@overaihq/cli 0.9.1 → 0.11.1

package/dist/index.js

@@ -3276,10 +3276,10 @@ var require_xpath = __commonJS({
           includes(REVERSE_AXES, step.axis)
         );
       }
-      function applyStepToNodes(context, nodes, step) {
+      function applyStepToNodes(context2, nodes, step) {
         return flatten(
           map2(
-            applyStepWithPredicates.bind(null, step, context),
+            applyStepWithPredicates.bind(null, step, context2),
             nodes
           )
         );
@@ -4410,12 +4410,12 @@ var require_xpath = __commonJS({
       FunctionResolver.prototype.addFunction = function(ns, ln, f) {
         this.functions["{" + ns + "}" + ln] = f;
       };
-      FunctionResolver.getFunctionFromContext = function(qName, context) {
-        var parts = Utilities.resolveQName(qName, context.namespaceResolver, context.contextNode, false);
+      FunctionResolver.getFunctionFromContext = function(qName, context2) {
+        var parts = Utilities.resolveQName(qName, context2.namespaceResolver, context2.contextNode, false);
         if (parts[0] === null) {
           throw new Error("Cannot resolve QName " + name);
         }
-        return context.functionResolver.getFunction(parts[1], parts[0]);
+        return context2.functionResolver.getFunction(parts[1], parts[0]);
       };
       FunctionResolver.prototype.getFunction = function(localName, namespace) {
         return this.functions["{" + namespace + "}" + localName];
@@ -5124,11 +5124,11 @@ var require_xpath = __commonJS({
           return ns;
         }
         function makeEvaluator(func) {
-          return function(context) {
+          return function(context2) {
             var args = Array.prototype.slice.call(arguments, 1).map(function(arg) {
-              return arg.evaluate(context);
+              return arg.evaluate(context2);
             });
-            var result = func.apply(this, [].concat(context, args));
+            var result = func.apply(this, [].concat(context2, args));
             return convertValue(result);
           };
         }
@@ -5193,22 +5193,22 @@ var require_xpath = __commonJS({
           }
         }
         function makeContext(options) {
-          var context = new XPathContext();
+          var context2 = new XPathContext();
           if (options) {
-            context.namespaceResolver = makeNSResolver(options.namespaces);
-            context.functionResolver = makeFunctionResolver(options.functions);
-            context.variableResolver = makeVariableResolver(options.variables);
-            context.expressionContextNode = options.node;
-            copyIfPresent("allowAnyNamespaceForNoPrefix", context, options);
-            copyIfPresent("isHtml", context, options);
+            context2.namespaceResolver = makeNSResolver(options.namespaces);
+            context2.functionResolver = makeFunctionResolver(options.functions);
+            context2.variableResolver = makeVariableResolver(options.variables);
+            context2.expressionContextNode = options.node;
+            copyIfPresent("allowAnyNamespaceForNoPrefix", context2, options);
+            copyIfPresent("isHtml", context2, options);
           } else {
-            context.namespaceResolver = defaultNSResolver;
+            context2.namespaceResolver = defaultNSResolver;
           }
-          return context;
+          return context2;
         }
         function evaluate(parsedExpression, options) {
-          var context = makeContext(options);
-          return parsedExpression.evaluate(context);
+          var context2 = makeContext(options);
+          return parsedExpression.evaluate(context2);
         }
         var evaluatorPrototype = {
           evaluate: function(options) {
@@ -7227,8 +7227,8 @@ var require_dom = __commonJS({
         }
       });
     }
-    function walkDOM(node, context, callbacks) {
-      var stack = [{ node, context, phase: walkDOM.ENTER }];
+    function walkDOM(node, context2, callbacks) {
+      var stack = [{ node, context: context2, phase: walkDOM.ENTER }];
       while (stack.length > 0) {
         var frame = stack.pop();
         if (frame.phase === walkDOM.ENTER) {
@@ -13203,21 +13203,21 @@ var require_lib2 = __commonJS({
     function getExportedToken(token) {
       return tokenTypes[token];
     }
-    tokenTypes[8].updateContext = (context) => {
-      context.pop();
+    tokenTypes[8].updateContext = (context2) => {
+      context2.pop();
     };
-    tokenTypes[5].updateContext = tokenTypes[7].updateContext = tokenTypes[23].updateContext = (context) => {
-      context.push(types.brace);
+    tokenTypes[5].updateContext = tokenTypes[7].updateContext = tokenTypes[23].updateContext = (context2) => {
+      context2.push(types.brace);
     };
-    tokenTypes[22].updateContext = (context) => {
-      if (context[context.length - 1] === types.template) {
-        context.pop();
+    tokenTypes[22].updateContext = (context2) => {
+      if (context2[context2.length - 1] === types.template) {
+        context2.pop();
       } else {
-        context.push(types.template);
+        context2.push(types.template);
       }
     };
-    tokenTypes[143].updateContext = (context) => {
-      context.push(types.j_expr, types.j_oTag);
+    tokenTypes[143].updateContext = (context2) => {
+      context2.push(types.j_expr, types.j_oTag);
     };
     var nonASCIIidentifierStartChars = "\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0560-\u0588\u05D0-\u05EA\u05EF-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5\u06E5\u06E6\u06EE\u06EF\u06FA-\u06FC\u06FF\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07CA-\u07EA\u07F4\u07F5\u07FA\u0800-\u0815\u081A\u0824\u0828\u0840-\u0858\u0860-\u086A\u0870-\u0887\u0889-\u088F\u08A0-\u08C9\u0904-\u0939\u093D\u0950\u0958-\u0961\u0971-\u0980\u0985-\u098C\u098F\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2\u09B6-\u09B9\u09BD\u09CE\u09DC\u09DD\u09DF-\u09E1\u09F0\u09F1\u09FC\u0A05-\u0A0A\u0A0F\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32\u0A33\u0A35\u0A36\u0A38\u0A39\u0A59-\u0A5C\u0A5E\u0A72-\u0A74\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8\u0AAA-\u0AB0\u0AB2\u0AB3\u0AB5-\u0AB9\u0ABD\u0AD0\u0AE0\u0AE1\u0AF9\u0B05-\u0B0C\u0B0F\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32\u0B33\u0B35-\u0B39\u0B3D\u0B5C\u0B5D\u0B5F-\u0B61\u0B71\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99\u0B9A\u0B9C\u0B9E\u0B9F\u0BA3\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0BD0\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C39\u0C3D\u0C58-\u0C5A\u0C5C\u0C5D\u0C60\u0C61\u0C80\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3\u0CB5-\u0CB9\u0CBD\u0CDC-\u0CDE\u0CE0\u0CE1\u0CF1\u0CF2\u0D04-\u0D0C\u0D0E-\u0D10\u0D12-\u0D3A\u0D3D\u0D4E\u0D54-\u0D56\u0D5F-\u0D61\u0D7A-\u0D7F\u0D85-\u0D96\u0D9A-\u0DB1\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0E01-\u0E30\u0E32\u0E33\u0E40-\u0E46\u0E81\u0E82\u0E84\u0E86-\u0E8A\u0E8C-\u0EA3\u0EA5\u0EA7-\u0EB0\u0EB2\u0EB3\u0EBD\u0EC0-\u0EC4\u0EC6\u0EDC-\u0EDF\u0F00\u0F40-\u0F47\u0F49-\u0F6C\u0F88-\u0F8C\u1000-\u102A\u103F\u1050-\u1055\u105A-\u105D\u1061\u1065\u1066\u106E-\u1070\u1075-\u1081\u108E\u10A0-\u10C5\u10C7\u10CD\u10D0-\u10FA\u10FC-\u1248\u124A-\u124D\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310\u1312-\u1315\u1318-\u135A\u1380-\u138F\u13A0-\u13F5\u13F8-\u13FD\u1401-\u166C\u166F-\u167F\u1681-\u169A\u16A0-\u16EA\u16EE-\u16F8\u1700-\u1711\u171F-\u1731\u1740-\u1751\u1760-\u176C\u176E-\u1770\u1780-\u17B3\u17D7\u17DC\u1820-\u1878\u1880-\u18A8\u18AA\u18B0-\u18F5\u1900-\u191E\u1950-\u196D\u1970-\u1974\u1980-\u19AB\u19B0-\u19C9\u1A00-\u1A16\u1A20-\u1A54\u1AA7\u1B05-\u1B33\u1B45-\u1B4C\u1B83-\u1BA0\u1BAE\u1BAF\u1BBA-\u1BE5\u1C00-\u1C23\u1C4D-\u1C4F\u1C5A-\u1C7D\u1C80-\u1C8A\u1C90-\u1CBA\u1CBD-\u1CBF\u1CE9-\u1CEC\u1CEE-\u1CF3\u1CF5\u1CF6\u1CFA\u1D00-\u1DBF\u1E00-\u1F15\u1F18-\u1F1D\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u2071\u207F\u2090-\u209C\u2102\u2107\u210A-\u2113\u2115\u2118-\u211D\u2124\u2126\u2128\u212A-\u2139\u213C-\u213F\u2145-\u2149\u214E\u2160-\u2188\u2C00-\u2CE4\u2CEB-\u2CEE\u2CF2\u2CF3\u2D00-\u2D25\u2D27\u2D2D\u2D30-\u2D67\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE\u2DD0-\u2DD6\u2DD8-\u2DDE\u3005-\u3007\u3021-\u3029\u3031-\u3035\u3038-\u303C\u3041-\u3096\u309B-\u309F\u30A1-\u30FA\u30FC-\u30FF\u3105-\u312F\u3131-\u318E\u31A0-\u31BF\u31F0-\u31FF\u3400-\u4DBF\u4E00-\uA48C\uA4D0-\uA4FD\uA500-\uA60C\uA610-\uA61F\uA62A\uA62B\uA640-\uA66E\uA67F-\uA69D\uA6A0-\uA6EF\uA717-\uA71F\uA722-\uA788\uA78B-\uA7DC\uA7F1-\uA801\uA803-\uA805\uA807-\uA80A\uA80C-\uA822\uA840-\uA873\uA882-\uA8B3\uA8F2-\uA8F7\uA8FB\uA8FD\uA8FE\uA90A-\uA925\uA930-\uA946\uA960-\uA97C\uA984-\uA9B2\uA9CF\uA9E0-\uA9E4\uA9E6-\uA9EF\uA9FA-\uA9FE\uAA00-\uAA28\uAA40-\uAA42\uAA44-\uAA4B\uAA60-\uAA76\uAA7A\uAA7E-\uAAAF\uAAB1\uAAB5\uAAB6\uAAB9-\uAABD\uAAC0\uAAC2\uAADB-\uAADD\uAAE0-\uAAEA\uAAF2-\uAAF4\uAB01-\uAB06\uAB09-\uAB0E\uAB11-\uAB16\uAB20-\uAB26\uAB28-\uAB2E\uAB30-\uAB5A\uAB5C-\uAB69\uAB70-\uABE2\uAC00-\uD7A3\uD7B0-\uD7C6\uD7CB-\uD7FB\uF900-\uFA6D\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1F-\uFB28\uFB2A-\uFB36\uFB38-\uFB3C\uFB3E\uFB40\uFB41\uFB43\uFB44\uFB46-\uFBB1\uFBD3-\uFD3D\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDFB\uFE70-\uFE74\uFE76-\uFEFC\uFF21-\uFF3A\uFF41-\uFF5A\uFF66-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF\uFFD2-\uFFD7\uFFDA-\uFFDC";
     var nonASCIIidentifierChars = "\xB7\u0300-\u036F\u0387\u0483-\u0487\u0591-\u05BD\u05BF\u05C1\u05C2\u05C4\u05C5\u05C7\u0610-\u061A\u064B-\u0669\u0670\u06D6-\u06DC\u06DF-\u06E4\u06E7\u06E8\u06EA-\u06ED\u06F0-\u06F9\u0711\u0730-\u074A\u07A6-\u07B0\u07C0-\u07C9\u07EB-\u07F3\u07FD\u0816-\u0819\u081B-\u0823\u0825-\u0827\u0829-\u082D\u0859-\u085B\u0897-\u089F\u08CA-\u08E1\u08E3-\u0903\u093A-\u093C\u093E-\u094F\u0951-\u0957\u0962\u0963\u0966-\u096F\u0981-\u0983\u09BC\u09BE-\u09C4\u09C7\u09C8\u09CB-\u09CD\u09D7\u09E2\u09E3\u09E6-\u09EF\u09FE\u0A01-\u0A03\u0A3C\u0A3E-\u0A42\u0A47\u0A48\u0A4B-\u0A4D\u0A51\u0A66-\u0A71\u0A75\u0A81-\u0A83\u0ABC\u0ABE-\u0AC5\u0AC7-\u0AC9\u0ACB-\u0ACD\u0AE2\u0AE3\u0AE6-\u0AEF\u0AFA-\u0AFF\u0B01-\u0B03\u0B3C\u0B3E-\u0B44\u0B47\u0B48\u0B4B-\u0B4D\u0B55-\u0B57\u0B62\u0B63\u0B66-\u0B6F\u0B82\u0BBE-\u0BC2\u0BC6-\u0BC8\u0BCA-\u0BCD\u0BD7\u0BE6-\u0BEF\u0C00-\u0C04\u0C3C\u0C3E-\u0C44\u0C46-\u0C48\u0C4A-\u0C4D\u0C55\u0C56\u0C62\u0C63\u0C66-\u0C6F\u0C81-\u0C83\u0CBC\u0CBE-\u0CC4\u0CC6-\u0CC8\u0CCA-\u0CCD\u0CD5\u0CD6\u0CE2\u0CE3\u0CE6-\u0CEF\u0CF3\u0D00-\u0D03\u0D3B\u0D3C\u0D3E-\u0D44\u0D46-\u0D48\u0D4A-\u0D4D\u0D57\u0D62\u0D63\u0D66-\u0D6F\u0D81-\u0D83\u0DCA\u0DCF-\u0DD4\u0DD6\u0DD8-\u0DDF\u0DE6-\u0DEF\u0DF2\u0DF3\u0E31\u0E34-\u0E3A\u0E47-\u0E4E\u0E50-\u0E59\u0EB1\u0EB4-\u0EBC\u0EC8-\u0ECE\u0ED0-\u0ED9\u0F18\u0F19\u0F20-\u0F29\u0F35\u0F37\u0F39\u0F3E\u0F3F\u0F71-\u0F84\u0F86\u0F87\u0F8D-\u0F97\u0F99-\u0FBC\u0FC6\u102B-\u103E\u1040-\u1049\u1056-\u1059\u105E-\u1060\u1062-\u1064\u1067-\u106D\u1071-\u1074\u1082-\u108D\u108F-\u109D\u135D-\u135F\u1369-\u1371\u1712-\u1715\u1732-\u1734\u1752\u1753\u1772\u1773\u17B4-\u17D3\u17DD\u17E0-\u17E9\u180B-\u180D\u180F-\u1819\u18A9\u1920-\u192B\u1930-\u193B\u1946-\u194F\u19D0-\u19DA\u1A17-\u1A1B\u1A55-\u1A5E\u1A60-\u1A7C\u1A7F-\u1A89\u1A90-\u1A99\u1AB0-\u1ABD\u1ABF-\u1ADD\u1AE0-\u1AEB\u1B00-\u1B04\u1B34-\u1B44\u1B50-\u1B59\u1B6B-\u1B73\u1B80-\u1B82\u1BA1-\u1BAD\u1BB0-\u1BB9\u1BE6-\u1BF3\u1C24-\u1C37\u1C40-\u1C49\u1C50-\u1C59\u1CD0-\u1CD2\u1CD4-\u1CE8\u1CED\u1CF4\u1CF7-\u1CF9\u1DC0-\u1DFF\u200C\u200D\u203F\u2040\u2054\u20D0-\u20DC\u20E1\u20E5-\u20F0\u2CEF-\u2CF1\u2D7F\u2DE0-\u2DFF\u302A-\u302F\u3099\u309A\u30FB\uA620-\uA629\uA66F\uA674-\uA67D\uA69E\uA69F\uA6F0\uA6F1\uA802\uA806\uA80B\uA823-\uA827\uA82C\uA880\uA881\uA8B4-\uA8C5\uA8D0-\uA8D9\uA8E0-\uA8F1\uA8FF-\uA909\uA926-\uA92D\uA947-\uA953\uA980-\uA983\uA9B3-\uA9C0\uA9D0-\uA9D9\uA9E5\uA9F0-\uA9F9\uAA29-\uAA36\uAA43\uAA4C\uAA4D\uAA50-\uAA59\uAA7B-\uAA7D\uAAB0\uAAB2-\uAAB4\uAAB7\uAAB8\uAABE\uAABF\uAAC1\uAAEB-\uAAEF\uAAF5\uAAF6\uABE3-\uABEA\uABEC\uABED\uABF0-\uABF9\uFB1E\uFE00-\uFE0F\uFE20-\uFE2F\uFE33\uFE34\uFE4D-\uFE4F\uFF10-\uFF19\uFF3F\uFF65";
@@ -15292,11 +15292,11 @@ var require_lib2 = __commonJS({
           jsx2 = this.tryParse(() => super.parseMaybeAssign(refExpressionErrors, afterLeftParse), state);
           if (!jsx2.error) return jsx2.node;
           const {
-            context
+            context: context2
           } = this.state;
-          const currentContext = context[context.length - 1];
+          const currentContext = context2[context2.length - 1];
           if (currentContext === types.j_oTag || currentContext === types.j_expr) {
-            context.pop();
+            context2.pop();
           }
         }
         if ((_jsx = jsx2) != null && _jsx.error || this.match(47)) {
@@ -15608,15 +15608,15 @@ var require_lib2 = __commonJS({
           init
         };
       }
-      flowEnumCheckExplicitTypeMismatch(loc, context, expectedType) {
+      flowEnumCheckExplicitTypeMismatch(loc, context2, expectedType) {
         const {
           explicitType
-        } = context;
+        } = context2;
         if (explicitType === null) {
           return;
         }
         if (explicitType !== expectedType) {
-          this.flowEnumErrorInvalidMemberInitializer(loc, context);
+          this.flowEnumErrorInvalidMemberInitializer(loc, context2);
         }
       }
       flowEnumMembers({
@@ -15659,7 +15659,7 @@ var require_lib2 = __commonJS({
             });
           }
           seenNames.add(memberName);
-          const context = {
+          const context2 = {
             enumName,
             explicitType,
             memberName
@@ -15667,33 +15667,33 @@ var require_lib2 = __commonJS({
           memberNode.id = id;
           switch (init.type) {
             case "boolean": {
-              this.flowEnumCheckExplicitTypeMismatch(init.loc, context, "boolean");
+              this.flowEnumCheckExplicitTypeMismatch(init.loc, context2, "boolean");
               memberNode.init = init.value;
               members.booleanMembers.push(this.finishNode(memberNode, "EnumBooleanMember"));
               break;
             }
             case "number": {
-              this.flowEnumCheckExplicitTypeMismatch(init.loc, context, "number");
+              this.flowEnumCheckExplicitTypeMismatch(init.loc, context2, "number");
               memberNode.init = init.value;
               members.numberMembers.push(this.finishNode(memberNode, "EnumNumberMember"));
               break;
             }
             case "string": {
-              this.flowEnumCheckExplicitTypeMismatch(init.loc, context, "string");
+              this.flowEnumCheckExplicitTypeMismatch(init.loc, context2, "string");
               memberNode.init = init.value;
               members.stringMembers.push(this.finishNode(memberNode, "EnumStringMember"));
               break;
             }
             case "invalid": {
-              throw this.flowEnumErrorInvalidMemberInitializer(init.loc, context);
+              throw this.flowEnumErrorInvalidMemberInitializer(init.loc, context2);
             }
             case "none": {
               switch (explicitType) {
                 case "boolean":
-                  this.flowEnumErrorBooleanMemberNotInitialized(init.loc, context);
+                  this.flowEnumErrorBooleanMemberNotInitialized(init.loc, context2);
                   break;
                 case "number":
-                  this.flowEnumErrorNumberMemberNotInitialized(init.loc, context);
+                  this.flowEnumErrorNumberMemberNotInitialized(init.loc, context2);
                   break;
                 default:
                   members.defaultedMembers.push(this.finishNode(memberNode, "EnumDefaultedMember"));
@@ -16534,9 +16534,9 @@ var require_lib2 = __commonJS({
       }
       setContext(newContext) {
         const {
-          context
+          context: context2
         } = this.state;
-        context[context.length - 1] = newContext;
+        context2[context2.length - 1] = newContext;
       }
       parseExprAtom(refExpressionErrors) {
         if (this.match(143)) {
@@ -16553,12 +16553,12 @@ var require_lib2 = __commonJS({
         if (!curContext.preserveSpace) super.skipSpace();
       }
       getTokenFromCode(code2) {
-        const context = this.curContext();
-        if (context === types.j_expr) {
+        const context2 = this.curContext();
+        if (context2 === types.j_expr) {
           this.jsxReadToken();
           return;
         }
-        if (context === types.j_oTag || context === types.j_cTag) {
+        if (context2 === types.j_oTag || context2 === types.j_cTag) {
           if (isIdentifierStart(code2)) {
             this.jsxReadWord();
             return;
@@ -16568,7 +16568,7 @@ var require_lib2 = __commonJS({
             this.finishToken(144);
             return;
           }
-          if ((code2 === 34 || code2 === 39) && context === types.j_oTag) {
+          if ((code2 === 34 || code2 === 39) && context2 === types.j_oTag) {
             this.jsxReadString(code2);
             return;
           }
@@ -16582,19 +16582,19 @@ var require_lib2 = __commonJS({
       }
       updateContext(prevType) {
         const {
-          context,
+          context: context2,
           type
         } = this.state;
         if (type === 56 && prevType === 143) {
-          context.splice(-2, 2, types.j_cTag);
+          context2.splice(-2, 2, types.j_cTag);
           this.state.canStartJSXElement = false;
         } else if (type === 143) {
-          context.push(types.j_oTag);
+          context2.push(types.j_oTag);
         } else if (type === 144) {
-          const out = context[context.length - 1];
+          const out = context2[context2.length - 1];
           if (out === types.j_oTag && prevType === 56 || out === types.j_cTag) {
-            context.pop();
-            this.state.canStartJSXElement = context[context.length - 1] === types.j_expr;
+            context2.pop();
+            this.state.canStartJSXElement = context2[context2.length - 1] === types.j_expr;
           } else {
             this.setContext(types.j_expr);
             this.state.canStartJSXElement = true;
@@ -21560,11 +21560,11 @@ var require_lib2 = __commonJS({
           jsx2 = this.tryParse(() => super.parseMaybeAssign(refExpressionErrors, afterLeftParse), state);
           if (!jsx2.error) return jsx2.node;
           const {
-            context
+            context: context2
           } = this.state;
-          const currentContext = context[context.length - 1];
+          const currentContext = context2[context2.length - 1];
           if (currentContext === types.j_oTag || currentContext === types.j_expr) {
-            context.pop();
+            context2.pop();
           }
         }
         if (!((_jsx = jsx2) != null && _jsx.error) && !this.match(47)) {
@@ -26360,36 +26360,125 @@ var require_lib2 = __commonJS({
   }
 });
 
+// src/api.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/config.ts
+import { randomUUID } from "crypto";
 import {
   chmodSync,
   mkdirSync,
   readFileSync,
+  renameSync,
   rmSync,
   writeFileSync
 } from "fs";
 import { homedir } from "os";
 import { join } from "path";
+import { lock } from "proper-lockfile";
+var sessionSchema = external_exports.object({
+  refreshToken: external_exports.string(),
+  organizationId: external_exports.string(),
+  apiBaseUrl: external_exports.string(),
+  identityId: external_exports.string().optional(),
+  email: external_exports.string().optional(),
+  accessToken: external_exports.string().optional(),
+  accessTokenExpiresAt: external_exports.number().optional()
+});
+var storeSchema = external_exports.object({
+  version: external_exports.literal(2),
+  generation: external_exports.number().default(0),
+  defaultApiBaseUrl: external_exports.string().optional(),
+  deployments: external_exports.record(
+    external_exports.string(),
+    external_exports.object({
+      defaultOrgId: external_exports.string().optional(),
+      appBaseUrl: external_exports.string().optional(),
+      signedOut: external_exports.record(external_exports.string(), external_exports.number()).default({}),
+      sessions: external_exports.record(external_exports.string(), sessionSchema),
+      // Persist before requesting a session so a lost response can be retried.
+      pending: external_exports.record(
+        external_exports.string(),
+        external_exports.object({
+          sourceOrgId: external_exports.string(),
+          sourceSessionId: external_exports.string(),
+          sourceRefreshToken: external_exports.string(),
+          requestId: external_exports.string()
+        })
+      ).default({})
+    })
+  )
+});
 var configDir = join(homedir(), ".overai");
 var configFilePath = join(configDir, "config.json");
-var readConfig = () => {
+var readStore = () => {
+  const raw2 = (() => {
+    try {
+      return readFileSync(configFilePath, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+  })();
+  if (raw2 == null) return { version: 2, generation: 0, deployments: {} };
+  const invalidStoreMessage = `Invalid credential store at ${configFilePath}. Restore a valid copy before continuing.`;
+  const [value, parseError] = resultOfSync(() => JSON.parse(raw2));
+  if (parseError != null) throw new Error(invalidStoreMessage);
+  const current = storeSchema.safeParse(value);
+  if (current.success) return current.data;
+  const legacy = sessionSchema.safeParse(value);
+  if (!legacy.success)
+    throw new Error(invalidStoreMessage);
+  const session = legacy.data;
+  session.apiBaseUrl = session.apiBaseUrl.replace(/\/+$/, "");
+  return {
+    version: 2,
+    generation: 0,
+    defaultApiBaseUrl: session.apiBaseUrl,
+    deployments: {
+      [session.apiBaseUrl]: {
+        defaultOrgId: session.organizationId,
+        sessions: { [session.organizationId]: session },
+        pending: {},
+        signedOut: {}
+      }
+    }
+  };
+};
+var writeStore = (store) => {
+  const temporary = `${configFilePath}.${randomUUID()}.tmp`;
   try {
-    return JSON.parse(readFileSync(configFilePath, "utf8"));
-  } catch {
-    return null;
+    writeFileSync(temporary, `${JSON.stringify(store, null, 2)}
+`, {
+      mode: 384,
+      flag: "wx"
+    });
+    renameSync(temporary, configFilePath);
+  } finally {
+    rmSync(temporary, { force: true });
   }
 };
-var writeConfig = (config) => {
-  mkdirSync(configDir, { recursive: true });
+var withStoreLock = async (run2) => {
+  mkdirSync(configDir, { recursive: true, mode: 448 });
   chmodSync(configDir, 448);
-  writeFileSync(configFilePath, `${JSON.stringify(config, null, 2)}
-`, {
-    mode: 384
+  const release = await lock(configFilePath, {
+    realpath: false,
+    stale: 6e4,
+    retries: { retries: 120, minTimeout: 250, maxTimeout: 1e3, factor: 1.2 }
   });
-  chmodSync(configFilePath, 384);
+  try {
+    return await run2(readStore());
+  } finally {
+    await release();
+  }
 };
-var clearConfig = () => {
-  rmSync(configFilePath, { force: true });
+
+// ../common/src/cluster.ts
+var API_HOST_REGEX = /^api\.((?:[a-z]+\.)?(?:perygee|overai)\.com)$/;
+var appBaseUrlFromApiHost = (apiHost) => {
+  const match = API_HOST_REGEX.exec(apiHost);
+  if (!match) return null;
+  return `https://app.${match[1] ?? ""}`;
 };
 
 // src/env.ts
@@ -26397,16 +26486,35 @@ var trimSlash = (url) => url.replace(/\/+$/, "");
 var DEFAULT_API_BASE_URL = "https://api.overai.com";
 var apiBaseUrlOverride = process.env.OVERAI_API_URL != null ? trimSlash(process.env.OVERAI_API_URL) : void 0;
 var orgIdOverride = process.env.OVERAI_ORG_ID != null && process.env.OVERAI_ORG_ID !== "" ? process.env.OVERAI_ORG_ID : void 0;
-var appBaseUrl = trimSlash(
-  process.env.OVERAI_APP_URL ?? "https://app.overai.com"
-);
+var appBaseUrl = (backend) => {
+  const saved = readStore();
+  return trimSlash(
+    process.env.OVERAI_APP_URL ?? saved.deployments[backend]?.appBaseUrl ?? appBaseUrlFromApiHost(new URL(backend).host) ?? (new URL(backend).hostname === "localhost" || new URL(backend).hostname === "127.0.0.1" ? `${new URL(backend).protocol}//${new URL(backend).hostname}:3000` : "")
+  );
+};
+
+// ../common/src/stdlib/omit.ts
+var omit = (obj, ...keys) => {
+  const result = { ...obj };
+  keys.forEach((key) => delete result[key]);
+  return result;
+};
 
 // src/api.ts
-var apiBaseUrl = () => apiBaseUrlOverride ?? readConfig()?.apiBaseUrl ?? DEFAULT_API_BASE_URL;
+var commandApiBaseUrl;
+var apiBaseUrl = () => commandApiBaseUrl ??= apiBaseUrlOverride ?? readStore().defaultApiBaseUrl ?? DEFAULT_API_BASE_URL;
+var AuthRpcError = class extends Error {
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
 var trpcResult = async (res, procedure) => {
   const body = await res.json().catch(() => null);
   if (body != null && "error" in body) {
-    throw new Error(
+    throw new AuthRpcError(
+      res.status,
       body.error.message || `${procedure} failed (${String(res.status)})`
     );
   }
@@ -26415,13 +26523,14 @@ var trpcResult = async (res, procedure) => {
   }
   return body.result.data;
 };
-var trpcMutation = async (procedure, input) => {
+var trpcMutation = async (procedure, input, baseUrl = apiBaseUrl()) => {
   const res = await fetch(
-    `${apiBaseUrl()}/v1/utils/trpc/unauthenticated/${procedure}`,
+    `${baseUrl}/v1/utils/trpc/unauthenticated/${procedure}`,
     {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(input)
+      body: JSON.stringify(input),
+      signal: AbortSignal.timeout(3e4)
     }
   );
   return trpcResult(res, procedure);
@@ -26431,7 +26540,18 @@ var exchangeSessionToken = (refreshToken, destinationOrgId) => trpcMutation("exc
   refreshToken,
   destinationOrgId
 });
-var signOutHeadless = (refreshToken) => trpcMutation("signOutHeadless", { refreshToken });
+var signOutHeadless = (refreshToken, baseUrl = apiBaseUrl()) => trpcMutation(
+  "signOutHeadless",
+  { refreshToken },
+  baseUrl
+);
+var cancelCliOrgSession = (sourceSessionId, sourceRefreshToken, destinationOrgId, requestId, backend = apiBaseUrl()) => trpcMutation(
+  "cancelCliOrgSession",
+  { sourceSessionId, sourceRefreshToken, destinationOrgId, requestId },
+  backend
+);
+var InteractiveSignInRequired = class extends Error {
+};
 var decodeJwtClaims = (token) => {
   const payload = token.split(".")[1];
   if (payload == null) return {};
@@ -26442,66 +26562,183 @@ var decodeJwtClaims = (token) => {
   }
 };
 var orgScopeOverride = null;
+var commandContext;
 var setOrgScope = (organizationId) => {
+  if (commandContext != null && commandContext.organizationId !== organizationId) {
+    throw new Error("Cannot change organization after a command has started.");
+  }
   orgScopeOverride = organizationId;
 };
-var resolveOrgId = (config) => orgIdOverride ?? orgScopeOverride ?? config.organizationId;
+var context = () => {
+  if (commandContext != null) return commandContext;
+  const store = readStore();
+  const deployment = store.deployments[apiBaseUrl()];
+  const organizationId = orgIdOverride ?? orgScopeOverride ?? deployment?.defaultOrgId;
+  if (organizationId == null)
+    throw new InteractiveSignInRequired("Not signed in. Run `overai signin`.");
+  const session = deployment?.sessions[organizationId] ?? Object.values(deployment?.sessions ?? {})[0];
+  commandContext = {
+    organizationId,
+    identityId: session?.identityId ?? (session?.accessToken == null ? void 0 : decodeJwtClaims(session.accessToken).user_id),
+    email: session?.email,
+    hadSession: deployment?.sessions[organizationId] != null,
+    signedOut: deployment?.signedOut[organizationId] ?? 0,
+    generation: store.generation
+  };
+  return commandContext;
+};
 var scopedOrgId = () => {
-  const config = readConfig();
-  return config == null ? null : resolveOrgId(config);
+  try {
+    return context().organizationId;
+  } catch {
+    return null;
+  }
 };
 var announceOrgScope = () => {
-  const config = readConfig();
-  if (config == null) return;
-  const targetOrgId = resolveOrgId(config);
-  if (targetOrgId === config.organizationId) return;
+  const org = scopedOrgId();
+  if (org == null) return;
   process.stderr.write(
-    `Using org ${targetOrgId} (${orgIdOverride != null ? "OVERAI_ORG_ID" : ".overai/manifest.json"}); the active org is ${config.organizationId}.
+    `Using org ${org} (${orgIdOverride != null ? "OVERAI_ORG_ID" : orgScopeOverride != null ? ".overai/manifest.json" : "saved default"}).
 `
   );
 };
-var inFlightExchange = null;
-var processToken = null;
 var getAccessToken = async () => {
-  const config = readConfig();
-  if (config == null) {
-    throw new Error("Not signed in. Run `overai signin`.");
-  }
-  const targetOrgId = resolveOrgId(config);
-  const skewMs = 6e4;
-  if (targetOrgId === config.organizationId && config.accessToken != null && config.accessTokenExpiresAt != null && config.accessTokenExpiresAt - skewMs > Date.now()) {
-    return { token: config.accessToken, organizationId: config.organizationId };
-  }
-  if (processToken?.organizationId === targetOrgId && processToken.expiresAt - skewMs > Date.now()) {
-    return { token: processToken.token, organizationId: targetOrgId };
-  }
-  inFlightExchange ??= (async () => {
-    const result = await exchangeSessionToken(config.refreshToken, targetOrgId);
-    if (result.type === "redirect") {
+  const target = context();
+  const baseUrl = apiBaseUrl();
+  return withStoreLock(async (store) => {
+    if (store.generation !== target.generation)
+      throw new Error(
+        "All CLI sessions were signed out in another process. Run the command again."
+      );
+    const deployment = store.deployments[baseUrl];
+    const signin = `Run OVERAI_ORG_ID=${target.organizationId} overai signin.`;
+    if (deployment == null) throw new InteractiveSignInRequired(signin);
+    if ((deployment.signedOut[target.organizationId] ?? 0) !== target.signedOut)
+      throw new Error(`This org was signed out in another process. ${signin}`);
+    const existing = deployment.sessions[target.organizationId];
+    if (target.hadSession && existing == null)
+      throw new Error(`This org was signed out in another process. ${signin}`);
+    const sources = existing == null ? Object.values(deployment.sessions) : [existing];
+    if (sources.length === 0) throw new InteractiveSignInRequired(signin);
+    if (sources.some(
+      (session) => target.identityId != null && (session.identityId ?? (session.accessToken == null ? void 0 : decodeJwtClaims(session.accessToken).user_id)) !== target.identityId || target.email != null && session.email !== target.email
+    )) {
+      throw new Error("The signed-in identity changed. Run the command again.");
+    }
+    if (existing?.accessToken != null && (existing.accessTokenExpiresAt ?? 0) > Date.now() + 6e4) {
+      writeStore(store);
+      return {
+        token: existing.accessToken,
+        organizationId: target.organizationId
+      };
+    }
+    const result = await (async () => {
+      if (existing != null) {
+        return exchangeSessionToken(existing.refreshToken, null).catch(
+          (error) => {
+            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+              throw new InteractiveSignInRequired(
+                `Session expired or revoked. ${signin}`
+              );
+            throw error;
+          }
+        );
+      }
+      const pending = deployment.pending[target.organizationId];
+      const candidates = [...sources].sort(
+        (a, b) => Number(b.organizationId === pending?.sourceOrgId) - Number(a.organizationId === pending?.sourceOrgId)
+      );
+      for (const source of candidates) {
+        if (source.accessToken == null || decodeJwtClaims(source.accessToken).sid == null) {
+          const refreshed = await exchangeSessionToken(
+            source.refreshToken,
+            null
+          ).catch((error) => {
+            if (error instanceof AuthRpcError && (error.status === 400 || error.status === 401))
+              return null;
+            throw error;
+          });
+          if (refreshed?.type !== "success") {
+            if (pending?.sourceOrgId === source.organizationId) {
+              await cancelCliOrgSession(
+                pending.sourceSessionId,
+                pending.sourceRefreshToken,
+                target.organizationId,
+                pending.requestId
+              );
+              deployment.pending = omit(
+                deployment.pending,
+                target.organizationId
+              );
+              writeStore(store);
+            }
+            continue;
+          }
+          source.refreshToken = refreshed.refreshToken;
+          source.accessToken = refreshed.token;
+          source.accessTokenExpiresAt = Date.now() + refreshed.accessTokenValiditySeconds * 1e3;
+          writeStore(store);
+        }
+        const sourceSessionId = decodeJwtClaims(source.accessToken).sid;
+        if (sourceSessionId == null || sourceSessionId === "")
+          throw new InteractiveSignInRequired(signin);
+        const operation = pending?.sourceOrgId === source.organizationId ? { ...pending, sourceRefreshToken: source.refreshToken } : {
+          sourceOrgId: source.organizationId,
+          sourceSessionId,
+          sourceRefreshToken: source.refreshToken,
+          requestId: randomUUID2()
+        };
+        deployment.pending[target.organizationId] = operation;
+        writeStore(store);
+        const response = await trpcMutation(
+          "establishCliOrgSession",
+          {
+            refreshToken: source.refreshToken,
+            destinationOrgId: target.organizationId,
+            requestId: operation.requestId
+          }
+        ).catch((error) => {
+          if (error instanceof AuthRpcError && error.status === 401)
+            return null;
+          throw new Error(
+            `Could not establish an independent org session: ${error instanceof Error ? error.message : String(error)}. No legacy switch was attempted.`
+          );
+        });
+        if (response?.type === "success") return response;
+        await cancelCliOrgSession(
+          operation.sourceSessionId,
+          operation.sourceRefreshToken,
+          target.organizationId,
+          operation.requestId
+        );
+        deployment.pending = omit(deployment.pending, target.organizationId);
+        writeStore(store);
+      }
+      throw new InteractiveSignInRequired(
+        `Org ${target.organizationId} requires browser authorization. ${signin}`
+      );
+    })();
+    if (result.type === "redirect") throw new InteractiveSignInRequired(signin);
+    const claims = decodeJwtClaims(result.token);
+    if (claims.org !== target.organizationId || target.identityId != null && claims.user_id !== target.identityId) {
       throw new Error(
-        targetOrgId === config.organizationId ? "Your session expired. Run `overai signin`." : `Org ${targetOrgId} requires interactive sign-in (SSO). Run \`overai org switch ${targetOrgId}\`.`
+        "The auth server returned a session for a different org or identity."
       );
     }
-    const forActiveOrg = targetOrgId === config.organizationId;
-    writeConfig({
-      ...config,
-      email: decodeJwtClaims(result.token).email ?? config.email,
+    deployment.sessions[target.organizationId] = {
+      organizationId: target.organizationId,
+      apiBaseUrl: baseUrl,
+      identityId: claims.user_id,
+      email: claims.email ?? target.email,
       refreshToken: result.refreshToken,
-      accessToken: forActiveOrg ? result.token : config.accessToken,
-      accessTokenExpiresAt: forActiveOrg ? Date.now() + result.accessTokenValiditySeconds * 1e3 : config.accessTokenExpiresAt
-    });
-    processToken = {
-      organizationId: targetOrgId,
-      token: result.token,
-      expiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3
+      accessToken: result.token,
+      accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3
     };
-    return { token: result.token, organizationId: targetOrgId };
-  })();
-  try {
-    return await inFlightExchange;
-  } finally {
-    inFlightExchange = null;
-  }
+    deployment.pending = omit(deployment.pending, target.organizationId);
+    writeStore(store);
+    target.hadSession = true;
+    return { token: result.token, organizationId: target.organizationId };
+  });
 };
 var v2Fetch = async (path, init) => {
   const auth = await getAccessToken();
@@ -26576,190 +26813,6 @@ var openBrowser = (url) => {
   }
 };
 
-// src/args.ts
-import { readFileSync as readFileSync2 } from "fs";
-var flagValue = (args, ...names) => {
-  for (const name2 of names) {
-    const i = args.indexOf(name2);
-    if (i !== -1 && i + 1 < args.length) return args[i + 1];
-  }
-  return void 0;
-};
-var stdinClaimedBy = null;
-var readStdin = async (claimant = "stdin") => {
-  if (stdinClaimedBy != null) {
-    throw new Error(
-      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
-    );
-  }
-  stdinClaimedBy = claimant;
-  const chunks = [];
-  for await (const chunk of process.stdin) {
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks).toString("utf8");
-};
-var readValue = async (value, label) => {
-  if (value?.startsWith("@") !== true) return value;
-  if (value.startsWith("@@")) return value.slice(1);
-  const path = value.slice(1);
-  if (path === "-") return (await readStdin(`${label} @-`)).trim();
-  try {
-    return readFileSync2(path, "utf8").trim();
-  } catch {
-    throw new Error(
-      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
-    );
-  }
-};
-
-// src/gql.ts
-var gqlRequest = async (query, variables) => {
-  const res = await v2Fetch("/v2/graphql", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ query, variables })
-  });
-  const raw2 = await res.text();
-  const body = (() => {
-    try {
-      return JSON.parse(raw2);
-    } catch {
-      return null;
-    }
-  })();
-  if (body?.errors != null && body.errors.length > 0) {
-    throw new Error(body.errors.map((e) => e.message).join("; "));
-  }
-  if (!res.ok) throw v2Error("graphql", res, raw2);
-  if (body?.data == null) {
-    throw new Error("graphql returned no data and no errors.");
-  }
-  return body.data;
-};
-
-// src/output.ts
-var resolveFormat = (explicit) => {
-  if (explicit === "json" || explicit === "csv" || explicit === "table") {
-    return explicit;
-  }
-  if (explicit != null) {
-    throw new Error(
-      `Unknown output format "${explicit}". Use json, table, or csv.`
-    );
-  }
-  return process.stdout.isTTY ? "table" : "json";
-};
-var cell = (value) => {
-  if (value == null) return "";
-  if (typeof value === "string") return value;
-  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return String(value);
-  }
-  return JSON.stringify(value);
-};
-var formatResult = (data, format2) => {
-  if (format2 === "json" || !Array.isArray(data)) {
-    return JSON.stringify(data, null, 2);
-  }
-  const records = data.map(
-    (row) => row != null && typeof row === "object" ? row : { value: row }
-  );
-  if (records.length === 0) return "(no rows)";
-  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
-  if (format2 === "csv") {
-    const escape2 = (value) => {
-      const text = cell(value);
-      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
-    };
-    return [
-      columns.join(","),
-      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
-    ].join("\n");
-  }
-  const widths = columns.map(
-    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
-  );
-  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
-  return [
-    line(columns),
-    line(widths.map((w) => "-".repeat(w))),
-    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
-  ].join("\n");
-};
-var printResult = (data, format2) => {
-  process.stdout.write(`${formatResult(data, format2)}
-`);
-};
-
-// src/commands/org.ts
-var USER_ORGS_QUERY = `
-  query UserOrganizations($identityId: String!) {
-    identityOrganizations(condition: { identityId: $identityId }) {
-      nodes {
-        disabled
-        organization { id name }
-      }
-    }
-  }
-`;
-var fetchOrgNames = async () => {
-  const orgs = await listOrgRows();
-  return new Map(orgs.map((org) => [org.id, org.name ?? ""]));
-};
-var listOrgRows = async () => {
-  const auth = await getAccessToken();
-  const identityId = decodeJwtClaims(auth.token).user_id;
-  if (identityId == null) {
-    throw new Error("Could not read identity from the current session.");
-  }
-  const data = await gqlRequest(USER_ORGS_QUERY, { identityId });
-  return data.identityOrganizations.nodes.filter((node) => node != null && !node.disabled).map((node) => node?.organization).filter((org) => org != null);
-};
-var listOrgs = async (args) => {
-  const active = scopedOrgId();
-  printResult(
-    (await listOrgRows()).map((org) => ({
-      id: org.id,
-      name: org.name ?? "",
-      active: org.id === active
-    })),
-    resolveFormat(flagValue(args, "-o", "--output"))
-  );
-};
-var switchOrg = async (orgId) => {
-  const config = readConfig();
-  if (config == null) {
-    process.stderr.write("Not signed in. Run `overai signin`.\n");
-    process.exitCode = 1;
-    return;
-  }
-  const result = await exchangeSessionToken(config.refreshToken, orgId);
-  if (result.type === "redirect") {
-    process.stdout.write(
-      `This organization requires SSO. Complete sign-in in your browser, then run \`overai signin\`.
-${result.redirectUrl}
-`
-    );
-    openBrowser(result.redirectUrl);
-    process.exitCode = 1;
-    return;
-  }
-  writeConfig({
-    ...config,
-    organizationId: orgId,
-    email: decodeJwtClaims(result.token).email ?? config.email,
-    accessToken: result.token,
-    accessTokenExpiresAt: Date.now() + result.accessTokenValiditySeconds * 1e3,
-    refreshToken: result.refreshToken
-  });
-  process.stdout.write(
-    `Switched to org ${orgId}.
-This is machine-global \u2014 every shell and editor session on this machine now uses it. Prefix a command with OVERAI_ORG_ID=<orgId> to scope just one.
-`
-  );
-};
-
 // src/pkce.ts
 import { createHash, randomBytes } from "crypto";
 var createPkcePair = () => {
@@ -26769,7 +26822,7 @@ var createPkcePair = () => {
 };
 
 // src/workspace/manifest.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname, join as join2, resolve } from "path";
 var MANIFEST_DIR = ".overai";
 var MANIFEST_FILE = "manifest.json";
@@ -26788,11 +26841,16 @@ var findWorkspaceRoot = (from = process.cwd()) => {
   }
 };
 var readManifest = (root) => JSON.parse(
-  readFileSync3(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
+  readFileSync2(join2(root, MANIFEST_DIR, MANIFEST_FILE), "utf8")
 );
 var openClone = () => {
   const root = findWorkspaceRoot();
   const manifest = readManifest(root);
+  if (orgIdOverride != null && orgIdOverride !== manifest.organizationId) {
+    throw new Error(
+      `OVERAI_ORG_ID=${orgIdOverride} conflicts with this clone's org ${manifest.organizationId}. Unset it before syncing.`
+    );
+  }
   setOrgScope(manifest.organizationId);
   return { root, manifest };
 };
@@ -26819,14 +26877,14 @@ var writeSynced = (root, relPath, content) => {
 };
 var readWorkingFile = (root, relPath) => {
   try {
-    return readFileSync3(join2(root, relPath), "utf8");
+    return readFileSync2(join2(root, relPath), "utf8");
   } catch {
     return null;
   }
 };
 var readBaseFile = (root, relPath) => {
   try {
-    return readFileSync3(basePath(root, relPath), "utf8");
+    return readFileSync2(basePath(root, relPath), "utf8");
   } catch {
     return null;
   }
@@ -26913,16 +26971,23 @@ var startCallbackServer = (expectedState) => {
     });
   });
 };
-var signIn = async () => {
+var signIn = async (requestedOrgId = orgIdOverride) => {
+  const baseUrl = apiBaseUrl();
+  const browserBaseUrl = appBaseUrl(baseUrl);
+  if (browserBaseUrl === "")
+    throw new Error("Set OVERAI_APP_URL for this backend before signing in.");
+  const initialStore = readStore();
   const { verifier, challenge } = createPkcePair();
   const state = randomBytes2(16).toString("base64url");
   const { port, codePromise, close } = await startCallbackServer(state);
-  const authorizeUrl = `${appBaseUrl}/cli-auth?${new URLSearchParams({
-    redirect_uri: `http://127.0.0.1:${String(port)}`,
-    code_challenge: challenge,
-    state,
-    label: hostname()
-  }).toString()}`;
+  const authorizeUrl = `${browserBaseUrl}${requestedOrgId == null ? "" : `/${encodeURIComponent(requestedOrgId)}`}/cli-auth?${new URLSearchParams(
+    {
+      redirect_uri: `http://127.0.0.1:${String(port)}`,
+      code_challenge: challenge,
+      state,
+      label: hostname()
+    }
+  ).toString()}`;
   const autoOpen = process.env.OVERAI_NO_BROWSER == null;
   process.stdout.write(
     `${autoOpen ? "Opening your browser to authorize the CLI.\nIf it doesn't open, visit" : "Visit this URL to authorize the CLI"}:
@@ -26933,15 +26998,58 @@ ${authorizeUrl}
   try {
     const code = await codePromise;
     const session = await exchangeCliAuthCode(code, verifier);
-    const email = decodeJwtClaims(session.token).email;
-    writeConfig({
-      refreshToken: session.refreshToken,
-      organizationId: session.organizationId,
-      apiBaseUrl: apiBaseUrlOverride ?? DEFAULT_API_BASE_URL,
-      email,
-      accessToken: session.token,
-      accessTokenExpiresAt: Date.now() + session.accessTokenValiditySeconds * 1e3
-    });
+    const claims = decodeJwtClaims(session.token);
+    const email = claims.email;
+    try {
+      await withStoreLock(async (store) => {
+        if (store.generation !== initialStore.generation || (store.deployments[baseUrl]?.signedOut[session.organizationId] ?? 0) !== (initialStore.deployments[baseUrl]?.signedOut[session.organizationId] ?? 0))
+          throw new Error(
+            "A sign-out occurred during authorization. Run signin again."
+          );
+        if (requestedOrgId != null && session.organizationId !== requestedOrgId)
+          throw new Error(
+            `Expected org ${requestedOrgId}; browser authorized ${session.organizationId}.`
+          );
+        const deployment = store.deployments[baseUrl] ??= {
+          sessions: {},
+          pending: {},
+          signedOut: {}
+        };
+        if (Object.values(deployment.sessions).some((saved) => {
+          const identityId = saved.identityId ?? (saved.accessToken == null ? void 0 : decodeJwtClaims(saved.accessToken).user_id);
+          return identityId != null && identityId !== claims.user_id || saved.email != null && saved.email !== email;
+        }))
+          throw new Error(
+            "Another identity is saved for this backend. Sign out of its sessions before changing accounts."
+          );
+        if (Object.entries(deployment.pending).some(
+          ([id, pending]) => id === session.organizationId || pending.sourceOrgId === session.organizationId
+        )) {
+          throw new Error(
+            "An org exchange is unfinished. Retry that org command or signout before replacing its source login."
+          );
+        }
+        const previous = deployment.sessions[session.organizationId];
+        if (previous != null) await signOutHeadless(previous.refreshToken);
+        deployment.sessions[session.organizationId] = {
+          refreshToken: session.refreshToken,
+          organizationId: session.organizationId,
+          apiBaseUrl: baseUrl,
+          identityId: claims.user_id,
+          email,
+          accessToken: session.token,
+          accessTokenExpiresAt: Date.now() + session.accessTokenValiditySeconds * 1e3
+        };
+        deployment.pending = omit(deployment.pending, session.organizationId);
+        deployment.appBaseUrl = browserBaseUrl;
+        deployment.defaultOrgId = session.organizationId;
+        store.defaultApiBaseUrl = baseUrl;
+        writeStore(store);
+      });
+    } catch (error) {
+      await signOutHeadless(session.refreshToken).catch(() => void 0);
+      throw error;
+    }
     process.stdout.write(
       `Signed in${email != null ? ` as ${email}` : ""} (org ${session.organizationId}).
 `
@@ -26950,43 +27058,182 @@ ${authorizeUrl}
     close();
   }
 };
-var signOut = async () => {
-  const config = readConfig();
-  if (config == null) {
-    process.stdout.write("Not signed in.\n");
-    return;
+var signOut = async (all = false) => {
+  const root = (() => {
+    try {
+      return findWorkspaceRoot();
+    } catch {
+      return null;
+    }
+  })();
+  if (root != null) setOrgScope(readManifest(root).organizationId);
+  const baseUrl = apiBaseUrl();
+  const orgId = scopedOrgId();
+  await withStoreLock(async (store) => {
+    const failures = [];
+    if (!all && orgId != null) {
+      const deployment = store.deployments[baseUrl] ??= {
+        sessions: {},
+        pending: {},
+        signedOut: {}
+      };
+      deployment.signedOut[orgId] = (deployment.signedOut[orgId] ?? 0) + 1;
+    }
+    for (const [backend, deployment] of Object.entries(store.deployments)) {
+      if (!all && backend !== baseUrl) continue;
+      const blockedSources = /* @__PURE__ */ new Set();
+      for (const [id, pending] of Object.entries(deployment.pending)) {
+        if (!all && id !== orgId && pending.sourceOrgId !== orgId) continue;
+        try {
+          await cancelCliOrgSession(
+            pending.sourceSessionId,
+            pending.sourceRefreshToken,
+            id,
+            pending.requestId,
+            backend
+          );
+          deployment.pending = omit(deployment.pending, id);
+          writeStore(store);
+        } catch {
+          blockedSources.add(pending.sourceOrgId);
+          failures.push(`${backend} pending org ${id}`);
+        }
+      }
+      for (const [id, session] of Object.entries(deployment.sessions)) {
+        if (!all && id !== orgId || blockedSources.has(id)) continue;
+        try {
+          await signOutHeadless(session.refreshToken, backend);
+          deployment.sessions = omit(deployment.sessions, id);
+        } catch {
+          failures.push(`${backend} org ${id}`);
+        }
+      }
+      if (deployment.defaultOrgId != null && deployment.sessions[deployment.defaultOrgId] == null) {
+        delete deployment.defaultOrgId;
+      }
+    }
+    if (all) store.generation += 1;
+    writeStore(store);
+    if (failures.length > 0)
+      throw new Error(
+        `Could not revoke ${failures.join(", ")}. Credentials retained; retry signout.`
+      );
+  });
+  process.stdout.write(
+    all ? "Signed out of all locally saved CLI sessions.\n" : `Signed out of org ${orgId ?? "(none selected)"}.
+`
+  );
+};
+var whoami = () => {
+  const root = (() => {
+    try {
+      return findWorkspaceRoot();
+    } catch {
+      return null;
+    }
+  })();
+  if (root != null) setOrgScope(readManifest(root).organizationId);
+  const org = scopedOrgId();
+  const deployment = readStore().deployments[apiBaseUrl()];
+  const session = org == null ? void 0 : deployment?.sessions[org];
+  process.stdout.write(
+    `Backend: ${apiBaseUrl()}
+Org: ${org ?? "none"}
+Selected by: ${orgIdOverride != null ? "OVERAI_ORG_ID" : root != null ? ".overai/manifest.json" : "saved default"}
+Identity: ${session?.email ?? session?.identityId ?? "no saved session for this org"}
+`
+  );
+};
+
+// src/args.ts
+import { readFileSync as readFileSync3 } from "fs";
+var flagValue = (args, ...names) => {
+  for (const name2 of names) {
+    const i = args.indexOf(name2);
+    if (i !== -1 && i + 1 < args.length) return args[i + 1];
+  }
+  return void 0;
+};
+var stdinClaimedBy = null;
+var readStdin = async (claimant = "stdin") => {
+  if (stdinClaimedBy != null) {
+    throw new Error(
+      `Only one value can be read from stdin; ${stdinClaimedBy} already consumed it.`
+    );
+  }
+  stdinClaimedBy = claimant;
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+};
+var readValue = async (value, label) => {
+  if (value?.startsWith("@") !== true) return value;
+  if (value.startsWith("@@")) return value.slice(1);
+  const path = value.slice(1);
+  if (path === "-") return (await readStdin(`${label} @-`)).trim();
+  try {
+    return readFileSync3(path, "utf8").trim();
+  } catch {
+    throw new Error(
+      `${label}: could not read file "${path}". Write "@@" to send a literal value starting with "@".`
+    );
+  }
+};
+
+// src/output.ts
+var resolveFormat = (explicit) => {
+  if (explicit === "json" || explicit === "csv" || explicit === "table") {
+    return explicit;
+  }
+  if (explicit != null) {
+    throw new Error(
+      `Unknown output format "${explicit}". Use json, table, or csv.`
+    );
+  }
+  return process.stdout.isTTY ? "table" : "json";
+};
+var cell = (value) => {
+  if (value == null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
   }
-  await signOutHeadless(config.refreshToken).catch(() => void 0);
-  clearConfig();
-  process.stdout.write("Signed out.\n");
+  return JSON.stringify(value);
 };
-var whoami = async () => {
-  const config = readConfig();
-  if (config == null) {
-    process.stderr.write("Not signed in. Run `overai signin`.\n");
-    process.exitCode = 1;
-    return;
+var formatResult = (data, format2) => {
+  if (format2 === "json" || !Array.isArray(data)) {
+    return JSON.stringify(data, null, 2);
   }
-  const cloneOrgId = (() => {
-    try {
-      return readManifest(findWorkspaceRoot()).organizationId;
-    } catch {
-      return null;
-    }
-  })();
-  const effective = orgIdOverride ?? cloneOrgId ?? config.organizationId;
-  const names = await fetchOrgNames().catch(() => null);
-  const label = (id) => names?.get(id) == null ? id : `${id} \u2014 ${String(names.get(id))}`;
-  process.stdout.write(
-    `Signed in${config.email != null ? ` as ${config.email}` : ""} (org ${label(effective)}).
-`
+  const records = data.map(
+    (row) => row != null && typeof row === "object" ? row : { value: row }
   );
-  if (effective !== config.organizationId) {
-    process.stdout.write(
-      `Scoped by ${orgIdOverride != null ? "OVERAI_ORG_ID" : ".overai/manifest.json"}; the machine-global active org is ${label(config.organizationId)}.
-`
-    );
+  if (records.length === 0) return "(no rows)";
+  const columns = [...new Set(records.flatMap((r) => Object.keys(r)))];
+  if (format2 === "csv") {
+    const escape2 = (value) => {
+      const text = cell(value);
+      return /[",\n\r]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    };
+    return [
+      columns.join(","),
+      ...records.map((r) => columns.map((c) => escape2(r[c])).join(","))
+    ].join("\n");
   }
+  const widths = columns.map(
+    (c) => Math.max(c.length, ...records.map((r) => cell(r[c]).length))
+  );
+  const line = (cells) => cells.map((text, i) => text.padEnd(widths[i] ?? 0)).join("  ");
+  return [
+    line(columns),
+    line(widths.map((w) => "-".repeat(w))),
+    ...records.map((r) => line(columns.map((c) => cell(r[c]))))
+  ].join("\n");
+};
+var printResult = (data, format2) => {
+  process.stdout.write(`${formatResult(data, format2)}
+`);
 };
 
 // src/commands/agent.ts
@@ -27007,6 +27254,31 @@ var runAgent = async (args) => {
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
+// src/gql.ts
+var gqlRequest = async (query, variables) => {
+  const res = await v2Fetch("/v2/graphql", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ query, variables })
+  });
+  const raw2 = await res.text();
+  const body = (() => {
+    try {
+      return JSON.parse(raw2);
+    } catch {
+      return null;
+    }
+  })();
+  if (body?.errors != null && body.errors.length > 0) {
+    throw new Error(body.errors.map((e) => e.message).join("; "));
+  }
+  if (!res.ok) throw v2Error("graphql", res, raw2);
+  if (body?.data == null) {
+    throw new Error("graphql returned no data and no errors.");
+  }
+  return body.data;
+};
+
 // src/commands/automation.ts
 var runRuns = async (automationId, args) => {
   const limit2 = Number(flagValue(args, "--limit") ?? 20);
@@ -27893,7 +28165,7 @@ var Token = class {
   }
 };
 var Drop = class {
-  liquidMethodMissing(key, context) {
+  liquidMethodMissing(key, context2) {
     return void 0;
   }
 };
@@ -28166,7 +28438,7 @@ function mkContext(token) {
   const lines = token.input.split("\n");
   const begin = Math.max(line - 2, 1);
   const end = Math.min(line + 3, lines.length);
-  const context = range(begin, end + 1).map((lineNumber) => {
+  const context2 = range(begin, end + 1).map((lineNumber) => {
     const rowIndicator = lineNumber === line ? ">> " : "   ";
     const num = padStart(String(lineNumber), String(end).length);
     let text = `${rowIndicator}${num}| `;
@@ -28175,7 +28447,7 @@ function mkContext(token) {
     text += colIndicator;
     return text;
   }).join("\n");
-  return context;
+  return context2;
 }
 function mkMessage(msg, token) {
   if (token.file)
@@ -29087,15 +29359,15 @@ var Filter = class {
     this.args = token.args;
     this.liquid = liquid;
   }
-  *render(value, context) {
+  *render(value, context2) {
     const argv = [];
     for (const arg of this.args) {
       if (isKeyValuePair(arg))
-        argv.push([arg[0], yield evalToken(arg[1], context)]);
+        argv.push([arg[0], yield evalToken(arg[1], context2)]);
       else
-        argv.push(yield evalToken(arg, context));
+        argv.push(yield evalToken(arg, context2));
     }
-    return yield this.handler.apply({ context, token: this.token, liquid: this.liquid }, [value, ...argv]);
+    return yield this.handler.apply({ context: context2, token: this.token, liquid: this.liquid }, [value, ...argv]);
   }
 };
 var Expression = class {
@@ -32080,8 +32352,8 @@ var DecrementTag = class extends Tag {
     this.identifier = this.tokenizer.readIdentifier();
     this.variable = this.identifier.content;
   }
-  render(context, emitter) {
-    const scope = context.environments;
+  render(context2, emitter) {
+    const scope = context2.environments;
     if (!isNumber(scope[this.variable])) {
       scope[this.variable] = 0;
     }
@@ -32185,8 +32457,8 @@ var IncrementTag = class extends Tag {
     this.identifier = this.tokenizer.readIdentifier();
     this.variable = this.identifier.content;
   }
-  render(context, emitter) {
-    const scope = context.environments;
+  render(context2, emitter) {
+    const scope = context2.environments;
     if (!isNumber(scope[this.variable])) {
       scope[this.variable] = 0;
     }
@@ -33151,8 +33423,8 @@ var GeneratePasswordTag = class extends Tag {
   *arguments() {
     yield* Object.values(this.args.hash).filter(typeGuards.isValueToken);
   }
-  *render(context, emitter) {
-    const { length, charSet } = yield this.args.render(context);
+  *render(context2, emitter) {
+    const { length, charSet } = yield this.args.render(context2);
     const passwordLength = typeof length === "string" && !isNaN(parseInt(length)) ? parseInt(length) : typeof length === "number" ? length : 12;
     const passwordCharSet = typeof charSet === "string" ? charSet : "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%&*";
     const password = customAlphabet(passwordCharSet, passwordLength)();
@@ -33564,66 +33836,6 @@ var runDataStream = async (args) => {
   printResult(body, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
-// src/commands/knowledgeBase.ts
-import { readFile as readFile2 } from "fs/promises";
-import { basename } from "path";
-var runKnowledgeBase = async (args) => {
-  const [operation, id] = args;
-  if (id == null || operation !== "upload" && operation !== "search") {
-    throw new Error(
-      "Usage: overai knowledge-base upload <id> <file...> | knowledge-base search <id> <query> [--limit N]"
-    );
-  }
-  const { organizationId } = await getAccessToken();
-  if (operation === "upload") {
-    const paths = args.slice(2).filter(
-      (arg, i, all) => !arg.startsWith("-") && all[i - 1] !== "-o" && all[i - 1] !== "--output"
-    );
-    if (paths.length === 0)
-      throw new Error("Knowledge base upload requires at least one file path.");
-    const uploads = [];
-    for (const path of paths) {
-      const bytes = await readFile2(path);
-      const formData = new FormData();
-      formData.append(
-        "file",
-        new Blob([new Uint8Array(bytes)]),
-        basename(path)
-      );
-      const response2 = await v2Fetch(
-        `/v2/knowledge-bases/${organizationId}/${id}/upload`,
-        { method: "POST", body: formData }
-      );
-      const raw3 = await response2.text();
-      if (!response2.ok) throw v2Error("knowledge-base upload", response2, raw3);
-      uploads.push({ file: basename(path), ...JSON.parse(raw3) });
-    }
-    printResult(uploads, resolveFormat(flagValue(args, "-o", "--output")));
-    return;
-  }
-  const query = args[2];
-  if (query == null || query.startsWith("-"))
-    throw new Error("Knowledge base search requires a query string.");
-  const limit2 = flagValue(args, "--limit");
-  const response = await v2Fetch(
-    `/v2/knowledge-bases/${organizationId}/${id}/search`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        query,
-        ...limit2 != null ? { limit: Number(limit2) } : {}
-      })
-    }
-  );
-  const raw2 = await response.text();
-  if (!response.ok) throw v2Error("knowledge-base search", response, raw2);
-  printResult(
-    JSON.parse(raw2),
-    resolveFormat(flagValue(args, "-o", "--output"))
-  );
-};
-
 // src/commands/dev.ts
 import { createHash as createHash3 } from "crypto";
 import { watch } from "fs";
@@ -33633,6 +33845,7 @@ import { dirname as dirname3, join as join5 } from "path";
 // src/commands/sync.ts
 import {
   existsSync as existsSync3,
+  lstatSync,
   mkdirSync as mkdirSync3,
   readFileSync as readFileSync6,
   unlinkSync,
@@ -33769,43 +33982,91 @@ var runClone = async (args) => {
   if (existsSync3(join4(root, "WORKSPACE.md")) && partialCloneWorkspaceId == null) {
     throw new Error(`${root} already contains WORKSPACE.md.`);
   }
-  const resourcesByAdapter = [];
-  for (const adapter of allAdapters) {
-    resourcesByAdapter.push({
-      adapter,
-      resources: await adapter.fetchAll(workspaceId)
-    });
-  }
-  mkdirSync3(join4(root, ".overai"), { recursive: true });
-  writeFileSync4(cloneMarker, `${workspaceId}
+  const pending = [{ workspace, root }];
+  const seen = /* @__PURE__ */ new Set([workspace.id]);
+  const plan = [];
+  for (const entry of pending) {
+    const marker = join4(entry.root, ".overai", "clone-in-progress");
+    const completed = existsSync3(join4(entry.root, ".overai", "manifest.json"));
+    if (entry.root !== root && existsSync3(entry.root)) {
+      if (lstatSync(entry.root).isSymbolicLink())
+        throw new Error(`Refusing to clone into symbolic link ${entry.root}.`);
+      const savedId = completed ? readManifest(entry.root).workspaceId : existsSync3(marker) ? readFileSync6(marker, "utf8").trim() : null;
+      if (partialCloneWorkspaceId !== workspaceId || savedId !== entry.workspace.id)
+        throw new Error(`${entry.root} already exists. Choose another clone directory.`);
+    }
+    if (existsSync3(join4(entry.root, "workspaces")) && lstatSync(join4(entry.root, "workspaces")).isSymbolicLink())
+      throw new Error(`Refusing to clone through symbolic link ${join4(entry.root, "workspaces")}.`);
+    if (!completed) {
+      const resourcesByAdapter = await Promise.all(allAdapters.map(async (adapter) => ({
+        adapter,
+        resources: await adapter.fetchAll(entry.workspace.id)
+      })));
+      plan.push({
+        root: entry.root,
+        description: entry.workspace.description,
+        manifest: {
+          workspaceId: entry.workspace.id,
+          workspaceName: entry.workspace.name,
+          organizationId: entry.workspace.organizationId,
+          resources: {}
+        },
+        resourcesByAdapter
+      });
+    }
+    let after = null;
+    do {
+      const data = await gqlRequest(
+        `query CliCloneChildren($id: String!, $after: Cursor) {
+          workspaceWorkspaces(condition: { parentWorkspaceId: $id }, first: 100, after: $after) {
+            nodes { workspace { id name description organizationId isArchived } }
+            pageInfo { hasNextPage endCursor }
+          }
+        }`,
+        { id: entry.workspace.id, after }
+      );
+      for (const node of data.workspaceWorkspaces.nodes) {
+        const child = node?.workspace;
+        if (child == null || child.isArchived) continue;
+        if (child.organizationId !== workspace.organizationId || seen.has(child.id))
+          throw new Error(`Invalid workspace hierarchy at ${child.id}.`);
+        if (!/^[a-zA-Z0-9_-]+$/.test(child.id))
+          throw new Error(`Invalid workspace id ${child.id}.`);
+        seen.add(child.id);
+        pending.push({ workspace: child, root: join4(entry.root, "workspaces", `${slugify(child.name)}.${child.id}`) });
+      }
+      const page = data.workspaceWorkspaces.pageInfo;
+      if (page.hasNextPage && (page.endCursor == null || page.endCursor === after))
+        throw new Error("Workspace pagination did not advance.");
+      after = page.hasNextPage ? page.endCursor : null;
+    } while (after != null);
+  }
+  for (const entry of plan) {
+    mkdirSync3(join4(entry.root, ".overai"), { recursive: true });
+    writeFileSync4(join4(entry.root, ".overai", "clone-in-progress"), `${entry.manifest.workspaceId}
 `);
-  writeFileSync4(
-    join4(root, "WORKSPACE.md"),
-    workspace.description.length === 0 ? "" : `${workspace.description.trimEnd()}
+    writeFileSync4(
+      join4(entry.root, "WORKSPACE.md"),
+      entry.description.length === 0 ? "" : `${entry.description.trimEnd()}
 `
-  );
-  const manifest = {
-    workspaceId: workspace.id,
-    workspaceName: workspace.name,
-    organizationId: workspace.organizationId,
-    resources: {}
-  };
-  for (const { adapter, resources: resources2 } of resourcesByAdapter) {
-    for (const remote of resources2) {
-      for (const [relPath, content] of Object.entries(remote.files)) {
-        writeSynced(root, relPath, content);
+    );
+    for (const { adapter, resources: resources2 } of entry.resourcesByAdapter) {
+      for (const remote of resources2) {
+        for (const [relPath, content] of Object.entries(remote.files)) {
+          writeSynced(entry.root, relPath, content);
+        }
+        entry.manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
       }
-      manifest.resources[remote.id] = toManifestResource(adapter.type, remote);
+      process.stdout.write(`${entry.manifest.workspaceName}: ${adapter.type}: ${String(resources2.length)} cloned
+`);
     }
-    process.stdout.write(
-      `${adapter.type}: ${String(resources2.length)} cloned
-`
-    );
   }
-  writeManifest(root, manifest);
-  unlinkSync(cloneMarker);
+  for (const entry of plan.toReversed()) {
+    writeManifest(entry.root, entry.manifest);
+    unlinkSync(join4(entry.root, ".overai", "clone-in-progress"));
+  }
   process.stdout.write(`
-Cloned "${workspace.name}" into ${root}
+Cloned "${workspace.name}" and ${String(pending.length - 1)} descendant workspaces into ${root}
 `);
 };
 var collectStatus = async (root, manifest) => {
@@ -34108,6 +34369,8 @@ var runDev = async (args) => {
     );
   }
   const [id, resource] = match;
+  const browserBaseUrl = appBaseUrl(apiBaseUrl());
+  const appOrigin = new URL(browserBaseUrl).origin;
   const snapshot = () => {
     const base = {
       id,
@@ -34149,7 +34412,6 @@ var runDev = async (args) => {
     ...new Set(resource.files.map((f) => join5(root, dirname3(f))))
   ];
   watchedDirs.forEach((dir) => watch(dir, notifyChange));
-  const appOrigin = new URL(appBaseUrl).origin;
   const server = createServer2((req, res) => {
     const headers = {
       // The webapp page is a different origin; a secure page may also send a
@@ -34201,7 +34463,7 @@ var runDev = async (args) => {
       error instanceof Error && "code" in error && error.code === "EADDRINUSE" ? `Port ${String(port)} is in use \u2014 pass --port <n>.` : String(error)
     );
   });
-  const url = `${appBaseUrl}/${manifest.organizationId}/dev?src=${encodeURIComponent(`http://127.0.0.1:${String(port)}`)}`;
+  const url = `${browserBaseUrl}/${manifest.organizationId}/dev?src=${encodeURIComponent(`http://127.0.0.1:${String(port)}`)}`;
   process.stdout.write(
     `Serving ${resource.name} (${id}) from local files.
 ${url}
@@ -34405,6 +34667,66 @@ var runIntegration = async (args) => {
   printResult(result, resolveFormat(flagValue(args, "-o", "--output")));
 };
 
+// src/commands/knowledgeBase.ts
+import { readFile as readFile2 } from "fs/promises";
+import { basename } from "path";
+var runKnowledgeBase = async (args) => {
+  const [operation, id] = args;
+  if (id == null || operation !== "upload" && operation !== "search") {
+    throw new Error(
+      "Usage: overai knowledge-base upload <id> <file...> | knowledge-base search <id> <query> [--limit N]"
+    );
+  }
+  const { organizationId } = await getAccessToken();
+  if (operation === "upload") {
+    const paths = args.slice(2).filter(
+      (arg, i, all) => !arg.startsWith("-") && all[i - 1] !== "-o" && all[i - 1] !== "--output"
+    );
+    if (paths.length === 0)
+      throw new Error("Knowledge base upload requires at least one file path.");
+    const uploads = [];
+    for (const path of paths) {
+      const bytes = await readFile2(path);
+      const formData = new FormData();
+      formData.append(
+        "file",
+        new Blob([new Uint8Array(bytes)]),
+        basename(path)
+      );
+      const response2 = await v2Fetch(
+        `/v2/knowledge-bases/${organizationId}/${id}/upload`,
+        { method: "POST", body: formData }
+      );
+      const raw3 = await response2.text();
+      if (!response2.ok) throw v2Error("knowledge-base upload", response2, raw3);
+      uploads.push({ file: basename(path), ...JSON.parse(raw3) });
+    }
+    printResult(uploads, resolveFormat(flagValue(args, "-o", "--output")));
+    return;
+  }
+  const query = args[2];
+  if (query == null || query.startsWith("-"))
+    throw new Error("Knowledge base search requires a query string.");
+  const limit2 = flagValue(args, "--limit");
+  const response = await v2Fetch(
+    `/v2/knowledge-bases/${organizationId}/${id}/search`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        query,
+        ...limit2 != null ? { limit: Number(limit2) } : {}
+      })
+    }
+  );
+  const raw2 = await response.text();
+  if (!response.ok) throw v2Error("knowledge-base search", response, raw2);
+  printResult(
+    JSON.parse(raw2),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+
 // src/commands/open.ts
 var ROUTE_BY_TYPE = {
   automation: "automations",
@@ -34440,14 +34762,14 @@ var runOpen = async (args) => {
     })();
     if (manifest != null) {
       if (filter2 == null) {
-        return `${appBaseUrl}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
+        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/workspaces/${manifest.workspaceId}`;
       }
       const match = Object.entries(manifest.resources).find(
         ([id, r]) => id === filter2 || r.name.toLowerCase().includes(filter2.toLowerCase()) || r.files.some((f) => f.includes(filter2))
       );
       if (match != null) {
         const [id, resource] = match;
-        return `${appBaseUrl}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
+        return `${appBaseUrl(apiBaseUrl())}/${manifest.organizationId}/${ROUTE_BY_TYPE[resource.type]}/${id}`;
       }
     }
     if (filter2 == null) {
@@ -34463,13 +34785,74 @@ var runOpen = async (args) => {
         `Nothing matched "${filter2}" (not a tracked resource or a recognized id prefix).`
       );
     }
-    return `${appBaseUrl}/${organizationId}/${prefixed[1]}/${filter2}`;
+    return `${appBaseUrl(apiBaseUrl())}/${organizationId}/${prefixed[1]}/${filter2}`;
   })();
   process.stdout.write(`${url}
 `);
   openBrowser(url);
 };
 
+// src/commands/org.ts
+var USER_ORGS_QUERY = `
+  query UserOrganizations($identityId: String!) {
+    identityOrganizations(condition: { identityId: $identityId }) {
+      nodes {
+        disabled
+        organization { id name }
+      }
+    }
+  }
+`;
+var listOrgRows = async () => {
+  const auth = await getAccessToken();
+  const identityId = decodeJwtClaims(auth.token).user_id;
+  if (identityId == null) {
+    throw new Error("Could not read identity from the current session.");
+  }
+  const data = await gqlRequest(USER_ORGS_QUERY, { identityId });
+  return data.identityOrganizations.nodes.filter((node) => node != null && !node.disabled).map((node) => node?.organization).filter((org) => org != null);
+};
+var listOrgs = async (args) => {
+  const active = scopedOrgId();
+  printResult(
+    (await listOrgRows()).map((org) => ({
+      id: org.id,
+      name: org.name ?? "",
+      active: org.id === active,
+      sessionSaved: readStore().deployments[apiBaseUrl()]?.sessions[org.id] != null
+    })),
+    resolveFormat(flagValue(args, "-o", "--output"))
+  );
+};
+var switchOrg = async (orgId) => {
+  if (orgIdOverride != null && orgIdOverride !== orgId) {
+    throw new Error(
+      `OVERAI_ORG_ID=${orgIdOverride} conflicts with the requested org ${orgId}. Unset it first.`
+    );
+  }
+  setOrgScope(orgId);
+  try {
+    await getAccessToken();
+  } catch (error) {
+    if (!(error instanceof InteractiveSignInRequired)) throw error;
+    await signIn(orgId);
+  }
+  await withStoreLock((store) => {
+    const deployment = store.deployments[apiBaseUrl()];
+    if (deployment?.sessions[orgId] == null)
+      throw new Error(
+        "Session was signed out before the default could be changed."
+      );
+    deployment.defaultOrgId = orgId;
+    writeStore(store);
+  });
+  process.stdout.write(
+    `Default org set to ${orgId}. Other org sessions are unchanged.
+This default is machine-global; workspace folders and OVERAI_ORG_ID override it.
+`
+  );
+};
+
 // src/commands/printablePage.ts
 var runPrintablePage = async (args) => {
   const [operation, id] = args;
@@ -34745,6 +35128,12 @@ var runResource = async (args) => {
 // src/docs/bestPractices.ts
 var platform2 = `# OverAI platform primer
 
+Organization context: Commands in a clone select its org automatically. Outside a clone,
+use OVERAI_ORG_ID=<orgId>. Each backend/org has an independent saved session; org switch
+changes only the machine-global default. Use whoami to inspect the effective scope.
+If browser authorization is required, ask the user to run the suggested signin command.
+Never change org to work around a clone-sync mismatch; use the correct workspace folder.
+
 Resources live in Workspaces. The runtime always executes the DEPLOYED version
 of a resource, never the latest \u2014 \`overai push\` creates a version, \`overai
 deploy\` makes it live. Pick primitives by trigger:
@@ -34849,9 +35238,9 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
 - SQL from pages: env.TBSxxx.sql tagged templates only; compose dynamic SQL by
   nesting sql fragments, sql([...]) for IN lists. sql.unsafe only for dynamic
   identifiers.
-- For guest-facing workspaces, add page-to-page navigation (guests land on the
-  workspace homepage and can only follow links). "Hide Top Bar" gives an
-  app-like experience.
+- For end-user-facing workspaces, add page-to-page navigation (end users land
+  on the workspace homepage and can only follow links). "Hide Top Bar" gives
+  an app-like experience.
 - Public pages (/public/:id) have no viewer identity \u2014 useCurrentUser() is
   null. Identity-scoped features degrade: useAgentChat streams but persists
   nothing (conversationId stays null, useAgentConversations is empty, the
@@ -34868,6 +35257,14 @@ language, customTitle, hideTopBar, ...). Push reassembles them.
   item/attribute model. For new pages load data in the page instead \u2014 web pages
   via env.TBSxxx.sql / env.DFxxx, printable pages via fetch with the \`token\`
   global (no env proxy there). Don't rewrite a working page just to migrate it.
+- filter in meta.json DOES evaluate Liquid, in every string value it contains,
+  against \`now\` (a Date rounded down to the minute) plus the search params.
+  The two page kinds bind params differently: a WEB page takes them by bare
+  name (\`{{ since }}\` for ?since=), a PRINTABLE page namespaces them
+  (\`{{ searchParams.since }}\`). \`{{ now | minus: 1209600000 | toISOString }}\`
+  works on both. On a web page a template that won't evaluate, or that
+  evaluates to nothing, fails the page; a printable page falls back to an
+  empty filter instead.
 - dataSourceUrl in meta.json is fetched verbatim and its response becomes the
   \`data\` global. It is a static URL, not a template \u2014 search params are NOT
   substituted into it (neither {x} nor Liquid {{ x }}). If the data depends on
@@ -34914,9 +35311,12 @@ executionMemory MB).
 var workflow = `# CLI editing workflow
 
 1. \`overai workspace list\` to find the id, then \`overai clone <workspaceId>\`
-   (or \`overai pull\` in an existing clone). Workspaces nest, and clone pulls
-   ONE workspace \u2014 a parent's clone does not include its children, so clone
-   each nested workspace you need separately.
+   (or \`overai pull\` in an existing clone). Clone includes accessible,
+   non-archived descendants under \`workspaces/<slug>.<workspaceId>/\`, each with
+   its own manifest and WORKSPACE.md. Change into a child folder to work there.
+   All sync commands stay scoped to the nearest workspace, never its children.
+   Pull does not discover new children; clone those separately. Moving local
+   files does not move resources between workspaces in OverAI.
 2. Edit files. The id in each filename is authoritative; slugs are cosmetic.
 3. \`overai status\` / \`overai diff\` \u2014 review what changed.
 4. \`overai review\` \u2014 local checks, authenticated TypeScript lint against the
@@ -35854,10 +36254,11 @@ var HELP = `overai \u2014 OverAI command-line interface
 Usage:
   overai signin                        Sign in via your browser; choose your
                                        organization there to complete SSO
-  overai signout                       Sign out and revoke this session
+  overai signout [--all]               Revoke this org\u2019s saved CLI session;
+                                       --all revokes all locally saved sessions
   overai whoami                        Show the current identity and org
   overai org list                      List your organizations
-  overai org switch <orgId>            Switch the active org
+  overai org switch <orgId>            Select the default org
   overai workspace list [--archived]   List workspaces you can see in this org
   overai workspace show [workspaceId]  Show a workspace's name and overview
   overai workspace users [workspaceId] List users and effective/direct roles
@@ -35881,7 +36282,7 @@ Usage:
   overai sql credential rotate|revoke <credentialId>
 
 Workspace sync (edit resources as local files):
-  overai clone <workspaceId> [dir]     Materialize resources and WORKSPACE.md
+  overai clone <workspaceId> [dir]     Clone workspace and accessible descendants
   overai status                        Local edits + remote drift
   overai diff [filter] [--from <ref>] [--to <ref>]
                                        Diff versions (refs: N, base, local, deployed, latest;
@@ -35940,10 +36341,12 @@ it from stdin. Prefer that for anything long or quote-heavy: an inline value is
 parsed by your shell first, and one apostrophe inside it silently truncates the
 rest. Write @@ to send a literal value that starts with "@".
 
-Organizations: commands run as the clone you're standing in (.overai/manifest.json),
-else the active org from \`org switch\`. The active org is machine-global \u2014 every
-shell shares it \u2014 so scope one command or one shell with OVERAI_ORG_ID=<orgId>
-instead. \`overai whoami\` says which org is in effect and why.
+Organizations: OVERAI_ORG_ID selects an org for one command or shell, else commands
+use the clone\u2019s org (.overai/manifest.json), else the saved default. Each backend
+and org has its own session. Entering another org preserves existing sessions;
+org switch changes only the machine-global default. Clone sync commands reject
+conflicting overrides. SSO prompts name the signin command to run explicitly.
+whoami shows the backend, org, identity, and selection source.
 
 Output: table on a TTY, JSON when piped; -o json|table|csv to force.
 Aliases: login = signin, logout = signout, ws = workspace.
@@ -35984,10 +36387,10 @@ var run = async () => {
       return;
     case "signout":
     case "logout":
-      await signOut();
+      await signOut(rest.includes("--all"));
       return;
     case "whoami":
-      await whoami();
+      whoami();
       return;
     case "org":
       if (rest[0] === "list") {