfigSchema
-} from "./chunk-M2NX2CHG.js";
+} from "./chunk-FTBTDB2B.js";
 import {
   external_exports
-} from "./chunk-XCJJTK3H.js";
+} from "./chunk-PF6GZFT4.js";
 import {
   __commonJS,
   __toESM
@@ -11911,9 +11911,9 @@ var require_lib = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@babel+parser@7.29.8/node_modules/@babel/parser/lib/index.js
+// ../../node_modules/.pnpm/@babel+parser@7.29.9/node_modules/@babel/parser/lib/index.js
 var require_lib2 = __commonJS({
-  "../../node_modules/.pnpm/@babel+parser@7.29.8/node_modules/@babel/parser/lib/index.js"(exports) {
+  "../../node_modules/.pnpm/@babel+parser@7.29.9/node_modules/@babel/parser/lib/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", {
       value: true
@@ -14965,13 +14965,15 @@ var require_lib2 = __commonJS({
         const arrows = [];
         while (stack.length !== 0) {
           const node2 = stack.pop();
-          if (node2.type === "ArrowFunctionExpression" && node2.body.type !== "BlockStatement") {
+          if (node2.type === "ArrowFunctionExpression") {
             if (node2.typeParameters || !node2.returnType) {
               this.finishArrowValidation(node2);
             } else {
               arrows.push(node2);
             }
-            stack.push(node2.body);
+            if (node2.body.type !== "BlockStatement") {
+              stack.push(node2.body);
+            }
           } else if (node2.type === "ConditionalExpression") {
             stack.push(node2.consequent);
             stack.push(node2.alternate);
@@ -22127,8 +22129,11 @@ var require_lib2 = __commonJS({
         }
       }
       fillOptionalPropertiesForTSESLint(node) {
-        var _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static2, _node$declare2, _node$definite, _node$readonly3, _node$typeAnnotation2, _node$accessibility3, _node$decorators3, _node$override2, _node$optional4, _node$id, _node$abstract, _node$declare3, _node$decorators4, _node$implements, _node$superTypeArgume, _node$typeParameters2, _node$declare4, _node$definite2, _node$const, _node$declare5, _node$computed, _node$qualifier, _node$options, _node$declare6, _node$extends, _node$optional5, _node$readonly4, _node$declare7, _node$global, _node$const2, _node$in, _node$out;
+        var _node$phase, _node$directive, _node$decorators, _node$optional, _node$typeAnnotation, _node$accessibility, _node$decorators2, _node$override, _node$readonly, _node$static, _node$declare, _node$returnType, _node$typeParameters, _node$optional2, _node$optional3, _node$accessibility2, _node$readonly2, _node$static2, _node$declare2, _node$definite, _node$readonly3, _node$typeAnnotation2, _node$accessibility3, _node$decorators3, _node$override2, _node$optional4, _node$id, _node$abstract, _node$declare3, _node$decorators4, _node$implements, _node$superTypeArgume, _node$typeParameters2, _node$declare4, _node$definite2, _node$const, _node$declare5, _node$computed, _node$qualifier, _node$options, _node$declare6, _node$extends, _node$optional5, _node$readonly4, _node$declare7, _node$global, _node$const2, _node$in, _node$out;
         switch (node.type) {
+          case "ImportDeclaration":
+            (_node$phase = node.phase) != null ? _node$phase : node.phase = null;
+            return;
           case "ExpressionStatement":
             (_node$directive = node.directive) != null ? _node$directive : node.directive = void 0;
             return;
@@ -26521,12 +26526,31 @@ var sessionSchema = external_exports.object({
   identityId: external_exports.string().optional(),
   email: external_exports.string().optional(),
   accessToken: external_exports.string().optional(),
-  accessTokenExpiresAt: external_exports.number().optional()
+  accessTokenExpiresAt: external_exports.number().optional(),
+  // When the refresh token itself dies. Sessions saved before this was recorded
+  // have none, which reads as "unknown" rather than "expired".
+  refreshTokenExpiresAt: external_exports.number().optional(),
+  // Cached from `org list` so tables and the switch picker can name an org
+  // without a network round trip.
+  organizationName: external_exports.string().optional()
 });
 var storeSchema = external_exports.object({
   version: external_exports.literal(2),
   generation: external_exports.number().default(0),
   defaultApiBaseUrl: external_exports.string().optional(),
+  /*
+   * Remote name -> API base URL. Names exist so a tenant's cluster can be typed
+   * instead of pasted; `prod` and `local` are built in (see remotes.ts) and a
+   * name in use is never silently repointed. The app URL stays on the deployment
+   * below, keyed by the API URL that identifies the backend.
+   */
+  remotes: external_exports.record(external_exports.string(), external_exports.string()).default({}),
+  /*
+   * Alias -> org ref (`[<remote>:]<orgId>`), expanded textually wherever an org
+   * can be named. Purely local, like a shell alias: ids stay canonical in the
+   * store, in clone manifests, and in everything the CLI prints.
+   */
+  aliases: external_exports.record(external_exports.string(), external_exports.string()).default({}),
   deployments: external_exports.record(
     external_exports.string(),
     external_exports.object({
@@ -26558,7 +26582,14 @@ var readStore = () => {
       throw error;
     }
   })();
-  if (raw2 == null) return { version: 2, generation: 0, deployments: {} };
+  if (raw2 == null)
+    return {
+      version: 2,
+      generation: 0,
+      remotes: {},
+      aliases: {},
+      deployments: {}
+    };
   const invalidStoreMessage = `Invalid credential store at ${configFilePath}. Restore a valid copy before continuing.`;
   const [value, parseError] = resultOfSync(() => JSON.parse(raw2));
   if (parseError != null) throw new Error(invalidStoreMessage);
@@ -26573,6 +26604,8 @@ var readStore = () => {
     version: 2,
     generation: 0,
     defaultApiBaseUrl: session.apiBaseUrl,
+    remotes: {},
+    aliases: {},
     deployments: {
       [session.apiBaseUrl]: {
         defaultOrgId: session.organizationId,
@@ -26623,7 +26656,18 @@ var appBaseUrlFromApiHost = (apiHost) => {
 var trimSlash = (url) => url.replace(/\/+$/, "");
 var DEFAULT_API_BASE_URL = "https://api.overai.com";
 var apiBaseUrlOverride = process.env.OVERAI_API_URL != null ? trimSlash(process.env.OVERAI_API_URL) : void 0;
-var orgIdOverride = process.env.OVERAI_ORG_ID != null && process.env.OVERAI_ORG_ID !== "" ? process.env.OVERAI_ORG_ID : void 0;
+var leadingFlag = (name2) => {
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i += 2) {
+    if (argv[i]?.startsWith("--") !== true) return void 0;
+    if (argv[i] === name2) return argv[i + 1];
+  }
+  return void 0;
+};
+var LEADING_FLAGS = ["--org"];
+var requireExplicitOrg = process.env.OVERAI_REQUIRE_EXPLICIT_ORG === "1";
+var orgRefOverride = leadingFlag("--org") ?? (process.env.OVERAI_ORG_ID != null && process.env.OVERAI_ORG_ID !== "" ? process.env.OVERAI_ORG_ID : void 0);
+var orgRefSource = leadingFlag("--org") != null ? "--org" : orgRefOverride != null ? "OVERAI_ORG_ID" : void 0;
 var appBaseUrl = (backend) => {
   const saved = readStore();
   return trimSlash(
@@ -26631,6 +26675,126 @@ var appBaseUrl = (backend) => {
   );
 };
 
+// src/remotes.ts
+var BUILT_IN_REMOTES = {
+  prod: DEFAULT_API_BASE_URL,
+  local: "http://localhost:3001"
+};
+var remoteUrl = (name2, store = readStore()) => {
+  const url = store.remotes[name2] ?? BUILT_IN_REMOTES[name2];
+  return url == null ? void 0 : trimSlash(url);
+};
+var knownRemotes = (store = readStore()) => {
+  const byUrl = new Map(
+    Object.entries({ ...BUILT_IN_REMOTES, ...store.remotes }).map(
+      ([name2, url]) => [trimSlash(url), name2]
+    )
+  );
+  for (const url of Object.keys(store.deployments)) {
+    const trimmed = trimSlash(url);
+    if (!byUrl.has(trimmed)) byUrl.set(trimmed, remoteName(trimmed, store));
+  }
+  return [...byUrl].map(([apiBaseUrl2, name2]) => ({ name: name2, apiBaseUrl: apiBaseUrl2 })).sort((a, b) => a.name.localeCompare(b.name));
+};
+var derivedRemoteName = (apiBaseUrl2) => {
+  const [url] = resultOfSync(() => new URL(apiBaseUrl2));
+  if (url == null) return void 0;
+  if ((url.hostname === "localhost" || url.hostname === "127.0.0.1") && url.port === "3001")
+    return "local";
+  const match = /^api\.(?:([a-z0-9-]+)\.)?(?:overai|perygee)\.com$/.exec(
+    url.hostname
+  );
+  if (match == null) return void 0;
+  return match[1] ?? "prod";
+};
+var remoteName = (apiBaseUrl2, store = readStore()) => {
+  const url = trimSlash(apiBaseUrl2);
+  const registered = Object.entries(store.remotes).find(
+    ([, value]) => trimSlash(value) === url
+  );
+  if (registered != null) return registered[0];
+  const builtIn = Object.entries(BUILT_IN_REMOTES).find(
+    ([, value]) => value === url
+  );
+  if (builtIn != null) return builtIn[0];
+  const derived = derivedRemoteName(url);
+  return derived != null && remoteUrl(derived, store) === url ? derived : url;
+};
+var defaultApiBaseUrl = (store = readStore()) => store.defaultApiBaseUrl ?? DEFAULT_API_BASE_URL;
+var remoteForOrg = (orgId, store = readStore()) => {
+  const holders = Object.entries(store.deployments).filter(([, deployment]) => deployment.sessions[orgId] != null).map(([url]) => url);
+  if (holders.length <= 1) return holders[0];
+  const preferred = holders.find((url) => url === store.defaultApiBaseUrl);
+  if (preferred != null) return preferred;
+  throw new Error(
+    `Org ${orgId} is signed in on ${holders.map((url) => remoteName(url, store)).join(" and ")}. Name one, e.g. --org ${remoteName(holders[0] ?? "", store)}:${orgId}.`
+  );
+};
+var remoteOnlyRef = (text, store = readStore()) => {
+  const trimmed = text.trim().replace(/:$/, "");
+  if (store.aliases[trimmed] != null) return void 0;
+  return remoteUrl(trimmed, store);
+};
+var parseOrgRef = (text, store = readStore()) => {
+  const trimmed = text.trim();
+  if (trimmed === "") throw new Error("Empty organization reference.");
+  const expanded = store.aliases[trimmed] ?? trimmed;
+  const colon = expanded.indexOf(":");
+  if (colon === -1) return { orgId: expanded };
+  const name2 = expanded.slice(0, colon);
+  const orgPart = expanded.slice(colon + 1).trim();
+  const apiBaseUrl2 = remoteUrl(name2, store);
+  if (apiBaseUrl2 == null)
+    throw new Error(
+      `Unknown remote "${name2}". Known: ${knownRemotes(store).map((remote) => remote.name).join(", ")}. Add one with: overai remote add ${name2} <apiUrl>`
+    );
+  if (orgPart === "")
+    throw new Error(`Missing org id in "${expanded}". Use ${name2}:<orgId>.`);
+  const aliased = store.aliases[orgPart];
+  const orgId = aliased == null ? orgPart : aliased.split(":").at(-1) ?? orgPart;
+  return { orgId, apiBaseUrl: apiBaseUrl2 };
+};
+var resolveOrgRef = (text, store = readStore()) => {
+  const ref = parseOrgRef(text, store);
+  return {
+    orgId: ref.orgId,
+    apiBaseUrl: ref.apiBaseUrl ?? remoteForOrg(ref.orgId, store) ?? defaultApiBaseUrl(store)
+  };
+};
+var cachedOverride;
+var orgOverride = () => {
+  if (cachedOverride !== void 0) return cachedOverride;
+  cachedOverride = orgRefOverride == null ? null : { ...parseOrgRef(orgRefOverride), source: orgRefSource ?? "--org" };
+  return cachedOverride;
+};
+var orgRefText = (orgId, apiBaseUrl2, store = readStore()) => {
+  const alias = Object.entries(store.aliases).find(([name3]) => {
+    const [ref] = resultOfSync(() => resolveOrgRef(name3, store));
+    return ref?.orgId === orgId && ref.apiBaseUrl === trimSlash(apiBaseUrl2);
+  })?.[0];
+  if (alias != null) return alias;
+  if (trimSlash(apiBaseUrl2) === trimSlash(defaultApiBaseUrl(store)))
+    return orgId;
+  const name2 = remoteName(apiBaseUrl2, store);
+  return name2 === trimSlash(apiBaseUrl2) ? orgId : `${name2}:${orgId}`;
+};
+var signinHint = (orgId, apiBaseUrl2) => {
+  const store = readStore();
+  const url = trimSlash(apiBaseUrl2);
+  return remoteName(url, store) === url && url !== trimSlash(defaultApiBaseUrl(store)) ? `Run OVERAI_API_URL=${url} overai signin ${orgId}.` : `Run overai signin ${orgRefText(orgId, apiBaseUrl2, store)}.`;
+};
+var expiresIn = (at) => {
+  if (at == null) return void 0;
+  const ms = at - Date.now();
+  if (ms <= 0) return "expired";
+  const hours = Math.floor(ms / 36e5);
+  if (hours < 1) return `${String(Math.max(1, Math.floor(ms / 6e4)))}m`;
+  return hours < 48 ? `${String(hours)}h` : `${String(Math.floor(hours / 24))}d`;
+};
+
+// ../common/src/stdlib/iife.ts
+var iife = (fn2) => fn2();
+
 // ../common/src/stdlib/omit.ts
 var omit = (obj, ...keys) => {
   const result = { ...obj };
@@ -26640,7 +26804,29 @@ var omit = (obj, ...keys) => {
 
 // src/api.ts
 var commandApiBaseUrl;
-var apiBaseUrl = () => commandApiBaseUrl ??= apiBaseUrlOverride ?? readStore().defaultApiBaseUrl ?? DEFAULT_API_BASE_URL;
+var explicitRemote;
+var cloneRemote;
+var setRemoteScope = (apiBaseUrl_) => {
+  if (commandApiBaseUrl != null && commandApiBaseUrl !== apiBaseUrl_)
+    throw new Error("Cannot change remote after a command has started.");
+  explicitRemote = apiBaseUrl_;
+};
+var setCloneRemote = (apiBaseUrl_, organizationId) => {
+  cloneRemote = { apiBaseUrl: apiBaseUrl_, organizationId };
+};
+var apiBaseUrl = () => commandApiBaseUrl ??= iife(() => {
+  if (apiBaseUrlOverride != null) return apiBaseUrlOverride;
+  if (explicitRemote != null) return explicitRemote;
+  const store = readStore();
+  const override = orgOverride();
+  if (override?.apiBaseUrl != null) return override.apiBaseUrl;
+  if (cloneRemote != null && (override == null || override.orgId === cloneRemote.organizationId))
+    return cloneRemote.apiBaseUrl;
+  const overrideHome = override == null ? void 0 : remoteForOrg(override.orgId, store);
+  if (overrideHome != null) return overrideHome;
+  if (cloneRemote != null) return cloneRemote.apiBaseUrl;
+  return (orgScopeOverride == null ? void 0 : remoteForOrg(orgScopeOverride, store)) ?? defaultApiBaseUrl(store);
+});
 var AuthRpcError = class extends Error {
   constructor(status, message) {
     super(message);
@@ -26674,10 +26860,11 @@ var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
   return trpcResult(res, procedure);
 };
 var exchangeCliAuthCode = (code, codeVerifier) => trpcMutation("exchangeCliAuthCode", { code, codeVerifier });
-var exchangeSessionToken = (refreshToken, destinationOrgId) => trpcMutation("exchangeSessionToken", {
-  refreshToken,
-  destinationOrgId
-});
+var exchangeSessionToken = (refreshToken, destinationOrgId, backend = apiBaseUrl()) => trpcMutation(
+  "exchangeSessionToken",
+  { refreshToken, destinationOrgId },
+  backend
+);
 var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => trpcMutation(
   "signOutHeadless",
   { refreshToken },
@@ -26711,7 +26898,7 @@ var context = () => {
   if (commandContext != null) return commandContext;
   const store = readStore();
   const deployment = store.deployments[apiBaseUrl()];
-  const organizationId = orgIdOverride ?? orgScopeOverride ?? deployment?.defaultOrgId;
+  const organizationId = orgOverride()?.orgId ?? orgScopeOverride ?? deployment?.defaultOrgId;
   if (organizationId == null)
     throw new InteractiveSignInRequired("Not signed in. Run `overai signin`.");
   const session = deployment?.sessions[organizationId] ?? Object.values(deployment?.sessions ?? {})[0];
@@ -26732,11 +26919,12 @@ var scopedOrgId = () => {
     return null;
   }
 };
+var orgScopeSource = () => orgOverride()?.source ?? (orgScopeOverride != null ? ".overai/manifest.json" : "saved default");
 var announceOrgScope = () => {
   const org = scopedOrgId();
   if (org == null) return;
   process.stderr.write(
-    `Using org ${org} (${orgIdOverride != null ? "OVERAI_ORG_ID" : orgScopeOverride != null ? ".overai/manifest.json" : "saved default"}).
+    `Using org ${org} on ${remoteName(apiBaseUrl())} (${orgScopeSource()}).
 `
   );
 };
@@ -26749,7 +26937,7 @@ var getAccessToken = async () => {
         "All CLI sessions were signed out in another process. Run the command again."
       );
     const deployment = store.deployments[baseUrl];
-    const signin = `Run OVERAI_ORG_ID=${target.organizationId} overai signin.`;
+    const signin = signinHint(target.organizationId, baseUrl);
     if (deployment == null) throw new InteractiveSignInRequired(signin);
     if ((deployment.signedOut[target.organizationId] ?? 0) !== target.signedOut)
       throw new Error(`This org was signed out in another process. ${signin}`);
@@ -26815,6 +27003,7 @@ var getAccessToken = async () => {
           source.refreshToken = refreshed.refreshToken;
           source.accessToken = refreshed.token;
           source.accessTokenExpiresAt = Date.now() + refreshed.accessTokenValiditySeconds * 1e3;
+          source.refreshTokenExpiresAt = refreshed.refreshTokenValiditySeconds == null ? void 0 : Date.now() + refreshed.refreshTokenValiditySeconds * 1e3;
           writeStore(store);
         }
         const sourceSessionId = decodeJwtClaims(source.accessToken).sid;
@@ -26875,9 +27064,11 @@ var getAccessToken = async () => {
       apiBaseUrl: baseUrl,
       identityId: claims.user_id,
       email: claims.email ?? target.email,
+      organizationName: existing?.organizationName,
       refreshToken: result.refreshToken,
       accessToken: result.token,
-      accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3
+      accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3,
+      refreshTokenExpiresAt: result.refreshTokenValiditySeconds == null ? void 0 : Date.now() + result.refreshTokenValiditySeconds * 1e3
     };
     deployment.pending = omit(deployment.pending, target.organizationId);
     writeStore(store);
@@ -26885,6 +27076,34 @@ var getAccessToken = async () => {
     return { token: result.token, organizationId: target.organizationId };
   });
 };
+var accessTokenForSavedSession = async (backend, organizationId) => withStoreLock(async (store) => {
+  const session = store.deployments[backend]?.sessions[organizationId];
+  if (session == null)
+    throw new InteractiveSignInRequired(
+      signinHint(organizationId, backend)
+    );
+  if (session.accessToken != null && (session.accessTokenExpiresAt ?? 0) > Date.now() + 6e4)
+    return session.accessToken;
+  const result = await exchangeSessionToken(
+    session.refreshToken,
+    null,
+    backend
+  );
+  if (result.type !== "success")
+    throw new InteractiveSignInRequired(
+      signinHint(organizationId, backend)
+    );
+  if (decodeJwtClaims(result.token).org !== organizationId)
+    throw new Error(
+      "The auth server returned a session for a different org or identity."
+    );
+  session.refreshToken = result.refreshToken;
+  session.accessToken = result.token;
+  session.accessTokenExpiresAt = Date.now() + result.accessTokenValiditySeconds * 1e3;
+  session.refreshTokenExpiresAt = result.refreshTokenValiditySeconds == null ? void 0 : Date.now() + result.refreshTokenValiditySeconds * 1e3;
+  writeStore(store);
+  return result.token;
+});
 var v2Fetch = async (path, init) => {
   const auth = await getAccessToken();
   const headers = new Headers(init?.headers);
@@ -26914,7 +27133,7 @@ var v2Error = (label, res, rawBody) => {
   const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
   const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
   const orgHint = res.status === 404 || res.status === 403 ? `
-  If it lives in another org, prefix the command with OVERAI_ORG_ID=<orgId> (\`overai org list\` shows them).` : "";
+  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).` : "";
   if (reason != null) return new Error(`${reason}${orgHint}`);
   const path = (() => {
     try {
@@ -26944,6 +27163,43 @@ import { randomBytes as randomBytes2 } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 
+// src/args.ts
+import { readFileSync as readFileSync2 } from "fs";
+var flagValue = (args, ...names) => {
+  for (const name2 of names) {
+    const i = args.indexOf(name2);
+    if (i !== -1 && i + 1 < args.length) return args[i + 1];
+  }
+  return void 0;
+};
+var stdinClaimedBy = null;
+var readStdin = async (claimant = "stdin") => {
+  if (stdinClaimedBy != null) {
+    throw new Error(
+      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
+    );
+  }
+  stdinClaimedBy = claimant;
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+};
+var readValue = async (value, label) => {
+  if (value?.startsWith("@") !== true) return value;
+  if (value.startsWith("@@")) return value.slice(1);
+  const path = value.slice(1);
+  if (path === "-") return (await readStdin(`${label} @-`)).trim();
+  try {
+    return readFileSync2(path, "utf8").trim();
+  } catch {
+    throw new Error(
+      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
+    );
+  }
+};
+
 // src/browser.ts
 import { spawn } from "child_process";
 import { platform } from "os";
@@ -26958,6 +27214,60 @@ var openBrowser = (url) => {
   }
 };
 
+// src/output.ts
+var resolveFormat = (explicit) => {
+  if (explicit === "json" || explicit === "csv" || explicit === "table") {
+    return explicit;
+  }
+  if (explicit != null) {
+    throw new Error(
+      `Unknown output format "${explicit}". Use json, table, or csv.`
+    );
+  }
+  return process.stdout.isTTY ? "table" : "json";
+};
+var cell = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+};
+var formatResult = (data, format2) => {
+  if (format2 === "json" || !Array.isArray(data)) {
+    return JSON.stringify(data, null, 2);
+  }
+  const records = data.map(
+    (row) => row != null && typeof row === "object" ? row : { value: row }
+  );
+  if (records.length === 0) return "(no rows)";
+  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
+  if (format2 === "csv") {
+    const escape2 = (value) => {
+      const text = cell(value);
+      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    };
+    return [
+      columns.join(","),
+      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
+    ].join("\n");
+  }
+  const widths = columns.map(
+    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
+  );
+  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
+  return [
+    line(columns),
+    line(widths.map((w) => "-".repeat(w))),
+    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
+  ].join("\n");
+};
+var printResult = (data, format2) => {
+  process.stdout.write(`${formatResult(data, format2)}
+`);
+};
+
 // src/pkce.ts
 import { createHash, randomBytes } from "crypto";
 var createPkcePair = () => {
@@ -26967,7 +27277,7 @@ var createPkcePair = () => {
 };
 
 // src/workspace/manifest.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { dirname, join as join2, resolve } from "path";
 var MANIFEST_DIR = ".overai";
 var MANIFEST_FILE = "manifest.json";
@@ -26986,22 +27296,34 @@ var findWorkspaceRoot = (from = process.cwd()) => {
   }
 };
 var readManifest = (root) => JSON.parse(
-  readFileSync2(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
+  readFileSync3(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
 );
 var openClone = () => {
   const root = findWorkspaceRoot();
   const manifest = readManifest(root);
-  if (orgIdOverride != null && orgIdOverride !== manifest.organizationId) {
+  const override = orgOverride();
+  if (override != null && override.orgId !== manifest.organizationId) {
+    throw new Error(
+      `${override.source}=${override.orgId} conflicts with this clone's org ${manifest.organizationId}. Drop it before syncing.`
+    );
+  }
+  const namedRemote = override?.apiBaseUrl ?? apiBaseUrlOverride;
+  if (namedRemote != null && manifest.apiBaseUrl != null && namedRemote !== manifest.apiBaseUrl) {
     throw new Error(
-      `OVERAI_ORG_ID=${orgIdOverride} conflicts with this clone's org ${manifest.organizationId}. Unset it before syncing.`
+      `${override?.apiBaseUrl == null ? "OVERAI_API_URL" : override.source} names remote ${remoteName(namedRemote)}; this clone came from ${remoteName(manifest.apiBaseUrl)}.`
     );
   }
+  if (manifest.apiBaseUrl != null)
+    setCloneRemote(manifest.apiBaseUrl, manifest.organizationId);
   setOrgScope(manifest.organizationId);
   return { root, manifest };
 };
 var pinOrgFromClone = () => {
   try {
-    setOrgScope(readManifest(findWorkspaceRoot()).organizationId);
+    const manifest = readManifest(findWorkspaceRoot());
+    if (manifest.apiBaseUrl != null)
+      setCloneRemote(manifest.apiBaseUrl, manifest.organizationId);
+    setOrgScope(manifest.organizationId);
   } catch {
   }
 };
@@ -27022,14 +27344,14 @@ var writeSynced = (root, relPath, content) => {
 };
 var readWorkingFile = (root, relPath) => {
   try {
-    return readFileSync2(join2(root, relPath), "utf8");
+    return readFileSync3(join2(root, relPath), "utf8");
   } catch {
     return null;
   }
 };
 var readBaseFile = (root, relPath) => {
   try {
-    return readFileSync2(basePath(root, relPath), "utf8");
+    return readFileSync3(basePath(root, relPath), "utf8");
   } catch {
     return null;
   }
@@ -27116,11 +27438,28 @@ var startCallbackServer = (expectedState) => {
     });
   });
 };
-var signIn = async (requestedOrgId = orgIdOverride) => {
+var signIn = async (target = orgRefOverride) => {
+  const requestedOrgId = (() => {
+    if (target == null) return void 0;
+    if (target.startsWith("http://") || target.startsWith("https://")) {
+      setRemoteScope(trimSlash(target));
+      return orgOverride()?.orgId;
+    }
+    const remote = remoteOnlyRef(target);
+    if (remote != null) {
+      setRemoteScope(remote);
+      return orgOverride()?.orgId;
+    }
+    const ref = parseOrgRef(target);
+    if (ref.apiBaseUrl != null) setRemoteScope(ref.apiBaseUrl);
+    return ref.orgId;
+  })();
   const baseUrl = apiBaseUrl();
   const browserBaseUrl = appBaseUrl(baseUrl);
   if (browserBaseUrl === "")
-    throw new Error("Set OVERAI_APP_URL for this backend before signing in.");
+    throw new Error(
+      `No web address known for ${remoteName(baseUrl)}. Record one with: overai remote add <name> ${baseUrl} --app <appUrl>`
+    );
   const initialStore = readStore();
   const { verifier, challenge } = createPkcePair();
   const state = randomBytes2(16).toString("base64url");
@@ -27183,12 +27522,16 @@ ${authorizeUrl}
           identityId: claims.user_id,
           email,
           accessToken: session.token,
-          accessTokenExpiresAt: Date.now() + session.accessTokenValiditySeconds * 1e3
+          accessTokenExpiresAt: Date.now() + session.accessTokenValiditySeconds * 1e3,
+          refreshTokenExpiresAt: Date.now() + session.refreshTokenValiditySeconds * 1e3
         };
         deployment.pending = omit(deployment.pending, session.organizationId);
         deployment.appBaseUrl = browserBaseUrl;
         deployment.defaultOrgId = session.organizationId;
         store.defaultApiBaseUrl = baseUrl;
+        const derived = derivedRemoteName(baseUrl);
+        if (derived != null && remoteUrl(derived, store) == null && !Object.values(store.remotes).some((url) => trimSlash(url) === baseUrl))
+          store.remotes[derived] = baseUrl;
         writeStore(store);
       });
     } catch (error) {
@@ -27196,22 +27539,44 @@ ${authorizeUrl}
       throw error;
     }
     process.stdout.write(
-      `Signed in${email != null ? ` as ${email}` : ""} (org ${session.organizationId}).
+      `Signed in${email != null ? ` as ${email}` : ""} to org ${session.organizationId} on ${remoteName(baseUrl)}.
+This is now the default for commands that don't name an org.
 `
     );
   } finally {
     close();
   }
 };
-var signOut = async (all = false) => {
-  const root = (() => {
-    try {
-      return findWorkspaceRoot();
-    } catch {
-      return null;
+var signOut = async (all = false, target) => {
+  if (target != null) {
+    const ref = resolveOrgRef(target);
+    const override = orgOverride();
+    if (override != null && override.orgId !== ref.orgId) {
+      throw new Error(
+        `${override.source}=${override.orgId} conflicts with the requested org ${ref.orgId}. Drop it first.`
+      );
     }
-  })();
-  if (root != null) setOrgScope(readManifest(root).organizationId);
+    setRemoteScope(ref.apiBaseUrl);
+    setOrgScope(ref.orgId);
+  } else {
+    const root = (() => {
+      try {
+        return findWorkspaceRoot();
+      } catch {
+        return null;
+      }
+    })();
+    if (root != null) {
+      const manifest = readManifest(root);
+      if (manifest.apiBaseUrl != null)
+        setCloneRemote(manifest.apiBaseUrl, manifest.organizationId);
+      setOrgScope(manifest.organizationId);
+    }
+  }
+  if (requireExplicitOrg && !all && orgScopeSource() === "saved default")
+    throw new Error(
+      "OVERAI_REQUIRE_EXPLICIT_ORG is set and nothing named an org to sign out of. Name one: overai signout <ref>, or revoke every saved session with: overai signout --all"
+    );
   const baseUrl = apiBaseUrl();
   const orgId = scopedOrgId();
   await withStoreLock(async (store) => {
@@ -27265,11 +27630,11 @@ var signOut = async (all = false) => {
       );
   });
   process.stdout.write(
-    all ? "Signed out of all locally saved CLI sessions.\n" : `Signed out of org ${orgId ?? "(none selected)"}.
+    all ? "Signed out of all locally saved CLI sessions.\n" : `Signed out of org ${orgId ?? "(none selected)"}${orgId == null ? "" : ` on ${remoteName(baseUrl)}`}.
 `
   );
 };
-var whoami = () => {
+var whoami = (args = []) => {
   const root = (() => {
     try {
       return findWorkspaceRoot();
@@ -27277,108 +27642,40 @@ var whoami = () => {
       return null;
     }
   })();
-  if (root != null) setOrgScope(readManifest(root).organizationId);
-  const org = scopedOrgId();
-  const deployment = readStore().deployments[apiBaseUrl()];
-  const session = org == null ? void 0 : deployment?.sessions[org];
-  process.stdout.write(
-    `Backend: ${apiBaseUrl()}
-Org: ${org ?? "none"}
-Selected by: ${orgIdOverride != null ? "OVERAI_ORG_ID" : root != null ? ".overai/manifest.json" : "saved default"}
-Identity: ${session?.email ?? session?.identityId ?? "no saved session for this org"}
-`
-  );
-};
-
-// src/args.ts
-import { readFileSync as readFileSync3 } from "fs";
-var flagValue = (args, ...names) => {
-  for (const name2 of names) {
-    const i = args.indexOf(name2);
-    if (i !== -1 && i + 1 < args.length) return args[i + 1];
-  }
-  return void 0;
-};
-var stdinClaimedBy = null;
-var readStdin = async (claimant = "stdin") => {
-  if (stdinClaimedBy != null) {
-    throw new Error(
-      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
-    );
-  }
-  stdinClaimedBy = claimant;
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks).toString("utf8");
-};
-var readValue = async (value, label) => {
-  if (value?.startsWith("@") !== true) return value;
-  if (value.startsWith("@@")) return value.slice(1);
-  const path = value.slice(1);
-  if (path === "-") return (await readStdin(`${label} @-`)).trim();
-  try {
-    return readFileSync3(path, "utf8").trim();
-  } catch {
-    throw new Error(
-      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
-    );
-  }
-};
-
-// src/output.ts
-var resolveFormat = (explicit) => {
-  if (explicit === "json" || explicit === "csv" || explicit === "table") {
-    return explicit;
-  }
-  if (explicit != null) {
-    throw new Error(
-      `Unknown output format "${explicit}". Use json, table, or csv.`
-    );
-  }
-  return process.stdout.isTTY ? "table" : "json";
-};
-var cell = (value) => {
-  if (value == null) return "";
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
+  if (root != null) {
+    const manifest = readManifest(root);
+    if (manifest.apiBaseUrl != null)
+      setCloneRemote(manifest.apiBaseUrl, manifest.organizationId);
+    setOrgScope(manifest.organizationId);
   }
-  return JSON.stringify(value);
-};
-var formatResult = (data, format2) => {
-  if (format2 === "json" || !Array.isArray(data)) {
-    return JSON.stringify(data, null, 2);
-  }
-  const records = data.map(
-    (row) => row != null && typeof row === "object" ? row : { value: row }
-  );
-  if (records.length === 0) return "(no rows)";
-  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
-  if (format2 === "csv") {
-    const escape2 = (value) => {
-      const text = cell(value);
-      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
-    };
-    return [
-      columns.join(","),
-      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
-    ].join("\n");
+  const store = readStore();
+  const org = scopedOrgId();
+  const backend = apiBaseUrl();
+  const session = org == null ? void 0 : store.deployments[backend]?.sessions[org];
+  const facts = {
+    remote: remoteName(backend, store),
+    apiBaseUrl: backend,
+    org: org ?? "none",
+    orgName: session?.organizationName ?? "",
+    ref: org == null ? "" : orgRefText(org, backend, store),
+    selectedBy: orgOverride()?.source ?? (root != null ? ".overai/manifest.json" : "saved default"),
+    identity: session?.email ?? session?.identityId ?? "no saved session for this org",
+    sessionExpires: expiresIn(session?.refreshTokenExpiresAt) ?? "unknown"
+  };
+  const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+  if (format2 !== "table") {
+    printResult(facts, format2);
+    return;
   }
-  const widths = columns.map(
-    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
+  process.stdout.write(
+    [
+      `Remote:   ${facts.remote} (${facts.apiBaseUrl})`,
+      `Org:      ${facts.org}${facts.orgName === "" ? "" : ` (${facts.orgName})`}`,
+      `Selected: ${facts.selectedBy}`,
+      `Identity: ${facts.identity}`,
+      `Session:  ${facts.sessionExpires === "unknown" ? "expiry unknown" : facts.sessionExpires === "expired" ? "expired \u2014 sign in again" : `expires in ${facts.sessionExpires}`}`
+    ].join("\n") + "\n"
   );
-  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
-  return [
-    line(columns),
-    line(widths.map((w) => "-".repeat(w))),
-    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
-  ].join("\n");
-};
-var printResult = (data, format2) => {
-  process.stdout.write(`${formatResult(data, format2)}
-`);
 };
 
 // src/commands/agent.ts
@@ -27517,11 +27814,11 @@ var runAutomation = async (args) => {
 // src/workspace/validateElements.ts
 var findings = (parsed) => parsed.success ? [] : parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
 var validateAutomationElements = async (elements) => {
-  const { automationNodesSchema } = await import("./types-WI2WSJ3F.js");
+  const { automationNodesSchema } = await import("./types-7JF7GZMJ.js");
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
-  const { webPageConfigWriteSchema } = await import("./webPage-3MNCKCRX.js");
+  const { webPageConfigWriteSchema } = await import("./webPage-7BXDGWX5.js");
   return findings(webPageConfigWriteSchema.safeParse(config));
 };
 
@@ -34257,6 +34554,7 @@ var runClone = async (args, isShallow = false) => {
           workspaceId: entry.workspace.id,
           workspaceName: entry.workspace.name,
           organizationId: entry.workspace.organizationId,
+          apiBaseUrl: apiBaseUrl(),
           resources: {}
         },
         resourcesByAdapter
@@ -35130,6 +35428,7 @@ var ID_PREFIXES = {
   },
   snaptrade_user: { prefix: "stu", body: 12 },
   storage_transcription: { prefix: "stc", body: 10 },
+  storage_transcription_job: { prefix: "stj", body: 10 },
   storage_vision_conversion: {
     prefix: "svc",
     body: 20,
@@ -35249,6 +35548,7 @@ var runOpen = async (args) => {
 };
 
 // src/commands/org.ts
+import { createInterface } from "readline/promises";
 var USER_ORGS_QUERY = `
   query UserOrganizations($identityId: String!) {
     identityOrganizations(condition: { identityId: $identityId }) {
@@ -35259,55 +35559,369 @@ var USER_ORGS_QUERY = `
     }
   }
 `;
-var listOrgRows = async () => {
-  const auth = await getAccessToken();
-  const identityId = decodeJwtClaims(auth.token).user_id;
-  if (identityId == null) {
+var collectOrgs = async () => {
+  const store = readStore();
+  const aliasFor = (orgId, backend) => Object.entries(store.aliases).find(([alias]) => {
+    const [ref] = resultOfSync(() => resolveOrgRef(alias, store));
+    return ref?.orgId === orgId && trimSlash(ref.apiBaseUrl) === backend;
+  })?.[0] ?? "";
+  const activeBackend = defaultApiBaseUrl(store);
+  const rows = await Promise.all(
+    Object.entries(store.deployments).filter(([, deployment]) => Object.keys(deployment.sessions).length > 0).map(async ([backend, deployment]) => {
+      const name2 = remoteName(backend, store);
+      const asOrg = deployment.defaultOrgId != null && deployment.sessions[deployment.defaultOrgId] != null ? deployment.defaultOrgId : Object.keys(deployment.sessions)[0] ?? "";
+      const [memberships, failure] = await fetchOrgNames(backend, asOrg).then(
+        (names) => [names, void 0],
+        (error) => [
+          /* @__PURE__ */ new Map(),
+          error instanceof Error ? error.message : String(error)
+        ]
+      );
+      const ids = /* @__PURE__ */ new Set([
+        ...Object.keys(deployment.sessions),
+        ...memberships.keys()
+      ]);
+      return [...ids].map((id) => {
+        const session = deployment.sessions[id];
+        return {
+          active: backend === activeBackend && deployment.defaultOrgId === id,
+          alias: aliasFor(id, backend),
+          name: memberships.get(id) ?? session?.organizationName ?? "",
+          id,
+          remote: name2,
+          apiBaseUrl: backend,
+          session: failure ?? (session == null ? "signin required" : expiresIn(session.refreshTokenExpiresAt) ?? "saved")
+        };
+      });
+    })
+  );
+  return rows.flat().sort(
+    (a, b) => a.remote.localeCompare(b.remote) || a.name.localeCompare(b.name) || a.id.localeCompare(b.id)
+  );
+};
+var fetchOrgNames = async (backend, organizationId) => {
+  const token = await accessTokenForSavedSession(backend, organizationId);
+  const identityId = decodeJwtClaims(token).user_id;
+  if (identityId == null)
     throw new Error("Could not read identity from the current session.");
-  }
-  const data = await gqlRequest(USER_ORGS_QUERY, { identityId });
-  return data.identityOrganizations.nodes.filter((node) => node != null && !node.disabled).map((node) => node?.organization).filter((org) => org != null);
+  const response = await fetch(`${backend}/v2/graphql`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    body: JSON.stringify({
+      query: USER_ORGS_QUERY,
+      variables: { identityId }
+    }),
+    signal: AbortSignal.timeout(3e4)
+  });
+  const body = await response.json().catch(() => null);
+  const failure = body?.errors?.[0]?.message;
+  if (failure != null) throw new Error(failure);
+  if (body?.data == null)
+    throw new Error(`HTTP ${String(response.status)} listing organizations`);
+  return new Map(
+    body.data.identityOrganizations.nodes.filter((node) => node != null && !node.disabled).map((node) => node?.organization).filter((org) => org != null).map((org) => [org.id, org.name ?? ""])
+  );
 };
-var listOrgs = async (args) => {
-  const active = scopedOrgId();
+var cacheOrgNames = async (rows) => {
+  const named = rows.filter((row) => row.name !== "");
+  if (named.length === 0) return;
+  await withStoreLock((store) => {
+    let changed = false;
+    for (const row of named) {
+      const session = store.deployments[row.apiBaseUrl]?.sessions[row.id];
+      if (session == null || session.organizationName === row.name) continue;
+      session.organizationName = row.name;
+      changed = true;
+    }
+    if (changed) writeStore(store);
+  });
+};
+var printOrgs = (rows, format2) => {
+  const resolved = resolveFormat(format2);
+  if (resolved !== "table") {
+    printResult(rows, resolved);
+    return;
+  }
+  const multiRemote = new Set(rows.map((row) => row.remote)).size > 1;
+  const aliased = rows.some((row) => row.alias !== "");
   printResult(
-    (await listOrgRows()).map((org) => ({
-      id: org.id,
-      name: org.name ?? "",
-      active: org.id === active,
-      sessionSaved: readStore().deployments[apiBaseUrl()]?.sessions[org.id] != null
+    rows.map((row) => ({
+      "": row.active ? "*" : "",
+      ...aliased ? { alias: row.alias } : {},
+      name: row.name,
+      id: row.id,
+      ...multiRemote ? { remote: row.remote } : {},
+      session: row.session
     })),
-    resolveFormat(flagValue(args, "-o", "--output"))
+    resolved
   );
 };
-var switchOrg = async (orgId) => {
-  if (orgIdOverride != null && orgIdOverride !== orgId) {
+var listOrgs = async (args) => {
+  const rows = await collectOrgs();
+  await cacheOrgNames(rows);
+  printOrgs(rows, flagValue(args, "-o", "--output"));
+};
+var promptForOrg = async () => {
+  if (!process.stdin.isTTY || !process.stdout.isTTY)
     throw new Error(
-      `OVERAI_ORG_ID=${orgIdOverride} conflicts with the requested org ${orgId}. Unset it first.`
+      "Name the org to switch to: overai org switch <alias|orgId|remote:orgId>"
+    );
+  const rows = await collectOrgs();
+  if (rows.length === 0)
+    throw new Error("No organizations found. Run overai signin first.");
+  rows.forEach((row, index) => {
+    process.stdout.write(
+      `${String(index + 1).padStart(2)}. ${row.active ? "*" : " "} ${row.name || row.id}  ${row.id}  ${row.remote}${row.alias === "" ? "" : `  (${row.alias})`}
+`
     );
+  });
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await rl.question("Switch to: ");
+    const chosen = rows[Number(answer.trim()) - 1];
+    if (chosen == null) throw new Error(`No org numbered "${answer.trim()}".`);
+    return { orgId: chosen.id, apiBaseUrl: chosen.apiBaseUrl };
+  } finally {
+    rl.close();
   }
-  setOrgScope(orgId);
+};
+var switchOrg = async (target) => {
+  const override = orgOverride();
+  const ref = await iife(async () => {
+    if (target == null) return promptForOrg();
+    const remote = remoteOnlyRef(target);
+    if (remote == null) return resolveOrgRef(target);
+    const orgId = readStore().deployments[remote]?.defaultOrgId;
+    if (orgId == null)
+      throw new Error(
+        `No default org saved for ${target}. Name one: overai org switch ${target}:<orgId>`
+      );
+    return { orgId, apiBaseUrl: remote };
+  });
+  if (override != null && override.orgId !== ref.orgId) {
+    throw new Error(
+      `${override.source}=${override.orgId} conflicts with the requested org ${ref.orgId}. Drop it first.`
+    );
+  }
+  setRemoteScope(ref.apiBaseUrl);
+  setOrgScope(ref.orgId);
   try {
     await getAccessToken();
   } catch (error) {
     if (!(error instanceof InteractiveSignInRequired)) throw error;
-    await signIn(orgId);
+    await signIn(ref.orgId);
   }
   await withStoreLock((store) => {
-    const deployment = store.deployments[apiBaseUrl()];
-    if (deployment?.sessions[orgId] == null)
+    const deployment = store.deployments[ref.apiBaseUrl];
+    if (deployment?.sessions[ref.orgId] == null)
       throw new Error(
         "Session was signed out before the default could be changed."
       );
-    deployment.defaultOrgId = orgId;
+    deployment.defaultOrgId = ref.orgId;
+    store.defaultApiBaseUrl = ref.apiBaseUrl;
     writeStore(store);
   });
   process.stdout.write(
-    `Default org set to ${orgId}. Other org sessions are unchanged.
-This default is machine-global; workspace folders and OVERAI_ORG_ID override it.
+    `Default org set to ${ref.orgId} on ${remoteName(ref.apiBaseUrl)}. Other org sessions are unchanged.
+This default is machine-global; a clone folder, --org, and OVERAI_ORG_ID all override it.
 `
   );
 };
+var aliasRows = (store) => Object.entries(store.aliases).map(([alias, ref]) => ({ alias, ref })).sort((a, b) => a.alias.localeCompare(b.alias));
+var aliasOrg = async (args) => {
+  const format2 = flagValue(args, "-o", "--output");
+  const [alias, target] = args.filter(
+    (arg, index) => !arg.startsWith("-") && args[index - 1] !== "-o" && args[index - 1] !== "--output"
+  );
+  if (alias == null) {
+    printResult(aliasRows(readStore()), resolveFormat(format2));
+    return;
+  }
+  if (target == null)
+    throw new Error("Usage: overai org alias <name> <alias|orgId|remote:orgId>");
+  if (alias.includes(":") || /\s/.test(alias))
+    throw new Error(`Alias "${alias}" cannot contain ":" or whitespace.`);
+  const ref = resolveOrgRef(target);
+  await withStoreLock((store) => {
+    const name2 = remoteName(ref.apiBaseUrl, store);
+    store.aliases[alias] = name2 === trimSlash(ref.apiBaseUrl) ? ref.orgId : `${name2}:${ref.orgId}`;
+    writeStore(store);
+  });
+  process.stdout.write(
+    `${alias} \u2192 ${ref.orgId} on ${remoteName(ref.apiBaseUrl)}
+`
+  );
+};
+var unaliasOrg = async (alias) => {
+  await withStoreLock((store) => {
+    if (store.aliases[alias] == null)
+      throw new Error(`No alias named "${alias}".`);
+    store.aliases = omit(store.aliases, alias);
+    writeStore(store);
+  });
+  process.stdout.write(`Removed alias ${alias}.
+`);
+};
+
+// src/commands/remote.ts
+var listRemotes = (args) => {
+  const store = readStore();
+  const active = defaultApiBaseUrl(store);
+  const rows = knownRemotes(store).map((remote) => {
+    const deployment = store.deployments[remote.apiBaseUrl];
+    return {
+      active: remote.apiBaseUrl === active,
+      name: remote.name,
+      apiBaseUrl: remote.apiBaseUrl,
+      appBaseUrl: deployment?.appBaseUrl ?? "",
+      signedInOrgs: Object.keys(deployment?.sessions ?? {}).length
+    };
+  });
+  const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+  if (format2 !== "table") {
+    printResult(rows, format2);
+    return;
+  }
+  const customApp = rows.some((row) => row.appBaseUrl !== "");
+  printResult(
+    rows.map((row) => ({
+      "": row.active ? "*" : "",
+      name: row.name,
+      api: row.apiBaseUrl,
+      ...customApp ? { app: row.appBaseUrl } : {},
+      orgs: row.signedInOrgs === 0 ? "" : String(row.signedInOrgs)
+    })),
+    format2
+  );
+};
+var addRemote = async (args) => {
+  const [name2, url] = args;
+  if (name2 == null || url == null)
+    throw new Error(
+      "Usage: overai remote add <name> <apiUrl> [--app <appUrl>]"
+    );
+  if (name2.includes(":") || /\s/.test(name2))
+    throw new Error(`Remote name "${name2}" cannot contain ":" or whitespace.`);
+  if (!url.startsWith("http://") && !url.startsWith("https://"))
+    throw new Error(`"${url}" is not an http(s) URL.`);
+  const apiBaseUrl2 = trimSlash(url);
+  const app = flagValue(args, "--app");
+  await withStoreLock((store) => {
+    const existing = remoteUrl(name2, store);
+    if (existing != null && existing !== apiBaseUrl2)
+      throw new Error(
+        `"${name2}" already names ${existing}. Remove that remote first, or choose another name.`
+      );
+    store.remotes[name2] = apiBaseUrl2;
+    if (app != null) {
+      const deployment = store.deployments[apiBaseUrl2] ??= {
+        sessions: {},
+        pending: {},
+        signedOut: {}
+      };
+      deployment.appBaseUrl = trimSlash(app);
+    }
+    writeStore(store);
+  });
+  process.stdout.write(
+    `Added remote ${name2} \u2192 ${apiBaseUrl2}. Sign in with: overai signin ${name2}
+`
+  );
+};
+var removeRemote = async (name2) => {
+  const apiBaseUrl2 = remoteUrl(name2, readStore());
+  if (apiBaseUrl2 == null) throw new Error(`No remote named "${name2}".`);
+  if (BUILT_IN_REMOTES[name2] != null)
+    throw new Error(
+      `"${name2}" is built in and cannot be removed. Run overai signout --all to drop its sessions.`
+    );
+  await withStoreLock(async (store) => {
+    const deployment = store.deployments[apiBaseUrl2];
+    if (Object.keys(deployment?.pending ?? {}).length > 0)
+      throw new Error(
+        `${name2} has an unfinished org exchange. Run overai signout --all first.`
+      );
+    const failures = [];
+    for (const [orgId, session] of Object.entries(deployment?.sessions ?? {})) {
+      try {
+        await signOutHeadless(session.refreshToken, apiBaseUrl2);
+        if (deployment != null)
+          deployment.sessions = omit(deployment.sessions, orgId);
+      } catch {
+        failures.push(orgId);
+      }
+    }
+    if (failures.length > 0) {
+      writeStore(store);
+      throw new Error(
+        `Could not revoke ${name2} org ${failures.join(", ")}. Credentials retained; retry.`
+      );
+    }
+    store.remotes = omit(store.remotes, name2);
+    store.deployments = omit(store.deployments, apiBaseUrl2);
+    store.aliases = Object.fromEntries(
+      Object.entries(store.aliases).filter(
+        ([, ref]) => !ref.startsWith(`${name2}:`)
+      )
+    );
+    if (store.defaultApiBaseUrl === apiBaseUrl2) delete store.defaultApiBaseUrl;
+    writeStore(store);
+  });
+  process.stdout.write(`Removed remote ${name2}.
+`);
+};
+var renameRemote = async (from, to) => {
+  if (BUILT_IN_REMOTES[from] != null)
+    throw new Error(`"${from}" is built in and cannot be renamed.`);
+  if (to.includes(":") || /\s/.test(to))
+    throw new Error(`Remote name "${to}" cannot contain ":" or whitespace.`);
+  await withStoreLock((store) => {
+    const url = remoteUrl(from, store);
+    if (url == null) throw new Error(`No remote named "${from}".`);
+    const taken = remoteUrl(to, store);
+    if (taken != null)
+      throw new Error(`"${to}" already names ${taken}. Choose another name.`);
+    store.remotes = { ...omit(store.remotes, from), [to]: url };
+    store.aliases = Object.fromEntries(
+      Object.entries(store.aliases).map(([alias, ref]) => [
+        alias,
+        ref.startsWith(`${from}:`) ? `${to}:${ref.slice(from.length + 1)}` : ref
+      ])
+    );
+    writeStore(store);
+  });
+  process.stdout.write(`Renamed remote ${from} to ${to}.
+`);
+};
+var runRemote = async (args) => {
+  const [subcommand, ...rest] = args;
+  switch (subcommand) {
+    case void 0:
+    case "list":
+      listRemotes(rest);
+      return;
+    case "add":
+      await addRemote(rest);
+      return;
+    case "remove":
+    case "rm":
+      if (rest[0] == null) throw new Error("Usage: overai remote remove <name>");
+      await removeRemote(rest[0]);
+      return;
+    case "rename":
+      if (rest[0] == null || rest[1] == null)
+        throw new Error("Usage: overai remote rename <old> <new>");
+      await renameRemote(rest[0], rest[1]);
+      return;
+    default:
+      throw new Error(
+        "Usage: overai remote list | add <name> <apiUrl> [--app <url>] | remove <name> | rename <old> <new>"
+      );
+  }
+};
 
 // src/commands/printablePage.ts
 var runPrintablePage = async (args) => {
@@ -35978,10 +36592,17 @@ var platform2 = `# OverAI platform primer
 Saves reject a stale editing base without discarding your draft. Incorporate the latest saved changes before retrying; never retry with a newer base unless those changes have been reconciled. A save conflict does not deploy anything. Normal push sends the manifest base to an atomic server check. Only explicit --force omits it; never use --force as automatic conflict recovery.
 
 Organization context: Commands in a clone select its org automatically. Outside a clone,
-use OVERAI_ORG_ID=<orgId>. Each backend/org has an independent saved session; org switch
-changes only the machine-global default. Use whoami to inspect the effective scope.
-If browser authorization is required, ask the user to run the suggested signin command.
-Never change org to work around a clone-sync mismatch; use the correct workspace folder.
+put --org <ref> before the command (overai --org acme sql ...), or set OVERAI_ORG_ID for a
+whole shell. A ref is an org id, a local alias, or <remote>:<orgId>, and a named org
+selects its own deployment \u2014 never switch the machine-global default to reach another org,
+because every other session on the machine shares it. Prefer naming the org on every
+command rather than relying on the saved default: the default is whatever another session
+last switched to, so falling back to it reads the wrong tenant instead of failing.
+OVERAI_REQUIRE_EXPLICIT_ORG=1 turns that fallback into an error for every command
+that acts on an org. Each remote/org has an independent
+saved session. Use whoami to inspect the effective scope. If browser authorization is
+required, ask the user to run the suggested signin command. Never change org to work
+around a clone-sync mismatch; use the correct workspace folder.
 
 Resources live in Workspaces. The runtime always executes the DEPLOYED version
 of a resource, never the latest \u2014 \`overai push\` creates a version, \`overai
@@ -36444,7 +37065,7 @@ var runReview = async () => {
 };
 
 // src/commands/sql.ts
-import { createInterface } from "readline";
+import { createInterface as createInterface2 } from "readline";
 
 // src/commands/sqlCredential.ts
 var connectionString = async (tableSpaceId, secret) => {
@@ -36475,11 +37096,11 @@ var runSqlCredential = async (args) => {
     const tableSpaceId = id;
     const name2 = flagValue(args, "--name");
     if (!name2) throw new Error("create requires --name <name>");
-    const expiresIn = flagValue(args, "--expires-in");
-    if (expiresIn && args.includes("--never")) {
+    const expiresIn2 = flagValue(args, "--expires-in");
+    if (expiresIn2 && args.includes("--never")) {
       throw new Error("Use either --expires-in <days> or --never, not both");
     }
-    const days = expiresIn ? Number(expiresIn) : 365;
+    const days = expiresIn2 ? Number(expiresIn2) : 365;
     if (!args.includes("--never") && (!Number.isInteger(days) || days < 1)) {
       throw new Error("--expires-in must be a positive whole number of days");
     }
@@ -36588,7 +37209,7 @@ transaction \u2014 BEGIN/SET/temp tables don't carry across statements.
 `;
 var runRepl = async (organizationId, tableSpaceId, format2) => {
   const interactive = process.stdin.isTTY;
-  const rl = createInterface({
+  const rl = createInterface2({
     input: process.stdin,
     ...interactive ? { output: process.stdout, historySize: 1e3, terminal: true } : {}
   });
@@ -36916,13 +37537,22 @@ var printUpdateNotice = async (check) => {
 var HELP = `overai \u2014 OverAI command-line interface
 
 Usage:
-  overai signin                        Sign in via your browser; choose your
-                                       organization there to complete SSO
-  overai signout [--all]               Revoke this org\u2019s saved CLI session;
+  overai signin [<ref> | <apiUrl>]     Sign in via your browser; choose your
+                                       organization there to complete SSO.
+                                       A URL signs in to that deployment and
+                                       remembers it as a remote
+  overai signout [<ref>] [--all]       Revoke one org\u2019s saved CLI session;
                                        --all revokes all locally saved sessions
-  overai whoami                        Show the current identity and org
-  overai org list                      List your organizations
-  overai org switch <orgId>            Select the default org
+  overai whoami                        Show the current remote, identity, and org
+  overai org list                      Your organizations, on every remote
+  overai org switch [<ref>]            Select the default org and remote;
+                                       no argument picks from a list
+  overai org alias [<name> <ref>]      Name an org locally, or list the names
+  overai org unalias <name>
+  overai remote list                   Deployments you can reach
+  overai remote add <name> <apiUrl> [--app <url>]
+  overai remote remove <name>          Forget it and revoke its sessions
+  overai remote rename <old> <new>
   overai workspace list [--archived]   List workspaces you can see in this org
   overai workspace show [workspaceId]  Show a workspace's name and overview
   overai workspace users [workspaceId] List users and effective/direct roles
@@ -37010,17 +37640,24 @@ it from stdin. Prefer that for anything long or quote-heavy: an inline value is
 parsed by your shell first, and one apostrophe inside it silently truncates the
 rest. Write @@ to send a literal value that starts with "@".
 
-Organizations: OVERAI_ORG_ID selects an org for one command or shell, else commands
-use the clone\u2019s org (.overai/manifest.json), else the saved default. Each backend
-and org has its own session. Entering another org preserves existing sessions;
-org switch changes only the machine-global default. Clone sync commands reject
-conflicting overrides. SSO prompts name the signin command to run explicitly.
-whoami shows the backend, org, identity, and selection source.
+Organizations: an org is named by a ref \u2014 <orgId>, an alias, or <remote>:<orgId> \u2014
+wherever one is accepted. --org (before the command) selects one for a single
+invocation and OVERAI_ORG_ID for a shell; else commands use the clone\u2019s org
+(.overai/manifest.json), else the saved default. A named org picks its own
+remote, so concurrent agents in different orgs never need a second variable.
+Each remote and org has its own session; entering another org preserves the
+existing ones, and org switch changes only the machine-global default.
+Clone sync commands reject conflicting overrides. whoami shows the effective
+remote, org, identity, and what selected them.
 
 Output: table on a TTY, JSON when piped; -o json|table|csv to force.
 Aliases: login = signin, logout = signout, ws = workspace.
 Env: OVERAI_API_URL, OVERAI_APP_URL override the target deployment.
      OVERAI_ORG_ID overrides the organization for this shell.
+     OVERAI_REQUIRE_EXPLICIT_ORG=1 refuses to fall back to the saved default
+     org, so every command that acts on one must name it with --org or stand in
+     a clone.
+Global flags (before the command): --org <ref>
 `;
 process.stdout.on("error", (error) => {
   if (error.code === "EPIPE") process.exit(0);
@@ -37033,6 +37670,7 @@ var ORG_AGNOSTIC_COMMANDS = /* @__PURE__ */ new Set([
   "logout",
   "whoami",
   "org",
+  "remote",
   "clone",
   "update",
   "upgrade",
@@ -37043,6 +37681,24 @@ var ORG_AGNOSTIC_COMMANDS = /* @__PURE__ */ new Set([
   "--help",
   "-h"
 ]);
+var ORG_OPTIONAL_COMMANDS = /* @__PURE__ */ new Set([
+  "signin",
+  "login",
+  "signout",
+  "logout",
+  "whoami",
+  "org",
+  "remote",
+  "best-practices",
+  "update",
+  "upgrade",
+  "version",
+  "--version",
+  "-v",
+  "help",
+  "--help",
+  "-h"
+]);
 var SKIP_UPDATE_CHECK = /* @__PURE__ */ new Set([
   void 0,
   "update",
@@ -37054,12 +37710,30 @@ var SKIP_UPDATE_CHECK = /* @__PURE__ */ new Set([
   "--help",
   "-h"
 ]);
+var withoutLeadingFlags = (argv) => {
+  let index = 0;
+  while (argv[index]?.startsWith("--") === true) {
+    const flag = argv[index] ?? "";
+    if (!LEADING_FLAGS.includes(flag)) break;
+    if (argv[index + 1] == null) throw new Error(`${flag} needs a value.`);
+    index += 2;
+  }
+  return argv.slice(index);
+};
 var run = async () => {
-  const [command2, ...rest] = process.argv.slice(2);
-  if (command2 != null && !ORG_AGNOSTIC_COMMANDS.has(command2)) {
-    pinOrgFromClone();
-    announceOrgScope();
-  }
+  const [command2, ...rest] = withoutLeadingFlags(process.argv.slice(2));
+  const misplaced = rest.find((arg) => LEADING_FLAGS.includes(arg));
+  if (misplaced != null)
+    throw new Error(
+      `${misplaced} goes before the command: overai ${misplaced} <ref> ${command2 ?? "<command>"} ...`
+    );
+  const orgFromFolder = command2 != null && !ORG_AGNOSTIC_COMMANDS.has(command2);
+  if (orgFromFolder) pinOrgFromClone();
+  if (requireExplicitOrg && command2 != null && !ORG_OPTIONAL_COMMANDS.has(command2) && orgScopeSource() === "saved default")
+    throw new Error(
+      `OVERAI_REQUIRE_EXPLICIT_ORG is set and nothing named an org for "${command2}". Put --org <ref> before the command, or run it inside a clone. See your shorthands with: overai org alias`
+    );
+  if (orgFromFolder) announceOrgScope();
   if (rest.includes("--recursive")) {
     if (command2 !== "status" && command2 !== "diff" && command2 !== "pull" && command2 !== "push")
       throw new Error(
@@ -37074,25 +37748,41 @@ var run = async () => {
   switch (command2) {
     case "signin":
     case "login":
-      await signIn();
+      await signIn(rest.find((arg) => !arg.startsWith("-")));
       return;
     case "signout":
     case "logout":
-      await signOut(rest.includes("--all"));
+      await signOut(
+        rest.includes("--all"),
+        rest.find((arg) => !arg.startsWith("-"))
+      );
       return;
     case "whoami":
-      whoami();
+      whoami(rest);
+      return;
+    case "remote":
+      await runRemote(rest);
       return;
     case "org":
       if (rest[0] === "list") {
         await listOrgs(rest.slice(1));
         return;
       }
-      if (rest[0] === "switch" && rest[1] != null) {
+      if (rest[0] === "switch") {
         await switchOrg(rest[1]);
         return;
       }
-      process.stderr.write("Usage: overai org list | org switch <orgId>\n");
+      if (rest[0] === "alias") {
+        await aliasOrg(rest.slice(1));
+        return;
+      }
+      if (rest[0] === "unalias" && rest[1] != null) {
+        await unaliasOrg(rest[1]);
+        return;
+      }
+      process.stderr.write(
+        "Usage: overai org list | org switch [<ref>] | org alias [<name> <ref>] | org unalias <name>\n"
+      );
       process.exitCode = 1;
       return;
     case "workspace":
@@ -37203,7 +37893,10 @@ ${HELP}`);
       process.exitCode = 1;
   }
 };
-var [command] = process.argv.slice(2);
+var [parsedArgv] = resultOfSync(
+  () => withoutLeadingFlags(process.argv.slice(2))
+);
+var [command] = parsedArgv ?? ["help"];
 var updateNotice2 = process.env.OVERAI_SKIP_UPDATE_CHECK === "1" || !process.stderr.isTTY || SKIP_UPDATE_CHECK.has(command) ? null : startUpdateCheck();
 run().catch((error) => {
   process.stderr.write(