aipctl 2026.10.2 → 2026.10.4

package/build/index.cjs

@@ -8532,10 +8532,10 @@ const defects = self => reverse$1(reduce$1(self, empty$r(), (list, cause) => cau
 /** @internal */
 const interruptors$1 = self => reduce$1(self, empty$o(), (set, cause) => cause._tag === OP_INTERRUPT ? some$1(pipe(set, add(cause.fiberId))) : none$7());
 /** @internal */
-const failureOption = self => find(self, cause => cause._tag === OP_FAIL$2 ? some$1(cause.error) : none$7());
+const failureOption$1 = self => find(self, cause => cause._tag === OP_FAIL$2 ? some$1(cause.error) : none$7());
 /** @internal */
 const failureOrCause$1 = self => {
-  const option = failureOption(self);
+  const option = failureOption$1(self);
   switch (option._tag) {
     case "None":
       {
@@ -9978,7 +9978,7 @@ const causeSquash = self => {
 };
 /** @internal */
 const causeSquashWith = /*#__PURE__*/dual(2, (self, f) => {
-  const option = pipe(self, failureOption, map$j(f));
+  const option = pipe(self, failureOption$1, map$j(f));
   switch (option._tag) {
     case "None":
       {
@@ -16583,6 +16583,19 @@ const isInterruptedOnly = isInterruptedOnly$1;
  * @category Getters
  */
 const interruptors = interruptors$1;
+/**
+ * Retrieves the first `Fail` error in a `Cause`, if present.
+ *
+ * **Details**
+ *
+ * This function returns an `Option` containing the first recoverable error
+ * (`E`) from the cause. It's often used to quickly check if there's a primary
+ * error to handle or display.
+ *
+ * @since 2.0.0
+ * @category Getters
+ */
+const failureOption = failureOption$1;
 /**
  * Splits a `Cause` into either its first `Fail` error or the rest of the cause
  * (which might only contain `Die` or `Interrupt`).
@@ -17781,12 +17794,24 @@ const effect_provide = /*#__PURE__*/dual(2, (self, source) => {
 });
 
 /** @internal */
-const consoleWith = f => fiberRefGetWith(currentServices, services => f(get$a(services, consoleTag)));
+const consoleWith$1 = f => fiberRefGetWith(currentServices, services => f(get$a(services, consoleTag)));
 /** @internal */
-const error$2 = (...args) => consoleWith(_ => _.error(...args));
+const withConsole$1 = /*#__PURE__*/dual(2, (effect, value) => fiberRefLocallyWith(effect, currentServices, add$2(consoleTag, value)));
 /** @internal */
-const log$1 = (...args) => consoleWith(_ => _.log(...args));
+const error$2 = (...args) => consoleWith$1(_ => _.error(...args));
+/** @internal */
+const log$1 = (...args) => consoleWith$1(_ => _.log(...args));
 
+/**
+ * @since 2.0.0
+ * @category default services
+ */
+const withConsole = withConsole$1;
+/**
+ * @since 2.0.0
+ * @category accessor
+ */
+const consoleWith = consoleWith$1;
 /**
  * @since 2.0.0
  * @category accessor
@@ -89663,1239 +89688,169 @@ const runMain = runMain$1;
 ({
   ...CommitPrototype$1});
 
-const BUILD_ENVS = ["local", "dev", "qa", "stage", "prod", "test"];
-const isBuildEnv = (value) => BUILD_ENVS.includes(value);
+const NOT_LOGGED_IN_MESSAGE = 'Not logged in. Please run "aipctl auth login" first.';
+const SESSION_EXPIRED_MESSAGE = 'Session expired. Run "aipctl auth login" to continue.';
 
-const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
-if (!isBuildEnv(injectedBuildEnv)) {
-  throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
+const CONFIG_SET_HINT = "aipctl config set --app-url https://app.example.com";
+const CONFIG_DIR$2 = path__namespace.join(os__namespace.homedir(), ".config", "aip");
+const CONFIG_FILE = path__namespace.join(CONFIG_DIR$2, "config.json");
+let cachedConfig;
+class ConfigServiceTag extends Tag$1("ConfigService")() {
 }
-const VERSION = "2026.10.2".length > 0 ? "2026.10.2" : "0.0.0";
-const BUILD_ENV = injectedBuildEnv;
-const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
-
-const loadBinaryModule = () => {
-  const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
-  return require$1(["..", "binary.cjs"].join("/"));
-};
-const resolveNativeBinary = (options = {}) => {
-  const env = options.env ?? process.env;
-  if (env.AIPCTL_NATIVE_BINARY && env.AIPCTL_NATIVE_BINARY.length > 0) {
-    return env.AIPCTL_NATIVE_BINARY;
+class AppUrlNotConfiguredError extends Error {
+  constructor() {
+    super(`App URL is not configured. Run "${CONFIG_SET_HINT}" first.`);
+    this.name = "AppUrlNotConfiguredError";
   }
-  const binary = (options.loadBinaryModule ?? loadBinaryModule)();
-  return binary.resolveBinaryPath(options.platform ?? process.platform, options.arch ?? process.arch);
-};
-const runNativeCommand = (args, options = {}) => new Promise((resolve) => {
-  const env = options.env ?? process.env;
-  const spawn = options.spawn ?? childProcess.spawn;
-  const binaryPath = resolveNativeBinary(options);
-  const child = spawn(binaryPath, [...args], {
-    stdio: "inherit",
-    env
-  });
-  child.on("error", (error) => {
-    console.error(`Failed to start native command: ${error.message}`);
-    process.exitCode = 1;
-    resolve();
-  });
-  child.on("exit", (code) => {
-    process.exitCode = code ?? 1;
-    resolve();
-  });
-});
-
-const restArgs = text$2({ name: "arg" }).pipe(
-  repeated,
-  withDescription$5("Arguments passed through to the native aipctl command")
-);
-const makeNativeCommand = (name, description) => make$4(
-  name,
-  { rest: restArgs },
-  ({ rest }) => promise$1(() => runNativeCommand([name, ...rest]))
-).pipe(withDescription(description));
-
-const nativeCommandDefinitions = [
-  { name: "install", description: "Install an MCP preset into a local client", includeInProd: true },
-  { name: "run", description: "Run the native MCP server", includeInProd: true },
-  { name: "tunnel", description: "Manage Edge Tunnel connections", includeInProd: true },
-  { name: "logs", description: "Inspect native MCP CLI logs", includeInProd: false }
-];
-const nativeCommandNames = nativeCommandDefinitions.map(({ name }) => name);
-const isEnabledNativeCommand = (definition, includeLogs) => definition.includeInProd || includeLogs;
-const nativeSubcommands = nativeCommandDefinitions.filter((definition) => isEnabledNativeCommand(definition, INCLUDE_NATIVE_LOGS)).map(({ name, description }) => makeNativeCommand(name, description));
-const isNativeCommandEnabled = (command, includeLogs = INCLUDE_NATIVE_LOGS) => {
-  const definition = nativeCommandDefinitions.find(({ name }) => name === command);
-  return definition ? isEnabledNativeCommand(definition, includeLogs) : false;
-};
-
-const FORCED_ARGS_SEPARATOR = "--";
-const NATIVE_ROOT_COMMANDS = new Set(nativeCommandNames);
-const trailingOptionSpecs = [
-  ...["list", "get"].map((command) => ({
-    command: ["automation", command],
-    booleanOptions: /* @__PURE__ */ new Set(["--json"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--name"] : []]),
-    explicitBooleanValues: true
-  })),
-  {
-    command: ["automation", "delete"],
-    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org"]),
-    explicitBooleanValues: true,
-    booleanAliases: { "-f": "--force" }
-  },
-  {
-    command: ["drive", "delete"],
-    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org"])
-  },
-  {
-    command: ["automation", "history"],
-    booleanOptions: /* @__PURE__ */ new Set(),
-    valueOptions: /* @__PURE__ */ new Set(["--page", "--org"])
-  },
-  {
-    command: ["automation", "triggers"],
-    booleanOptions: /* @__PURE__ */ new Set(),
-    valueOptions: /* @__PURE__ */ new Set(["--account-id", "--folder-id", "--service-type", "--org"])
-  },
-  {
-    command: ["admin", "skill", "github", "import"],
-    booleanOptions: /* @__PURE__ */ new Set(["--overwrite", "--json"]),
-    valueOptions: /* @__PURE__ */ new Set(["--org", "--pat-env"])
+}
+class InvalidAppUrlError extends Error {
+  rawValue;
+  constructor(rawValue, reason) {
+    super(`App URL is invalid: ${reason}. Run "${CONFIG_SET_HINT}" to fix it.`);
+    this.name = "InvalidAppUrlError";
+    this.rawValue = rawValue;
   }
-];
-const getOptionName = (arg) => arg.split("=", 1)[0];
-const findTrailingOptionSpec = (args) => trailingOptionSpecs.find((spec) => spec.command.every((part, index) => args[index] === part));
-const isNativeRootCommand = (args) => NATIVE_ROOT_COMMANDS.has(args[0] ?? "");
-const isBooleanOption = (arg, spec) => spec.booleanOptions.has(arg);
-const isValueOption = (arg, spec) => spec.valueOptions.has(getOptionName(arg));
-const normalizeTrailingOptions = (args, spec) => {
-  const options = [];
-  const rest = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === void 0) {
-      continue;
-    }
-    if (spec.explicitBooleanValues && spec.booleanOptions.has(getOptionName(arg))) {
-      const nextArg = args[index + 1];
-      const optionName = spec.booleanAliases?.[getOptionName(arg)] ?? getOptionName(arg);
-      if (arg.includes("=")) {
-        options.push(`${optionName}${arg.slice(arg.indexOf("="))}`);
-      } else if (nextArg === "true" || nextArg === "false") {
-        options.push(`${optionName}=${nextArg}`);
-        index += 1;
-      } else {
-        options.push(`${optionName}=true`);
-      }
-      continue;
-    }
-    if (isBooleanOption(arg, spec)) {
-      options.push(arg);
-      continue;
-    }
-    if (isValueOption(arg, spec)) {
-      options.push(arg);
-      const nextArg = args[index + 1];
-      if (!arg.includes("=") && nextArg !== void 0 && !nextArg.startsWith("-")) {
-        index += 1;
-        options.push(nextArg);
-      }
-      continue;
+}
+function isRecord$1(value) {
+  return typeof value === "object" && value !== null;
+}
+function optionalString$1(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function parseCurrentOrganization(value) {
+  if (!isRecord$1(value)) {
+    return void 0;
+  }
+  const id = optionalString$1(value["id"]);
+  const slug = optionalString$1(value["slug"]);
+  const name = optionalString$1(value["name"]);
+  if (!id || !slug || !name) {
+    return void 0;
+  }
+  return { id, slug, name };
+}
+function normalizeLoadedConfig(value) {
+  if (!isRecord$1(value)) {
+    return {};
+  }
+  return {
+    appBaseUrl: optionalString$1(value["appBaseUrl"]),
+    currentOrganization: parseCurrentOrganization(value["currentOrganization"])
+  };
+}
+function cloneConfig(config) {
+  return {
+    appBaseUrl: config.appBaseUrl,
+    currentOrganization: config.currentOrganization ? { ...config.currentOrganization } : void 0
+  };
+}
+function readConfigFile() {
+  try {
+    const content = fs__namespace.readFileSync(CONFIG_FILE, "utf-8");
+    return normalizeLoadedConfig(JSON.parse(content));
+  } catch {
+    return {};
+  }
+}
+function isSameCurrentOrganization(left, right) {
+  return left?.id === right?.id && left?.slug === right?.slug && left?.name === right?.name;
+}
+function isSameConfig(left, right) {
+  return left.appBaseUrl === right.appBaseUrl && isSameCurrentOrganization(left.currentOrganization, right.currentOrganization);
+}
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.toLowerCase();
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
+}
+function hasExplicitAppUrlProtocol(value) {
+  const protocolMatch = /^[a-z][a-z\d+.-]*:/i.exec(value);
+  if (!protocolMatch) {
+    return false;
+  }
+  const valueAfterProtocol = value.slice(protocolMatch[0].length);
+  return !/^\d+(?:$|[/?#])/.test(valueAfterProtocol);
+}
+function normalizeAppUrl(rawValue) {
+  const trimmed = rawValue.trim();
+  if (trimmed.length === 0) {
+    throw new InvalidAppUrlError(rawValue, "value must not be empty");
+  }
+  const appUrl = hasExplicitAppUrlProtocol(trimmed) ? trimmed : `https://${trimmed}`;
+  let url;
+  try {
+    url = new URL(appUrl);
+  } catch {
+    throw new InvalidAppUrlError(rawValue, "value must be a valid URL");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new InvalidAppUrlError(rawValue, "only https:// URLs are supported, with http:// allowed for localhost development");
+  }
+  if (url.protocol === "http:" && !isLoopbackHostname(url.hostname)) {
+    throw new InvalidAppUrlError(rawValue, "http:// is only supported for localhost development; use https:// for app URLs");
+  }
+  return url.origin;
+}
+function deriveInternalBaseUrls(appBaseUrl) {
+  const url = new URL(normalizeAppUrl(appBaseUrl));
+  return {
+    apiBaseUrl: `${url.protocol}//api.${url.host}`,
+    chatBaseUrl: `${url.protocol}//chat.${url.host}`
+  };
+}
+function getAppUrlStatus(config) {
+  const rawValue = config.appBaseUrl;
+  if (!rawValue) {
+    return { state: "unconfigured" };
+  }
+  try {
+    return {
+      state: "configured",
+      value: normalizeAppUrl(rawValue)
+    };
+  } catch (error) {
+    if (error instanceof InvalidAppUrlError) {
+      return {
+        state: "invalid",
+        value: rawValue,
+        reason: error.message
+      };
     }
-    rest.push(arg);
+    throw error;
   }
-  return [...options, ...rest];
-};
-const normalizeAipArgs = (args) => {
-  if (isNativeRootCommand(args)) {
-    return [...args];
+}
+function requireAppBaseUrl(config) {
+  const rawValue = config.appBaseUrl;
+  if (!rawValue) {
+    throw new AppUrlNotConfiguredError();
   }
-  const forcedArgsIndex = args.indexOf(FORCED_ARGS_SEPARATOR);
-  const parsedArgs = forcedArgsIndex === -1 ? args : args.slice(0, forcedArgsIndex);
-  const forcedArgs = forcedArgsIndex === -1 ? [] : args.slice(forcedArgsIndex);
-  const spec = findTrailingOptionSpec(parsedArgs);
-  if (!spec) {
-    return [...args];
+  return normalizeAppUrl(rawValue);
+}
+function requireApiBaseUrl(config) {
+  return deriveInternalBaseUrls(requireAppBaseUrl(config)).apiBaseUrl;
+}
+function requireChatBaseUrl(config) {
+  return deriveInternalBaseUrls(requireAppBaseUrl(config)).chatBaseUrl;
+}
+const ConfigServiceLive = succeed$2(ConfigServiceTag, {
+  load: () => {
+    cachedConfig ??= readConfigFile();
+    return cloneConfig(cachedConfig);
+  },
+  save: (config, currentConfig) => {
+    const current = currentConfig ?? cachedConfig ?? readConfigFile();
+    const merged = cloneConfig({
+      ...current,
+      ...config
+    });
+    cachedConfig = merged;
+    if (isSameConfig(current, merged)) {
+      return;
+    }
+    fs__namespace.mkdirSync(CONFIG_DIR$2, { recursive: true });
+    fs__namespace.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2));
   }
-  const commandPrefix = parsedArgs.slice(0, spec.command.length);
-  const suffix = parsedArgs.slice(spec.command.length);
-  return [
-    ...commandPrefix,
-    ...normalizeTrailingOptions(suffix, spec),
-    ...forcedArgs
-  ];
-};
-
-const implementedCommandOperationIds = /* @__PURE__ */ new Set([
-  "listCliAgents",
-  "getCliAgent",
-  "listCliAgentTemplates",
-  "createCliAgent",
-  "updateCliAgent",
-  "deleteCliAgent",
-  "updateCliAgentStatus",
-  "getCliAgentShare",
-  "getCliMe",
-  "getCliUserSettings",
-  "listCliOrganizations",
-  "getCliOrganizationCapabilities",
-  "listCliOrganizationMembers",
-  "listCliModels",
-  "listCliModelExecModels",
-  "createCliModelChatExecution",
-  "listCliSkills",
-  "getCliSkill",
-  "deleteCliSkill",
-  "listCliSkillLibrary",
-  "createCliSkillClones",
-  "listCliBuiltInSkills",
-  "createCliBuiltInSkillClones",
-  "listCliAdminSkills",
-  "getCliAdminSkill",
-  "deleteCliAdminSkill",
-  "updateCliAdminSkill",
-  "listCliAdminBuiltInSkills",
-  "createCliAdminBuiltInSkillClones",
-  "listCliDriveEntries",
-  "getCliDriveUsage",
-  "createCliDriveFolder",
-  "updateCliDriveEntryName",
-  "deleteCliDriveEntries",
-  "listCliChats",
-  "getCliChat",
-  "listCliChatMessages",
-  "listCliIntegrations",
-  "listCliAvailableIntegrations",
-  "getCliAdminIntegration",
-  "listCliIntegrationTools",
-  "listCliAutomations",
-  "getCliAutomation",
-  "listCliAutomationTriggers",
-  "listCliAutomationHistory",
-  "createCliAutomation",
-  "updateCliAutomation",
-  "deleteCliAutomation",
-  "updateCliAutomationStatus",
-  "getCliCreditUsage",
-  "listCliTopUsers",
-  "getCliDailyUsageGraph",
-  "listCliDailyUsers",
-  "listCliTopMcpTools",
-  "listCliAuditLogs",
-  "listCliAuditEventTypes"
-]);
-const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
-  "listCliAgents",
-  "getCliAgent",
-  "listCliAgentTemplates",
-  "createCliAgent",
-  "updateCliAgent",
-  "deleteCliAgent",
-  "updateCliAgentStatus",
-  "getCliAgentShare",
-  "getCliMe",
-  "getCliUserSettings",
-  "listCliOrganizations",
-  "getCliOrganizationCapabilities",
-  "listCliOrganizationMembers",
-  "listCliModels",
-  "listCliModelExecModels",
-  "listCliSkills",
-  "getCliSkill",
-  "deleteCliSkill",
-  "listCliSkillLibrary",
-  "createCliSkillClones",
-  "listCliBuiltInSkills",
-  "createCliBuiltInSkillClones",
-  "listCliAdminSkills",
-  "getCliAdminSkill",
-  "deleteCliAdminSkill",
-  "updateCliAdminSkill",
-  "listCliAdminBuiltInSkills",
-  "createCliAdminBuiltInSkillClones",
-  "listCliDriveEntries",
-  "getCliDriveUsage",
-  "createCliDriveFolder",
-  "updateCliDriveEntryName",
-  "deleteCliDriveEntries",
-  "listCliChats",
-  "getCliChat",
-  "listCliChatMessages",
-  "listCliIntegrations",
-  "listCliAvailableIntegrations",
-  "getCliAdminIntegration",
-  "listCliIntegrationTools",
-  "listCliAutomations",
-  "getCliAutomation",
-  "listCliAutomationTriggers",
-  "listCliAutomationHistory",
-  "createCliAutomation",
-  "updateCliAutomation",
-  "deleteCliAutomation",
-  "updateCliAutomationStatus",
-  "getCliCreditUsage",
-  "listCliTopUsers",
-  "getCliDailyUsageGraph",
-  "listCliDailyUsers",
-  "listCliTopMcpTools",
-  "listCliAuditLogs",
-  "listCliAuditEventTypes"
-]);
-const direct = (commands, operation) => commands.map((command) => ({
-  command,
-  tier: "GA_DIRECT",
-  availability: !implementedCommandOperationIds.has(operation.operationId ?? "") ? "PLANNED" : releaseEnabledCommandOperationIds.has(operation.operationId ?? "") ? "IMPLEMENTED" : "GATED",
-  ...operation
-}));
-const candidate = (commands, owner, authBoundary, requiredGates) => commands.map((command) => ({
-  command,
-  tier: "GA_CANDIDATE",
-  owner,
-  authBoundary,
-  quotaClass: "endpoint-guard",
-  availability: "GATED",
-  capability: `cli.${command.replaceAll(" ", ".")}`,
-  requiredGates
-}));
-const fixedBoundary = (commands, tier, owner, authBoundary) => commands.map((command) => ({
-  command,
-  tier,
-  owner,
-  authBoundary,
-  quotaClass: "none",
-  availability: tier === "INTERNAL_HIDDEN" ? "HIDDEN" : "AVAILABLE"
-}));
-const orgPath = "/api/cli/v1/organizations/{organizationSlug}";
-const commandManifest = [
-  ...direct(["auth whoami"], {
-    owner: "backend",
-    authBoundary: "user-oauth",
-    quotaClass: "bootstrap",
-    endpoint: { method: "GET", path: "/api/cli/v1/me" },
-    operationId: "getCliMe",
-    canonicalOperation: "cli.identity.me.read",
-    capability: "cli.identity.me"
-  }),
-  ...direct(["org list", "org use", "org select"], {
-    owner: "backend",
-    authBoundary: "user-oauth",
-    quotaClass: "bootstrap",
-    endpoint: { method: "GET", path: "/api/cli/v1/organizations" },
-    operationId: "listCliOrganizations",
-    canonicalOperation: "cli.organization.list",
-    capability: "cli.organization.discovery"
-  }),
-  ...direct(["org capabilities"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/capabilities` },
-    operationId: "getCliOrganizationCapabilities",
-    canonicalOperation: "cli.organization.capabilities.read",
-    capability: "cli.organization.capabilities"
-  }),
-  ...direct(["org settings"], {
-    owner: "backend",
-    authBoundary: "user-oauth",
-    quotaClass: "bootstrap",
-    endpoint: { method: "GET", path: "/api/cli/v1/me/settings" },
-    operationId: "getCliUserSettings",
-    canonicalOperation: "cli.user.settings.read",
-    capability: "cli.user.settings"
-  }),
-  ...direct(["org members"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/members` },
-    operationId: "listCliOrganizationMembers",
-    canonicalOperation: "cli.organization.members.list",
-    capability: "cli.organization.members.read"
-  }),
-  ...direct(["org exit"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/membership` },
-    operationId: "deleteCliOrganizationMembership",
-    canonicalOperation: "cli.organization.membership.exit",
-    capability: "cli.organization.exit"
-  }),
-  ...direct(["admin org invite"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/members/invitations` },
-    operationId: "createCliOrganizationMemberInvitations",
-    canonicalOperation: "cli.organization.members.invite",
-    capability: "cli.organization.members.write"
-  }),
-  ...direct(["admin org remove-member"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/members` },
-    operationId: "deleteCliOrganizationMembers",
-    canonicalOperation: "cli.organization.members.remove",
-    capability: "cli.organization.members.write"
-  }),
-  ...direct(["admin org update-member-role"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PUT", path: `${orgPath}/members/role` },
-    operationId: "updateCliOrganizationMemberRoles",
-    canonicalOperation: "cli.organization.members.role.update",
-    capability: "cli.organization.members.write"
-  }),
-  ...direct(["model list"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/models` },
-    operationId: "listCliModels",
-    canonicalOperation: "cli.model.catalog.read",
-    capability: "cli.model.catalog"
-  }),
-  ...direct(["model-exec models", "model-exec get", "model-exec sample"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/model-exec/models` },
-    operationId: "listCliModelExecModels",
-    canonicalOperation: "cli.model.catalog.read",
-    capability: "cli.model.catalog"
-  }),
-  ...direct(["model-exec chat"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "text-execution",
-    endpoint: { method: "POST", path: `${orgPath}/model-exec/chat` },
-    operationId: "createCliModelChatExecution",
-    canonicalOperation: "cli.model.text.execute",
-    capability: "cli.model.text.execute"
-  }),
-  ...direct(["agent list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/agents` },
-    operationId: "listCliAgents",
-    canonicalOperation: "cli.agent.list",
-    capability: "cli.agent.read"
-  }),
-  ...direct(["agent get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}` },
-    operationId: "getCliAgent",
-    canonicalOperation: "cli.agent.get",
-    capability: "cli.agent.read"
-  }),
-  ...direct(["agent enable", "agent disable"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}/status` },
-    operationId: "updateCliAgentStatus",
-    canonicalOperation: "cli.agent.status.update",
-    capability: "cli.agent.write"
-  }),
-  ...direct(["admin agent templates"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/agents/templates` },
-    operationId: "listCliAgentTemplates",
-    canonicalOperation: "cli.agent.templates.list",
-    capability: "cli.agent.read"
-  }),
-  ...direct(["admin agent create"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/agents` },
-    operationId: "createCliAgent",
-    canonicalOperation: "cli.agent.create",
-    capability: "cli.agent.write"
-  }),
-  ...direct(["admin agent update"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}` },
-    operationId: "updateCliAgent",
-    canonicalOperation: "cli.agent.update",
-    capability: "cli.agent.write"
-  }),
-  ...direct(["admin agent delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/agents/{installedAgentId}` },
-    operationId: "deleteCliAgent",
-    canonicalOperation: "cli.agent.delete",
-    capability: "cli.agent.write"
-  }),
-  ...direct(["admin agent share"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}/share` },
-    operationId: "getCliAgentShare",
-    canonicalOperation: "cli.agent.share.read",
-    capability: "cli.agent.read"
-  }),
-  ...direct(["skill list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/skills` },
-    operationId: "listCliSkills",
-    canonicalOperation: "cli.skill.list",
-    capability: "cli.skill.read"
-  }),
-  ...direct(["skill get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/skills/{skillId}` },
-    operationId: "getCliSkill",
-    canonicalOperation: "cli.skill.get",
-    capability: "cli.skill.read"
-  }),
-  ...direct(["skill delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/skills/{skillId}` },
-    operationId: "deleteCliSkill",
-    canonicalOperation: "cli.skill.delete",
-    capability: "cli.skill.write"
-  }),
-  ...direct(["skill library"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/skills/library` },
-    operationId: "listCliSkillLibrary",
-    canonicalOperation: "cli.skill.library.list",
-    capability: "cli.skill.read"
-  }),
-  ...direct(["skill clone"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/skills/library/clone` },
-    operationId: "createCliSkillClones",
-    canonicalOperation: "cli.skill.library.clone",
-    capability: "cli.skill.write"
-  }),
-  ...direct(["skill built-in"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/skills/built-in` },
-    operationId: "listCliBuiltInSkills",
-    canonicalOperation: "cli.skill.built-in.list",
-    capability: "cli.skill.read"
-  }),
-  ...direct(["skill clone-built-in"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/skills/built-in/clone` },
-    operationId: "createCliBuiltInSkillClones",
-    canonicalOperation: "cli.skill.built-in.clone",
-    capability: "cli.skill.write"
-  }),
-  ...direct(["admin skill list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/skills` },
-    operationId: "listCliAdminSkills",
-    canonicalOperation: "cli.admin.skill.list",
-    capability: "cli.admin.skill.read"
-  }),
-  ...direct(["admin skill get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/skills/{skillId}` },
-    operationId: "getCliAdminSkill",
-    canonicalOperation: "cli.admin.skill.get",
-    capability: "cli.admin.skill.read"
-  }),
-  ...direct(["admin skill delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/admin/skills/{skillId}` },
-    operationId: "deleteCliAdminSkill",
-    canonicalOperation: "cli.admin.skill.delete",
-    capability: "cli.admin.skill.write"
-  }),
-  ...direct(["admin skill publish", "admin skill unpublish"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/admin/skills/{skillId}` },
-    operationId: "updateCliAdminSkill",
-    canonicalOperation: "cli.admin.skill.update",
-    capability: "cli.admin.skill.write"
-  }),
-  ...direct(["admin skill built-in"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/skills/built-in` },
-    operationId: "listCliAdminBuiltInSkills",
-    canonicalOperation: "cli.admin.skill.built-in.list",
-    capability: "cli.admin.skill.read"
-  }),
-  ...direct(["admin skill clone-built-in"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/admin/skills/built-in/clone` },
-    operationId: "createCliAdminBuiltInSkillClones",
-    canonicalOperation: "cli.admin.skill.built-in.clone",
-    capability: "cli.admin.skill.write"
-  }),
-  ...direct(["drive list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/drive/entries` },
-    operationId: "listCliDriveEntries",
-    canonicalOperation: "cli.drive.entries.list",
-    capability: "cli.drive.read"
-  }),
-  ...direct(["drive usage"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/drive/usage` },
-    operationId: "getCliDriveUsage",
-    canonicalOperation: "cli.drive.usage.read",
-    capability: "cli.drive.read"
-  }),
-  ...direct(["drive mkdir"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/drive/folders` },
-    operationId: "createCliDriveFolder",
-    canonicalOperation: "cli.drive.folder.create",
-    capability: "cli.drive.write"
-  }),
-  ...direct(["drive rename"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/drive/entries/{entryId}` },
-    operationId: "updateCliDriveEntryName",
-    canonicalOperation: "cli.drive.entry.rename",
-    capability: "cli.drive.write"
-  }),
-  ...direct(["drive delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/drive/entries/delete` },
-    operationId: "deleteCliDriveEntries",
-    canonicalOperation: "cli.drive.entries.delete",
-    capability: "cli.drive.write"
-  }),
-  ...direct(["chat list"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/chats` },
-    operationId: "listCliChats",
-    canonicalOperation: "cli.chat.list",
-    capability: "cli.chat.read"
-  }),
-  ...direct(["chat get"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}` },
-    operationId: "getCliChat",
-    canonicalOperation: "cli.chat.get",
-    capability: "cli.chat.read"
-  }),
-  ...direct(["chat messages"], {
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}/messages` },
-    operationId: "listCliChatMessages",
-    canonicalOperation: "cli.chat.messages.list",
-    capability: "cli.chat.read"
-  }),
-  ...direct(["integration list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/integrations` },
-    operationId: "listCliIntegrations",
-    canonicalOperation: "cli.integration.list",
-    capability: "cli.integration.read"
-  }),
-  ...direct(["admin integration available"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/available` },
-    operationId: "listCliAvailableIntegrations",
-    canonicalOperation: "cli.admin.integration.available.list",
-    capability: "cli.admin.integration.read"
-  }),
-  ...direct(["admin integration get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}` },
-    operationId: "getCliAdminIntegration",
-    canonicalOperation: "cli.admin.integration.get",
-    capability: "cli.admin.integration.read"
-  }),
-  ...direct(["admin integration tools"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}/tools` },
-    operationId: "listCliIntegrationTools",
-    canonicalOperation: "cli.admin.integration.tools.list",
-    capability: "cli.admin.integration.read"
-  }),
-  ...direct(["automation list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/automations` },
-    operationId: "listCliAutomations",
-    canonicalOperation: "cli.automation.list",
-    capability: "cli.automation.read"
-  }),
-  ...direct(["automation get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}` },
-    operationId: "getCliAutomation",
-    canonicalOperation: "cli.automation.get",
-    capability: "cli.automation.read"
-  }),
-  ...direct(["automation triggers"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/automations/triggers` },
-    operationId: "listCliAutomationTriggers",
-    canonicalOperation: "cli.automation.triggers.list",
-    capability: "cli.automation.read"
-  }),
-  ...direct(["automation history"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}/history` },
-    operationId: "listCliAutomationHistory",
-    canonicalOperation: "cli.automation.history.list",
-    capability: "cli.automation.read"
-  }),
-  ...direct(["automation create"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/automations` },
-    operationId: "createCliAutomation",
-    canonicalOperation: "cli.automation.create",
-    capability: "cli.automation.write"
-  }),
-  ...direct(["automation update"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PUT", path: `${orgPath}/automations/{automationId}` },
-    operationId: "updateCliAutomation",
-    canonicalOperation: "cli.automation.update",
-    capability: "cli.automation.write"
-  }),
-  ...direct(["automation delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/automations/{automationId}` },
-    operationId: "deleteCliAutomation",
-    canonicalOperation: "cli.automation.delete",
-    capability: "cli.automation.write"
-  }),
-  ...direct(["automation enable", "automation disable"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/automations/{automationId}/status` },
-    operationId: "updateCliAutomationStatus",
-    canonicalOperation: "cli.automation.status.update",
-    capability: "cli.automation.write"
-  }),
-  ...direct(["admin usage credit"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/usage/credit` },
-    operationId: "getCliCreditUsage",
-    canonicalOperation: "cli.admin.usage.credit.read",
-    capability: "cli.admin.usage.read"
-  }),
-  ...direct(["admin usage top-users"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/usage/top-users` },
-    operationId: "listCliTopUsers",
-    canonicalOperation: "cli.admin.usage.top-users.read",
-    capability: "cli.admin.usage.read"
-  }),
-  ...direct(["admin usage daily-graph"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-graph` },
-    operationId: "getCliDailyUsageGraph",
-    canonicalOperation: "cli.admin.usage.daily-graph.read",
-    capability: "cli.admin.usage.read"
-  }),
-  ...direct(["admin usage daily-users"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-users` },
-    operationId: "listCliDailyUsers",
-    canonicalOperation: "cli.admin.usage.daily-users.read",
-    capability: "cli.admin.usage.read"
-  }),
-  ...direct(["admin usage mcp-top"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/usage/mcp-top` },
-    operationId: "listCliTopMcpTools",
-    canonicalOperation: "cli.admin.usage.mcp-top.read",
-    capability: "cli.admin.usage.read"
-  }),
-  ...direct(["admin audit list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/audit` },
-    operationId: "listCliAuditLogs",
-    canonicalOperation: "cli.admin.audit.list",
-    capability: "cli.admin.audit.read"
-  }),
-  ...direct(["admin audit types"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/audit/types` },
-    operationId: "listCliAuditEventTypes",
-    canonicalOperation: "cli.admin.audit.types.list",
-    capability: "cli.admin.audit.read"
-  }),
-  ...direct(["admin preset list"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/presets` },
-    operationId: "listCliPresets",
-    canonicalOperation: "cli.admin.preset.list",
-    capability: "cli.admin.preset.read"
-  }),
-  ...direct(["admin preset get"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/presets/{presetId}` },
-    operationId: "getCliPreset",
-    canonicalOperation: "cli.admin.preset.get",
-    capability: "cli.admin.preset.read"
-  }),
-  ...direct(["admin preset create"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "POST", path: `${orgPath}/admin/presets` },
-    operationId: "createCliPreset",
-    canonicalOperation: "cli.admin.preset.create",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin preset update"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}` },
-    operationId: "updateCliPreset",
-    canonicalOperation: "cli.admin.preset.update",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin preset rename"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PATCH", path: `${orgPath}/admin/presets/{presetId}` },
-    operationId: "updateCliPresetName",
-    canonicalOperation: "cli.admin.preset.rename",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin preset delete"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}` },
-    operationId: "deleteCliPreset",
-    canonicalOperation: "cli.admin.preset.delete",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin preset set-default"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}/default` },
-    operationId: "updateCliDefaultPreset",
-    canonicalOperation: "cli.admin.preset.default.set",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin preset unset-default"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}/default` },
-    operationId: "deleteCliDefaultPreset",
-    canonicalOperation: "cli.admin.preset.default.unset",
-    capability: "cli.admin.preset.write"
-  }),
-  ...direct(["admin tunnel status"], {
-    owner: "backend",
-    authBoundary: "organization-oauth",
-    quotaClass: "metadata",
-    endpoint: { method: "GET", path: `${orgPath}/admin/tunnel/status` },
-    operationId: "getCliTunnelStatus",
-    canonicalOperation: "cli.admin.tunnel.status.read",
-    capability: "cli.admin.tunnel.read"
-  }),
-  ...candidate(["agent chat"], "chat", "organization-oauth", [
-    "streaming-performance",
-    "execution-permit-lifetime",
-    "disconnect-cancel-recovery"
-  ]),
-  ...candidate(["admin agent export"], "backend", "organization-oauth", [
-    "bounded-download",
-    "partial-file-cleanup",
-    "authorization-audit"
-  ]),
-  ...candidate(["skill upload", "skill download", "admin skill upload", "admin skill download"], "backend", "organization-oauth", [
-    "archive-size-mime-validation",
-    "presigned-host-policy",
-    "abort-complete-recovery"
-  ]),
-  ...candidate([
-    "admin skill github inspect",
-    "admin skill github import",
-    "admin skill github sync"
-  ], "backend", "organization-oauth", [
-    "external-timeout",
-    "repository-size-limit",
-    "duplicate-import-protection",
-    "credential-redaction"
-  ]),
-  ...candidate([
-    "admin skill github credentials set",
-    "admin skill github credentials clear"
-  ], "backend", "organization-oauth", [
-    "secret-redaction",
-    "rotation-revoke-audit"
-  ]),
-  ...candidate(["drive upload", "drive download"], "backend", "organization-oauth", [
-    "byte-timeout-bound",
-    "presigned-host-policy",
-    "storage-quota",
-    "partial-file-cleanup"
-  ]),
-  ...candidate(["chat send"], "chat", "organization-oauth", [
-    "conversation-idempotency",
-    "paid-execution-deduplication",
-    "timeout-cancel-recovery"
-  ]),
-  ...candidate(["integration test"], "backend", "organization-oauth", [
-    "external-timeout",
-    "credential-redaction"
-  ]),
-  ...candidate(["admin integration update", "admin integration delete"], "backend", "organization-oauth", [
-    "typed-contract",
-    "credential-redaction",
-    "mutation-idempotency"
-  ]),
-  ...candidate(["automation run", "automation cancel", "automation webhook-regen"], "backend", "organization-oauth", [
-    "operation-idempotency",
-    "state-transition-validation",
-    "execution-quota",
-    "secret-rotation"
-  ]),
-  ...candidate(["admin preset regen-key", "admin preset regen-static-key"], "backend", "organization-oauth", [
-    "key-redaction",
-    "rotation-audit",
-    "retry-rollback-safety"
-  ]),
-  ...candidate(["admin tunnel config", "admin tunnel token"], "backend", "organization-oauth", [
-    "sensitive-output-policy",
-    "token-ttl-redaction",
-    "audit"
-  ]),
-  {
-    command: "model-exec image generate",
-    tier: "DEFERRED",
-    owner: "chat",
-    authBoundary: "organization-oauth",
-    quotaClass: "endpoint-guard",
-    availability: "DEFERRED",
-    capability: "cli.model.image.generate",
-    requiredGates: ["async-job-lifecycle", "artifact-ttl", "my-drive-output", "cost-reservation"]
-  },
-  ...fixedBoundary(["auth login", "auth refresh"], "STANDARD_OAUTH", "backend", "standard-oauth"),
-  ...fixedBoundary([
-    "auth status",
-    "auth logout",
-    "config set",
-    "config status",
-    "org current"
-  ], "LOCAL_ONLY", "desktop", "local"),
-  ...fixedBoundary(["install", "run", "tunnel"], "EXISTING_NATIVE", "native", "native"),
-  ...fixedBoundary(["logs"], "INTERNAL_HIDDEN", "native", "hidden")
-];
-
-const CUSTOMER_AVAILABILITIES = /* @__PURE__ */ new Set([
-  "IMPLEMENTED",
-  "AVAILABLE"
-]);
-const isCustomerAvailable = (entry) => CUSTOMER_AVAILABILITIES.has(entry.availability);
-const normalizeCliArgCase = (arg) => arg.toLowerCase();
-const commandSegments = (command) => command.split(" ");
-const PROD_DISABLED_BUILT_INS = /* @__PURE__ */ new Set(["--completions", "--wizard"]);
-const isCommandPrefix = (entry, args) => {
-  const segments = commandSegments(entry.command);
-  return segments.length <= args.length && segments.every((segment, index) => args[index] === segment);
-};
-const commandPathBeforeOptions = (args) => args.slice(0, args.findIndex((arg) => arg.startsWith("-")) === -1 ? args.length : args.findIndex((arg) => arg.startsWith("-")));
-const formatUnavailableMessage = (command) => `Command "aipctl ${command}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
-const formatUnavailableOptionMessage = (option) => `Option "aipctl ${option}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
-const commandArgsForAvailability = (args) => {
-  const commandArgs = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--log-level") {
-      index += 1;
-      continue;
-    }
-    commandArgs.push(arg);
-  }
-  return commandArgs;
-};
-const getUnavailableCommandMessage = (args, buildEnv) => {
-  if (buildEnv !== "prod" || args.length === 0) {
-    return null;
-  }
-  const normalizedArgs = args.map(normalizeCliArgCase);
-  const disabledBuiltIn = normalizedArgs.find((arg) => PROD_DISABLED_BUILT_INS.has(arg));
-  if (disabledBuiltIn) {
-    return formatUnavailableOptionMessage(disabledBuiltIn);
-  }
-  const commandArgs = commandArgsForAvailability(normalizedArgs);
-  const entry = commandManifest.filter((candidate) => isCommandPrefix(candidate, commandArgs)).sort((left, right) => commandSegments(right.command).length - commandSegments(left.command).length).at(0);
-  if (entry) {
-    return isCustomerAvailable(entry) ? null : formatUnavailableMessage(entry.command);
-  }
-  const path = commandPathBeforeOptions(commandArgs).join(" ");
-  if (!path) {
-    return null;
-  }
-  const descendants = commandManifest.filter(({ command }) => command.startsWith(`${path} `));
-  if (descendants.length > 0 && descendants.every((candidate) => !isCustomerAvailable(candidate))) {
-    return formatUnavailableMessage(path);
-  }
-  return null;
-};
-
-const NOT_LOGGED_IN_MESSAGE = 'Not logged in. Please run "aipctl auth login" first.';
-const SESSION_EXPIRED_MESSAGE = 'Session expired. Run "aipctl auth login" to continue.';
-
-const CONFIG_SET_HINT = "aipctl config set --app-url https://app.example.com";
-const CONFIG_DIR$2 = path__namespace.join(os__namespace.homedir(), ".config", "aip");
-const CONFIG_FILE = path__namespace.join(CONFIG_DIR$2, "config.json");
-let cachedConfig;
-class ConfigServiceTag extends Tag$1("ConfigService")() {
-}
-class AppUrlNotConfiguredError extends Error {
-  constructor() {
-    super(`App URL is not configured. Run "${CONFIG_SET_HINT}" first.`);
-    this.name = "AppUrlNotConfiguredError";
-  }
-}
-class InvalidAppUrlError extends Error {
-  rawValue;
-  constructor(rawValue, reason) {
-    super(`App URL is invalid: ${reason}. Run "${CONFIG_SET_HINT}" to fix it.`);
-    this.name = "InvalidAppUrlError";
-    this.rawValue = rawValue;
-  }
-}
-function isRecord$1(value) {
-  return typeof value === "object" && value !== null;
-}
-function optionalString$1(value) {
-  return typeof value === "string" ? value : void 0;
-}
-function parseCurrentOrganization(value) {
-  if (!isRecord$1(value)) {
-    return void 0;
-  }
-  const id = optionalString$1(value["id"]);
-  const slug = optionalString$1(value["slug"]);
-  const name = optionalString$1(value["name"]);
-  if (!id || !slug || !name) {
-    return void 0;
-  }
-  return { id, slug, name };
-}
-function normalizeLoadedConfig(value) {
-  if (!isRecord$1(value)) {
-    return {};
-  }
-  return {
-    appBaseUrl: optionalString$1(value["appBaseUrl"]),
-    currentOrganization: parseCurrentOrganization(value["currentOrganization"])
-  };
-}
-function cloneConfig(config) {
-  return {
-    appBaseUrl: config.appBaseUrl,
-    currentOrganization: config.currentOrganization ? { ...config.currentOrganization } : void 0
-  };
-}
-function readConfigFile() {
-  try {
-    const content = fs__namespace.readFileSync(CONFIG_FILE, "utf-8");
-    return normalizeLoadedConfig(JSON.parse(content));
-  } catch {
-    return {};
-  }
-}
-function isSameCurrentOrganization(left, right) {
-  return left?.id === right?.id && left?.slug === right?.slug && left?.name === right?.name;
-}
-function isSameConfig(left, right) {
-  return left.appBaseUrl === right.appBaseUrl && isSameCurrentOrganization(left.currentOrganization, right.currentOrganization);
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase();
-  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
-}
-function hasExplicitAppUrlProtocol(value) {
-  const protocolMatch = /^[a-z][a-z\d+.-]*:/i.exec(value);
-  if (!protocolMatch) {
-    return false;
-  }
-  const valueAfterProtocol = value.slice(protocolMatch[0].length);
-  return !/^\d+(?:$|[/?#])/.test(valueAfterProtocol);
-}
-function normalizeAppUrl(rawValue) {
-  const trimmed = rawValue.trim();
-  if (trimmed.length === 0) {
-    throw new InvalidAppUrlError(rawValue, "value must not be empty");
-  }
-  const appUrl = hasExplicitAppUrlProtocol(trimmed) ? trimmed : `https://${trimmed}`;
-  let url;
-  try {
-    url = new URL(appUrl);
-  } catch {
-    throw new InvalidAppUrlError(rawValue, "value must be a valid URL");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new InvalidAppUrlError(rawValue, "only https:// URLs are supported, with http:// allowed for localhost development");
-  }
-  if (url.protocol === "http:" && !isLoopbackHostname(url.hostname)) {
-    throw new InvalidAppUrlError(rawValue, "http:// is only supported for localhost development; use https:// for app URLs");
-  }
-  return url.origin;
-}
-function deriveInternalBaseUrls(appBaseUrl) {
-  const url = new URL(normalizeAppUrl(appBaseUrl));
-  return {
-    apiBaseUrl: `${url.protocol}//api.${url.host}`,
-    chatBaseUrl: `${url.protocol}//chat.${url.host}`
-  };
-}
-function getAppUrlStatus(config) {
-  const rawValue = config.appBaseUrl;
-  if (!rawValue) {
-    return { state: "unconfigured" };
-  }
-  try {
-    return {
-      state: "configured",
-      value: normalizeAppUrl(rawValue)
-    };
-  } catch (error) {
-    if (error instanceof InvalidAppUrlError) {
-      return {
-        state: "invalid",
-        value: rawValue,
-        reason: error.message
-      };
-    }
-    throw error;
-  }
-}
-function requireAppBaseUrl(config) {
-  const rawValue = config.appBaseUrl;
-  if (!rawValue) {
-    throw new AppUrlNotConfiguredError();
-  }
-  return normalizeAppUrl(rawValue);
-}
-function requireApiBaseUrl(config) {
-  return deriveInternalBaseUrls(requireAppBaseUrl(config)).apiBaseUrl;
-}
-function requireChatBaseUrl(config) {
-  return deriveInternalBaseUrls(requireAppBaseUrl(config)).chatBaseUrl;
-}
-const ConfigServiceLive = succeed$2(ConfigServiceTag, {
-  load: () => {
-    cachedConfig ??= readConfigFile();
-    return cloneConfig(cachedConfig);
-  },
-  save: (config, currentConfig) => {
-    const current = currentConfig ?? cachedConfig ?? readConfigFile();
-    const merged = cloneConfig({
-      ...current,
-      ...config
-    });
-    cachedConfig = merged;
-    if (isSameConfig(current, merged)) {
-      return;
-    }
-    fs__namespace.mkdirSync(CONFIG_DIR$2, { recursive: true });
-    fs__namespace.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2));
-  }
-});
-const ConfigService = ConfigServiceTag;
+});
+const ConfigService = ConfigServiceTag;
 
 var properLockfile = {exports: {}};
 
@@ -93791,6 +92746,7 @@ const CLI_FLAG_PATTERN = /(\-\-(?:access-token|refresh-token|token|secret|client
 const HIGH_RISK_KEY_VALUE_PATTERN = /((?:["']?)\b(?:webhook[_-]?url|invitation[_-]?link|invite[_-]?link|mcp[_-]?url|upload[_-]?url|download[_-]?url)\b(?:["']?)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|https?:\/\/[^\s"'`<>]+|[^\s,;]+)/gi;
 const KEY_VALUE_PATTERN = /((?:["']?)\b(?:access[_-]?token|refresh[_-]?token|auth[_-]?token|token|secret|client[_-]?secret|password|api[_-]?key|private[_-]?key|secret[_-]?key|pat|credential|credentials|cookie|signature|sig)\b(?:["']?)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;&}]+)/gi;
 const AUTH_HEADER_PATTERN = /(Authorization\s*:\s*(?:Bearer|Basic)\s+)([^\s,;]+)/gi;
+const BEARER_PATTERN = /(\bBearer\s+)([^\s,;]+)/gi;
 const URL_PATTERN = /https?:\/\/[^\s"'`<>]+/gi;
 function normalizeKey(value) {
   return value.replace(/[^a-z0-9]/gi, "").toLowerCase();
@@ -93903,6 +92859,7 @@ function sanitizeOAuthAuthorizeUrlForDisplay(value) {
 function maskSensitiveText(value) {
   let masked = value;
   masked = masked.replace(AUTH_HEADER_PATTERN, `$1${REDACTED_VALUE}`);
+  masked = masked.replace(BEARER_PATTERN, `$1${REDACTED_VALUE}`);
   masked = masked.replace(CLI_FLAG_PATTERN, `$1${REDACTED_VALUE}`);
   masked = masked.replace(HIGH_RISK_KEY_VALUE_PATTERN, `$1${REDACTED_VALUE}`);
   masked = masked.replace(KEY_VALUE_PATTERN, `$1${REDACTED_VALUE}`);
@@ -93963,31 +92920,270 @@ function maskSensitiveData(value, options = {}, context = {}) {
       masked[key] = maskDictionaryString(entry, options);
       continue;
     }
-    if (isFullyRedactedKey(key)) {
-      if (entry !== null && typeof entry === "object") {
-        masked[key] = maskSensitiveData(entry, options, {
-          key,
-          forceMaskPrimitives: true
-        });
-      } else {
-        masked[key] = entry == null ? entry : REDACTED_VALUE;
+    if (isFullyRedactedKey(key)) {
+      if (entry !== null && typeof entry === "object") {
+        masked[key] = maskSensitiveData(entry, options, {
+          key,
+          forceMaskPrimitives: true
+        });
+      } else {
+        masked[key] = entry == null ? entry : REDACTED_VALUE;
+      }
+      continue;
+    }
+    if (normalizedKey === MASKED_COMMAND_KEY && typeof entry === "string") {
+      masked[key] = entry;
+      continue;
+    }
+    if (normalizedKey === COMMAND_KEY && typeof entry === "string") {
+      masked[key] = maskSensitiveText(entry);
+      continue;
+    }
+    masked[key] = maskSensitiveData(entry, options, {
+      key,
+      forceMaskPrimitives: context.forceMaskPrimitives || isSensitiveContainerKey(key)
+    });
+  }
+  return masked;
+}
+
+const MAX_CONCURRENCY = 3;
+const MAX_RATE_REQUESTS = 10;
+const RATE_WINDOW_MS = 5e3;
+const POLL_INTERVAL_MS = 300;
+const CONFIG_DIR = path__namespace.join(os__namespace.homedir(), ".config", "aip");
+const STATE_FILE = path__namespace.join(CONFIG_DIR, "rate-limit.json");
+function pruneOldRequests(recentRequests, now = Date.now()) {
+  return recentRequests.filter((ts) => now - new Date(ts).getTime() < RATE_WINDOW_MS);
+}
+function pruneDeadSlots(slots) {
+  return slots.filter((slot) => {
+    try {
+      process.kill(slot.pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+function getRateLimitWaitMs(recentRequests, now = Date.now()) {
+  const active = pruneOldRequests(recentRequests, now);
+  if (active.length < MAX_RATE_REQUESTS) return 0;
+  const oldestMs = Math.min(...active.map((ts) => new Date(ts).getTime()));
+  return oldestMs + RATE_WINDOW_MS - now;
+}
+function ensureConfigDir() {
+  fs__namespace.mkdirSync(CONFIG_DIR, { recursive: true });
+}
+function readState() {
+  try {
+    const raw = fs__namespace.readFileSync(STATE_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return { slots: [], recentRequests: [] };
+  }
+}
+function writeState(state) {
+  fs__namespace.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+async function withLock(fn) {
+  ensureConfigDir();
+  if (!fs__namespace.existsSync(STATE_FILE)) {
+    writeState({ slots: [], recentRequests: [] });
+  }
+  const release2 = await lockfile.lock(STATE_FILE, {
+    retries: { retries: 20, minTimeout: 50, maxTimeout: 200 },
+    stale: 5e3
+  });
+  try {
+    return fn();
+  } finally {
+    await release2();
+  }
+}
+async function release(id) {
+  try {
+    await withLock(() => {
+      const state = readState();
+      state.slots = state.slots.filter((s) => id ? s.id !== id : s.pid !== process.pid);
+      writeState(state);
+    });
+  } catch {
+  }
+}
+async function acquire(signal) {
+  const id = crypto.randomUUID();
+  while (true) {
+    signal?.throwIfAborted();
+    let concurrencyFull = false;
+    let rateLimitWaitMs = 0;
+    try {
+      await withLock(() => {
+        signal?.throwIfAborted();
+        const state = readState();
+        state.slots = pruneDeadSlots(state.slots);
+        const now = Date.now();
+        state.recentRequests = pruneOldRequests(state.recentRequests, now);
+        if (state.slots.length >= MAX_CONCURRENCY) {
+          concurrencyFull = true;
+          writeState(state);
+          return;
+        }
+        rateLimitWaitMs = getRateLimitWaitMs(state.recentRequests, now);
+        if (rateLimitWaitMs > 0) {
+          writeState(state);
+          return;
+        }
+        state.slots.push({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString(), id });
+        state.recentRequests.push((/* @__PURE__ */ new Date()).toISOString());
+        writeState(state);
+      });
+    } catch {
+      signal?.throwIfAborted();
+      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+      continue;
+    }
+    if (!concurrencyFull && rateLimitWaitMs === 0) {
+      if (signal?.aborted) {
+        await release(id);
+        signal.throwIfAborted();
       }
-      continue;
-    }
-    if (normalizedKey === MASKED_COMMAND_KEY && typeof entry === "string") {
-      masked[key] = entry;
-      continue;
-    }
-    if (normalizedKey === COMMAND_KEY && typeof entry === "string") {
-      masked[key] = maskSensitiveText(entry);
-      continue;
+      return id;
     }
-    masked[key] = maskSensitiveData(entry, options, {
-      key,
-      forceMaskPrimitives: context.forceMaskPrimitives || isSensitiveContainerKey(key)
+    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+  }
+}
+
+const HTTP_DEADLINE_MS = 12e4;
+const HTTP_MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const TRANSFER_DEADLINE_MS = 6e5;
+const TRANSFER_MAX_RESPONSE_BYTES = 128 * 1024 * 1024;
+const pendingHttp = /* @__PURE__ */ new Set();
+function track(task) {
+  pendingHttp.add(task);
+  void task.then(() => pendingHttp.delete(task), () => pendingHttp.delete(task));
+  return task;
+}
+async function waitForHttpCleanup() {
+  if (pendingHttp.size === 0) return;
+  let timer;
+  try {
+    await Promise.race([
+      Promise.allSettled([...pendingHttp]),
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, 5e3);
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+class HttpRequestError extends Error {
+  constructor(code, message, outcome, requestId) {
+    super(message);
+    this.code = code;
+    this.outcome = outcome;
+    this.requestId = requestId;
+    this.name = "HttpRequestError";
+  }
+}
+function withHttpResponse(input, init, consume, options = {}) {
+  return track(performHttpResponse(input, init, consume, options));
+}
+async function performHttpResponse(input, init, consume, options) {
+  const controller = new AbortController();
+  const timeoutMs = options.timeoutMs ?? HTTP_DEADLINE_MS;
+  const maxBytes = options.maxResponseBytes ?? HTTP_MAX_RESPONSE_BYTES;
+  const mutation = !["GET", "HEAD"].includes((init.method ?? "GET").toUpperCase());
+  const externalSignal = options.signal ?? init.signal ?? void 0;
+  let acquired = false;
+  let lease;
+  let finished = false;
+  let dispatched = false;
+  let response;
+  let limitedResponse;
+  let stopError;
+  let rejectStopped;
+  const stopped = new Promise((_, reject) => {
+    rejectStopped = reject;
+  });
+  const outcome = () => !dispatched ? "not-dispatched" : mutation ? "unknown" : "read-failed";
+  const stop = (code) => {
+    stopError = new HttpRequestError(
+      code,
+      code === "CLI_REQUEST_TIMEOUT" ? "The request timed out." : "The request was cancelled.",
+      outcome(),
+      response?.headers.get("x-request-id") ?? void 0
+    );
+    controller.abort(stopError);
+    rejectStopped(stopError);
+  };
+  const cancel = () => stop("CLI_REQUEST_CANCELLED");
+  externalSignal?.addEventListener("abort", cancel, { once: true });
+  const timer = setTimeout(() => stop("CLI_REQUEST_TIMEOUT"), timeoutMs);
+  const work = async () => {
+    if (externalSignal?.aborted) cancel();
+    controller.signal.throwIfAborted();
+    if (options.localAdmission !== false) {
+      lease = await acquire(controller.signal);
+      acquired = true;
+      if (finished || controller.signal.aborted) {
+        acquired = false;
+        await release(lease);
+        controller.signal.throwIfAborted();
+      }
+    }
+    controller.signal.throwIfAborted();
+    dispatched = true;
+    response = await fetch(input, { ...init, signal: controller.signal });
+    controller.signal.throwIfAborted();
+    const tooLarge = () => new HttpRequestError(
+      "CLI_RESPONSE_TOO_LARGE",
+      "The response exceeded the size limit. Request a smaller page or narrower range.",
+      outcome(),
+      response?.headers.get("x-request-id") ?? void 0
+    );
+    const declaredBytes = response.headers.get("content-length");
+    if (declaredBytes && /^\d+$/.test(declaredBytes) && Number(declaredBytes) > Math.min(maxBytes, options.responseBudget?.remainingBytes ?? maxBytes)) throw tooLarge();
+    let bytes = 0;
+    const body = response.body?.pipeThrough(new TransformStream({
+      transform(chunk, stream) {
+        bytes += chunk.byteLength;
+        if (options.responseBudget) options.responseBudget.remainingBytes -= chunk.byteLength;
+        if (bytes > maxBytes || options.responseBudget && options.responseBudget.remainingBytes < 0) throw tooLarge();
+        stream.enqueue(chunk);
+      }
+    }));
+    limitedResponse = new Response(body ?? null, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+    return await consume(limitedResponse);
+  };
+  try {
+    return await Promise.race([track(work()), stopped]);
+  } catch (error) {
+    if (stopError) throw stopError;
+    if (error instanceof HttpRequestError) throw error;
+    if (typeof error === "object" && error !== null && "_tag" in error) throw error;
+    throw new HttpRequestError(
+      error instanceof SyntaxError ? "CLI_RESPONSE_INVALID" : "CLI_REQUEST_FAILED",
+      error instanceof SyntaxError ? "The server response was incomplete or invalid." : "The request could not be completed.",
+      outcome(),
+      response?.headers.get("x-request-id") ?? void 0
+    );
+  } finally {
+    finished = true;
+    clearTimeout(timer);
+    externalSignal?.removeEventListener("abort", cancel);
+    controller.abort();
+    void limitedResponse?.body?.cancel().catch(() => {
     });
+    void response?.body?.cancel().catch(() => {
+    });
+    if (acquired) await release(lease);
   }
-  return masked;
 }
 
 const CALLBACK_HOST = "127.0.0.1";
@@ -94007,13 +93203,18 @@ const CALLBACK_RESPONSE_HEADERS$1 = {
   Connection: "close"
 };
 class OAuthRequestError extends Error {
+  _tag = "OAuthRequestError";
   statusCode;
   code;
-  constructor(message, statusCode, code) {
-    super(message);
+  outcome;
+  requestId;
+  constructor(message, statusCode, code, diagnostics = {}) {
+    super(maskSensitiveText(message) + (diagnostics.outcome === "unknown" ? " The server may have processed this request. Check your authentication state before running it again." : ""));
     this.name = "OAuthRequestError";
     this.statusCode = statusCode;
-    this.code = code;
+    this.code = code ? maskSensitiveText(code).slice(0, 128) : void 0;
+    this.outcome = diagnostics.outcome;
+    this.requestId = diagnostics.requestId ? maskSensitiveText(diagnostics.requestId).slice(0, 128) : void 0;
   }
 }
 function generateState$1() {
@@ -94026,6 +93227,7 @@ function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
 function toError$1(error, fallbackMessage) {
+  if (error instanceof OAuthRequestError) return error;
   return error instanceof Error ? new Error(maskSensitiveText(error.message)) : new Error(maskSensitiveText(fallbackMessage));
 }
 function isRecord(value) {
@@ -94055,39 +93257,49 @@ function parseOAuthTokenResponse(value) {
     scope: optionalString(value["scope"])
   };
 }
-async function fetchJson(input, init) {
-  const abortController = new AbortController();
-  const abortTimeout = setTimeout(() => abortController.abort(), OAUTH_REQUEST_TIMEOUT_MS);
-  let response;
+async function fetchJson(input, init, parse = (value) => value) {
   try {
-    response = await fetch(input, { ...init, signal: abortController.signal });
+    return await withHttpResponse(input, init ?? {}, async (response) => {
+      if (!response.ok) {
+        let errorData = {};
+        try {
+          errorData = await response.json();
+        } catch (error) {
+          if (error instanceof HttpRequestError) throw error;
+        }
+        const message = errorData.error_description ?? errorData.message ?? errorData.error ?? `HTTP ${response.status}: ${response.statusText}`;
+        throw new OAuthRequestError(message, response.status, errorData.error ?? errorData.code, {
+          requestId: response.headers.get("x-request-id") ?? void 0
+        });
+      }
+      const value = await response.json();
+      try {
+        return parse(value);
+      } catch (error) {
+        if (!(error instanceof OAuthRequestError)) throw error;
+        throw new OAuthRequestError(error.message, response.status, error.code, {
+          outcome: ["GET", "HEAD"].includes((init?.method ?? "GET").toUpperCase()) ? "read-failed" : "unknown",
+          requestId: response.headers.get("x-request-id") ?? void 0
+        });
+      }
+    }, { timeoutMs: OAUTH_REQUEST_TIMEOUT_MS, localAdmission: false });
   } catch (error) {
-    if (abortController.signal.aborted) {
+    if (error instanceof OAuthRequestError) throw error;
+    if (error instanceof HttpRequestError && error.code === "CLI_REQUEST_TIMEOUT") {
       throw new OAuthRequestError(
         `OAuth request timed out after ${OAUTH_REQUEST_TIMEOUT_SECONDS} seconds`,
         void 0,
-        "timeout"
+        "timeout",
+        { outcome: error.outcome, requestId: error.requestId }
       );
     }
     throw new OAuthRequestError(
       error instanceof Error ? maskSensitiveText(error.message) : "OAuth request failed",
       void 0,
-      "request_failed"
+      "request_failed",
+      error instanceof HttpRequestError ? { outcome: error.outcome, requestId: error.requestId } : {}
     );
-  } finally {
-    clearTimeout(abortTimeout);
-  }
-  if (!response.ok) {
-    let errorData = {};
-    try {
-      errorData = await response.json();
-    } catch {
-    }
-    const message = errorData.error_description ?? errorData.message ?? errorData.error ?? `HTTP ${response.status}: ${response.statusText}`;
-    const code = errorData.error ?? errorData.code;
-    throw new OAuthRequestError(maskSensitiveText(message), response.status, code);
   }
-  return await response.json();
 }
 async function discoverOAuthMetadata(apiBaseUrl) {
   const normalizedBaseUrl = trimTrailingSlash(apiBaseUrl);
@@ -94114,7 +93326,7 @@ async function discoverOAuthMetadata(apiBaseUrl) {
   }
 }
 async function registerCliOAuthClient(metadata) {
-  const response = await fetchJson(metadata.registrationEndpoint, {
+  return fetchJson(metadata.registrationEndpoint, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -94128,13 +93340,11 @@ async function registerCliOAuthClient(metadata) {
       token_endpoint_auth_method: "none",
       scope: OAUTH_SCOPE
     })
+  }, (response) => {
+    const clientId = isRecord(response) ? optionalString(response["client_id"]) : void 0;
+    if (!clientId) throw new OAuthRequestError("OAuth client registration did not return client_id", void 0, "invalid_client_response");
+    return { clientId };
   });
-  if (!response.client_id) {
-    throw new Error("OAuth client registration did not return client_id");
-  }
-  return {
-    clientId: response.client_id
-  };
 }
 function generatePkcePair() {
   const verifier = toBase64Url(crypto__namespace.randomBytes(64));
@@ -94175,14 +93385,13 @@ async function exchangeAuthorizationCode(input) {
     code: input.code,
     code_verifier: input.codeVerifier
   });
-  const response = await fetchJson(input.tokenEndpoint, {
+  return fetchJson(input.tokenEndpoint, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body
-  });
-  return parseOAuthTokenResponse(response);
+  }, parseOAuthTokenResponse);
 }
 async function refreshOAuthToken(input) {
   const body = new URLSearchParams({
@@ -94190,14 +93399,13 @@ async function refreshOAuthToken(input) {
     client_id: input.clientId,
     refresh_token: input.refreshToken
   });
-  const response = await fetchJson(input.tokenEndpoint, {
+  return fetchJson(input.tokenEndpoint, {
     method: "POST",
     headers: {
       "Content-Type": "application/x-www-form-urlencoded"
     },
     body
-  });
-  return parseOAuthTokenResponse(response);
+  }, parseOAuthTokenResponse);
 }
 function tokenExpiresAt(now, expiresInSeconds, fallbackMs) {
   return now + (expiresInSeconds === void 0 ? fallbackMs : expiresInSeconds * 1e3);
@@ -94242,330 +93450,1159 @@ const OAUTH_RESULT_PAGE = {
     title: "Authentication successful",
     message: "You can close this window."
   },
-  error: {
-    title: "Authentication failed",
-    message: 'Check the terminal, then run "aipctl auth login" again.'
-  }
-};
-function buildOAuthResultHtml(variant) {
-  const { title, message } = OAUTH_RESULT_PAGE[variant];
-  return `
-<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${title}</title>
-  <style>
-    :root {
-      color-scheme: light dark;
-      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      --background: #ffffff;
-      --foreground: #171717;
-      --muted-foreground: #737373;
-      background: var(--background);
-      color: var(--foreground);
-    }
-    @media (prefers-color-scheme: dark) {
-      :root {
-        --background: #171717;
-        --foreground: #fafafa;
-        --muted-foreground: #a3a3a3;
-      }
-    }
-    * { box-sizing: border-box; }
-    body {
-      margin: 0;
-      min-height: 100vh;
-      min-height: 100svh;
-      display: grid;
-      place-items: center;
-      padding: 24px;
-      background: var(--background);
-      color: var(--foreground);
-    }
-    main {
-      max-width: 48rem;
-      text-align: center;
-    }
-    h1 {
-      margin: 0;
-      font-size: clamp(1.75rem, 5vw, 2.5rem);
-      font-weight: 600;
-      line-height: 1.15;
-      letter-spacing: -0.03em;
-    }
-    p {
-      margin: 1rem 0 0;
-      color: var(--muted-foreground);
-      font-size: 1rem;
-      line-height: 1.6;
-    }
-  </style>
-</head>
-<body data-variant="${variant}">
-  <main aria-labelledby="result-title">
-    <h1 id="result-title">${title}</h1>
-    <p>${message}</p>
-  </main>
-</body>
-</html>
-`;
-}
-const successHtml$1 = buildOAuthResultHtml("success");
-const errorHtml$1 = buildOAuthResultHtml("error");
-function createServerCloser$1(server) {
-  let closePromise;
-  return () => {
-    if (!closePromise) {
-      closePromise = new Promise((resolve) => {
-        if (!server.listening) {
-          resolve();
-          return;
-        }
-        let settled = false;
-        const finish = () => {
-          if (settled) {
-            return;
-          }
-          settled = true;
-          clearTimeout(forceCloseTimeout);
-          resolve();
-        };
-        const forceCloseTimeout = setTimeout(() => {
-          server.closeAllConnections?.();
-          finish();
-        }, CALLBACK_SERVER_CLOSE_TIMEOUT_MS$1);
-        server.close(finish);
-        server.closeIdleConnections?.();
-      });
-    }
-    return closePromise;
-  };
-}
-async function listenOnCallbackPort$1(server) {
-  await new Promise((resolve, reject) => {
-    let settled = false;
-    const onError = (error) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      server.off("error", onError);
-      if (error.code === "EADDRINUSE") {
-        reject(new Error(CALLBACK_PORT_IN_USE_MESSAGE$1));
-        return;
-      }
-      reject(error);
-    };
-    server.on("error", onError);
-    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      server.off("error", onError);
-      resolve();
-    });
-  });
-}
-const startOAuthFlow = gen(function* () {
-  const config = yield* ConfigService;
-  const credentials = yield* CredentialService;
-  const apiBaseUrl = yield* try_({
-    try: () => requireApiBaseUrl(config.load()),
-    catch: (error) => toError$1(error, "App URL validation failed")
-  });
-  const pkce = generatePkcePair();
-  const state = generateState$1();
-  const deferred = yield* make$m();
-  const server = Http__namespace.createServer((req, res) => {
-    const url = new URL(req.url || "/", CALLBACK_URL);
-    if (url.pathname !== CALLBACK_PATH) {
-      res.writeHead(404);
-      res.end("Not Found");
-      return;
-    }
-    try {
-      const callback = parseOAuthCallback(url.searchParams, state);
-      res.writeHead(200, CALLBACK_RESPONSE_HEADERS$1);
-      res.end(successHtml$1);
-      runSync(succeed$5(deferred, callback));
-    } catch (error) {
-      res.writeHead(400, CALLBACK_RESPONSE_HEADERS$1);
-      res.end(errorHtml$1);
-      runSync(fail$4(deferred, toError$1(error, "Authentication failed")));
-    } finally {
-      void closeServer();
-    }
-  });
-  const closeServer = createServerCloser$1(server);
-  yield* tryPromise({
-    try: () => listenOnCallbackPort$1(server),
-    catch: (error) => toError$1(error, "Failed to start OAuth callback server")
-  });
-  return yield* gen(function* () {
-    const metadata = yield* tryPromise({
-      try: () => discoverOAuthMetadata(apiBaseUrl),
-      catch: (error) => toError$1(error, "OAuth metadata discovery failed")
-    });
-    const registration = yield* tryPromise({
-      try: () => registerCliOAuthClient(metadata),
-      catch: (error) => toError$1(error, "OAuth client registration failed")
-    });
-    const authorizeUrl = buildAuthorizeUrl({
-      authorizationEndpoint: metadata.authorizationEndpoint,
-      clientId: registration.clientId,
-      state,
-      codeChallenge: pkce.challenge
-    });
-    yield* sync$1(() => {
-      console.log("Opening browser for login...");
-      console.log(`If browser doesn't open, visit: ${sanitizeOAuthAuthorizeUrlForDisplay(authorizeUrl)}`);
-      void open(authorizeUrl).catch(() => void 0);
-    });
-    const callback = yield* raceFirst(
-      _await(deferred),
-      sleep$1("5 minutes").pipe(flatMap$5(() => fail$3(new Error("Login timeout"))))
-    );
-    yield* sync$1(() => {
-      console.log("Authorization received. Exchanging token...");
-    });
-    const tokenResponse = yield* tryPromise({
-      try: () => exchangeAuthorizationCode({
-        tokenEndpoint: metadata.tokenEndpoint,
-        clientId: registration.clientId,
-        code: callback.code,
-        codeVerifier: pkce.verifier
-      }),
-      catch: (error) => toError$1(error, "OAuth token exchange failed")
-    });
-    const nextCredentials = toCredentialsFromTokenResponse({
-      tokenResponse,
-      clientId: registration.clientId,
-      issuer: metadata.issuer
-    });
-    credentials.save(nextCredentials);
-    return nextCredentials;
-  }).pipe(ensuring$1(promise$1(() => closeServer())));
-});
-
-const MAX_CONCURRENCY = 3;
-const MAX_RATE_REQUESTS = 10;
-const RATE_WINDOW_MS = 5e3;
-const POLL_INTERVAL_MS = 300;
-const CONFIG_DIR = path__namespace.join(os__namespace.homedir(), ".config", "aip");
-const STATE_FILE = path__namespace.join(CONFIG_DIR, "rate-limit.json");
-function pruneOldRequests(recentRequests, now = Date.now()) {
-  return recentRequests.filter((ts) => now - new Date(ts).getTime() < RATE_WINDOW_MS);
-}
-function pruneDeadSlots(slots) {
-  return slots.filter((slot) => {
-    try {
-      process.kill(slot.pid, 0);
-      return true;
-    } catch {
-      return false;
-    }
-  });
-}
-function getRateLimitWaitMs(recentRequests, now = Date.now()) {
-  const active = pruneOldRequests(recentRequests, now);
-  if (active.length < MAX_RATE_REQUESTS) return 0;
-  const oldestMs = Math.min(...active.map((ts) => new Date(ts).getTime()));
-  return oldestMs + RATE_WINDOW_MS - now;
-}
-function ensureConfigDir() {
-  fs__namespace.mkdirSync(CONFIG_DIR, { recursive: true });
-}
-function readState() {
-  try {
-    const raw = fs__namespace.readFileSync(STATE_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return { slots: [], recentRequests: [] };
-  }
-}
-function writeState(state) {
-  fs__namespace.writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
-}
-async function withLock(fn) {
-  ensureConfigDir();
-  if (!fs__namespace.existsSync(STATE_FILE)) {
-    writeState({ slots: [], recentRequests: [] });
-  }
-  const release2 = await lockfile.lock(STATE_FILE, {
-    retries: { retries: 20, minTimeout: 50, maxTimeout: 200 },
-    stale: 5e3
-  });
-  try {
-    return fn();
-  } finally {
-    await release2();
-  }
-}
-async function release() {
-  try {
-    await withLock(() => {
-      const state = readState();
-      state.slots = state.slots.filter((s) => s.pid !== process.pid);
-      writeState(state);
-    });
-  } catch {
-    process.stderr.write("\n[Rate limit] \uC2AC\uB86F \uBC18\uB0A9 \uC2E4\uD328. \uB2E4\uC74C \uC694\uCCAD \uC2DC \uC790\uB3D9\uC73C\uB85C \uC815\uB9AC\uB429\uB2C8\uB2E4.\n");
-  }
-}
-async function acquire() {
-  let waitStart = null;
-  while (true) {
-    let concurrencyFull = false;
-    let rateLimitWaitMs = 0;
-    try {
-      await withLock(() => {
-        const state = readState();
-        state.slots = pruneDeadSlots(state.slots);
-        const now = Date.now();
-        state.recentRequests = pruneOldRequests(state.recentRequests, now);
-        if (state.slots.length >= MAX_CONCURRENCY) {
-          concurrencyFull = true;
-          writeState(state);
-          return;
-        }
-        rateLimitWaitMs = getRateLimitWaitMs(state.recentRequests, now);
-        if (rateLimitWaitMs > 0) {
-          writeState(state);
-          return;
-        }
-        state.slots.push({ pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() });
-        state.recentRequests.push((/* @__PURE__ */ new Date()).toISOString());
-        writeState(state);
-      });
-    } catch {
-      process.stderr.write("\n[Rate limit] \uB77D \uD68D\uB4DD \uC2E4\uD328. \uC7A0\uC2DC \uD6C4 \uC7AC\uC2DC\uB3C4\uD569\uB2C8\uB2E4...\n");
-      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-      continue;
-    }
-    if (!concurrencyFull && rateLimitWaitMs === 0) {
-      if (waitStart !== null) {
-        process.stderr.write("\r" + " ".repeat(80) + "\r");
-      }
-      return;
-    }
-    if (waitStart === null) waitStart = Date.now();
-    const elapsed = Math.floor((Date.now() - waitStart) / 1e3);
-    if (concurrencyFull) {
-      process.stderr.write(
-        `\r[Rate limit] \uB3D9\uC2DC \uC2E4\uD589: ${MAX_CONCURRENCY}/${MAX_CONCURRENCY} | \uC2AC\uB86F \uB300\uAE30 \uC911... (${elapsed}\uCD08 \uACBD\uACFC)`
-      );
-    } else if (rateLimitWaitMs > 0) {
-      const remainSec = Math.ceil(rateLimitWaitMs / 1e3);
-      process.stderr.write(
-        `\r[Rate limit] \uC694\uCCAD \uD55C\uB3C4 \uCD08\uACFC (${MAX_RATE_REQUESTS}/${RATE_WINDOW_MS / 1e3}\uCD08) | ${remainSec}\uCD08 \uD6C4 \uC7AC\uC2DC\uB3C4...`
-      );
-    }
-    await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
-  }
-}
+  error: {
+    title: "Authentication failed",
+    message: 'Check the terminal, then run "aipctl auth login" again.'
+  }
+};
+function buildOAuthResultHtml(variant) {
+  const { title, message } = OAUTH_RESULT_PAGE[variant];
+  return `
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${title}</title>
+  <style>
+    :root {
+      color-scheme: light dark;
+      font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      --background: #ffffff;
+      --foreground: #171717;
+      --muted-foreground: #737373;
+      background: var(--background);
+      color: var(--foreground);
+    }
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --background: #171717;
+        --foreground: #fafafa;
+        --muted-foreground: #a3a3a3;
+      }
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      min-height: 100vh;
+      min-height: 100svh;
+      display: grid;
+      place-items: center;
+      padding: 24px;
+      background: var(--background);
+      color: var(--foreground);
+    }
+    main {
+      max-width: 48rem;
+      text-align: center;
+    }
+    h1 {
+      margin: 0;
+      font-size: clamp(1.75rem, 5vw, 2.5rem);
+      font-weight: 600;
+      line-height: 1.15;
+      letter-spacing: -0.03em;
+    }
+    p {
+      margin: 1rem 0 0;
+      color: var(--muted-foreground);
+      font-size: 1rem;
+      line-height: 1.6;
+    }
+  </style>
+</head>
+<body data-variant="${variant}">
+  <main aria-labelledby="result-title">
+    <h1 id="result-title">${title}</h1>
+    <p>${message}</p>
+  </main>
+</body>
+</html>
+`;
+}
+const successHtml$1 = buildOAuthResultHtml("success");
+const errorHtml$1 = buildOAuthResultHtml("error");
+function createServerCloser$1(server) {
+  let closePromise;
+  return () => {
+    if (!closePromise) {
+      closePromise = new Promise((resolve) => {
+        if (!server.listening) {
+          resolve();
+          return;
+        }
+        let settled = false;
+        const finish = () => {
+          if (settled) {
+            return;
+          }
+          settled = true;
+          clearTimeout(forceCloseTimeout);
+          resolve();
+        };
+        const forceCloseTimeout = setTimeout(() => {
+          server.closeAllConnections?.();
+          finish();
+        }, CALLBACK_SERVER_CLOSE_TIMEOUT_MS$1);
+        server.close(finish);
+        server.closeIdleConnections?.();
+      });
+    }
+    return closePromise;
+  };
+}
+async function listenOnCallbackPort$1(server) {
+  await new Promise((resolve, reject) => {
+    let settled = false;
+    const onError = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      server.off("error", onError);
+      if (error.code === "EADDRINUSE") {
+        reject(new Error(CALLBACK_PORT_IN_USE_MESSAGE$1));
+        return;
+      }
+      reject(error);
+    };
+    server.on("error", onError);
+    server.listen(CALLBACK_PORT, CALLBACK_HOST, () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      server.off("error", onError);
+      resolve();
+    });
+  });
+}
+const startOAuthFlow = gen(function* () {
+  const config = yield* ConfigService;
+  const credentials = yield* CredentialService;
+  const apiBaseUrl = yield* try_({
+    try: () => requireApiBaseUrl(config.load()),
+    catch: (error) => toError$1(error, "App URL validation failed")
+  });
+  const pkce = generatePkcePair();
+  const state = generateState$1();
+  const deferred = yield* make$m();
+  const server = Http__namespace.createServer((req, res) => {
+    const url = new URL(req.url || "/", CALLBACK_URL);
+    if (url.pathname !== CALLBACK_PATH) {
+      res.writeHead(404);
+      res.end("Not Found");
+      return;
+    }
+    try {
+      const callback = parseOAuthCallback(url.searchParams, state);
+      res.writeHead(200, CALLBACK_RESPONSE_HEADERS$1);
+      res.end(successHtml$1);
+      runSync(succeed$5(deferred, callback));
+    } catch (error) {
+      res.writeHead(400, CALLBACK_RESPONSE_HEADERS$1);
+      res.end(errorHtml$1);
+      runSync(fail$4(deferred, toError$1(error, "Authentication failed")));
+    } finally {
+      void closeServer();
+    }
+  });
+  const closeServer = createServerCloser$1(server);
+  yield* tryPromise({
+    try: () => listenOnCallbackPort$1(server),
+    catch: (error) => toError$1(error, "Failed to start OAuth callback server")
+  });
+  return yield* gen(function* () {
+    const metadata = yield* tryPromise({
+      try: () => discoverOAuthMetadata(apiBaseUrl),
+      catch: (error) => toError$1(error, "OAuth metadata discovery failed")
+    });
+    const registration = yield* tryPromise({
+      try: () => registerCliOAuthClient(metadata),
+      catch: (error) => toError$1(error, "OAuth client registration failed")
+    });
+    const authorizeUrl = buildAuthorizeUrl({
+      authorizationEndpoint: metadata.authorizationEndpoint,
+      clientId: registration.clientId,
+      state,
+      codeChallenge: pkce.challenge
+    });
+    yield* sync$1(() => {
+      console.log("Opening browser for login...");
+      console.log(`If browser doesn't open, visit: ${sanitizeOAuthAuthorizeUrlForDisplay(authorizeUrl)}`);
+      void open(authorizeUrl).catch(() => void 0);
+    });
+    const callback = yield* raceFirst(
+      _await(deferred),
+      sleep$1("5 minutes").pipe(flatMap$5(() => fail$3(new Error("Login timeout"))))
+    );
+    yield* sync$1(() => {
+      console.log("Authorization received. Exchanging token...");
+    });
+    const tokenResponse = yield* tryPromise({
+      try: () => exchangeAuthorizationCode({
+        tokenEndpoint: metadata.tokenEndpoint,
+        clientId: registration.clientId,
+        code: callback.code,
+        codeVerifier: pkce.verifier
+      }),
+      catch: (error) => toError$1(error, "OAuth token exchange failed")
+    });
+    const nextCredentials = toCredentialsFromTokenResponse({
+      tokenResponse,
+      clientId: registration.clientId,
+      issuer: metadata.issuer
+    });
+    credentials.save(nextCredentials);
+    return nextCredentials;
+  }).pipe(ensuring$1(promise$1(() => closeServer())));
+});
+
+const BUILD_ENVS = ["local", "dev", "qa", "stage", "prod", "test"];
+const isBuildEnv = (value) => BUILD_ENVS.includes(value);
+
+const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
+if (!isBuildEnv(injectedBuildEnv)) {
+  throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
+}
+const VERSION = "2026.10.4".length > 0 ? "2026.10.4" : "0.0.0";
+const BUILD_ENV = injectedBuildEnv;
+const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
+
+function parseMyCliQuota(value) {
+  const invalid = () => new HttpRequestError("CLI_RESPONSE_INVALID", "The quota response was invalid. Available capacity is unknown.", "read-failed");
+  const object = (item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) throw invalid();
+    return item;
+  };
+  const integer = (item) => {
+    if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) throw invalid();
+    return item;
+  };
+  const nullableInteger = (item) => item === null ? null : integer(item);
+  const source = object(value);
+  const limits = (item) => {
+    const fields = object(item);
+    return {
+      metadataRequestsPerMinute: integer(fields["metadataRequestsPerMinute"]),
+      metadataRequestBurst: integer(fields["metadataRequestBurst"]),
+      textRequestsPerMinute: integer(fields["textRequestsPerMinute"]),
+      textRequestBurst: integer(fields["textRequestBurst"]),
+      concurrentTextExecutions: integer(fields["concurrentTextExecutions"])
+    };
+  };
+  const usage = object(source["usage"]);
+  const status = usage["status"];
+  if (status !== "AVAILABLE" && status !== "UNAVAILABLE") throw invalid();
+  const reset = usage["dailyResetAt"];
+  if (reset !== null && (typeof reset !== "string" || !Number.isFinite(Date.parse(reset)))) throw invalid();
+  const parsedUsage = {
+    status,
+    dailyTextAdmissionsUsed: nullableInteger(usage["dailyTextAdmissionsUsed"]),
+    activeTextExecutions: nullableInteger(usage["activeTextExecutions"]),
+    unresolvedTextExecutions: nullableInteger(usage["unresolvedTextExecutions"]),
+    dailyResetAt: reset
+  };
+  const counters = [parsedUsage.dailyTextAdmissionsUsed, parsedUsage.activeTextExecutions, parsedUsage.unresolvedTextExecutions, reset];
+  if (status === "UNAVAILABLE" ? counters.some((item) => item !== null) : counters.some((item) => item === null)) throw invalid();
+  if (parsedUsage.unresolvedTextExecutions !== null && parsedUsage.activeTextExecutions !== null && parsedUsage.unresolvedTextExecutions > parsedUsage.activeTextExecutions) throw invalid();
+  return {
+    userLimits: { ...limits(source["userLimits"]), dailyTextAdmissions: integer(object(source["userLimits"])["dailyTextAdmissions"]) },
+    organizationSharedLimits: limits(source["organizationSharedLimits"]),
+    organizationPolicyVersion: nullableInteger(source["organizationPolicyVersion"]),
+    userPolicyVersion: nullableInteger(source["userPolicyVersion"]),
+    usage: parsedUsage
+  };
+}
+
+const implementedCommandOperationIds = /* @__PURE__ */ new Set([
+  "getCliMyQuota",
+  "listCliAgents",
+  "getCliAgent",
+  "listCliAgentTemplates",
+  "createCliAgent",
+  "updateCliAgent",
+  "deleteCliAgent",
+  "updateCliAgentStatus",
+  "getCliAgentShare",
+  "getCliMe",
+  "getCliUserSettings",
+  "listCliOrganizations",
+  "getCliOrganizationCapabilities",
+  "listCliOrganizationMembers",
+  "listCliModels",
+  "listCliModelExecModels",
+  "createCliModelChatExecution",
+  "listCliSkills",
+  "getCliSkill",
+  "deleteCliSkill",
+  "listCliSkillLibrary",
+  "createCliSkillClones",
+  "listCliBuiltInSkills",
+  "createCliBuiltInSkillClones",
+  "listCliAdminSkills",
+  "getCliAdminSkill",
+  "deleteCliAdminSkill",
+  "updateCliAdminSkill",
+  "listCliAdminBuiltInSkills",
+  "createCliAdminBuiltInSkillClones",
+  "listCliDriveEntries",
+  "getCliDriveUsage",
+  "createCliDriveFolder",
+  "updateCliDriveEntryName",
+  "deleteCliDriveEntries",
+  "listCliChats",
+  "getCliChat",
+  "listCliChatMessages",
+  "listCliIntegrations",
+  "listCliAvailableIntegrations",
+  "getCliAdminIntegration",
+  "listCliIntegrationTools",
+  "listCliAutomations",
+  "getCliAutomation",
+  "listCliAutomationTriggers",
+  "listCliAutomationHistory",
+  "createCliAutomation",
+  "updateCliAutomation",
+  "deleteCliAutomation",
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes",
+  "listCliPresets",
+  "getCliPreset",
+  "createCliPreset",
+  "updateCliPreset",
+  "updateCliPresetName",
+  "deleteCliPreset",
+  "updateCliDefaultPreset",
+  "deleteCliDefaultPreset",
+  "createCliOrganizationMemberInvitations",
+  "deleteCliOrganizationMembers",
+  "updateCliOrganizationMemberRoles",
+  "deleteCliOrganizationMembership",
+  "getCliTunnelStatus"
+]);
+const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
+  "getCliMyQuota",
+  "listCliAgents",
+  "getCliAgent",
+  "listCliAgentTemplates",
+  "createCliAgent",
+  "updateCliAgent",
+  "deleteCliAgent",
+  "updateCliAgentStatus",
+  "getCliAgentShare",
+  "getCliMe",
+  "getCliUserSettings",
+  "listCliOrganizations",
+  "getCliOrganizationCapabilities",
+  "listCliOrganizationMembers",
+  "listCliModels",
+  "listCliModelExecModels",
+  "listCliSkills",
+  "getCliSkill",
+  "deleteCliSkill",
+  "listCliSkillLibrary",
+  "createCliSkillClones",
+  "listCliBuiltInSkills",
+  "createCliBuiltInSkillClones",
+  "listCliAdminSkills",
+  "getCliAdminSkill",
+  "deleteCliAdminSkill",
+  "updateCliAdminSkill",
+  "listCliAdminBuiltInSkills",
+  "createCliAdminBuiltInSkillClones",
+  "listCliDriveEntries",
+  "getCliDriveUsage",
+  "createCliDriveFolder",
+  "updateCliDriveEntryName",
+  "deleteCliDriveEntries",
+  "listCliChats",
+  "getCliChat",
+  "listCliChatMessages",
+  "listCliIntegrations",
+  "listCliAvailableIntegrations",
+  "getCliAdminIntegration",
+  "listCliIntegrationTools",
+  "listCliAutomations",
+  "getCliAutomation",
+  "listCliAutomationTriggers",
+  "listCliAutomationHistory",
+  "createCliAutomation",
+  "updateCliAutomation",
+  "deleteCliAutomation",
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes",
+  "listCliPresets",
+  "getCliPreset",
+  "createCliPreset",
+  "updateCliPreset",
+  "updateCliPresetName",
+  "deleteCliPreset",
+  "updateCliDefaultPreset",
+  "deleteCliDefaultPreset",
+  "createCliOrganizationMemberInvitations",
+  "deleteCliOrganizationMembers",
+  "updateCliOrganizationMemberRoles",
+  "deleteCliOrganizationMembership",
+  "getCliTunnelStatus"
+]);
+const direct = (commands, operation) => commands.map((command) => ({
+  command,
+  tier: "GA_DIRECT",
+  availability: !implementedCommandOperationIds.has(operation.operationId ?? "") ? "PLANNED" : releaseEnabledCommandOperationIds.has(operation.operationId ?? "") ? "IMPLEMENTED" : "GATED",
+  ...operation
+}));
+const candidate = (commands, owner, authBoundary, requiredGates) => commands.map((command) => ({
+  command,
+  tier: "GA_CANDIDATE",
+  owner,
+  authBoundary,
+  quotaClass: "endpoint-guard",
+  availability: "GATED",
+  capability: `cli.${command.replaceAll(" ", ".")}`,
+  requiredGates
+}));
+const fixedBoundary = (commands, tier, owner, authBoundary) => commands.map((command) => ({
+  command,
+  tier,
+  owner,
+  authBoundary,
+  quotaClass: "none",
+  availability: tier === "INTERNAL_HIDDEN" ? "HIDDEN" : "AVAILABLE"
+}));
+const orgPath = "/api/cli/v1/organizations/{organizationSlug}";
+const commandManifest = [
+  ...direct(["quota status"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "control-read",
+    endpoint: { method: "GET", path: `${orgPath}/quota` },
+    operationId: "getCliMyQuota",
+    canonicalOperation: "cli.quota.self.read",
+    capability: "cli.quota.self"
+  }),
+  ...direct(["auth whoami"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/me" },
+    operationId: "getCliMe",
+    canonicalOperation: "cli.identity.me.read",
+    capability: "cli.identity.me"
+  }),
+  ...direct(["org list", "org use", "org select"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/organizations" },
+    operationId: "listCliOrganizations",
+    canonicalOperation: "cli.organization.list",
+    capability: "cli.organization.discovery"
+  }),
+  ...direct(["org capabilities"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/capabilities` },
+    operationId: "getCliOrganizationCapabilities",
+    canonicalOperation: "cli.organization.capabilities.read",
+    capability: "cli.organization.capabilities"
+  }),
+  ...direct(["org settings"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/me/settings" },
+    operationId: "getCliUserSettings",
+    canonicalOperation: "cli.user.settings.read",
+    capability: "cli.user.settings"
+  }),
+  ...direct(["org members"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/members` },
+    operationId: "listCliOrganizationMembers",
+    canonicalOperation: "cli.organization.members.list",
+    capability: "cli.organization.members.read"
+  }),
+  ...direct(["org exit"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/membership` },
+    operationId: "deleteCliOrganizationMembership",
+    canonicalOperation: "cli.organization.membership.exit",
+    capability: "cli.organization.exit"
+  }),
+  ...direct(["admin org invite"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/members/invitations` },
+    operationId: "createCliOrganizationMemberInvitations",
+    canonicalOperation: "cli.organization.members.invite",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["admin org remove-member"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/members` },
+    operationId: "deleteCliOrganizationMembers",
+    canonicalOperation: "cli.organization.members.remove",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["admin org update-member-role"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/members/role` },
+    operationId: "updateCliOrganizationMemberRoles",
+    canonicalOperation: "cli.organization.members.role.update",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["model list"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/models` },
+    operationId: "listCliModels",
+    canonicalOperation: "cli.model.catalog.read",
+    capability: "cli.model.catalog"
+  }),
+  ...direct(["model-exec models", "model-exec get", "model-exec sample"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/model-exec/models` },
+    operationId: "listCliModelExecModels",
+    canonicalOperation: "cli.model.catalog.read",
+    capability: "cli.model.catalog"
+  }),
+  ...direct(["model-exec chat"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "text-execution",
+    endpoint: { method: "POST", path: `${orgPath}/model-exec/chat` },
+    operationId: "createCliModelChatExecution",
+    canonicalOperation: "cli.model.text.execute",
+    capability: "cli.model.text.execute"
+  }),
+  ...direct(["agent list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents` },
+    operationId: "listCliAgents",
+    canonicalOperation: "cli.agent.list",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["agent get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "getCliAgent",
+    canonicalOperation: "cli.agent.get",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["agent enable", "agent disable"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}/status` },
+    operationId: "updateCliAgentStatus",
+    canonicalOperation: "cli.agent.status.update",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent templates"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/templates` },
+    operationId: "listCliAgentTemplates",
+    canonicalOperation: "cli.agent.templates.list",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["admin agent create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/agents` },
+    operationId: "createCliAgent",
+    canonicalOperation: "cli.agent.create",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "updateCliAgent",
+    canonicalOperation: "cli.agent.update",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "deleteCliAgent",
+    canonicalOperation: "cli.agent.delete",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent share"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}/share` },
+    operationId: "getCliAgentShare",
+    canonicalOperation: "cli.agent.share.read",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["skill list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills` },
+    operationId: "listCliSkills",
+    canonicalOperation: "cli.skill.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/{skillId}` },
+    operationId: "getCliSkill",
+    canonicalOperation: "cli.skill.get",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/skills/{skillId}` },
+    operationId: "deleteCliSkill",
+    canonicalOperation: "cli.skill.delete",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["skill library"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/library` },
+    operationId: "listCliSkillLibrary",
+    canonicalOperation: "cli.skill.library.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill clone"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/skills/library/clone` },
+    operationId: "createCliSkillClones",
+    canonicalOperation: "cli.skill.library.clone",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["skill built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/built-in` },
+    operationId: "listCliBuiltInSkills",
+    canonicalOperation: "cli.skill.built-in.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill clone-built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/skills/built-in/clone` },
+    operationId: "createCliBuiltInSkillClones",
+    canonicalOperation: "cli.skill.built-in.clone",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["admin skill list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills` },
+    operationId: "listCliAdminSkills",
+    canonicalOperation: "cli.admin.skill.list",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "getCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.get",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "deleteCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.delete",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["admin skill publish", "admin skill unpublish"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "updateCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.update",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["admin skill built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills/built-in` },
+    operationId: "listCliAdminBuiltInSkills",
+    canonicalOperation: "cli.admin.skill.built-in.list",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill clone-built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/admin/skills/built-in/clone` },
+    operationId: "createCliAdminBuiltInSkillClones",
+    canonicalOperation: "cli.admin.skill.built-in.clone",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["drive list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/drive/entries` },
+    operationId: "listCliDriveEntries",
+    canonicalOperation: "cli.drive.entries.list",
+    capability: "cli.drive.read"
+  }),
+  ...direct(["drive usage"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/drive/usage` },
+    operationId: "getCliDriveUsage",
+    canonicalOperation: "cli.drive.usage.read",
+    capability: "cli.drive.read"
+  }),
+  ...direct(["drive mkdir"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/drive/folders` },
+    operationId: "createCliDriveFolder",
+    canonicalOperation: "cli.drive.folder.create",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["drive rename"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/drive/entries/{entryId}` },
+    operationId: "updateCliDriveEntryName",
+    canonicalOperation: "cli.drive.entry.rename",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["drive delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/drive/entries/delete` },
+    operationId: "deleteCliDriveEntries",
+    canonicalOperation: "cli.drive.entries.delete",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["chat list"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats` },
+    operationId: "listCliChats",
+    canonicalOperation: "cli.chat.list",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["chat get"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}` },
+    operationId: "getCliChat",
+    canonicalOperation: "cli.chat.get",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["chat messages"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}/messages` },
+    operationId: "listCliChatMessages",
+    canonicalOperation: "cli.chat.messages.list",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["integration list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/integrations` },
+    operationId: "listCliIntegrations",
+    canonicalOperation: "cli.integration.list",
+    capability: "cli.integration.read"
+  }),
+  ...direct(["admin integration available"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/available` },
+    operationId: "listCliAvailableIntegrations",
+    canonicalOperation: "cli.admin.integration.available.list",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["admin integration get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}` },
+    operationId: "getCliAdminIntegration",
+    canonicalOperation: "cli.admin.integration.get",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["admin integration tools"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}/tools` },
+    operationId: "listCliIntegrationTools",
+    canonicalOperation: "cli.admin.integration.tools.list",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["automation list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations` },
+    operationId: "listCliAutomations",
+    canonicalOperation: "cli.automation.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}` },
+    operationId: "getCliAutomation",
+    canonicalOperation: "cli.automation.get",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation triggers"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/triggers` },
+    operationId: "listCliAutomationTriggers",
+    canonicalOperation: "cli.automation.triggers.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation history"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}/history` },
+    operationId: "listCliAutomationHistory",
+    canonicalOperation: "cli.automation.history.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/automations` },
+    operationId: "createCliAutomation",
+    canonicalOperation: "cli.automation.create",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/automations/{automationId}` },
+    operationId: "updateCliAutomation",
+    canonicalOperation: "cli.automation.update",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/automations/{automationId}` },
+    operationId: "deleteCliAutomation",
+    canonicalOperation: "cli.automation.delete",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation enable", "automation disable"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/automations/{automationId}/status` },
+    operationId: "updateCliAutomationStatus",
+    canonicalOperation: "cli.automation.status.update",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["admin usage credit"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/credit` },
+    operationId: "getCliCreditUsage",
+    canonicalOperation: "cli.admin.usage.credit.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage top-users"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/top-users` },
+    operationId: "listCliTopUsers",
+    canonicalOperation: "cli.admin.usage.top-users.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage daily-graph"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-graph` },
+    operationId: "getCliDailyUsageGraph",
+    canonicalOperation: "cli.admin.usage.daily-graph.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage daily-users"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-users` },
+    operationId: "listCliDailyUsers",
+    canonicalOperation: "cli.admin.usage.daily-users.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage mcp-top"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/mcp-top` },
+    operationId: "listCliTopMcpTools",
+    canonicalOperation: "cli.admin.usage.mcp-top.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin audit list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/audit` },
+    operationId: "listCliAuditLogs",
+    canonicalOperation: "cli.admin.audit.list",
+    capability: "cli.admin.audit.read"
+  }),
+  ...direct(["admin audit types"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/audit/types` },
+    operationId: "listCliAuditEventTypes",
+    canonicalOperation: "cli.admin.audit.types.list",
+    capability: "cli.admin.audit.read"
+  }),
+  ...direct(["admin preset list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/presets` },
+    operationId: "listCliPresets",
+    canonicalOperation: "cli.admin.preset.list",
+    capability: "cli.admin.preset.read"
+  }),
+  ...direct(["admin preset get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "getCliPreset",
+    canonicalOperation: "cli.admin.preset.get",
+    capability: "cli.admin.preset.read"
+  }),
+  ...direct(["admin preset create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/admin/presets` },
+    operationId: "createCliPreset",
+    canonicalOperation: "cli.admin.preset.create",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "updateCliPreset",
+    canonicalOperation: "cli.admin.preset.update",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset rename"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "updateCliPresetName",
+    canonicalOperation: "cli.admin.preset.rename",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "deleteCliPreset",
+    canonicalOperation: "cli.admin.preset.delete",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset set-default"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}/default` },
+    operationId: "updateCliDefaultPreset",
+    canonicalOperation: "cli.admin.preset.default.set",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset unset-default"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}/default` },
+    operationId: "deleteCliDefaultPreset",
+    canonicalOperation: "cli.admin.preset.default.unset",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin tunnel status"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/tunnel/status` },
+    operationId: "getCliTunnelStatus",
+    canonicalOperation: "cli.admin.tunnel.status.read",
+    capability: "cli.admin.tunnel.read"
+  }),
+  ...candidate(["agent chat"], "chat", "organization-oauth", [
+    "streaming-performance",
+    "execution-permit-lifetime",
+    "disconnect-cancel-recovery"
+  ]),
+  ...candidate(["admin agent export"], "backend", "organization-oauth", [
+    "bounded-download",
+    "partial-file-cleanup",
+    "authorization-audit"
+  ]),
+  ...candidate(["skill upload", "skill download", "admin skill upload", "admin skill download"], "backend", "organization-oauth", [
+    "archive-size-mime-validation",
+    "presigned-host-policy",
+    "abort-complete-recovery"
+  ]),
+  ...candidate([
+    "admin skill github inspect",
+    "admin skill github import",
+    "admin skill github sync"
+  ], "backend", "organization-oauth", [
+    "external-timeout",
+    "repository-size-limit",
+    "duplicate-import-protection",
+    "credential-redaction"
+  ]),
+  ...candidate([
+    "admin skill github credentials set",
+    "admin skill github credentials clear"
+  ], "backend", "organization-oauth", [
+    "secret-redaction",
+    "rotation-revoke-audit"
+  ]),
+  ...candidate(["drive upload", "drive download"], "backend", "organization-oauth", [
+    "byte-timeout-bound",
+    "presigned-host-policy",
+    "storage-quota",
+    "partial-file-cleanup"
+  ]),
+  ...candidate(["chat send"], "chat", "organization-oauth", [
+    "conversation-idempotency",
+    "paid-execution-deduplication",
+    "timeout-cancel-recovery"
+  ]),
+  ...candidate(["integration test"], "backend", "organization-oauth", [
+    "external-timeout",
+    "credential-redaction"
+  ]),
+  ...candidate(["admin integration update", "admin integration delete"], "backend", "organization-oauth", [
+    "typed-contract",
+    "credential-redaction",
+    "mutation-idempotency"
+  ]),
+  ...candidate(["automation run", "automation cancel", "automation webhook-regen"], "backend", "organization-oauth", [
+    "operation-idempotency",
+    "state-transition-validation",
+    "execution-quota",
+    "secret-rotation"
+  ]),
+  ...candidate(["admin preset regen-key", "admin preset regen-static-key"], "backend", "organization-oauth", [
+    "key-redaction",
+    "rotation-audit",
+    "retry-rollback-safety"
+  ]),
+  ...candidate(["admin tunnel config", "admin tunnel token"], "backend", "organization-oauth", [
+    "sensitive-output-policy",
+    "token-ttl-redaction",
+    "audit"
+  ]),
+  {
+    command: "model-exec image generate",
+    tier: "DEFERRED",
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "endpoint-guard",
+    availability: "DEFERRED",
+    capability: "cli.model.image.generate",
+    requiredGates: ["async-job-lifecycle", "artifact-ttl", "my-drive-output", "cost-reservation"]
+  },
+  ...fixedBoundary(["auth login", "auth refresh"], "STANDARD_OAUTH", "backend", "standard-oauth"),
+  ...fixedBoundary([
+    "auth status",
+    "auth logout",
+    "config set",
+    "config status",
+    "org current"
+  ], "LOCAL_ONLY", "desktop", "local"),
+  ...fixedBoundary(["install", "run", "tunnel"], "EXISTING_NATIVE", "native", "native"),
+  ...fixedBoundary(["logs"], "INTERNAL_HIDDEN", "native", "hidden")
+];
 
 class ApiError extends TaggedError$1("ApiError") {
 }
@@ -94598,6 +94635,14 @@ function apiErrorFromUnknown(error, fallbackMessage) {
   if (error instanceof ApiError) {
     return error;
   }
+  if (error instanceof HttpRequestError) {
+    return createApiError({
+      message: error.message + (error.outcome === "unknown" ? " The server may have completed the action. Check its state before running it again." : ""),
+      code: error.code,
+      outcome: error.outcome,
+      ...error.requestId ? { requestId: maskSensitiveText(error.requestId).slice(0, 128) } : {}
+    });
+  }
   return createApiError({
     message: error instanceof Error ? error.message : fallbackMessage
   });
@@ -94608,6 +94653,7 @@ class AgentChatStreamIncompleteError extends Error {
     this.sawOnlyTerminalEnvelope = sawOnlyTerminalEnvelope;
     this.name = "AgentChatStreamIncompleteError";
   }
+  _tag = "AgentChatStreamIncompleteError";
 }
 function normalizeAutomationPagination(pagination) {
   return {
@@ -94698,14 +94744,6 @@ function normalizeSharedUserList(sharedUserList) {
     return { userId, userName };
   });
 }
-async function rateLimitedFetch(input, init) {
-  await acquire();
-  try {
-    return await fetch(input, init);
-  } finally {
-    await release();
-  }
-}
 async function sleep(ms) {
   await new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -94713,7 +94751,8 @@ async function toApiError(response) {
   let errorData = {};
   try {
     errorData = await response.json();
-  } catch {
+  } catch (error) {
+    if (error instanceof HttpRequestError) throw error;
   }
   const code = errorData.code ?? errorData.errorCode;
   const details = isCliQuotaErrorCode(code) ? parseCliQuotaErrorDetails(errorData.details, code) : void 0;
@@ -94723,7 +94762,8 @@ async function toApiError(response) {
     statusCode: response.status,
     code,
     ...details ? { details } : {},
-    ...retryAfterSeconds === void 0 ? {} : { retryAfterSeconds }
+    ...retryAfterSeconds === void 0 ? {} : { retryAfterSeconds },
+    ...response.headers.get("x-request-id") ? { requestId: maskSensitiveText(response.headers.get("x-request-id")).slice(0, 128) } : {}
   });
 }
 function isCliQuotaErrorCode(code) {
@@ -94791,29 +94831,23 @@ function parseRetryAfterSeconds(value) {
   return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
 }
 const makeRequest = (baseUrl, path, accessToken, options) => tryPromise({
-  try: async () => {
+  try: async (signal) => {
     const resolvedBaseUrl = typeof baseUrl === "function" ? baseUrl() : baseUrl;
-    const response = await rateLimitedFetch(`${resolvedBaseUrl}${path}`, {
+    return withHttpResponse(`${resolvedBaseUrl}${path}`, {
       method: options?.method || "GET",
       headers: jsonBearerHeaders(accessToken),
       body: options?.body ? JSON.stringify(options.body) : void 0
-    });
-    if (!response.ok) {
-      throw await toApiError(response);
-    }
-    if (options?.skipJsonParse || response.status === 202 || response.status === 204) {
-      return void 0;
-    }
-    return await response.json();
+    }, async (response) => {
+      if (!response.ok) {
+        throw await toApiError(response);
+      }
+      if (options?.skipJsonParse || response.status === 202 || response.status === 204) {
+        return void 0;
+      }
+      return await response.json();
+    }, { signal, ...options?.timeoutMs ? { timeoutMs: options.timeoutMs } : {}, ...options?.responseBudget ? { responseBudget: options.responseBudget } : {} });
   },
-  catch: (error) => {
-    if (error instanceof ApiError) {
-      return error;
-    }
-    return createApiError({
-      message: error instanceof Error ? error.message : "Unknown error"
-    });
-  }
+  catch: (error) => apiErrorFromUnknown(error, "The request could not be completed.")
 });
 const getSseData = (line) => {
   if (!line.startsWith("data:")) {
@@ -94948,6 +94982,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
     });
     const requireApiBaseUrlEffect = () => requireConfiguredBaseUrlEffect(loadConfiguredApiBaseUrl);
     const requireChatBaseUrlEffect = () => requireConfiguredBaseUrlEffect(loadConfiguredChatBaseUrl);
+    const presetPath = (presetId, orgSlug) => try_({
+      try: () => {
+        const slug = orgSlug ?? configService.load().currentOrganization?.slug;
+        if (!slug) throw new Error("No organization selected. Use --org or select an organization.");
+        return `/api/cli/v1/organizations/${encodeURIComponent(slug)}/admin/presets/${encodeURIComponent(presetId)}`;
+      },
+      catch: configuredBaseUrlError
+    });
     const toRefreshFailure = (error) => {
       if (error instanceof ApiError || error instanceof NotLoggedInError) {
         return error;
@@ -94959,7 +95001,9 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return createApiError({
           message: error.message,
           statusCode: error.statusCode,
-          code: error.code
+          code: error.code,
+          outcome: error.outcome,
+          requestId: error.requestId
         });
       }
       return createApiError({
@@ -95058,21 +95102,23 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       const resolvedChatBaseUrl = yield* requireChatBaseUrlEffect();
       const path = `/api/${encodeURIComponent(orgSlug)}/conversations/${encodeURIComponent(conversationId)}/stream`;
       return yield* tryPromise({
-        try: async () => {
+        try: async (signal) => {
+          const deadline = Date.now() + TRANSFER_DEADLINE_MS;
           for (let attempt = 1; attempt <= AGENT_CHAT_STREAM_MAX_ATTEMPTS; attempt += 1) {
-            const response = await rateLimitedFetch(`${resolvedChatBaseUrl}${path}`, {
-              method: "POST",
-              headers: jsonBearerHeaders(token),
-              body: JSON.stringify({})
-            });
-            if (!response.ok) {
-              throw await toApiError(response);
-            }
-            if (!response.body) {
-              throw createApiError({ message: "No response body from agent chat stream endpoint" });
-            }
             try {
-              return await parseSseStream(response.body);
+              return await withHttpResponse(`${resolvedChatBaseUrl}${path}`, {
+                method: "POST",
+                headers: jsonBearerHeaders(token),
+                body: JSON.stringify({})
+              }, async (response) => {
+                if (!response.ok) {
+                  throw await toApiError(response);
+                }
+                if (!response.body) {
+                  throw createApiError({ message: "No response body from agent chat stream endpoint" });
+                }
+                return await parseSseStream(response.body);
+              }, { signal, timeoutMs: Math.max(1, deadline - Date.now()) });
             } catch (error) {
               if (error instanceof AgentChatStreamIncompleteError && error.sawOnlyTerminalEnvelope && attempt < AGENT_CHAT_STREAM_MAX_ATTEMPTS) {
                 await sleep(AGENT_CHAT_STREAM_RETRY_DELAY_MS);
@@ -95086,11 +95132,13 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         catch: (error) => {
           if (error instanceof ApiError) return error;
           if (error instanceof AgentChatStreamIncompleteError) {
-            return createApiError({ message: error.message });
+            return createApiError({
+              message: "The chat response was incomplete. Check the conversation before sending the message again.",
+              code: "CLI_RESPONSE_INVALID",
+              outcome: "unknown"
+            });
           }
-          return createApiError({
-            message: error instanceof Error ? error.message : "Agent chat failed"
-          });
+          return apiErrorFromUnknown(error, "Agent chat failed");
         }
       });
     });
@@ -95118,6 +95166,13 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       return conversation.agentInstallationId;
     });
     return {
+      getMyCliQuota: (orgSlug) => gen(function* () {
+        const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliMyQuota");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/quota`;
+        const response = yield* makeRequest(baseUrl, path, token);
+        return yield* try_({ try: () => parseMyCliQuota(response), catch: (error) => apiErrorFromUnknown(error, "Invalid quota response") });
+      }),
       listOrganizations: () => gen(function* () {
         const token = yield* getAccessToken();
         yield* requireReleaseEnabledOperation("listCliOrganizations");
@@ -95195,19 +95250,17 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         });
       }),
       uploadToS3: (uploadUrl, headers, fileBuffer) => tryPromise({
-        try: async () => {
-          const response = await fetch(uploadUrl, {
-            method: "PUT",
-            headers,
-            body: fileBuffer
-          });
+        try: async (signal) => withHttpResponse(uploadUrl, {
+          method: "PUT",
+          headers,
+          body: fileBuffer
+        }, async (response) => {
           if (!response.ok) {
-            throw new Error(`S3 upload failed: ${response.status} ${response.statusText}`);
+            throw createApiError({ message: `S3 upload failed: ${response.status}`, statusCode: response.status });
           }
-        },
-        catch: (error) => createApiError({
-          message: error instanceof Error ? error.message : "S3 upload failed"
-        })
+          await response.arrayBuffer();
+        }, { signal, timeoutMs: TRANSFER_DEADLINE_MS, localAdmission: false }),
+        catch: (error) => apiErrorFromUnknown(error, "S3 upload failed")
       }),
       completeUpload: (orgSlug, skillId, overwrite) => gen(function* () {
         const token = yield* getAccessToken();
@@ -95340,17 +95393,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         });
       }),
       downloadFromUrl: (url) => tryPromise({
-        try: async () => {
-          const response = await fetch(url);
+        try: async (signal) => withHttpResponse(url, {}, async (response) => {
           if (!response.ok) {
-            throw new Error(`Download failed: ${response.status} ${response.statusText}`);
+            throw createApiError({ message: `Download failed: ${response.status}`, statusCode: response.status });
           }
           const arrayBuffer = await response.arrayBuffer();
           return Buffer.from(arrayBuffer);
-        },
-        catch: (error) => createApiError({
-          message: error instanceof Error ? error.message : "Download failed"
-        })
+        }, { signal, timeoutMs: TRANSFER_DEADLINE_MS, maxResponseBytes: TRANSFER_MAX_RESPONSE_BYTES, localAdmission: false }),
+        catch: (error) => apiErrorFromUnknown(error, "Download failed")
       }),
       listLibrarySkills: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
@@ -95522,7 +95572,8 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/model-exec/chat`;
         return yield* makeRequest(chatBaseUrl, path, token, {
           method: "POST",
-          body
+          body,
+          timeoutMs: TRANSFER_DEADLINE_MS + 1e4
         });
       }),
       executeModelExecImageGeneration: (orgSlug, body) => gen(function* () {
@@ -95741,20 +95792,16 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         const token = yield* getAccessToken();
         const path = `/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/installed-agents/${encodeURIComponent(agentId)}/export`;
         return yield* tryPromise({
-          try: async () => {
-            const response = await rateLimitedFetch(`${resolvedApiBaseUrl}${path}`, {
-              headers: bearerHeaders(token)
-            });
+          try: async (signal) => withHttpResponse(`${resolvedApiBaseUrl}${path}`, {
+            headers: bearerHeaders(token)
+          }, async (response) => {
             if (!response.ok) {
               throw await toApiError(response);
             }
             const arrayBuffer = await response.arrayBuffer();
             return Buffer.from(arrayBuffer);
-          },
-          catch: (error) => {
-            if (error instanceof ApiError) return error;
-            return createApiError({ message: error instanceof Error ? error.message : "Export failed" });
-          }
+          }, { signal, timeoutMs: TRANSFER_DEADLINE_MS, maxResponseBytes: TRANSFER_MAX_RESPONSE_BYTES }),
+          catch: (error) => apiErrorFromUnknown(error, "Export failed")
         });
       }),
       getInstalledAgentShare: (orgSlug, agentId) => gen(function* () {
@@ -95776,9 +95823,39 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         yield* requireReleaseEnabledOperation("listCliAgentTemplates");
         const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/agents/templates`;
         const templates = [];
+        const ids = /* @__PURE__ */ new Set();
+        const responseBudget = { remainingBytes: HTTP_MAX_RESPONSE_BYTES };
+        const deadline = Date.now() + HTTP_DEADLINE_MS;
+        let firstPagination;
         let page = 1;
         while (true) {
-          const raw = yield* makeRequest(baseUrl, page === 1 ? path : `${path}?page=${page}`, token);
+          if (page > 100 || templates.length >= 1e4 || Date.now() >= deadline) {
+            return yield* fail$3(createApiError({
+              message: "The template catalog exceeded the collection limit. Contact support to inspect the catalog.",
+              code: "CLI_COLLECTION_LIMIT"
+            }));
+          }
+          const raw = yield* makeRequest(baseUrl, page === 1 ? path : `${path}?page=${page}`, token, { timeoutMs: Math.max(1, deadline - Date.now()), responseBudget });
+          const pagination = raw.pagination;
+          if (!Array.isArray(raw.list) || !pagination || pagination.page !== page || !Number.isSafeInteger(pagination.pageSize) || pagination.pageSize < 1 || pagination.pageSize > 100 || !Number.isSafeInteger(pagination.total) || pagination.total < 0 || raw.list.length > pagination.pageSize || raw.list.length === 0 && (page - 1) * pagination.pageSize < pagination.total) {
+            return yield* fail$3(createApiError({ message: "The template page was inconsistent. No partial catalog was returned.", code: "CLI_RESPONSE_INVALID" }));
+          }
+          if (firstPagination && (pagination.pageSize !== firstPagination.pageSize || pagination.total !== firstPagination.total)) {
+            return yield* fail$3(createApiError({ message: "The template catalog changed during collection. No partial catalog was returned.", code: "CLI_COLLECTION_CHANGED" }));
+          }
+          firstPagination ??= pagination;
+          if (raw.list.length !== Math.min(pagination.pageSize, Math.max(0, pagination.total - (page - 1) * pagination.pageSize))) {
+            return yield* fail$3(createApiError({ message: "The template page was incomplete. No partial catalog was returned.", code: "CLI_RESPONSE_INVALID" }));
+          }
+          for (const item of raw.list) {
+            if (typeof item.agentId !== "string" || !item.agentId || ids.has(item.agentId)) {
+              return yield* fail$3(createApiError({ message: "The template catalog changed during collection. No partial catalog was returned.", code: "CLI_COLLECTION_CHANGED" }));
+            }
+            ids.add(item.agentId);
+          }
+          if (templates.length + raw.list.length > 1e4) {
+            return yield* fail$3(createApiError({ message: "The template catalog exceeded the collection limit.", code: "CLI_COLLECTION_LIMIT" }));
+          }
           templates.push(...raw.list);
           if (raw.list.length === 0 || page * raw.pagination.pageSize >= raw.pagination.total) break;
           page += 1;
@@ -95908,7 +95985,8 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Tunnel management
       getTunnelStatus: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/edge-tunnel/v2/organizations/slug/${encodeURIComponent(orgSlug)}/status`;
+        yield* requireReleaseEnabledOperation("getCliTunnelStatus");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/tunnel/status`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getTunnelConfig: (orgSlug) => gen(function* () {
@@ -95922,49 +96000,60 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return yield* makeRequest(baseUrl, path, token, { method: "POST" });
       }),
       // Preset management
-      listPresets: (orgSlug) => gen(function* () {
+      listPresets: (orgSlug, page = 1, pageSize = 100) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/v2?organizationSlug=${encodeURIComponent(orgSlug)}`;
-        return yield* makeRequest(baseUrl, path, token);
+        yield* requireReleaseEnabledOperation("listCliPresets");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/presets?page=${page}&pageSize=${pageSize}`;
+        const response = yield* makeRequest(baseUrl, path, token);
+        return response.list;
       }),
-      getPreset: (presetId) => gen(function* () {
+      getPreset: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("getCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token);
       }),
       createPreset: (body) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/presets/v2", token, {
+        yield* requireReleaseEnabledOperation("createCliPreset");
+        const { organizationSlug, ...request } = body;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(organizationSlug)}/admin/presets`;
+        return yield* makeRequest(baseUrl, path, token, {
           method: "POST",
-          body
+          body: request
         });
       }),
-      updatePreset: (presetId, body) => gen(function* () {
+      updatePreset: (presetId, body, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("updateCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, { method: "PUT", body });
       }),
-      renamePreset: (presetId, name) => gen(function* () {
+      renamePreset: (presetId, name, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("updateCliPresetName");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, {
           method: "PATCH",
           body: { name }
         });
       }),
-      deletePreset: (presetId) => gen(function* () {
+      deletePreset: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("deleteCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE", skipJsonParse: true });
       }),
-      setPresetAsDefault: (presetId) => gen(function* () {
+      setPresetAsDefault: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}/default`;
-        return yield* makeRequest(baseUrl, path, token, { method: "POST" });
+        yield* requireReleaseEnabledOperation("updateCliDefaultPreset");
+        const path = `${yield* presetPath(presetId, orgSlug)}/default`;
+        return yield* makeRequest(baseUrl, path, token, { method: "PUT" });
       }),
-      unsetPresetAsDefault: (presetId) => gen(function* () {
+      unsetPresetAsDefault: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}/default`;
+        yield* requireReleaseEnabledOperation("deleteCliDefaultPreset");
+        const path = `${yield* presetPath(presetId, orgSlug)}/default`;
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE" });
       }),
       regenPresetKey: (presetId) => gen(function* () {
@@ -95980,29 +96069,33 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Org member management
       inviteOrgMembers: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/invite`, token, {
+        yield* requireReleaseEnabledOperation("createCliOrganizationMemberInvitations");
+        return yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members/invitations`, token, {
           method: "POST",
           body: { emails: req.emails, role: req.role }
         });
       }),
       removeOrgMembers: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/members`, token, {
+        yield* requireReleaseEnabledOperation("deleteCliOrganizationMembers");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members`, token, {
           method: "DELETE",
           body: { members: req.members }
         });
       }),
       updateOrgMemberRoles: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/members`, token, {
+        yield* requireReleaseEnabledOperation("updateCliOrganizationMemberRoles");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members/role`, token, {
           method: "PUT",
           body: { members: req.members, role: req.role }
         });
       }),
       exitOrg: (slug) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(slug)}/exit`, token, {
-          method: "POST"
+        yield* requireReleaseEnabledOperation("deleteCliOrganizationMembership");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(slug)}/membership`, token, {
+          method: "DELETE"
         });
       }),
       // Agent headless chat
@@ -96023,6 +96116,305 @@ const makeApiServiceLive = (buildEnv) => effect$1(
 const ApiServiceLive = makeApiServiceLive(BUILD_ENV);
 const ApiService = ApiServiceTag;
 
+function jsonOutputRequested(args) {
+  const forced = args.indexOf("--");
+  const options = forced === -1 ? args : args.slice(0, forced);
+  return options.some((arg, index) => arg === "--json=true" || arg === "--json" && options[index + 1] !== "false");
+}
+function reportInterruption(json) {
+  const message = "The command was interrupted. Check the status of any change or execution before running it again.";
+  process.stderr.write(`${json ? JSON.stringify({ error: { code: "CLI_COMMAND_INTERRUPTED", message, outcome: "unknown" } }) : message}
+`);
+  process.exitCode = 130;
+}
+function cliTeardown(json) {
+  return (exit, onExit) => {
+    if (isFailure(exit) && isInterruptedOnly(exit.cause) && process.exitCode !== 130) reportInterruption(json);
+    defaultTeardown(exit, (code) => {
+      void waitForHttpCleanup().then(() => onExit(process.exitCode ? Number(process.exitCode) : code));
+    });
+  };
+}
+function withCliFailureOutput(program, json) {
+  return consoleWith((original) => {
+    const pending = [];
+    let errorCount = 0;
+    const flush = () => forEach$2(pending, ({ method, args }) => original[method](...args), { discard: true });
+    const defer = (method) => (...args) => sync$1(() => {
+      if (method !== "error" || errorCount++ < 100) pending.push({ method, args });
+    });
+    const console = {
+      ...original,
+      error: defer("error"),
+      ...json ? { log: defer("log"), info: defer("info"), debug: defer("debug"), warn: defer("warn") } : {}
+    };
+    return program.pipe(
+      withConsole(console),
+      tap(() => flush()),
+      catchAllCause((cause) => {
+        if (isInterruptedOnly(cause)) {
+          return sync$1(() => {
+            reportInterruption(json);
+          }).pipe(uninterruptible);
+        }
+        const failure = failureOption(cause);
+        const output = isSome(failure) ? formatCliFailure(failure.value, json) : void 0;
+        if (!output) return flush().pipe(zipRight$2(failCause$2(cause)));
+        return sync$1(() => {
+          process.stderr.write(`${output}
+`);
+          process.exitCode = 1;
+        });
+      })
+    );
+  });
+}
+function formatCliFailure(error, json) {
+  if (!(error instanceof ApiError || error instanceof OAuthRequestError || error instanceof NotLoggedInError || error instanceof NoOrganizationSelectedError)) return void 0;
+  const diagnosticError = error instanceof ApiError || error instanceof OAuthRequestError;
+  if (!json) return maskSensitiveText(error.message + (diagnosticError && error.requestId ? ` Request ID: ${error.requestId}` : ""));
+  return JSON.stringify({ error: {
+    code: diagnosticError ? error.code ?? (error instanceof OAuthRequestError ? "CLI_OAUTH_ERROR" : "CLI_API_ERROR") : error._tag === "NotLoggedInError" ? "CLI_AUTH_REQUIRED" : "CLI_ORGANIZATION_REQUIRED",
+    message: maskSensitiveText(error.message),
+    ...diagnosticError ? {
+      ...error.statusCode === void 0 ? {} : { statusCode: error.statusCode },
+      ...error instanceof ApiError && error.details ? { details: error.details } : {},
+      ...error instanceof ApiError && error.retryAfterSeconds !== void 0 ? { retryAfterSeconds: error.retryAfterSeconds } : {},
+      ...error.outcome ? { outcome: error.outcome } : {},
+      ...error.requestId ? { requestId: error.requestId } : {}
+    } : {}
+  } });
+}
+
+const loadBinaryModule = () => {
+  const require$1 = node_module.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  return require$1(["..", "binary.cjs"].join("/"));
+};
+const resolveNativeBinary = (options = {}) => {
+  const env = options.env ?? process.env;
+  if (env.AIPCTL_NATIVE_BINARY && env.AIPCTL_NATIVE_BINARY.length > 0) {
+    return env.AIPCTL_NATIVE_BINARY;
+  }
+  const binary = (options.loadBinaryModule ?? loadBinaryModule)();
+  return binary.resolveBinaryPath(options.platform ?? process.platform, options.arch ?? process.arch);
+};
+const runNativeCommand = (args, options = {}) => new Promise((resolve) => {
+  const env = options.env ?? process.env;
+  const spawn = options.spawn ?? childProcess.spawn;
+  const binaryPath = resolveNativeBinary(options);
+  const child = spawn(binaryPath, [...args], {
+    stdio: "inherit",
+    env
+  });
+  child.on("error", (error) => {
+    console.error(`Failed to start native command: ${error.message}`);
+    process.exitCode = 1;
+    resolve();
+  });
+  child.on("exit", (code) => {
+    process.exitCode = code ?? 1;
+    resolve();
+  });
+});
+
+const restArgs = text$2({ name: "arg" }).pipe(
+  repeated,
+  withDescription$5("Arguments passed through to the native aipctl command")
+);
+const makeNativeCommand = (name, description) => make$4(
+  name,
+  { rest: restArgs },
+  ({ rest }) => promise$1(() => runNativeCommand([name, ...rest]))
+).pipe(withDescription(description));
+
+const nativeCommandDefinitions = [
+  { name: "install", description: "Install an MCP preset into a local client", includeInProd: true },
+  { name: "run", description: "Run the native MCP server", includeInProd: true },
+  { name: "tunnel", description: "Manage Edge Tunnel connections", includeInProd: true },
+  { name: "logs", description: "Inspect native MCP CLI logs", includeInProd: false }
+];
+const nativeCommandNames = nativeCommandDefinitions.map(({ name }) => name);
+const isEnabledNativeCommand = (definition, includeLogs) => definition.includeInProd || includeLogs;
+const nativeSubcommands = nativeCommandDefinitions.filter((definition) => isEnabledNativeCommand(definition, INCLUDE_NATIVE_LOGS)).map(({ name, description }) => makeNativeCommand(name, description));
+const isNativeCommandEnabled = (command, includeLogs = INCLUDE_NATIVE_LOGS) => {
+  const definition = nativeCommandDefinitions.find(({ name }) => name === command);
+  return definition ? isEnabledNativeCommand(definition, includeLogs) : false;
+};
+
+const FORCED_ARGS_SEPARATOR = "--";
+const NATIVE_ROOT_COMMANDS = new Set(nativeCommandNames);
+const trailingOptionSpecs = [
+  { command: ["quota", "status"], booleanOptions: /* @__PURE__ */ new Set(["--json"]), valueOptions: /* @__PURE__ */ new Set(["--org"]), explicitBooleanValues: true },
+  ...["list", "get", "create", "update", "rename", "delete", "set-default", "unset-default"].map((command) => ({
+    command: ["admin", "preset", command],
+    booleanOptions: new Set(command === "delete" ? ["--force", "-f"] : ["list", "get"].includes(command) ? ["--json"] : []),
+    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--page", "--pageSize"] : []]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  })),
+  ...["invite", "remove-member", "update-member-role"].map((command) => ({
+    command: ["admin", "org", command],
+    booleanOptions: new Set(command === "remove-member" ? ["--force", "-f"] : []),
+    valueOptions: /* @__PURE__ */ new Set(["--org", ...command !== "remove-member" ? ["--role"] : []]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  })),
+  {
+    command: ["org", "exit"],
+    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org"]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  },
+  ...["list", "get"].map((command) => ({
+    command: ["automation", command],
+    booleanOptions: /* @__PURE__ */ new Set(["--json"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--name"] : []]),
+    explicitBooleanValues: true
+  })),
+  {
+    command: ["automation", "delete"],
+    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org"]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  },
+  {
+    command: ["drive", "delete"],
+    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org"])
+  },
+  {
+    command: ["automation", "history"],
+    booleanOptions: /* @__PURE__ */ new Set(),
+    valueOptions: /* @__PURE__ */ new Set(["--page", "--org"])
+  },
+  {
+    command: ["automation", "triggers"],
+    booleanOptions: /* @__PURE__ */ new Set(),
+    valueOptions: /* @__PURE__ */ new Set(["--account-id", "--folder-id", "--service-type", "--org"])
+  },
+  {
+    command: ["admin", "skill", "github", "import"],
+    booleanOptions: /* @__PURE__ */ new Set(["--overwrite", "--json"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org", "--pat-env"])
+  }
+];
+const getOptionName = (arg) => arg.split("=", 1)[0];
+const findTrailingOptionSpec = (args) => trailingOptionSpecs.find((spec) => spec.command.every((part, index) => args[index] === part));
+const isNativeRootCommand = (args) => NATIVE_ROOT_COMMANDS.has(args[0] ?? "");
+const isBooleanOption = (arg, spec) => spec.booleanOptions.has(arg);
+const isValueOption = (arg, spec) => spec.valueOptions.has(getOptionName(arg));
+const normalizeTrailingOptions = (args, spec) => {
+  const options = [];
+  const rest = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0) {
+      continue;
+    }
+    if (spec.explicitBooleanValues && spec.booleanOptions.has(getOptionName(arg))) {
+      const nextArg = args[index + 1];
+      const optionName = spec.booleanAliases?.[getOptionName(arg)] ?? getOptionName(arg);
+      if (arg.includes("=")) {
+        options.push(`${optionName}${arg.slice(arg.indexOf("="))}`);
+      } else if (nextArg === "true" || nextArg === "false") {
+        options.push(`${optionName}=${nextArg}`);
+        index += 1;
+      } else {
+        options.push(`${optionName}=true`);
+      }
+      continue;
+    }
+    if (isBooleanOption(arg, spec)) {
+      options.push(arg);
+      continue;
+    }
+    if (isValueOption(arg, spec)) {
+      options.push(arg);
+      const nextArg = args[index + 1];
+      if (!arg.includes("=") && nextArg !== void 0 && !nextArg.startsWith("-")) {
+        index += 1;
+        options.push(nextArg);
+      }
+      continue;
+    }
+    rest.push(arg);
+  }
+  return [...options, ...rest];
+};
+const normalizeAipArgs = (args) => {
+  if (isNativeRootCommand(args)) {
+    return [...args];
+  }
+  const forcedArgsIndex = args.indexOf(FORCED_ARGS_SEPARATOR);
+  const parsedArgs = forcedArgsIndex === -1 ? args : args.slice(0, forcedArgsIndex);
+  const forcedArgs = forcedArgsIndex === -1 ? [] : args.slice(forcedArgsIndex);
+  const spec = findTrailingOptionSpec(parsedArgs);
+  if (!spec) {
+    return [...args];
+  }
+  const commandPrefix = parsedArgs.slice(0, spec.command.length);
+  const suffix = parsedArgs.slice(spec.command.length);
+  return [
+    ...commandPrefix,
+    ...normalizeTrailingOptions(suffix, spec),
+    ...forcedArgs
+  ];
+};
+
+const CUSTOMER_AVAILABILITIES = /* @__PURE__ */ new Set([
+  "IMPLEMENTED",
+  "AVAILABLE"
+]);
+const isCustomerAvailable = (entry) => CUSTOMER_AVAILABILITIES.has(entry.availability);
+const normalizeCliArgCase = (arg) => arg.toLowerCase();
+const commandSegments = (command) => command.split(" ");
+const PROD_DISABLED_BUILT_INS = /* @__PURE__ */ new Set(["--completions", "--wizard"]);
+const isCommandPrefix = (entry, args) => {
+  const segments = commandSegments(entry.command);
+  return segments.length <= args.length && segments.every((segment, index) => args[index] === segment);
+};
+const commandPathBeforeOptions = (args) => args.slice(0, args.findIndex((arg) => arg.startsWith("-")) === -1 ? args.length : args.findIndex((arg) => arg.startsWith("-")));
+const formatUnavailableMessage = (command) => `Command "aipctl ${command}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
+const formatUnavailableOptionMessage = (option) => `Option "aipctl ${option}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
+const commandArgsForAvailability = (args) => {
+  const commandArgs = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--log-level") {
+      index += 1;
+      continue;
+    }
+    commandArgs.push(arg);
+  }
+  return commandArgs;
+};
+const getUnavailableCommandMessage = (args, buildEnv) => {
+  if (buildEnv !== "prod" || args.length === 0) {
+    return null;
+  }
+  const normalizedArgs = args.map(normalizeCliArgCase);
+  const disabledBuiltIn = normalizedArgs.find((arg) => PROD_DISABLED_BUILT_INS.has(arg));
+  if (disabledBuiltIn) {
+    return formatUnavailableOptionMessage(disabledBuiltIn);
+  }
+  const commandArgs = commandArgsForAvailability(normalizedArgs);
+  const entry = commandManifest.filter((candidate) => isCommandPrefix(candidate, commandArgs)).sort((left, right) => commandSegments(right.command).length - commandSegments(left.command).length).at(0);
+  if (entry) {
+    return isCustomerAvailable(entry) ? null : formatUnavailableMessage(entry.command);
+  }
+  const path = commandPathBeforeOptions(commandArgs).join(" ");
+  if (!path) {
+    return null;
+  }
+  const descendants = commandManifest.filter(({ command }) => command.startsWith(`${path} `));
+  if (descendants.length > 0 && descendants.every((candidate) => !isCustomerAvailable(candidate))) {
+    return formatUnavailableMessage(path);
+  }
+  return null;
+};
+
 const orgOption = text("org").pipe(
   withDescription$3("Organization slug (overrides current organization)"),
   optional
@@ -96959,13 +97351,13 @@ const deleteCommand$4 = make$4(
   { id: idArg$7, org: orgOption, force: forceOption$5 },
   ({ id, org, force }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
+    const orgSlug = yield* resolveOrgSlug(org, api);
     if (!force) {
       yield* log(`Warning: This will permanently delete preset "${id}".`);
       yield* log("Use --force (-f) to skip this confirmation.");
       return;
     }
-    yield* api.deletePreset(id).pipe(
+    yield* api.deletePreset(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -96998,8 +97390,8 @@ const getCommand$6 = make$4(
   { id: idArg$6, org: orgOption, json: jsonOption$h },
   ({ id, org, json }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    const preset = yield* api.getPreset(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    const preset = yield* api.getPreset(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97054,11 +97446,19 @@ function formatPresetListPrompt(prompt) {
 }
 const listCommand$9 = make$4(
   "list",
-  { org: orgOption, json: jsonOption$g },
-  ({ org, json }) => gen(function* () {
+  {
+    org: orgOption,
+    json: jsonOption$g,
+    page: integer("page").pipe(withDescription$3("Page number, starting at 1"), withDefault(1)),
+    pageSize: integer("pageSize").pipe(withDescription$3("Presets per page (1\u2013100)"), withDefault(100))
+  },
+  ({ org, json, page, pageSize }) => gen(function* () {
+    if (page < 1 || pageSize < 1 || pageSize > 100) {
+      return yield* fail$3(new ApiError({ message: "Use --page 1 or higher and --pageSize between 1 and 100." }));
+    }
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    const result = yield* api.listPresets(orgSlug).pipe(
+    const result = yield* api.listPresets(orgSlug, page, pageSize).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97079,10 +97479,10 @@ const listCommand$9 = make$4(
       return;
     }
     if (result.length === 0) {
-      yield* log("No presets found.");
+      yield* log(`No presets found on page ${page}.`);
       return;
     }
-    yield* log(`Presets in organization "${orgSlug}":
+    yield* log(`Presets in organization "${orgSlug}" (page ${page}):
 `);
     for (const preset of result) {
       const defaultMark = preset.isDefault ? " (default)" : "";
@@ -97158,8 +97558,8 @@ const renameCommand$1 = make$4(
   { id: idArg$3, name: nameArg$1, org: orgOption },
   ({ id, name, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.renamePreset(id, name).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.renamePreset(id, name, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97185,8 +97585,8 @@ const setDefaultCommand = make$4(
   { id: idArg$2, org: orgOption },
   ({ id, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.setPresetAsDefault(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.setPresetAsDefault(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97212,8 +97612,8 @@ const unsetDefaultCommand = make$4(
   { id: idArg$1, org: orgOption },
   ({ id, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.unsetPresetAsDefault(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.unsetPresetAsDefault(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97242,7 +97642,7 @@ const updateCommand$1 = make$4(
   { id: idArg, jsonFile: jsonFileArg$2, org: orgOption },
   ({ id, jsonFile, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
+    const orgSlug = yield* resolveOrgSlug(org, api);
     const body = yield* try_({
       try: () => {
         const content = fs__namespace.readFileSync(jsonFile, "utf-8");
@@ -97257,7 +97657,7 @@ const updateCommand$1 = make$4(
         })
       )
     );
-    yield* api.updatePreset(id, body).pipe(
+    yield* api.updatePreset(id, body, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -98987,15 +99387,16 @@ function loginEffect(authFlow, organizationSelection = _void) {
   return gen(function* () {
     yield* log("Starting login flow...");
     const nextCredentials = yield* authFlow.pipe(
-      catchAll(
-        (error) => gen(function* () {
+      catchAll((error) => {
+        if (error instanceof OAuthRequestError) return fail$3(error);
+        return gen(function* () {
           yield* error$1(`Login failed: ${error.message}`);
           yield* sync$1(() => {
             process.exitCode = 1;
           });
           return null;
-        })
-      )
+        });
+      })
     );
     if (!nextCredentials) {
       return;
@@ -101628,6 +102029,43 @@ const skillCommand = make$4("skill", {}).pipe(
   withSubcommands(skillSubcommands)
 );
 
+const quotaStatusCommand = make$4(
+  "status",
+  { org: orgOption, json: boolean("json").pipe(withDescription$3("Output quota status as JSON")) },
+  ({ org, json }) => gen(function* () {
+    const api = yield* ApiService;
+    const slug = yield* resolveOrgSlug(org, api);
+    const quota = yield* api.getMyCliQuota(slug);
+    if (json) {
+      yield* log(jsonFormat(quota));
+      return;
+    }
+    yield* log(`CLI quota for organization "${slug}":`);
+    yield* log(`  Metadata requests: ${quota.userLimits.metadataRequestsPerMinute}/min, burst ${quota.userLimits.metadataRequestBurst}`);
+    yield* log(`  Text requests: ${quota.userLimits.textRequestsPerMinute}/min, burst ${quota.userLimits.textRequestBurst}`);
+    yield* log(`  Daily text limit: ${quota.userLimits.dailyTextAdmissions}`);
+    yield* log(`  Concurrent text limit: ${quota.userLimits.concurrentTextExecutions}`);
+    yield* log(`  Organization shared requests: metadata ${quota.organizationSharedLimits.metadataRequestsPerMinute}/min (burst ${quota.organizationSharedLimits.metadataRequestBurst}), text ${quota.organizationSharedLimits.textRequestsPerMinute}/min (burst ${quota.organizationSharedLimits.textRequestBurst})`);
+    yield* log(`  Organization concurrent text limit: ${quota.organizationSharedLimits.concurrentTextExecutions}`);
+    yield* log(`  Policy versions: organization ${quota.organizationPolicyVersion ?? "inherited"}, user ${quota.userPolicyVersion ?? "inherited"}`);
+    if (quota.usage.status === "UNAVAILABLE") {
+      yield* log("  Usage: unavailable. Usage could not be checked; available capacity is unknown.");
+      return;
+    }
+    yield* log(`  Daily text used: ${quota.usage.dailyTextAdmissionsUsed}`);
+    yield* log(`  Daily reset (UTC): ${quota.usage.dailyResetAt}`);
+    yield* log(`  Active text executions: ${quota.usage.activeTextExecutions}`);
+    yield* log(`  Unresolved text executions: ${quota.usage.unresolvedTextExecutions}`);
+    yield* log("  Usage is a snapshot. Unresolved executions still occupy capacity.");
+  })
+).pipe(withDescription("Show your CLI limits and text usage in the selected organization"));
+const quotaCommandDescription = "Inspect your CLI limits and usage";
+const quotaSubcommands = [quotaStatusCommand];
+const quotaCommand = make$4("quota", {}).pipe(
+  withDescription(quotaCommandDescription),
+  withSubcommands(quotaSubcommands)
+);
+
 const mainCommandDescription = "AIP command-line interface for managing organizations, skills, and native MCP commands";
 const rootSubcommands = [
   adminCommand,
@@ -101641,6 +102079,7 @@ const rootSubcommands = [
   modelCommand,
   modelExecCommand,
   orgCommand,
+  quotaCommand,
   skillCommand,
   ...nativeSubcommands
 ];
@@ -101664,6 +102103,7 @@ const HELP_GROUPS = [
   { path: ["model-exec"], description: modelExecCommandDescription, subcommands: modelExecSubcommands },
   { path: ["model-exec", "image"], description: imageCommandDescription, subcommands: imageSubcommands },
   { path: ["org"], description: orgCommandDescription, subcommands: orgSubcommands },
+  { path: ["quota"], description: quotaCommandDescription, subcommands: quotaSubcommands },
   { path: ["skill"], description: skillCommandDescription, subcommands: skillSubcommands },
   { path: ["admin", "org"], description: adminOrgCommandDescription, subcommands: adminOrgSubcommands },
   { path: ["admin", "agent"], description: adminAgentCommandDescription, subcommands: adminAgentSubcommands },
@@ -101767,6 +102207,7 @@ const runNativeHelpIfRequested = (args, options = {}) => {
 };
 
 const args = process.argv.slice(2);
+const json = jsonOutputRequested(args);
 const unavailableMessage = getUnavailableCommandMessage(args, BUILD_ENV);
 if (unavailableMessage) {
   process.stderr.write(`${unavailableMessage}
@@ -101795,5 +102236,6 @@ const argv = [
 cli(argv).pipe(
   provide$1(AppLayer),
   provide$1(layer),
-  runMain
+  (program) => withCliFailureOutput(program, json),
+  runMain({ teardown: cliTeardown(json) })
 );