diff --git a/.agent/skills/vhs.md b/.agent/skills/vhs.md
new file mode 100644
index 00000000..a65ac714
--- /dev/null
+++ b/.agent/skills/vhs.md
@@ -0,0 +1,101 @@
+---
+description: Writing and editing VHS `.tape` files for terminal demo GIFs
+---
+
+# VHS Tape Files
+
+[VHS](https://github.com/charmbracelet/vhs) records terminal sessions into GIFs/MP4s/WebMs from `.tape` scripts. Run with `vhs demo.tape`.
+
+## Critical Syntax Rules
+
+### Type command and inline directives
+
+`Type`, `Sleep`, `Enter` are **separate directives on the same line**, delimited by the closing `"` of the `Type` string. The most common bug is forgetting to close the `Type` string, which causes `Sleep`/`Enter` to be typed literally into the terminal.
+
+```
+# ✅ CORRECT — closing " before Sleep
+Type "echo hello" Sleep 300ms Enter
+
+# ❌ WRONG — Sleep and Enter are typed as literal text
+Type "echo hello Sleep 300ms Enter
+```
+
+### Type with @speed override
+
+Override typing speed per-command with `@<time>` immediately after `Type` (no space):
+
+```
+Type@80ms '{"pageSize": 2}' Sleep 100ms
+```
+
+### Quoting
+
+- Double quotes `"..."` are the standard Type delimiter
+- Single quotes `'...'` also work and are useful when the typed content contains double quotes (e.g. JSON)
+- Escape quotes inside strings with backticks: `` Type `VAR="value"` ``
+- When building shell commands with nested quotes, split across multiple `Type` lines:
+
+```
+Type "gws drive files list --params '" Sleep 100ms
+Type@80ms '{"pageSize": 2, "fields": "nextPageToken,files(id)"}' Sleep 100ms
+Type "' --page-all" Sleep 300ms Enter
+```
+
+> **Pitfall**: Every `Type` line that is followed by `Sleep` or `Enter` on the same line MUST close its string first. Audit each line to ensure the quote is closed before any directive.
+
+## Settings (top of file only)
+
+Settings must appear before any non-setting command (except `Output`). `TypingSpeed` is the only setting that can be changed mid-tape.
+
+```
+Output demo.gif
+
+Set Shell "bash"
+Set FontSize 14
+Set Width 1200
+Set Height 1200
+Set Theme "Catppuccin Mocha"
+Set WindowBar Colorful
+Set WindowBarSize 40
+Set TypingSpeed 40ms
+Set Padding 20
+```
+
+## Common Commands
+
+| Command | Example | Notes |
+|---|---|---|
+| `Output` | `Output demo.gif` | `.gif`, `.mp4`, `.webm` |
+| `Type` | `Type "ls -la"` | Type characters |
+| `Type@<time>` | `Type@80ms "slow"` | Override typing speed |
+| `Sleep` | `Sleep 2s`, `Sleep 300ms` | Pause recording |
+| `Enter` | `Enter` | Press enter |
+| `Hide` / `Show` | `Hide` ... `Show` | Hide setup commands |
+| `Ctrl+<key>` | `Ctrl+C` | Key combos |
+| `Tab`, `Space`, `Backspace` | `Tab 2` | Optional repeat count |
+| `Up`, `Down`, `Left`, `Right` | `Up 3` | Arrow keys |
+| `Wait` | `Wait /pattern/` | Wait for regex on screen |
+| `Screenshot` | `Screenshot out.png` | Capture frame |
+| `Env` | `Env FOO "bar"` | Set env var |
+| `Source` | `Source other.tape` | Include another tape |
+| `Require` | `Require jq` | Assert program exists |
+
+## Hide/Show for Setup
+
+Use `Hide`/`Show` to run setup commands (e.g. setting `$PATH`, clearing screen) without recording them:
+
+```
+Hide
+Type "export PATH=$PWD/target/release:$PATH" Enter
+Type "clear" Enter
+Sleep 2s
+Show
+```
+
+## Checklist When Editing Tape Files
+
+1. **Every `Type` string must be closed** before `Sleep`/`Enter` on the same line
+2. **Multi-line Type sequences** that build a single shell command: ensure the final line closes its string and includes `Enter`
+3. **Sleep durations** after commands should be long enough for the command to finish (network calls may need 8s+)
+4. **Settings go at the top** — only `TypingSpeed` can appear later
+5. **Test locally** with `vhs <file>.tape` before committing
diff --git a/.agent/workflows/verify-skills.md b/.agent/workflows/verify-skills.md
new file mode 100644
index 00000000..c79c609a
--- /dev/null
+++ b/.agent/workflows/verify-skills.md
@@ -0,0 +1,73 @@
+---
+description: Verify all skills/*/SKILL.md files against actual CLI output for accuracy
+---
+
+# Verify Skills
+
+Ensure every `skills/*/SKILL.md` file is accurate and optimized for AI agent consumption.
+
+## Steps
+
+1. **List all skill files**
+
+```bash
+find skills -name SKILL.md | sort
+```
+
+2. **Get top-level help for every service**
+
+// turbo
+```bash
+for svc in drive sheets gmail calendar admin admin-reports docs slides tasks people chat vault groupssettings reseller licensing apps-script; do
+  echo "=== $svc ==="
+  ./target/debug/gws $svc --help 2>&1
+  echo
+done
+```
+
+3. **Get sub-resource help for key services** (spot-check method names used in examples)
+
+// turbo
+```bash
+./target/debug/gws drive files --help 2>&1
+./target/debug/gws gmail users messages --help 2>&1
+./target/debug/gws sheets spreadsheets --help 2>&1
+./target/debug/gws sheets spreadsheets values --help 2>&1
+./target/debug/gws calendar events --help 2>&1
+./target/debug/gws people people --help 2>&1
+./target/debug/gws chat spaces --help 2>&1
+./target/debug/gws vault matters --help 2>&1
+./target/debug/gws admin users --help 2>&1
+./target/debug/gws tasks tasks --help 2>&1
+```
+
+4. **For each SKILL.md, verify the following against the CLI `--help` output:**
+
+   - [ ] **Resource names** match exactly (e.g., `files`, `spreadsheets`, `users`)
+   - [ ] **Method names** match exactly (e.g., `list`, `insert`, `batchUpdate`, `getContent`)
+   - [ ] **Nested resource paths** are correct (e.g., `spreadsheets values get`, not `values get`)
+   - [ ] **Alias** mentioned in the file matches `services.rs` (e.g., `gws script` for apps-script)
+   - [ ] **API version** in the header is correct
+   - [ ] **Example commands** use valid `--params` and `--json` flag syntax
+   - [ ] **No OAuth scopes section** — scopes should not be listed in skill files
+   - [ ] **Tips section** contains accurate, actionable advice
+
+5. **Cross-check `shared/SKILL.md`** covers:
+
+   - [ ] `--fields` / field mask syntax
+   - [ ] CLI syntax (`--params`, `--json`, `--output`, `--upload`, `--page-all`, `--page-limit`, `--page-delay`)
+   - [ ] Authentication (`GOOGLE_WORKSPACE_CLI_CREDENTIALS`, `GOOGLE_WORKSPACE_API_KEY`)
+   - [ ] Auto-pagination (`--page-all`) with NDJSON output
+   - [ ] `gws schema <method>` introspection
+   - [ ] Error handling JSON structure
+   - [ ] Binary download with `--output`
+   - [ ] Version override (`--api-version`, colon syntax)
+
+6. **Fix any issues found** — update the SKILL.md files directly.
+
+7. **Rebuild and re-verify** if any examples were changed.
+
+// turbo
+```bash
+cargo build 2>&1
+```
diff --git a/.changeset/README.md b/.changeset/README.md
new file mode 100644
index 00000000..e5b6d8d6
--- /dev/null
+++ b/.changeset/README.md
@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)
diff --git a/.changeset/config.json b/.changeset/config.json
new file mode 100644
index 00000000..b8213321
--- /dev/null
+++ b/.changeset/config.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}
diff --git a/.env.example b/.env.example
new file mode 100644
index 00000000..c1b15c8f
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,18 @@
+# OAuth Client Credentials
+# Create these at https://console.cloud.google.com/apis/credentials
+GOOGLE_WORKSPACE_CLI_CLIENT_ID=
+GOOGLE_WORKSPACE_CLI_CLIENT_SECRET=
+
+# Authentication
+# Path to a service account JSON key file or user credentials
+# GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=
+
+# Impersonation (Domain-Wide Delegation)
+# Email address of the user to impersonate when using a service account
+# GOOGLE_WORKSPACE_CLI_IMPERSONATED_USER=
+
+# Model Armor Sanitization
+# Default template resource name for --sanitize
+# GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE=projects/my-project/locations/us-central1/templates/my-template
+# Sanitization mode: 'warn' (default) or 'block'
+# GOOGLE_WORKSPACE_CLI_SANITIZE_MODE=warn
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..3c8b319f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,10 @@
+# Codeowners
+
+# Core engine code strictly requires your review
+# Isolates agents to `skills/` or `src/helpers/` unless absolutely necessary
+/src/main.rs @jpoehnelt
+/src/executor.rs @jpoehnelt
+/src/discovery.rs @jpoehnelt
+/src/commands.rs @jpoehnelt
+/src/auth.rs @jpoehnelt
+/src/schema.rs @jpoehnelt
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 00000000..e1c628ba
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,16 @@
+## Description
+
+Please include a summary of the change and which issue is fixed. If adding a new feature or command, please include the output of running it with `--dry-run` to prove the JSON request body matches the Discovery Document schema.
+
+**Dry Run Output:**
+```json
+// Paste --dry-run output here if applicable
+```
+
+## Checklist:
+
+- [ ] My code follows the `AGENTS.md` guidelines (no generated `google-*` crates).
+- [ ] I have run `cargo fmt --all` to format the code perfectly.
+- [ ] I have run `cargo clippy -- -D warnings` and resolved all warnings.
+- [ ] I have added tests that prove my fix is effective or that my feature works.
+- [ ] I have provided a Changeset file (e.g. via `pnpx changeset`) to document my changes.
diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 00000000..c6a3ddbe
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,40 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+area: schema:
+  - 'src/schema.rs'
+area: auth:
+  - 'src/auth.rs'
+area: execution:
+  - 'src/executor.rs'
+  - 'src/commands.rs'
+  - 'src/main.rs'
+area: discovery:
+  - 'src/discovery.rs'
+skill: docs:
+  - 'src/helpers/docs.rs'
+skill: drive:
+  - 'src/helpers/drive.rs'
+skill: events:
+  - 'src/helpers/events.rs'
+skill: gmail:
+  - 'src/helpers/gmail.rs'
+skill: script:
+  - 'src/helpers/script.rs'
+skill: sheets:
+  - 'src/helpers/sheets.rs'
+core: docs:
+  - '**/*.md'
+core: ci:
+  - '.github/**/*'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..240b9012
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,271 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: Test
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Run tests
+        run: cargo test --verbose
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        run: |
+          if ! cargo fmt --all -- --check; then
+            echo "::error::Cargo fmt failed. Please run 'cargo fmt --all' locally and commit the changes."
+            exit 1
+          fi
+
+      - name: Clippy
+        run: cargo clippy -- -D warnings
+
+  policy-check:
+    name: Policy Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Enforce AGENTS.md rules
+        run: |
+          if grep -qE "^google-[a-zA-Z0-9_-]+[[:space:]]*=" Cargo.toml; then
+            echo "::error file=Cargo.toml::Violates AGENTS.md: Adding generated google-* crates is prohibited. The CLI uses dynamic schema discovery at runtime."
+            exit 1
+          fi
+          echo "Policy check passed."
+      - name: Enforce Changeset File
+        if: github.event_name == 'pull_request'
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          if ! git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -q "^.changeset/.*\.md$"; then
+            echo "::error::A Changeset file is required! Please run 'npx changeset' or manually create a markdown file in the .changeset directory describing your changes to automatically version and release this PR."
+            exit 1
+          fi
+          echo "Changeset file found!"
+
+  skills:
+    name: Verify Skills
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-skills-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Regenerate skills
+        run: cargo run -- generate-skills --output-dir skills
+
+      - name: Check for drift
+        run: |
+          if ! git diff --exit-code skills/; then
+            echo "::error::Skills are out of date. Run 'cargo run -- generate-skills' and commit the changes."
+            exit 1
+          fi
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Generate code coverage
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+
+  build:
+    name: Build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+
+      - name: Build
+        run: cargo build --release --target ${{ matrix.target }}
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+
+  smoketest:
+    name: API Smoketest
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo-smoketest-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Build
+        run: cargo build --release
+
+      - name: Decode credentials
+        env:
+          GOOGLE_CREDENTIALS_JSON: ${{ secrets.GOOGLE_CREDENTIALS_JSON }}
+        run: |
+          if [ -z "$GOOGLE_CREDENTIALS_JSON" ]; then
+            echo "::error::GOOGLE_CREDENTIALS_JSON secret is not set"
+            exit 1
+          fi
+          echo "$GOOGLE_CREDENTIALS_JSON" | base64 -d > /tmp/credentials.json
+
+      - name: Smoketest — help
+        run: ./target/release/gws --help
+
+      - name: Smoketest — schema introspection
+        run: ./target/release/gws schema drive.files.list | jq -e '.httpMethod'
+
+      - name: Smoketest — Drive files list
+        env:
+          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
+        run: |
+          ./target/release/gws drive files list \
+            --params '{"pageSize": 1, "fields": "files(id,mimeType)"}' \
+            | jq -e '.files'
+
+      - name: Smoketest — Gmail messages
+        env:
+          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
+        run: |
+          ./target/release/gws gmail users messages list \
+            --params '{"userId": "me", "maxResults": 1, "fields": "messages(id)"}' \
+            | jq -e '.messages'
+
+      - name: Smoketest — Calendar events
+        env:
+          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
+        run: |
+          ./target/release/gws calendar events list \
+            --params '{"calendarId": "primary", "maxResults": 1, "fields": "kind,items(id,status)"}' \
+            | jq -e '.kind'
+
+      - name: Smoketest — Slides presentation
+        env:
+          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
+        run: |
+          ./target/release/gws slides presentations get \
+            --params '{"presentationId": "1knOKD_87JWE4qsEbO4r5O91IxTER5ybBBhOJgZ1yLFI", "fields": "presentationId,slides(objectId)"}' \
+            | jq -e '.presentationId'
+
+      - name: Smoketest — pagination
+        env:
+          GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE: /tmp/credentials.json
+        run: |
+          LINES=$(./target/release/gws drive files list \
+            --params '{"pageSize": 1, "fields": "nextPageToken,files(id)"}' \
+            --page-all --page-limit 2 \
+            | wc -l)
+          if [ "$LINES" -lt 2 ]; then
+            echo "::error::Expected at least 2 NDJSON lines from pagination, got $LINES"
+            exit 1
+          fi
+
+      - name: Smoketest — error handling
+        run: |
+          if ./target/release/gws fakeservice list 2>&1; then
+            echo "::error::Expected exit code 1 for unknown service"
+            exit 1
+          fi
+
+      - name: Cleanup credentials
+        if: always()
+        run: rm -f /tmp/credentials.json
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
new file mode 100644
index 00000000..37ffc7d6
--- /dev/null
+++ b/.github/workflows/coverage.yml
@@ -0,0 +1,46 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: llvm-tools-preview
+          
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+        
+      - name: Generate code coverage
+        run: cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info
+        
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          files: lcov.info
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
new file mode 100644
index 00000000..a9745d4c
--- /dev/null
+++ b/.github/workflows/labeler.yml
@@ -0,0 +1,30 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "Pull Request Labeler"
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          sync-labels: true
diff --git a/.github/workflows/release-changesets.yml b/.github/workflows/release-changesets.yml
new file mode 100644
index 00000000..865da492
--- /dev/null
+++ b/.github/workflows/release-changesets.yml
@@ -0,0 +1,55 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Release (Changeset)
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install Dependencies
+        run: pnpm install
+
+      - name: Create Release Pull Request or Publish
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          publish: pnpm changeset publish
+          commit: 'chore: release versions'
+          title: 'chore: release versions'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..a047544c
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,333 @@
+# This file was autogenerated by dist: https://axodotdev.github.io/cargo-dist
+#
+# Copyright 2022-2024, axodotdev
+# SPDX-License-Identifier: MIT or Apache-2.0
+#
+# CI that:
+#
+# * checks for a Git Tag that looks like a release
+# * builds artifacts with dist (archives, installers, hashes)
+# * uploads those artifacts to temporary workflow zip
+# * on success, uploads the artifacts to a GitHub Release
+#
+# Note that the GitHub Release will be created with a generated
+# title/body based on your changelogs.
+
+name: Release
+permissions:
+  "contents": "write"
+
+# This task will run whenever you push a git tag that looks like a version
+# like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
+# Various formats will be parsed into a VERSION and an optional PACKAGE_NAME, where
+# PACKAGE_NAME must be the name of a Cargo package in your workspace, and VERSION
+# must be a Cargo-style SemVer Version (must have at least major.minor.patch).
+#
+# If PACKAGE_NAME is specified, then the announcement will be for that
+# package (erroring out if it doesn't have the given version or isn't dist-able).
+#
+# If PACKAGE_NAME isn't specified, then the announcement will be for all
+# (dist-able) packages in the workspace with that version (this mode is
+# intended for workspaces with only one dist-able package, or with all dist-able
+# packages versioned/released in lockstep).
+#
+# If you push multiple tags at once, separate instances of this workflow will
+# spin up, creating an independent announcement for each one. However, GitHub
+# will hard limit this to 3 tags per commit, as it will assume more tags is a
+# mistake.
+#
+# If there's a prerelease-style suffix to the version, then the release(s)
+# will be marked as a prerelease.
+on:
+  pull_request:
+  push:
+    tags:
+      - '**[0-9]+.[0-9]+.[0-9]+*'
+
+jobs:
+  # Run 'dist plan' (or host) to determine what tasks we need to do
+  plan:
+    runs-on: "ubuntu-22.04"
+    outputs:
+      val: ${{ steps.plan.outputs.manifest }}
+      tag: ${{ !github.event.pull_request && github.ref_name || '' }}
+      tag-flag: ${{ !github.event.pull_request && format('--tag={0}', github.ref_name) || '' }}
+      publishing: ${{ !github.event.pull_request }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install dist
+        # we specify bash to get pipefail; it guards against the `curl` command
+        # failing. otherwise `sh` won't catch that `curl` returned non-0
+        shell: bash
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.31.0/cargo-dist-installer.sh | sh"
+      - name: Cache dist
+        uses: actions/upload-artifact@v6
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/dist
+      # sure would be cool if github gave us proper conditionals...
+      # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
+      # functionality based on whether this is a pull_request, and whether it's from a fork.
+      # (PRs run on the *source* but secrets are usually on the *target* -- that's *good*
+      # but also really annoying to build CI around when it needs secrets to work right.)
+      - id: plan
+        run: |
+          dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
+          echo "dist ran successfully"
+          cat plan-dist-manifest.json
+          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
+      - name: "Upload dist-manifest.json"
+        uses: actions/upload-artifact@v6
+        with:
+          name: artifacts-plan-dist-manifest
+          path: plan-dist-manifest.json
+
+  # Build and packages all the platform-specific things
+  build-local-artifacts:
+    name: build-local-artifacts (${{ join(matrix.targets, ', ') }})
+    # Let the initial task tell us to not run (currently very blunt)
+    needs:
+      - plan
+    if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
+    strategy:
+      fail-fast: false
+      # Target platforms/runners are computed by dist in create-release.
+      # Each member of the matrix has the following arguments:
+      #
+      # - runner: the github runner
+      # - dist-args: cli flags to pass to dist
+      # - install-dist: expression to run to install dist on the runner
+      #
+      # Typically there will be:
+      # - 1 "global" task that builds universal installers
+      # - N "local" tasks that build each platform's binaries and platform-specific installers
+      matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
+    runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container && matrix.container.image || null }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
+    permissions:
+      "attestations": "write"
+      "contents": "read"
+      "id-token": "write"
+    steps:
+      - name: enable windows longpaths
+        run: |
+          git config --global core.longpaths true
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install Rust non-interactively if not already installed
+        if: ${{ matrix.container }}
+        run: |
+          if ! command -v cargo > /dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          fi
+      - name: Install dist
+        run: ${{ matrix.install_dist.run }}
+      # Get the dist-manifest
+      - name: Fetch local artifacts
+        uses: actions/download-artifact@v7
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - name: Install dependencies
+        run: |
+          ${{ matrix.packages_install }}
+      - name: Build artifacts
+        run: |
+          # Actually do builds and make zips and whatnot
+          dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
+          echo "dist ran successfully"
+      - name: Attest
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: "target/distrib/*${{ join(matrix.targets, ', ') }}*"
+      - id: cargo-dist
+        name: Post-build
+        # We force bash here just because github makes it really hard to get values up
+        # to "real" actions without writing to env-vars, and writing to env-vars has
+        # inconsistent syntax between shell and powershell.
+        shell: bash
+        run: |
+          # Parse out what we just built and upload it to scratch storage
+          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
+          dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
+      - name: "Upload artifacts"
+        uses: actions/upload-artifact@v6
+        with:
+          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
+          path: |
+            ${{ steps.cargo-dist.outputs.paths }}
+            ${{ env.BUILD_MANIFEST_NAME }}
+
+  # Build and package all the platform-agnostic(ish) things
+  build-global-artifacts:
+    needs:
+      - plan
+      - build-local-artifacts
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install cached dist
+        uses: actions/download-artifact@v7
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
+      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
+      - name: Fetch local artifacts
+        uses: actions/download-artifact@v7
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - id: cargo-dist
+        shell: bash
+        run: |
+          dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
+          echo "dist ran successfully"
+
+          # Parse out what we just built and upload it to scratch storage
+          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
+          jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
+      - name: "Upload artifacts"
+        uses: actions/upload-artifact@v6
+        with:
+          name: artifacts-build-global
+          path: |
+            ${{ steps.cargo-dist.outputs.paths }}
+            ${{ env.BUILD_MANIFEST_NAME }}
+  # Determines if we should publish/announce
+  host:
+    needs:
+      - plan
+      - build-local-artifacts
+      - build-global-artifacts
+    # Only run if we're "publishing", and only if plan, local and global didn't fail (skipped is fine)
+    if: ${{ always() && needs.plan.result == 'success' && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    runs-on: "ubuntu-22.04"
+    outputs:
+      val: ${{ steps.host.outputs.manifest }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install cached dist
+        uses: actions/download-artifact@v7
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
+      # Fetch artifacts from scratch-storage
+      - name: Fetch artifacts
+        uses: actions/download-artifact@v7
+        with:
+          pattern: artifacts-*
+          path: target/distrib/
+          merge-multiple: true
+      - id: host
+        shell: bash
+        run: |
+          dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
+          echo "artifacts uploaded and released successfully"
+          cat dist-manifest.json
+          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
+      - name: "Upload dist-manifest.json"
+        uses: actions/upload-artifact@v6
+        with:
+          # Overwrite the previous copy
+          name: artifacts-dist-manifest
+          path: dist-manifest.json
+      # Create a GitHub Release while uploading all files to it
+      - name: "Download GitHub Artifacts"
+        uses: actions/download-artifact@v7
+        with:
+          pattern: artifacts-*
+          path: artifacts
+          merge-multiple: true
+      - name: Cleanup
+        run: |
+          # Remove the granular manifests
+          rm -f artifacts/*-dist-manifest.json
+      - name: Create GitHub Release
+        env:
+          PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}"
+          ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}"
+          ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}"
+          RELEASE_COMMIT: "${{ github.sha }}"
+        run: |
+          # Write and read notes from a file to avoid quoting breaking things
+          echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
+
+          gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
+
+  publish-npm:
+    needs:
+      - plan
+      - host
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PLAN: ${{ needs.plan.outputs.val }}
+    if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
+    steps:
+      - name: Fetch npm packages
+        uses: actions/download-artifact@v7
+        with:
+          pattern: artifacts-*
+          path: npm/
+          merge-multiple: true
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - run: |
+          for release in $(echo "$PLAN" | jq --compact-output '.releases[] | select([.artifacts[] | endswith("-npm-package.tar.gz")] | any)'); do
+            pkg=$(echo "$release" | jq '.artifacts[] | select(endswith("-npm-package.tar.gz"))' --raw-output)
+            npm publish --access public "./npm/${pkg}"
+          done
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  announce:
+    needs:
+      - plan
+      - host
+      - publish-npm
+    # use "always() && ..." to allow us to wait for all publish jobs while
+    # still allowing individual publish jobs to skip themselves (for prereleases).
+    # "host" however must run to completion, no skipping allowed!
+    if: ${{ always() && needs.host.result == 'success' && (needs.publish-npm.result == 'skipped' || needs.publish-npm.result == 'success') }}
+    runs-on: "ubuntu-22.04"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+          submodules: recursive
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
new file mode 100644
index 00000000..0fb8e456
--- /dev/null
+++ b/.github/workflows/stale.yml
@@ -0,0 +1,36 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: 'Close Stale PRs'
+on:
+  schedule:
+    - cron: '30 1 * * *'
+  workflow_dispatch:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9
+        with:
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+          days-before-pr-stale: 3
+          days-before-pr-close: 0
+          stale-pr-message: 'This PR has been inactive for 72 hours. Closing to keep the queue clean.'
+          close-pr-message: 'This PR was closed because it has been stalled for 72 hours. Feel free to magically reopen it if you want to continue working on it!'
+          exempt-pr-labels: 'keep-alive'
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 00000000..a8939a52
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,65 @@
+# AGENTS.md
+
+## Project Overview
+
+`gws` is a Rust CLI tool for interacting with Google Workspace APIs. It dynamically generates its command surface at runtime by parsing Google Discovery Service JSON documents.
+
+> [!IMPORTANT]
+> **Dynamic Discovery**: This project does NOT use generated Rust crates (e.g., `google-drive3`) for API interaction. Instead, it fetches the Discovery JSON at runtime and builds `clap` commands dynamically. When adding a new service, you only need to register it in `src/services.rs` and verify the Discovery URL pattern in `src/discovery.rs`. Do NOT add new crates to `Cargo.toml` for standard Google APIs.
+
+> [!NOTE]
+> **Package Manager**: Use `pnpm` instead of `npm` for Node.js package management in this repository.
+
+## Build & Test
+
+```bash
+cargo build          # Build in dev mode
+cargo clippy -- -D warnings  # Lint check
+cargo test           # Run tests
+```
+
+## Architecture
+
+The CLI uses a **two-phase argument parsing** strategy:
+1. Parse argv to extract the service name (e.g., `drive`)
+2. Fetch the service's Discovery Document, build a dynamic `clap::Command` tree, then re-parse
+
+### Source Layout
+
+| File | Purpose |
+|---|---|
+| `src/main.rs` | Entrypoint, two-phase CLI parsing, method resolution |
+| `src/discovery.rs` | Serde models for Discovery Document + fetch/cache |
+| `src/services.rs` | Service alias → Discovery API name/version mapping |
+| `src/auth.rs` | Headless OAuth2 via `yup-oauth2` |
+| `src/commands.rs` | Recursive `clap::Command` builder from Discovery resources |
+| `src/executor.rs` | HTTP request construction, response handling, schema validation |
+| `src/schema.rs` | `gws schema` command — introspect API method schemas |
+| `src/error.rs` | Structured JSON error output |
+
+## Demo Videos
+
+Demo recordings are generated with [VHS](https://github.com/charmbracelet/vhs) (`.tape` files).
+
+```bash
+vhs demo.tape        # YouTube Short (portrait 1080×1920)
+```
+
+### VHS quoting rules
+
+- Use **double quotes** for simple strings: `Type "gws --help" Enter`
+- Use **backtick quotes** when the typed text contains JSON with double quotes:
+  ```
+  Type `gws drive files list --params '{"pageSize":5}'` Enter
+  ```
+  `\"` escapes inside double-quoted `Type` strings are **not supported** by VHS and will cause parse errors.
+
+### Scene art
+
+ASCII art title cards live in `art/`. The `scripts/show-art.sh` helper clears the screen and cats the file. Portrait scenes use `scene*.txt`; landscape chapters use `long-*.txt`.
+
+## Environment Variables
+
+- `GOOGLE_WORKSPACE_CLI_TOKEN` — Pre-obtained OAuth2 access token (highest priority; bypasses all credential file loading)
+- `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE` — Path to OAuth credentials JSON (no default; if unset, falls back to credentials secured by the OS Keyring and encrypted in `~/.config/gws/`)
+- Supports `.env` files via `dotenvy`
diff --git a/CONTEXT.md b/CONTEXT.md
new file mode 100644
index 00000000..546ef9d6
--- /dev/null
+++ b/CONTEXT.md
@@ -0,0 +1,68 @@
+# Google Workspace CLI (`gws`) Context
+
+The `gws` CLI provides dynamic access to Google Workspace APIs (Drive, Gmail, Calendar, Sheets, Admin, etc.) by parsing Discovery Documents at runtime.
+
+## Core Syntax
+
+```bash
+gws <service> <resource> [sub-resource] <method> [flags]
+```
+
+Use `--help` to get help on the available commands.
+
+```bash
+gws --help
+gws <service> --help
+gws <service> <resource> --help
+gws <service> <resource> <method> --help
+```
+
+### Key Flags
+
+-   `--params '<JSON>'`: URL/query parameters (e.g., `id`, `q`, `pageSize`).
+-   `--json '<JSON>'`: Request body for POST/PUT/PATCH methods.
+-   `--page-all`: Auto-paginates results and outputs NDJSON (one JSON object per line).
+-   `--fields '<MASK>'`: Limits the response fields (critical for AI context window efficiency).
+-   `--upload <PATH>`: Files for multipart uploads (e.g., `drive files create`).
+-   `--output <PATH>`: Destination for binary downloads (e.g., `drive files get`).
+-   `--sanitize <TEMPLATE>`: Sanitizes output using Google Cloud Model Armor.
+
+## Usage Patterns
+
+### 1. Reading Data (GET/LIST)
+Always use `--fields` to minimize tokens.
+
+```bash
+# List Drive files (efficient)
+gws drive files list --params '{"q": "name contains \"Report\"", "pageSize": 10}' --fields "files(id,name,mimeType)"
+
+# Get Gmail message details
+gws gmail users messages get --params '{"userId": "me", "id": "MSG_123"}'
+```
+
+### 2. Writing Data (POST/PUT/PATCH)
+Use `--json` for the request body.
+
+```bash
+# Send Email
+gws gmail users messages send --params '{"userId": "me"}' --json '{"raw": "BASE64..."}'
+
+# Create Spreadsheet
+gws sheets spreadsheets create --json '{"properties": {"title": "Q4 Budget"}}'
+```
+
+### 3. Pagination (NDJSON)
+Use `--page-all` for listing large collections. The output is Newline Delimited JSON.
+
+```bash
+# Stream all users
+gws admin users list --params '{"domain": "example.com"}' --page-all
+```
+
+### 4. Schema Introspection
+If unsure about parameters or body structure, check the schema:
+
+```bash
+gws schema drive.files.list
+gws schema sheets.spreadsheets.create
+```
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 00000000..74b28469
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,3622 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.101"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+
+[[package]]
+name = "async-trait"
+version = "0.1.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "atomic"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89cbf775b137e9b968e67227ef7f775587cde3fd31b0d8599dbd0f598a48340"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "bit-set"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349f9b6a179ed607305526ca489b34ad0a41aed5f7980fa90eb03160b69598fb"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clap"
+version = "4.5.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63be97961acde393029492ce0be7a1af7e323e6bae9511ebfac33751be5e6806"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f13174bda5dfd69d7e947827e5af4b0f2f94a4a3ee92912fba07a66150f21e2"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a822ea5bc7590f9d40f1ba12c0dc3c2760f3482c6984db1573ad11031420831"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
+[[package]]
+name = "compact_str"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdb1325a1cece981e8a296ab8f0f9b63ae357bd0784a9faaf548cc7b480707a"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "rustversion",
+ "ryu",
+ "static_assertions",
+]
+
+[[package]]
+name = "convert_case"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "633458d4ef8c78b72454de2d54fd6ab2e60f9e02be22f3c6104cdc8a4e0fceb9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crossterm"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b9f2e4c67f833b660cdb0a3523065869fb35570177239812ed4c905aeff87b"
+dependencies = [
+ "bitflags 2.10.0",
+ "crossterm_winapi",
+ "derive_more",
+ "document-features",
+ "mio",
+ "parking_lot",
+ "rustix",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
+[[package]]
+name = "crossterm_winapi"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acdd7c62a3665c7f6830a51635d9ac9b23ed385797f70a83bb8bafe9c572ab2b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "csscolorparser"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2a7d3066da2de787b7f032c736763eb7ae5d355f81a68bab2675a96008b0bf"
+dependencies = [
+ "lab",
+ "phf",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "deltae"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4"
+
+[[package]]
+name = "deranged"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc3dc5ad92c2e2d1c193bbbbdf2ea477cb81331de4f3103f267ca18368b988c4"
+dependencies = [
+ "powerfmt",
+ "serde_core",
+]
+
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "convert_case",
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs"
+version = "5.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c45a9d03d6676652bcb5e724c7e988de1acad23a711b5217ab9cbecbec2225"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "520f05a5cbd335fae5a99ff7a6ab8627577660ee5cfd6a94a6a929b52ff0321c"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "document-features"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
+dependencies = [
+ "litrs",
+]
+
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
+[[package]]
+name = "either"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "euclid"
+version = "0.22.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df61bf483e837f88d5c2291dcf55c67be7e676b3a51acc48db3a7b163b91ed63"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fancy-regex"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b95f7c0680e4142284cf8b22c14a476e87d61b004a3a0861872b32ef7ead40a2"
+dependencies = [
+ "bit-set",
+ "regex",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "filedescriptor"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e40758ed24c9b2eeb76c35fb0aebc66c626084edd827e07e1552279814c6682d"
+dependencies = [
+ "libc",
+ "thiserror 1.0.69",
+ "winapi",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "finl_unicode"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+
+[[package]]
+name = "futures-util"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139ef39800118c7683f2fd3c98c1b23c09ae076556b435f8e9064ae108aaeeec"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
+[[package]]
+name = "gws"
+version = "0.1.0"
+dependencies = [
+ "aes-gcm",
+ "anyhow",
+ "async-trait",
+ "base64",
+ "chrono",
+ "clap",
+ "crossterm",
+ "derive_builder",
+ "dirs",
+ "dotenvy",
+ "futures-util",
+ "hostname",
+ "keyring",
+ "rand 0.8.5",
+ "ratatui",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serial_test",
+ "sha2",
+ "tempfile",
+ "thiserror 2.0.18",
+ "tokio",
+ "yup-oauth2",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hostname"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-link",
+]
+
+[[package]]
+name = "http"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hyper"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "pin-utils",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+
+[[package]]
+name = "icu_properties"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+
+[[package]]
+name = "icu_provider"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.16.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "instability"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357b7205c6cd18dd2c86ed312d1e70add149aea98e7ef72b9fdf0270e555c11d"
+dependencies = [
+ "darling 0.23.0",
+ "indoc",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+
+[[package]]
+name = "iri-string"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c91338f0783edbd6195decb37bae672fd3b165faffb89bf7b9e6942f8b1a731a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+
+[[package]]
+name = "js-sys"
+version = "0.3.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "kasuari"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fe90c1150662e858c7d5f945089b7517b0a80d8bf7ba4b1b5ffc984e7230a5b"
+dependencies = [
+ "hashbrown 0.16.1",
+ "portable-atomic",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "log",
+ "zeroize",
+]
+
+[[package]]
+name = "lab"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf36173d4167ed999940f804952e6b08197cae5ad5d572eb4db150ce8ad5d58f"
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.181"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "459427e2af2b9c839b132acb702a1c654d95e10f8c326bfc2ad11310e458b1c5"
+
+[[package]]
+name = "libredox"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+dependencies = [
+ "bitflags 2.10.0",
+ "libc",
+]
+
+[[package]]
+name = "line-clipping"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f4de44e98ddbf09375cbf4d17714d18f39195f4f4894e8524501726fd9a8a4a"
+dependencies = [
+ "bitflags 2.10.0",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
+[[package]]
+name = "litemap"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+
+[[package]]
+name = "litrs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+
+[[package]]
+name = "lru"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "mac_address"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0aeb26bf5e836cc1c341c8106051b573f1766dfa05aa87f0b98be5e51b02303"
+dependencies = [
+ "nix",
+ "winapi",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+
+[[package]]
+name = "memmem"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15"
+
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "mio"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.10.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
+[[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_threads"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7398b9c8b70908f6371f47ed36737907c87c52af34c268fed0bf0ceb92ead9"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "ordered-float"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bb71e1b3fa6ca1c61f383464aaf2bb0e2f8e772a1f01d486832464de363b951"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pest"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
+dependencies = [
+ "pest",
+ "sha2",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.2",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "ratatui"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1ce67fb8ba4446454d1c8dbaeda0557ff5e94d39d5e5ed7f10a65eb4c8266bc"
+dependencies = [
+ "instability",
+ "ratatui-core",
+ "ratatui-crossterm",
+ "ratatui-macros",
+ "ratatui-termwiz",
+ "ratatui-widgets",
+]
+
+[[package]]
+name = "ratatui-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ef8dea09a92caaf73bff7adb70b76162e5937524058a7e5bff37869cbbec293"
+dependencies = [
+ "bitflags 2.10.0",
+ "compact_str",
+ "hashbrown 0.16.1",
+ "indoc",
+ "itertools",
+ "kasuari",
+ "lru",
+ "strum",
+ "thiserror 2.0.18",
+ "unicode-segmentation",
+ "unicode-truncate",
+ "unicode-width",
+]
+
+[[package]]
+name = "ratatui-crossterm"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "577c9b9f652b4c121fb25c6a391dd06406d3b092ba68827e6d2f09550edc54b3"
+dependencies = [
+ "cfg-if",
+ "crossterm",
+ "instability",
+ "ratatui-core",
+]
+
+[[package]]
+name = "ratatui-macros"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7f1342a13e83e4bb9d0b793d0ea762be633f9582048c892ae9041ef39c936f4"
+dependencies = [
+ "ratatui-core",
+ "ratatui-widgets",
+]
+
+[[package]]
+name = "ratatui-termwiz"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f76fe0bd0ed4295f0321b1676732e2454024c15a35d01904ddb315afd3d545c"
+dependencies = [
+ "ratatui-core",
+ "termwiz",
+]
+
+[[package]]
+name = "ratatui-widgets"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7dbfa023cd4e604c2553483820c5fe8aa9d71a42eea5aa77c6e7f35756612db"
+dependencies = [
+ "bitflags 2.10.0",
+ "hashbrown 0.16.1",
+ "indoc",
+ "instability",
+ "itertools",
+ "line-clipping",
+ "ratatui-core",
+ "strum",
+ "time",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.10.0",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+dependencies = [
+ "bitflags 2.10.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+dependencies = [
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+dependencies = [
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "scc"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
+dependencies = [
+ "sdd",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sdd"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
+
+[[package]]
+name = "seahash"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
+
+[[package]]
+name = "security-framework"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3297343eaf830f66ede390ea39da1d462b6b0c1b000f420d0a83f898bbbe6ef"
+dependencies = [
+ "bitflags 2.10.0",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc1f0cbffaac4852523ce30d8bd3c5cdc873501d96ff467ca09b6767bb8cd5c0"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.149"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serial_test"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "scc",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
+dependencies = [
+ "libc",
+ "signal-hook-registry",
+]
+
+[[package]]
+name = "signal-hook-mio"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
+dependencies = [
+ "libc",
+ "mio",
+ "signal-hook",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
+[[package]]
+name = "socket2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f4aa3ad99f2088c990dfa82d367e19cb29268ed67c574d10d0a4bfe71f07e0"
+dependencies = [
+ "libc",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af23d6f6c1a224baef9d3f61e287d2761385a5b88fdab4eb4c6f11aeb54c4bcf"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7695ce3845ea4b33927c055a39dc438a45b059f7c1b3d91d38d10355fb8cbca7"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.115"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e614ed320ac28113fa64972c4262d5dbc89deacdfd00c34a3e4cea073243c12"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.1",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "terminfo"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4ea810f0692f9f51b382fff5893887bb4580f5fa246fde546e0b13e7fcee662"
+dependencies = [
+ "fnv",
+ "nom",
+ "phf",
+ "phf_codegen",
+]
+
+[[package]]
+name = "termios"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411c5bf740737c7918b8b1fe232dca4dc9f8e754b8ad5e20966814001ed0ac6b"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "termwiz"
+version = "0.23.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7"
+dependencies = [
+ "anyhow",
+ "base64",
+ "bitflags 2.10.0",
+ "fancy-regex",
+ "filedescriptor",
+ "finl_unicode",
+ "fixedbitset",
+ "hex",
+ "lazy_static",
+ "libc",
+ "log",
+ "memmem",
+ "nix",
+ "num-derive",
+ "num-traits",
+ "ordered-float",
+ "pest",
+ "pest_derive",
+ "phf",
+ "sha2",
+ "signal-hook",
+ "siphasher",
+ "terminfo",
+ "termios",
+ "thiserror 1.0.69",
+ "ucd-trie",
+ "unicode-segmentation",
+ "vtparse",
+ "wezterm-bidi",
+ "wezterm-blob-leases",
+ "wezterm-color-types",
+ "wezterm-dynamic",
+ "wezterm-input-types",
+ "winapi",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl 2.0.18",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "libc",
+ "num-conv",
+ "num_threads",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.49.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8"
+dependencies = [
+ "bitflags 2.10.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "iri-string",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "537dd038a89878be9b64dd4bd1b260315c1bb94f4d784956b81e27a088d9a09e"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-truncate"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b380a1238663e5f8a691f9039c73e1cdae598a30e9855f541d29b08b53e9a5"
+dependencies = [
+ "itertools",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b672338555252d43fd2240c714dc444b8c6fb0a5c5335e65a07bba7742735ddb"
+dependencies = [
+ "atomic",
+ "getrandom 0.4.1",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vtparse"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9b2acfb050df409c972a37d3b8e08cdea3bddb0c09db9d53137e504cfabed0"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70a6e77fd0ae8029c9ea0063f87c46fde723e7d887703d74ad2616d792e51e6f"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.108"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags 2.10.0",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "312e32e551d92129218ea9a2452120f4aabc03529ef03e4d0d82fb2780608598"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cfaf3c063993ff62e73cb4311efde4db1efb31ab78a3e5c457939ad5cc0bed"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "wezterm-bidi"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0a6e355560527dd2d1cf7890652f4f09bb3433b6aadade4c9b5ed76de5f3ec"
+dependencies = [
+ "log",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "wezterm-blob-leases"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692daff6d93d94e29e4114544ef6d5c942a7ed998b37abdc19b17136ea428eb7"
+dependencies = [
+ "getrandom 0.3.4",
+ "mac_address",
+ "sha2",
+ "thiserror 1.0.69",
+ "uuid",
+]
+
+[[package]]
+name = "wezterm-color-types"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7de81ef35c9010270d63772bebef2f2d6d1f2d20a983d27505ac850b8c4b4296"
+dependencies = [
+ "csscolorparser",
+ "deltae",
+ "lazy_static",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "wezterm-dynamic"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f2ab60e120fd6eaa68d9567f3226e876684639d22a4219b313ff69ec0ccd5ac"
+dependencies = [
+ "log",
+ "ordered-float",
+ "strsim",
+ "thiserror 1.0.69",
+ "wezterm-dynamic-derive",
+]
+
+[[package]]
+name = "wezterm-dynamic-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46c0cf2d539c645b448eaffec9ec494b8b19bd5077d9e58cb1ae7efece8d575b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "wezterm-input-types"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7012add459f951456ec9d6c7e6fc340b1ce15d6fc9629f8c42853412c029e57e"
+dependencies = [
+ "bitflags 1.3.2",
+ "euclid",
+ "lazy_static",
+ "serde",
+ "wezterm-dynamic",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn 2.0.115",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags 2.10.0",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+ "synstructure",
+]
+
+[[package]]
+name = "yup-oauth2"
+version = "12.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef19a12dfb29fe39f78e1547e1be49717b84aef8762a4001359ed4f94d3accc1"
+dependencies = [
+ "async-trait",
+ "base64",
+ "http",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "log",
+ "percent-encoding",
+ "rustls",
+ "seahash",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+ "time",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db6d35d663eadb6c932438e763b262fe1a70987f9ae936e60158176d710cae4a"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4122cd3169e94605190e77839c9a40d40ed048d305bfdc146e7df40ab0f3e517"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.115",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 00000000..0550034f
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,64 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[package]
+name = "gws"
+version = "0.1.0"
+edition = "2021"
+description = "Google Workspace CLI — dynamic command surface from Discovery Service"
+license = "Apache-2.0"
+repository = "https://github.com/googleworkspace/cli"
+homepage = "https://github.com/googleworkspace/cli"
+readme = "README.md"
+authors = ["Justin Poehnelt"]
+keywords = ["cli", "google-workspace", "google", "drive", "gmail"]
+categories = ["command-line-utilities", "web-programming"]
+
+[[bin]]
+name = "gws"
+path = "src/main.rs"
+
+[dependencies]
+aes-gcm = "0.10"
+anyhow = "1"
+clap = { version = "4", features = ["derive", "string"] }
+dirs = "5"
+dotenvy = "0.15"
+hostname = "0.4"
+reqwest = { version = "0.12", features = ["json", "stream", "rustls-tls"], default-features = false }
+rand = "0.8"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+thiserror = "2"
+tokio = { version = "1", features = ["full"] }
+yup-oauth2 = "12"
+futures-util = "0.3"
+base64 = "0.22.1"
+derive_builder = "0.20.2"
+ratatui = "0.30.0"
+crossterm = "0.29.0"
+chrono = "0.4.44"
+keyring = "3.6.3"
+async-trait = "0.1.89"
+
+
+# The profile that 'cargo dist' will build with
+[profile.dist]
+inherits = "release"
+lto = "thin"
+
+[dev-dependencies]
+serial_test = "3.4.0"
+tempfile = "3"
diff --git a/README.md b/README.md
index abc24fa4..139210b3 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,260 @@
 # gws — Google Workspace CLI
 
-A CLI that generates its entire command surface dynamically from Google Discovery Service JSON documents.
+A CLI that generates its entire command surface dynamically from Google Discovery Service JSON documents. Includes skills for AI agents.
 
-## License
+![Demo](docs/demo.gif)
+
+## Install
+
+```bash
+npm install -g @googleworkspace/cli
+```
+
+Or build from source:
+
+```bash
+cargo install --path .
+```
+
+## AI Agents & Skills
+
+This repository includes [Agent Skills](https://github.com/vercel-labs/agent-skills) definitions (`SKILL.md`) for every supported Google Workspace API. Skills are prefixed with `gws-` to avoid namespace collisions when installed globally.
+
+You can install these skills directly into your AI agent using `npx`:
+
+```bash
+# Add all Google Workspace skills to your agent
+npx skills add github:googleworkspace/cli
+```
+
+Or add specific skills by path:
+
+```bash
+# Add the shared skill (authentication, etc.)
+npx skills add https://github.com/googleworkspace/cli/tree/main/skills/gws-shared
+
+# Add only Google Drive and Gmail skills
+npx skills add https://github.com/googleworkspace/cli/tree/main/skills/gws-drive
+npx skills add https://github.com/googleworkspace/cli/tree/main/skills/gws-gmail
+```
+
+### OpenClaw
+
+Clone the repo and copy (or symlink) the skills into your OpenClaw skills directory:
+
+```bash
+# All skills
+cp -r skills/gws-* ~/.openclaw/skills/
+
+# Or symlink for easy updates
+ln -s $(pwd)/skills/gws-* ~/.openclaw/skills/
+```
+
+Or copy only specific skills:
+
+```bash
+cp -r skills/gws-drive skills/gws-gmail ~/.openclaw/skills/
+```
+
+The `gws-shared` skill includes an `install` block so OpenClaw can auto-install the CLI via `npm i -g @googleworkspace/cli` if the `gws` binary isn't found on PATH.
+
+## Usage
+
+```bash
+# List files in Drive
+gws drive files list --params '{"pageSize": 10}'
+
+# Get a file's metadata
+gws drive files get --params '{"fileId": "abc123"}'
+
+# Create a spreadsheet
+gws sheets spreadsheets create --json '{"properties": {"title": "My Sheet"}}'
+
+# List Gmail messages
+gws gmail users messages list --params '{"userId": "me"}'
+
+# Introspect a method's schema
+gws schema drive.files.list
+
+# Dynamic help for any resource
+gws drive files --help
+gws drive files list --help
+
+# Preview a request without sending it
+gws chat spaces messages create \
+  --params '{"parent": "spaces/xyz"}' \
+  --json '{"text": "Hello world"}' \
+  --dry-run
+```
+
+## Authentication
+
+The CLI supports three primary authentication workflows depending on your environment.
+
+### 1. Interactive Auth (Local Desktop)
+
+For interactive use on your personal machine where a web browser is available. 
+
+**Security**: By default, credentials and access tokens are encrypted at rest using AES-256-GCM. The encryption key is stored securely in your OS Keyring (Apple Keychain, Secret Service, or Windows Credential Manager). If a keyring is unavailable (e.g., headless Linux), it falls back to a strictly permissioned (`0600`) local key file.
+
+**Google Cloud Setup & Login:**
+The CLI includes a built-in setup wizard to help you configure your Google Cloud Project, enable APIs, and generate the necessary OAuth credentials. Note that this requires the [`gcloud` CLI](https://cloud.google.com/sdk/docs/install) to be installed and authenticated (`gcloud auth login`).
+
+```bash
+# Run the interactive setup and login wizard
+gws setup
+
+# Or login directly if you already have client_secret.json configured
+gws auth login
+
+# Or login with custom scopes
+gws auth login --scopes "https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/gmail.readonly"
+```
+
+### 2. Headless & CI/CD Auth (Export Flow)
+
+For remote servers, SSH sessions, or CI/CD pipelines where a browser is unavailable, use the export flow. 
+
+1. On your **local machine** (with a browser), complete the Interactive Auth steps above.
+2. Export your credentials to a portable JSON format:
+   ```bash
+   gws auth export --unmasked > credentials.json
+   ```
+3. On your **headless machine**, securely transfer `credentials.json` and point the CLI to it. The CLI will automatically use this payload to mint fresh access tokens.
+   ```bash
+   export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/credentials.json
+   
+   # Commands now work headlessly!
+   gws drive files list
+   ```
+
+*Note: You can also strictly provide a short-lived access token directly via environment variable (e.g. `export GOOGLE_WORKSPACE_CLI_TOKEN=$(gcloud auth print-access-token)`), though this token will naturally expire in ~1 hour.*
+
+### 3. Service Account Auth (Server-to-Server)
+
+For automated programmatic access. Point `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE` to your service account JSON key file. No login step is required.
+
+```bash
+export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=/path/to/service-account.json
+gws drive files list
+```
+
+**Domain-Wide Delegation (Impersonation)**
+If your service account has Domain-Wide Delegation enabled, you can impersonate a Workspace user (e.g., an admin) to perform actions on their behalf.
+
+```bash
+export GOOGLE_WORKSPACE_CLI_IMPERSONATED_USER=user@example.com
+```
+
+### 4. Pre-obtained Access Token (CI/CD or External)
+
+The simplest way to authenticate if you already possess a short-lived access token. This is often used in CI/CD pipelines where another tool (like `gcloud`) mints the token for the environment.
+
+```bash
+# Obtain a token using the gcloud CLI
+export GOOGLE_WORKSPACE_CLI_TOKEN=$(gcloud auth print-access-token)
+gws drive files list
+```
+*(Note: These raw access tokens typically expire in ~1 hour).*
+
+---
+
+### Auth Precedence Order
+
+The CLI evaluates authentication sources in the following strict order:
+
+| Priority | Source | How to set |
+|----------|--------|------------|
+| 1 (highest) | Raw access token | `GOOGLE_WORKSPACE_CLI_TOKEN` env var |
+| 2 | Credentials file (user or service account) | `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE` env var |
+| 3 | Encrypted credentials & token cache | `~/.config/gws/credentials.enc` and `token_cache.json` (created by `gws auth login`, secured via OS Keyring) |
+| 4 | Plaintext credentials | `~/.config/gws/credentials.json` |
+| — | No auth | Proceeds unauthenticated; shows error if the API rejects |
+
+*(Note: Environment variables can also be set via a `.env` file in the working directory.)*
+
+## Architecture
+
+The CLI uses a **two-phase argument parsing** strategy:
+
+1. Extract the service name from `argv[1]`
+2. Fetch the service's Discovery Document (cached for 24h)
+3. Build a dynamic `clap::Command` tree from the document's resources/methods
+4. Re-parse the remaining arguments against the tree
+5. Authenticate, construct the HTTP request, and execute
+
+All output (success, error, file download metadata) is structured JSON for AI agent consumption. Binary outputs require an `--output` flag.
+
+There are a few special behaviors to be aware of that diverge from the Discovery Service API representation:
+
+### Multipart uploads
+
+For multipart uploads (e.g. Drive file uploads), use the `--upload` flag to specify the path to the file to upload.
+
+```bash
+gws drive files create --json '{"name": "My File"}' --upload /path/to/file
+```
+
+### Pagination and NDJSON
+
+Use `--page-all` to auto-paginate through results. Each page is emitted as a single JSON line (NDJSON), making it easy to stream into tools like `jq`.
+
+| Flag | Description | Default |
+| --- | --- | --- |
+| `--page-all` | Auto-paginate, one JSON line per page | off |
+| `--page-limit <N>` | Max pages to fetch | 10 |
+| `--page-delay <MS>` | Delay between pages in ms | 100 |
+
+```bash
+# Stream all Drive files as NDJSON
+gws drive files list --params '{"pageSize": 100}' --page-all --page-limit 5
+
+# Pipe to jq to extract file names
+gws drive files list --params '{"pageSize": 100}' --page-all | jq -r '.files[].name'
+```
+
+## Testing & Coverage
+
+Run unit tests:
+```bash
+cargo test
+```
+
+Generate code coverage report (requires `cargo-llvm-cov`):
+```bash
+./scripts/coverage.sh
+```
+The report will be available at `target/llvm-cov/html/index.html`.
+
+## Security & Sanitization (Model Armor)
+ 
+ The CLI integrates with **Google Cloud Model Armor** to sanitize API responses for prompt injection risks before they reach your AI agent.
+ 
+ ```bash
+ # Sanitize a specific command
+ gws gmail users messages get --params '...' \
+   --sanitize "projects/P/locations/L/templates/T"
+ ```
+ 
+ This checks the *entire* JSON response against the specified Model Armor template.
+ 
+ ### Configuration
+ 
+ You can set default behavior via environment variables:
+ 
+ | Variable | Description |
+ |---|---|
+ | `GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE` | Default Model Armor template resource name |
+ | `GOOGLE_WORKSPACE_CLI_SANITIZE_MODE` | `warn` (default) or `block`. |
+ 
+ - **Warn mode**: Prints a warning to stderr and annotates the JSON with `_sanitization` details.
+ - **Block mode**: Suppresses the output entirely and exits with an error if a match is found.
+ 
+ ### Requirements
+ 
+ Using `--sanitize` requires the `https://www.googleapis.com/auth/cloud-platform` scope.
+ 
+ ## License
 
 Apache-2.0
 
diff --git a/art/features.txt b/art/features.txt
new file mode 100644
index 00000000..35af7894
--- /dev/null
+++ b/art/features.txt
@@ -0,0 +1,12 @@
+
+        ╔════════════════════════════════════════════════╗
+        ║                                                ║
+        ║           ✨  Feature Roll  ✨                 ║
+        ║                                                ║
+        ║      ✅ Compatible with Headless Envs          ║
+        ║      🔒 Can be Scoped to Read-Only             ║
+        ║      🦀 Zero Runtime (Static Binary)           ║
+        ║      📄 Auto-Pagination (NDJSON)               ║
+        ║      🧠 Type-Safe Discovery Schemas            ║
+        ║                                                ║
+        ╚════════════════════════════════════════════════╝
diff --git a/art/intro.txt b/art/intro.txt
new file mode 100644
index 00000000..38f7c21e
--- /dev/null
+++ b/art/intro.txt
@@ -0,0 +1,29 @@
+          
+          ╔════════════════════════════════════════════════╗
+          ║                                                ║
+          ║           ██████╗ ██╗     ██╗███████╗          ║
+          ║          ██╔════╝ ██║     ██║██╔════╝          ║
+          ║          ██║  ███╗██║█╗   ██║███████╗          ║
+          ║          ██║   ██║██║███╗ ██║╚════██║          ║
+          ║          ╚██████╔╝╚███╔ ███╔╝███████║          ║
+          ║           ╚═════╝  ╚══╝ ╚══╝ ╚══════╝          ║
+          ║                                                ║
+          ║              Google Workspace CLI              ║
+          ║             ─────────────────────              ║
+          ║              One tool. Every API.              ║
+          ║                                                ║
+          ╚════════════════════════════════════════════════╝
+        
+                  ⭐ github.com/googleworkspace/cli
+        
+                    npm i -g @googleworkspace/cli
+        
+                  ────────────────────────────────
+                         Built with Rust. 🦀
+                  ────────────────────────────────
+        
+                       🚀 Drive    📧 Gmail              
+                       📅 Calendar 📊 Sheets             
+                       📝 Docs     🎨 Slides             
+                       💬 Chat     👥 Admin              
+  
\ No newline at end of file
diff --git a/art/outro.txt b/art/outro.txt
new file mode 100644
index 00000000..38f7c21e
--- /dev/null
+++ b/art/outro.txt
@@ -0,0 +1,29 @@
+          
+          ╔════════════════════════════════════════════════╗
+          ║                                                ║
+          ║           ██████╗ ██╗     ██╗███████╗          ║
+          ║          ██╔════╝ ██║     ██║██╔════╝          ║
+          ║          ██║  ███╗██║█╗   ██║███████╗          ║
+          ║          ██║   ██║██║███╗ ██║╚════██║          ║
+          ║          ╚██████╔╝╚███╔ ███╔╝███████║          ║
+          ║           ╚═════╝  ╚══╝ ╚══╝ ╚══════╝          ║
+          ║                                                ║
+          ║              Google Workspace CLI              ║
+          ║             ─────────────────────              ║
+          ║              One tool. Every API.              ║
+          ║                                                ║
+          ╚════════════════════════════════════════════════╝
+        
+                  ⭐ github.com/googleworkspace/cli
+        
+                    npm i -g @googleworkspace/cli
+        
+                  ────────────────────────────────
+                         Built with Rust. 🦀
+                  ────────────────────────────────
+        
+                       🚀 Drive    📧 Gmail              
+                       📅 Calendar 📊 Sheets             
+                       📝 Docs     🎨 Slides             
+                       💬 Chat     👥 Admin              
+  
\ No newline at end of file
diff --git a/art/qr.txt b/art/qr.txt
new file mode 100644
index 00000000..40ada1c1
--- /dev/null
+++ b/art/qr.txt
@@ -0,0 +1,32 @@
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+                                                              
+
diff --git a/art/scene1.txt b/art/scene1.txt
new file mode 100644
index 00000000..9fcfa017
--- /dev/null
+++ b/art/scene1.txt
@@ -0,0 +1,12 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 🤖 WHAT IS GWS?
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+ A single CLI for ALL Google Workspace APIs.
+
+ Perfect for:
+
+  🤖 AI agents
+  📜 Shell scripts
+  ⚡ Power users
+  📊 Automation
diff --git a/art/scene2.txt b/art/scene2.txt
new file mode 100644
index 00000000..f0519223
--- /dev/null
+++ b/art/scene2.txt
@@ -0,0 +1,3 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📂 EXPLORE SERVICES
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
diff --git a/art/scene2b.txt b/art/scene2b.txt
new file mode 100644
index 00000000..f763ba8f
--- /dev/null
+++ b/art/scene2b.txt
@@ -0,0 +1,3 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 🔍 INSPECT DRIVE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
diff --git a/art/scene3.txt b/art/scene3.txt
new file mode 100644
index 00000000..1fc3ac6d
--- /dev/null
+++ b/art/scene3.txt
@@ -0,0 +1,7 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 🔍 INTROSPECT APIS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+ What params does an API
+ method accept? Just ask.
+
diff --git a/art/scene3b.txt b/art/scene3b.txt
new file mode 100644
index 00000000..0d965db8
--- /dev/null
+++ b/art/scene3b.txt
@@ -0,0 +1,3 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📊 JSON SCHEMAS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
diff --git a/art/scene4.txt b/art/scene4.txt
new file mode 100644
index 00000000..39b36029
--- /dev/null
+++ b/art/scene4.txt
@@ -0,0 +1,4 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 🗂️  List files in a folder
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
diff --git a/art/scene5.txt b/art/scene5.txt
new file mode 100644
index 00000000..c7df9ab3
--- /dev/null
+++ b/art/scene5.txt
@@ -0,0 +1,4 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📤 Upload to Drive
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
diff --git a/art/scene6.txt b/art/scene6.txt
new file mode 100644
index 00000000..d796c5c3
--- /dev/null
+++ b/art/scene6.txt
@@ -0,0 +1,4 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📧 Send an email
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
diff --git a/art/scene7.txt b/art/scene7.txt
new file mode 100644
index 00000000..e3fe176c
--- /dev/null
+++ b/art/scene7.txt
@@ -0,0 +1,4 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📅 Schedule a meeting
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
diff --git a/art/scene8.txt b/art/scene8.txt
new file mode 100644
index 00000000..ad79b044
--- /dev/null
+++ b/art/scene8.txt
@@ -0,0 +1,4 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ 📊 Log data to Sheets
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
diff --git a/art/scene9.txt b/art/scene9.txt
new file mode 100644
index 00000000..747117c9
--- /dev/null
+++ b/art/scene9.txt
@@ -0,0 +1,8 @@
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+ ♾️  Paginate all pages
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+ --page-all streams NDJSON
+ from every page.
+ Pipe to jq for processing.
+
diff --git a/demo.gif b/demo.gif
new file mode 100644
index 00000000..00add40b
Binary files /dev/null and b/demo.gif differ
diff --git a/demo.tape b/demo.tape
new file mode 100644
index 00000000..de99cce4
--- /dev/null
+++ b/demo.tape
@@ -0,0 +1,197 @@
+# GWS CLI — YouTube Short Demo (FAST iteration mode)
+# Run: vhs demo.tape
+#
+# All cosmetic sleeps minimized. API sleeps kept for responses.
+# Single line commands for reliability.
+
+Output demo.mp4
+Output demo.gif
+
+Set Shell "bash"
+Set FontSize 22
+Set Width 1080
+Set Height 1920
+Set TypingSpeed 1ms
+Set Padding 30
+Set LineHeight 1.3
+
+# ── Setup (hidden) ──
+Hide
+# Mock gemini CLI for deterministic demo
+Type 'function gemini() { echo "Why do Java developers wear glasses? Because they don'"'"'t C#."; }' Enter
+Type "export -f gemini" Enter
+Type "export PATH=$PWD/target/release:$PWD/target/debug:$PATH" Enter
+Type "set -e" Enter
+Sleep 1s
+Type `DEMO=$(gws drive files create --json '{"name":"gws-demo","mimeType":"application/vnd.google-apps.folder"}' | jq -r '.id')` Enter
+Sleep 3s
+Type `gws drive files create --json "{\"name\":\"meeting-notes.md\",\"mimeType\":\"text/markdown\",\"parents\":[\"$DEMO\"]}" > /dev/null` Enter
+Sleep 2s
+Type `gws drive files create --json "{\"name\":\"quarterly-report.csv\",\"mimeType\":\"text/csv\",\"parents\":[\"$DEMO\"]}" > /dev/null` Enter
+Sleep 2s
+Type `gws drive files create --json "{\"name\":\"project-roadmap.md\",\"mimeType\":\"text/markdown\",\"parents\":[\"$DEMO\"]}" > /dev/null` Enter
+Sleep 2s
+Type `Q="'$DEMO' in parents"` Enter
+Sleep 500ms
+Type "clear" Enter
+Sleep 1s
+Show
+
+# ╔══════════════════════════════════════╗
+# ║         ASCII ART INTRO             ║
+# ╚══════════════════════════════════════╝
+
+Hide
+Type "./scripts/show-art.sh art/intro.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+# ── Scene 1: What is gws? ──
+Hide
+Type "./scripts/show-art.sh art/scene1.txt" Enter
+Sleep 1s
+Show
+Sleep 4s
+
+# ── Scene 2: Discover all services ──
+Hide
+Type "./scripts/show-art.sh art/scene2.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws --help 2>&1 | head -40" Enter
+Sleep 4s
+
+# ── Scene 2b: Inspect Drive resources ──
+Hide
+Type "./scripts/show-art.sh art/scene2b.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws drive --help 2>&1 | head -40" Enter
+Sleep 4s
+
+# ── Scene 3: Schema introspection ──
+Hide
+Type "./scripts/show-art.sh art/scene3.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws schema drive.files.list | head -15" Enter
+Sleep 3s
+
+# ── Scene 3b: Inspect JSON Schemas ──
+Hide
+Type "./scripts/show-art.sh art/scene3b.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws schema drive.File | head -20" Enter
+Sleep 3s
+
+Type "gws schema drive.File --resolve-refs | head -30" Enter
+Sleep 5s
+
+# ── Scene 4: List files in a folder ──
+Hide
+Type "./scripts/show-art.sh art/scene4.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws drive files list" 
+Type ` --params "{\"q\":\"$Q\",\"fields\":\"files(name,mimeType)\"}"` Enter
+Sleep 3s
+
+# ── Scene 5: Upload a file ──
+Hide
+Type "./scripts/show-art.sh art/scene5.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "echo '# Notes' > /tmp/notes.md" Enter
+Sleep 500ms
+
+Type "gws drive files create" 
+Type ` --json '{"name":"notes.md","mimeType":"text/markdown"}'` 
+Type " --upload /tmp/notes.md" Enter
+Sleep 3s
+
+# ── Scene 6: Gmail labels ──
+Hide
+Type "./scripts/show-art.sh art/scene6.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "JOKE=$(gemini 'tell me a joke')" Enter
+Sleep 1s
+
+Type `MSG=$(echo -e "To: justin@example.com\nSubject: joke of the day\n\n$JOKE" | base64 | tr -d '\n' | tr '+/' '-_' | tr -d '=')` Enter
+
+Type "gws gmail users messages send" 
+Type ` --params '{"userId":"me"}'` 
+Type ` --json "{\"raw\":\"$MSG\"}"` 
+Type " | jq ." Enter
+Sleep 3s
+
+# ── Scene 7: Calendar event ──
+Hide
+Type "./scripts/show-art.sh art/scene7.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws calendar events insert" 
+Type ` --params '{"calendarId":"primary"}'` 
+Type ` --json '{"summary":"Ship v1.0 🚀","start":{"dateTime":"2024-06-17T10:00:00-07:00"},"end":{"dateTime":"2024-06-17T10:30:00-07:00"}}'` 
+Type " | jq . | head -15" Enter
+Sleep 3s
+
+# ── Scene 8: Sheets automation ──
+Hide
+Type "./scripts/show-art.sh art/scene8.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws sheets spreadsheets values append" 
+Type ` --params '{"spreadsheetId":"1izmtvgBC4NuxHhABFX6descuB6-SXTm3g7c6LYBngJQ","range":"Sheet1!A1","valueInputOption":"USER_ENTERED"}'` 
+Type ` --json '{"values":[["Deploy","v1.0","=NOW()"]]}'` Enter
+Sleep 3s
+
+# ── Scene 9: Auto-pagination ──
+Hide
+Type "./scripts/show-art.sh art/scene9.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+Type "gws drive files list" 
+Type " --params '" Sleep 50ms
+Type@30ms '{"pageSize":2,"fields":"nextPageToken,files(id)"}' Sleep 50ms
+Type "'" 
+Type " --page-all" 
+Type " | jq -r '.files[]?.id'" Enter
+Sleep 6s
+
+# ╔══════════════════════════════════════╗
+# ║         OUTRO                        ║
+# ╚══════════════════════════════════════╝
+
+Hide
+Type "./scripts/show-art.sh art/outro.txt" Enter
+Sleep 1s
+Show
+Sleep 1s
+
+# ── Cleanup (hidden) ──
+Hide
+Type `gws drive files delete --params "{\"fileId\":\"$DEMO\"}" > /dev/null 2>&1` Enter
+Sleep 3s
diff --git a/dist-workspace.toml b/dist-workspace.toml
new file mode 100644
index 00000000..5f11b9ef
--- /dev/null
+++ b/dist-workspace.toml
@@ -0,0 +1,39 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[workspace]
+members = ["cargo:."]
+
+# Config for 'cargo dist'
+[dist]
+# The preferred cargo-dist version to use in CI (Cargo.toml SemVer syntax)
+cargo-dist-version = "0.31.0"
+# CI backends to support
+ci = "github"
+# The installers to generate for each app
+installers = ["shell", "powershell", "npm"]
+# Publish jobs to run
+publish-jobs = ["npm"]
+scope = "@googleworkspace"
+# Enable github attestations
+github-attestations = true
+package = "cli"
+# Target platforms to build apps for (Rust target-triple syntax)
+targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
+# Which actions to run on pull requests
+pr-run-mode = "plan"
+# The archive format to use for windows builds (defaults .zip)
+windows-archive = ".tar.gz"
+# The archive format to use for non-windows builds (defaults .tar.xz)
+unix-archive = ".tar.gz"
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index bc23aaed..ff459510 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -30,4 +30,29 @@ This project follows
 All submissions, including submissions by project members, require review. We
 use GitHub pull requests for this purpose. Consult
 [GitHub Help](https://help.github.com/articles/about-pull-requests/) for more
-information on using pull requests.
\ No newline at end of file
+information on using pull requests.
+
+### Updating CI Smoketest Credentials
+
+If the OAuth refresh token used in the GitHub Actions smoketest expires or needs additional scopes, you can generate a new one and update the repository secret using the GitHub CLI (`gh`).
+
+1. **Set the credentials file path to output plaintext JSON**:
+   ```bash
+   export GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=smoketest-creds.json
+   ```
+
+2. **Authenticate with the required scopes**:
+   ```bash
+   cargo run -- auth login --scopes https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/calendar.readonly,https://www.googleapis.com/auth/presentations.readonly,https://www.googleapis.com/auth/tasks.readonly
+   ```
+
+3. **Export and set the GitHub actions secret**:
+   ```bash
+   cargo run --quiet -- auth export --unmasked | base64 | gh secret set GOOGLE_CREDENTIALS_JSON
+   ```
+
+4. **Clean up**:
+   ```bash
+   rm smoketest-creds.json
+   unset GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE
+   ```
\ No newline at end of file
diff --git a/gemini-extension.json b/gemini-extension.json
new file mode 100644
index 00000000..2c314f20
--- /dev/null
+++ b/gemini-extension.json
@@ -0,0 +1,38 @@
+{
+  "name": "google-workspace-cli",
+  "version": "latest",
+  "description": "CLI tool for managing Google Workspace resources dynamically using Discovery APIs.",
+  "contextFileName": "CONTEXT.md",
+  "settings": [
+    {
+      "name": "Credentials File",
+      "description": "Path to the Google Workspace authorized user credentials or service account JSON file.",
+      "envVar": "GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE",
+      "sensitive": false
+    },
+    {
+      "name": "OAuth Client ID",
+      "description": "Client ID for OAuth authentication.",
+      "envVar": "GOOGLE_WORKSPACE_CLI_CLIENT_ID",
+      "sensitive": false
+    },
+    {
+      "name": "OAuth Client Secret",
+      "description": "Client Secret for OAuth authentication.",
+      "envVar": "GOOGLE_WORKSPACE_CLI_CLIENT_SECRET",
+      "sensitive": true
+    },
+    {
+      "name": "Sanitize Template",
+      "description": "Resource name of the Model Armor template to use for sanitization (e.g., projects/P/locations/L/templates/T).",
+      "envVar": "GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE",
+      "sensitive": false
+    },
+    {
+      "name": "Impersonated User",
+      "description": "Email address of the user to impersonate (requires Domain-Wide Delegation).",
+      "envVar": "GOOGLE_WORKSPACE_CLI_IMPERSONATED_USER",
+      "sensitive": false
+    }
+  ]
+}
diff --git a/lefthook.yml b/lefthook.yml
new file mode 100644
index 00000000..4c887be3
--- /dev/null
+++ b/lefthook.yml
@@ -0,0 +1,19 @@
+pre-commit:
+  parallel: true
+  commands:
+    fmt:
+      glob: "*.rs"
+      run: cargo fmt -- --check
+    clippy:
+      glob: "*.rs"
+      run: cargo clippy -- -D warnings
+
+pre-push:
+  parallel: true
+  commands:
+    test:
+      glob: "*.rs"
+      run: cargo test
+    check:
+      glob: "*.rs"
+      run: cargo check
diff --git a/package.json b/package.json
new file mode 100644
index 00000000..09bb5f2c
--- /dev/null
+++ b/package.json
@@ -0,0 +1,45 @@
+{
+  "name": "@googleworkspace/cli",
+  "version": "0.1.0",
+  "description": "Google Workspace CLI — dynamic command surface from Discovery Service",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/googleworkspace/cli.git"
+  },
+  "author": {
+    "name": "Justin Poehnelt",
+    "email": "justin.poehnelt@mgail.com"
+  },
+  "homepage": "https://github.com/googleworkspace/cli",
+  "bugs": {
+    "url": "https://github.com/googleworkspace/cli/issues"
+  },
+  "scripts": {
+    "test": "cargo test",
+    "prepare": "lefthook install"
+  },
+  "publishConfig": {
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "packageManager": "pnpm@10.0.0",
+  "keywords": [
+    "cli",
+    "rust",
+    "google-workspace",
+    "google",
+    "drive",
+    "gmail",
+    "sheets",
+    "calendar",
+    "discovery-api",
+    "skills"
+  ],
+  "devDependencies": {
+    "@changesets/cli": "^2.29.8",
+    "lefthook": "^2.1.2"
+  }
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
new file mode 100644
index 00000000..aa0f0290
--- /dev/null
+++ b/pnpm-lock.yaml
@@ -0,0 +1,912 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      '@changesets/cli':
+        specifier: ^2.29.8
+        version: 2.29.8
+      lefthook:
+        specifier: ^2.1.2
+        version: 2.1.2
+
+packages:
+
+  '@babel/runtime@7.28.6':
+    resolution: {integrity: sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==}
+    engines: {node: '>=6.9.0'}
+
+  '@changesets/apply-release-plan@7.0.14':
+    resolution: {integrity: sha512-ddBvf9PHdy2YY0OUiEl3TV78mH9sckndJR14QAt87KLEbIov81XO0q0QAmvooBxXlqRRP8I9B7XOzZwQG7JkWA==}
+
+  '@changesets/assemble-release-plan@6.0.9':
+    resolution: {integrity: sha512-tPgeeqCHIwNo8sypKlS3gOPmsS3wP0zHt67JDuL20P4QcXiw/O4Hl7oXiuLnP9yg+rXLQ2sScdV1Kkzde61iSQ==}
+
+  '@changesets/changelog-git@0.2.1':
+    resolution: {integrity: sha512-x/xEleCFLH28c3bQeQIyeZf8lFXyDFVn1SgcBiR2Tw/r4IAWlk1fzxCEZ6NxQAjF2Nwtczoen3OA2qR+UawQ8Q==}
+
+  '@changesets/cli@2.29.8':
+    resolution: {integrity: sha512-1weuGZpP63YWUYjay/E84qqwcnt5yJMM0tep10Up7Q5cS/DGe2IZ0Uj3HNMxGhCINZuR7aO9WBMdKnPit5ZDPA==}
+    hasBin: true
+
+  '@changesets/config@3.1.2':
+    resolution: {integrity: sha512-CYiRhA4bWKemdYi/uwImjPxqWNpqGPNbEBdX1BdONALFIDK7MCUj6FPkzD+z9gJcvDFUQJn9aDVf4UG7OT6Kog==}
+
+  '@changesets/errors@0.2.0':
+    resolution: {integrity: sha512-6BLOQUscTpZeGljvyQXlWOItQyU71kCdGz7Pi8H8zdw6BI0g3m43iL4xKUVPWtG+qrrL9DTjpdn8eYuCQSRpow==}
+
+  '@changesets/get-dependents-graph@2.1.3':
+    resolution: {integrity: sha512-gphr+v0mv2I3Oxt19VdWRRUxq3sseyUpX9DaHpTUmLj92Y10AGy+XOtV+kbM6L/fDcpx7/ISDFK6T8A/P3lOdQ==}
+
+  '@changesets/get-release-plan@4.0.14':
+    resolution: {integrity: sha512-yjZMHpUHgl4Xl5gRlolVuxDkm4HgSJqT93Ri1Uz8kGrQb+5iJ8dkXJ20M2j/Y4iV5QzS2c5SeTxVSKX+2eMI0g==}
+
+  '@changesets/get-version-range-type@0.4.0':
+    resolution: {integrity: sha512-hwawtob9DryoGTpixy1D3ZXbGgJu1Rhr+ySH2PvTLHvkZuQ7sRT4oQwMh0hbqZH1weAooedEjRsbrWcGLCeyVQ==}
+
+  '@changesets/git@3.0.4':
+    resolution: {integrity: sha512-BXANzRFkX+XcC1q/d27NKvlJ1yf7PSAgi8JG6dt8EfbHFHi4neau7mufcSca5zRhwOL8j9s6EqsxmT+s+/E6Sw==}
+
+  '@changesets/logger@0.1.1':
+    resolution: {integrity: sha512-OQtR36ZlnuTxKqoW4Sv6x5YIhOmClRd5pWsjZsddYxpWs517R0HkyiefQPIytCVh4ZcC5x9XaG8KTdd5iRQUfg==}
+
+  '@changesets/parse@0.4.2':
+    resolution: {integrity: sha512-Uo5MC5mfg4OM0jU3up66fmSn6/NE9INK+8/Vn/7sMVcdWg46zfbvvUSjD9EMonVqPi9fbrJH9SXHn48Tr1f2yA==}
+
+  '@changesets/pre@2.0.2':
+    resolution: {integrity: sha512-HaL/gEyFVvkf9KFg6484wR9s0qjAXlZ8qWPDkTyKF6+zqjBe/I2mygg3MbpZ++hdi0ToqNUF8cjj7fBy0dg8Ug==}
+
+  '@changesets/read@0.6.6':
+    resolution: {integrity: sha512-P5QaN9hJSQQKJShzzpBT13FzOSPyHbqdoIBUd2DJdgvnECCyO6LmAOWSV+O8se2TaZJVwSXjL+v9yhb+a9JeJg==}
+
+  '@changesets/should-skip-package@0.1.2':
+    resolution: {integrity: sha512-qAK/WrqWLNCP22UDdBTMPH5f41elVDlsNyat180A33dWxuUDyNpg6fPi/FyTZwRriVjg0L8gnjJn2F9XAoF0qw==}
+
+  '@changesets/types@4.1.0':
+    resolution: {integrity: sha512-LDQvVDv5Kb50ny2s25Fhm3d9QSZimsoUGBsUioj6MC3qbMUCuC8GPIvk/M6IvXx3lYhAs0lwWUQLb+VIEUCECw==}
+
+  '@changesets/types@6.1.0':
+    resolution: {integrity: sha512-rKQcJ+o1nKNgeoYRHKOS07tAMNd3YSN0uHaJOZYjBAgxfV7TUE7JE+z4BzZdQwb5hKaYbayKN5KrYV7ODb2rAA==}
+
+  '@changesets/write@0.4.0':
+    resolution: {integrity: sha512-CdTLvIOPiCNuH71pyDu3rA+Q0n65cmAbXnwWH84rKGiFumFzkmHNT8KHTMEchcxN+Kl8I54xGUhJ7l3E7X396Q==}
+
+  '@inquirer/external-editor@1.0.3':
+    resolution: {integrity: sha512-RWbSrDiYmO4LbejWY7ttpxczuwQyZLBUyygsA9Nsv95hpzUWwnNTVQmAq3xuh7vNwCp07UTmE5i11XAEExx4RA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
+  '@manypkg/find-root@1.1.0':
+    resolution: {integrity: sha512-mki5uBvhHzO8kYYix/WRy2WX8S3B5wdVSc9D6KcU5lQNglP2yt58/VfLuAK49glRXChosY8ap2oJ1qgma3GUVA==}
+
+  '@manypkg/get-packages@1.1.3':
+    resolution: {integrity: sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A==}
+
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
+  '@types/node@12.20.55':
+    resolution: {integrity: sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ==}
+
+  ansi-colors@4.1.3:
+    resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
+    engines: {node: '>=6'}
+
+  ansi-regex@5.0.1:
+    resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
+    engines: {node: '>=8'}
+
+  argparse@1.0.10:
+    resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+
+  argparse@2.0.1:
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
+
+  array-union@2.1.0:
+    resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
+    engines: {node: '>=8'}
+
+  better-path-resolve@1.0.0:
+    resolution: {integrity: sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g==}
+    engines: {node: '>=4'}
+
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
+  chardet@2.1.1:
+    resolution: {integrity: sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==}
+
+  ci-info@3.9.0:
+    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
+    engines: {node: '>=8'}
+
+  cross-spawn@7.0.6:
+    resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
+    engines: {node: '>= 8'}
+
+  detect-indent@6.1.0:
+    resolution: {integrity: sha512-reYkTUJAZb9gUuZ2RvVCNhVHdg62RHnJ7WJl8ftMi4diZ6NWlciOzQN88pUhSELEwflJht4oQDv0F0BMlwaYtA==}
+    engines: {node: '>=8'}
+
+  dir-glob@3.0.1:
+    resolution: {integrity: sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
+    engines: {node: '>=8'}
+
+  enquirer@2.4.1:
+    resolution: {integrity: sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ==}
+    engines: {node: '>=8.6'}
+
+  esprima@4.0.1:
+    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
+    engines: {node: '>=4'}
+    hasBin: true
+
+  extendable-error@0.1.7:
+    resolution: {integrity: sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg==}
+
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
+  fastq@1.20.1:
+    resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
+
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  find-up@4.1.0:
+    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
+    engines: {node: '>=8'}
+
+  fs-extra@7.0.1:
+    resolution: {integrity: sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==}
+    engines: {node: '>=6 <7 || >=8'}
+
+  fs-extra@8.1.0:
+    resolution: {integrity: sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==}
+    engines: {node: '>=6 <7 || >=8'}
+
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
+  globby@11.1.0:
+    resolution: {integrity: sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==}
+    engines: {node: '>=10'}
+
+  graceful-fs@4.2.11:
+    resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
+
+  human-id@4.1.3:
+    resolution: {integrity: sha512-tsYlhAYpjCKa//8rXZ9DqKEawhPoSytweBC2eNvcaDK+57RZLHGqNs3PZTQO6yekLFSuvA6AlnAfrw1uBvtb+Q==}
+    hasBin: true
+
+  iconv-lite@0.7.2:
+    resolution: {integrity: sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==}
+    engines: {node: '>=0.10.0'}
+
+  ignore@5.3.2:
+    resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
+    engines: {node: '>= 4'}
+
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
+  is-subdir@1.2.0:
+    resolution: {integrity: sha512-2AT6j+gXe/1ueqbW6fLZJiIw3F8iXGJtt0yDrZaBhAZEG1raiTxKWU+IPqMCzQAXOUCKdA4UDMgacKH25XG2Cw==}
+    engines: {node: '>=4'}
+
+  is-windows@1.0.2:
+    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
+    engines: {node: '>=0.10.0'}
+
+  isexe@2.0.0:
+    resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
+
+  js-yaml@3.14.2:
+    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+    hasBin: true
+
+  js-yaml@4.1.1:
+    resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
+    hasBin: true
+
+  jsonfile@4.0.0:
+    resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
+
+  lefthook-darwin-arm64@2.1.2:
+    resolution: {integrity: sha512-AgHu93YuJtj1l9bcKlCbo4Tg8N8xFl9iD6BjXCGaGMu46LSjFiXbJFlkUdpgrL8fIbwoCjJi5FNp3POpqs4Wdw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  lefthook-darwin-x64@2.1.2:
+    resolution: {integrity: sha512-exooc9Ectz13OLJJOXM9AzaFQbqzf9QCF8JuVvGfbr4RYABYK+BwwtydjlPQrA76/n/h4tsS11MH5bBULnLkYA==}
+    cpu: [x64]
+    os: [darwin]
+
+  lefthook-freebsd-arm64@2.1.2:
+    resolution: {integrity: sha512-E1QMlJPEU21n9eewv6ePfh+JmoTSg5R1jaYcKCky10kfbMdohNucI3xV91F2LcerE+p3UejKDqr/1wWO2RMGeQ==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  lefthook-freebsd-x64@2.1.2:
+    resolution: {integrity: sha512-/5zp+x8055Thj46x9S7hgnneZxvWhHQvPWkkgISCab1Lh6eLrbxvhE1qTb1lU3DqTnNmH9NeXdq1xPHc9uGluA==}
+    cpu: [x64]
+    os: [freebsd]
+
+  lefthook-linux-arm64@2.1.2:
+    resolution: {integrity: sha512-UK5FvDTkwKO7tOznY8iEZzuTsM1jXMZAG5BMRs7olN1k1K6m2unR6oKABP0hCd0wDErK6DZKDJDJfB564Rzqtw==}
+    cpu: [arm64]
+    os: [linux]
+
+  lefthook-linux-x64@2.1.2:
+    resolution: {integrity: sha512-4eOtz4PNh8GbJ+nA8YVDfW/eMirQWdZqMP/V/MVtoVBGobf6oXvvuDOySvAPOgNYEFN0Boegytmuji/851Vstg==}
+    cpu: [x64]
+    os: [linux]
+
+  lefthook-openbsd-arm64@2.1.2:
+    resolution: {integrity: sha512-lJXRJ6iJIBKwomuNBA3CUNSclj2/rKuxGAQoUra214B92VB6jL9zaY5YEs6h/ie9jQrzSnllEeg7xyDIsuVCrQ==}
+    cpu: [arm64]
+    os: [openbsd]
+
+  lefthook-openbsd-x64@2.1.2:
+    resolution: {integrity: sha512-GyOje4W0DIqkmR7/Of5D+mZ0vWqMvtGAVedtJR6d1239xNeMzCS8Q+/a3O1xigceZa5xhlqq0BWlssB/QYPQnA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  lefthook-windows-arm64@2.1.2:
+    resolution: {integrity: sha512-MZKMqTULEpX/8N3fKXAR0A9RjsGKkEEY0japLqrHOIpxsJXry1DRz0FvQo2kkY4WW3rtFegV9m6eesOymuDrUg==}
+    cpu: [arm64]
+    os: [win32]
+
+  lefthook-windows-x64@2.1.2:
+    resolution: {integrity: sha512-NZUgObuaSxc0EXAwC/CzkMf7TuQc++GGIk6TLPdaUpoSsNSJSZEwBVz5DtFB1cG+eMkfO/wOKplls+yjimTTtQ==}
+    cpu: [x64]
+    os: [win32]
+
+  lefthook@2.1.2:
+    resolution: {integrity: sha512-HdAMl4g47kbWSkrUkCx3Kucq54omFS6piMJtXwXNtmCAfB40UaybTJuYtFW4hNzZ5SvaEimtxTp7P/MNIkEfsA==}
+    hasBin: true
+
+  locate-path@5.0.0:
+    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
+    engines: {node: '>=8'}
+
+  lodash.startcase@4.4.0:
+    resolution: {integrity: sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg==}
+
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
+  mri@1.2.0:
+    resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
+    engines: {node: '>=4'}
+
+  outdent@0.5.0:
+    resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==}
+
+  p-filter@2.1.0:
+    resolution: {integrity: sha512-ZBxxZ5sL2HghephhpGAQdoskxplTwr7ICaehZwLIlfL6acuVgZPm8yBNuRAFBGEqtD/hmUeq9eqLg2ys9Xr/yw==}
+    engines: {node: '>=8'}
+
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
+  p-locate@4.1.0:
+    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
+    engines: {node: '>=8'}
+
+  p-map@2.1.0:
+    resolution: {integrity: sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw==}
+    engines: {node: '>=6'}
+
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
+  package-manager-detector@0.2.11:
+    resolution: {integrity: sha512-BEnLolu+yuz22S56CU1SUKq3XC3PkwD5wv4ikR4MfGvnRVcmzXR9DwSlW2fEamyTPyXHomBJRzgapeuBvRNzJQ==}
+
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
+  path-key@3.1.1:
+    resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
+    engines: {node: '>=8'}
+
+  path-type@4.0.0:
+    resolution: {integrity: sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==}
+    engines: {node: '>=8'}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
+  pify@4.0.1:
+    resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==}
+    engines: {node: '>=6'}
+
+  prettier@2.8.8:
+    resolution: {integrity: sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==}
+    engines: {node: '>=10.13.0'}
+    hasBin: true
+
+  quansync@0.2.11:
+    resolution: {integrity: sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
+  read-yaml-file@1.1.0:
+    resolution: {integrity: sha512-VIMnQi/Z4HT2Fxuwg5KrY174U1VdUIASQVWXXyqtNRtxSr9IYkn1rsI6Tb6HsrHCmB7gVpNwX6JxPTHcH6IoTA==}
+    engines: {node: '>=6'}
+
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
+  safer-buffer@2.1.2:
+    resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
+
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  shebang-command@2.0.0:
+    resolution: {integrity: sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==}
+    engines: {node: '>=8'}
+
+  shebang-regex@3.0.0:
+    resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
+    engines: {node: '>=8'}
+
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
+  slash@3.0.0:
+    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
+    engines: {node: '>=8'}
+
+  spawndamnit@3.0.1:
+    resolution: {integrity: sha512-MmnduQUuHCoFckZoWnXsTg7JaiLBJrKFj9UI2MbRPGaJeVpsLcVBu6P/IGZovziM/YBsellCmsprgNA+w0CzVg==}
+
+  sprintf-js@1.0.3:
+    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
+
+  strip-ansi@6.0.1:
+    resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==}
+    engines: {node: '>=8'}
+
+  strip-bom@3.0.0:
+    resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
+    engines: {node: '>=4'}
+
+  term-size@2.2.1:
+    resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==}
+    engines: {node: '>=8'}
+
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
+  universalify@0.1.2:
+    resolution: {integrity: sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==}
+    engines: {node: '>= 4.0.0'}
+
+  which@2.0.2:
+    resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
+    engines: {node: '>= 8'}
+    hasBin: true
+
+snapshots:
+
+  '@babel/runtime@7.28.6': {}
+
+  '@changesets/apply-release-plan@7.0.14':
+    dependencies:
+      '@changesets/config': 3.1.2
+      '@changesets/get-version-range-type': 0.4.0
+      '@changesets/git': 3.0.4
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      detect-indent: 6.1.0
+      fs-extra: 7.0.1
+      lodash.startcase: 4.4.0
+      outdent: 0.5.0
+      prettier: 2.8.8
+      resolve-from: 5.0.0
+      semver: 7.7.4
+
+  '@changesets/assemble-release-plan@6.0.9':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      semver: 7.7.4
+
+  '@changesets/changelog-git@0.2.1':
+    dependencies:
+      '@changesets/types': 6.1.0
+
+  '@changesets/cli@2.29.8':
+    dependencies:
+      '@changesets/apply-release-plan': 7.0.14
+      '@changesets/assemble-release-plan': 6.0.9
+      '@changesets/changelog-git': 0.2.1
+      '@changesets/config': 3.1.2
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/get-release-plan': 4.0.14
+      '@changesets/git': 3.0.4
+      '@changesets/logger': 0.1.1
+      '@changesets/pre': 2.0.2
+      '@changesets/read': 0.6.6
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@changesets/write': 0.4.0
+      '@inquirer/external-editor': 1.0.3
+      '@manypkg/get-packages': 1.1.3
+      ansi-colors: 4.1.3
+      ci-info: 3.9.0
+      enquirer: 2.4.1
+      fs-extra: 7.0.1
+      mri: 1.2.0
+      p-limit: 2.3.0
+      package-manager-detector: 0.2.11
+      picocolors: 1.1.1
+      resolve-from: 5.0.0
+      semver: 7.7.4
+      spawndamnit: 3.0.1
+      term-size: 2.2.1
+    transitivePeerDependencies:
+      - '@types/node'
+
+  '@changesets/config@3.1.2':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/logger': 0.1.1
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      fs-extra: 7.0.1
+      micromatch: 4.0.8
+
+  '@changesets/errors@0.2.0':
+    dependencies:
+      extendable-error: 0.1.7
+
+  '@changesets/get-dependents-graph@2.1.3':
+    dependencies:
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      picocolors: 1.1.1
+      semver: 7.7.4
+
+  '@changesets/get-release-plan@4.0.14':
+    dependencies:
+      '@changesets/assemble-release-plan': 6.0.9
+      '@changesets/config': 3.1.2
+      '@changesets/pre': 2.0.2
+      '@changesets/read': 0.6.6
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+
+  '@changesets/get-version-range-type@0.4.0': {}
+
+  '@changesets/git@3.0.4':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@manypkg/get-packages': 1.1.3
+      is-subdir: 1.2.0
+      micromatch: 4.0.8
+      spawndamnit: 3.0.1
+
+  '@changesets/logger@0.1.1':
+    dependencies:
+      picocolors: 1.1.1
+
+  '@changesets/parse@0.4.2':
+    dependencies:
+      '@changesets/types': 6.1.0
+      js-yaml: 4.1.1
+
+  '@changesets/pre@2.0.2':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      fs-extra: 7.0.1
+
+  '@changesets/read@0.6.6':
+    dependencies:
+      '@changesets/git': 3.0.4
+      '@changesets/logger': 0.1.1
+      '@changesets/parse': 0.4.2
+      '@changesets/types': 6.1.0
+      fs-extra: 7.0.1
+      p-filter: 2.1.0
+      picocolors: 1.1.1
+
+  '@changesets/should-skip-package@0.1.2':
+    dependencies:
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+
+  '@changesets/types@4.1.0': {}
+
+  '@changesets/types@6.1.0': {}
+
+  '@changesets/write@0.4.0':
+    dependencies:
+      '@changesets/types': 6.1.0
+      fs-extra: 7.0.1
+      human-id: 4.1.3
+      prettier: 2.8.8
+
+  '@inquirer/external-editor@1.0.3':
+    dependencies:
+      chardet: 2.1.1
+      iconv-lite: 0.7.2
+
+  '@manypkg/find-root@1.1.0':
+    dependencies:
+      '@babel/runtime': 7.28.6
+      '@types/node': 12.20.55
+      find-up: 4.1.0
+      fs-extra: 8.1.0
+
+  '@manypkg/get-packages@1.1.3':
+    dependencies:
+      '@babel/runtime': 7.28.6
+      '@changesets/types': 4.1.0
+      '@manypkg/find-root': 1.1.0
+      fs-extra: 8.1.0
+      globby: 11.1.0
+      read-yaml-file: 1.1.0
+
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.20.1
+
+  '@types/node@12.20.55': {}
+
+  ansi-colors@4.1.3: {}
+
+  ansi-regex@5.0.1: {}
+
+  argparse@1.0.10:
+    dependencies:
+      sprintf-js: 1.0.3
+
+  argparse@2.0.1: {}
+
+  array-union@2.1.0: {}
+
+  better-path-resolve@1.0.0:
+    dependencies:
+      is-windows: 1.0.2
+
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
+  chardet@2.1.1: {}
+
+  ci-info@3.9.0: {}
+
+  cross-spawn@7.0.6:
+    dependencies:
+      path-key: 3.1.1
+      shebang-command: 2.0.0
+      which: 2.0.2
+
+  detect-indent@6.1.0: {}
+
+  dir-glob@3.0.1:
+    dependencies:
+      path-type: 4.0.0
+
+  enquirer@2.4.1:
+    dependencies:
+      ansi-colors: 4.1.3
+      strip-ansi: 6.0.1
+
+  esprima@4.0.1: {}
+
+  extendable-error@0.1.7: {}
+
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
+  fastq@1.20.1:
+    dependencies:
+      reusify: 1.1.0
+
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  find-up@4.1.0:
+    dependencies:
+      locate-path: 5.0.0
+      path-exists: 4.0.0
+
+  fs-extra@7.0.1:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+
+  fs-extra@8.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
+  globby@11.1.0:
+    dependencies:
+      array-union: 2.1.0
+      dir-glob: 3.0.1
+      fast-glob: 3.3.3
+      ignore: 5.3.2
+      merge2: 1.4.1
+      slash: 3.0.0
+
+  graceful-fs@4.2.11: {}
+
+  human-id@4.1.3: {}
+
+  iconv-lite@0.7.2:
+    dependencies:
+      safer-buffer: 2.1.2
+
+  ignore@5.3.2: {}
+
+  is-extglob@2.1.1: {}
+
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
+  is-number@7.0.0: {}
+
+  is-subdir@1.2.0:
+    dependencies:
+      better-path-resolve: 1.0.0
+
+  is-windows@1.0.2: {}
+
+  isexe@2.0.0: {}
+
+  js-yaml@3.14.2:
+    dependencies:
+      argparse: 1.0.10
+      esprima: 4.0.1
+
+  js-yaml@4.1.1:
+    dependencies:
+      argparse: 2.0.1
+
+  jsonfile@4.0.0:
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
+  lefthook-darwin-arm64@2.1.2:
+    optional: true
+
+  lefthook-darwin-x64@2.1.2:
+    optional: true
+
+  lefthook-freebsd-arm64@2.1.2:
+    optional: true
+
+  lefthook-freebsd-x64@2.1.2:
+    optional: true
+
+  lefthook-linux-arm64@2.1.2:
+    optional: true
+
+  lefthook-linux-x64@2.1.2:
+    optional: true
+
+  lefthook-openbsd-arm64@2.1.2:
+    optional: true
+
+  lefthook-openbsd-x64@2.1.2:
+    optional: true
+
+  lefthook-windows-arm64@2.1.2:
+    optional: true
+
+  lefthook-windows-x64@2.1.2:
+    optional: true
+
+  lefthook@2.1.2:
+    optionalDependencies:
+      lefthook-darwin-arm64: 2.1.2
+      lefthook-darwin-x64: 2.1.2
+      lefthook-freebsd-arm64: 2.1.2
+      lefthook-freebsd-x64: 2.1.2
+      lefthook-linux-arm64: 2.1.2
+      lefthook-linux-x64: 2.1.2
+      lefthook-openbsd-arm64: 2.1.2
+      lefthook-openbsd-x64: 2.1.2
+      lefthook-windows-arm64: 2.1.2
+      lefthook-windows-x64: 2.1.2
+
+  locate-path@5.0.0:
+    dependencies:
+      p-locate: 4.1.0
+
+  lodash.startcase@4.4.0: {}
+
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
+  mri@1.2.0: {}
+
+  outdent@0.5.0: {}
+
+  p-filter@2.1.0:
+    dependencies:
+      p-map: 2.1.0
+
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
+  p-locate@4.1.0:
+    dependencies:
+      p-limit: 2.3.0
+
+  p-map@2.1.0: {}
+
+  p-try@2.2.0: {}
+
+  package-manager-detector@0.2.11:
+    dependencies:
+      quansync: 0.2.11
+
+  path-exists@4.0.0: {}
+
+  path-key@3.1.1: {}
+
+  path-type@4.0.0: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@2.3.1: {}
+
+  pify@4.0.1: {}
+
+  prettier@2.8.8: {}
+
+  quansync@0.2.11: {}
+
+  queue-microtask@1.2.3: {}
+
+  read-yaml-file@1.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      js-yaml: 3.14.2
+      pify: 4.0.1
+      strip-bom: 3.0.0
+
+  resolve-from@5.0.0: {}
+
+  reusify@1.1.0: {}
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
+  safer-buffer@2.1.2: {}
+
+  semver@7.7.4: {}
+
+  shebang-command@2.0.0:
+    dependencies:
+      shebang-regex: 3.0.0
+
+  shebang-regex@3.0.0: {}
+
+  signal-exit@4.1.0: {}
+
+  slash@3.0.0: {}
+
+  spawndamnit@3.0.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
+  sprintf-js@1.0.3: {}
+
+  strip-ansi@6.0.1:
+    dependencies:
+      ansi-regex: 5.0.1
+
+  strip-bom@3.0.0: {}
+
+  term-size@2.2.1: {}
+
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
+  universalify@0.1.2: {}
+
+  which@2.0.2:
+    dependencies:
+      isexe: 2.0.0
diff --git a/scripts/coverage.sh b/scripts/coverage.sh
new file mode 100755
index 00000000..32e9176b
--- /dev/null
+++ b/scripts/coverage.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -e
+
+# Check if cargo-llvm-cov is installed
+if ! cargo llvm-cov --version &> /dev/null; then
+  echo "cargo-llvm-cov is not installed. Installing..."
+  cargo install cargo-llvm-cov
+fi
+
+# Run coverage and generate HTML report
+echo "Running tests with coverage..."
+cargo llvm-cov --all-features --workspace --html
+cargo llvm-cov --all-features --workspace # Print text summary
+
+echo "Coverage report generated at target/llvm-cov/html/index.html"
+
+# Open the report if on macOS
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  open target/llvm-cov/html/index.html
+fi
diff --git a/scripts/show-art.sh b/scripts/show-art.sh
new file mode 100755
index 00000000..0bbb07b9
--- /dev/null
+++ b/scripts/show-art.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+clear
+cat "$1"
diff --git a/skills/gws-admin-reports/SKILL.md b/skills/gws-admin-reports/SKILL.md
new file mode 100644
index 00000000..a40c0303
--- /dev/null
+++ b/skills/gws-admin-reports/SKILL.md
@@ -0,0 +1,57 @@
+---
+name: gws-admin-reports
+version: 1.0.0
+description: "USE WHEN the user wants to audit logs and usage reports via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws admin-reports --help"
+---
+
+# admin-reports (reports_v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws admin-reports <resource> <method> [flags]
+```
+
+## API Resources
+
+### activities
+
+  - `list` — Retrieves a list of activities for a specific customer's account and application such as the Admin console application or the Google Drive application. For more information, see the guides for adminis
+  - `watch` — Start receiving notifications for account activities. For more information, see Receiving Push Notifications.
+
+### channels
+
+  - `stop` — Stop watching resources through this channel.
+
+### customerUsageReports
+
+  - `get` — Retrieves a report which is a collection of properties and statistics for a specific customer's account. For more information, see the Customers Usage Report guide. For more information about the cust
+
+### entityUsageReports
+
+  - `get` — Retrieves a report which is a collection of properties and statistics for entities used by users within the account. For more information, see the Entities Usage Report guide. For more information abo
+
+### userUsageReport
+
+  - `get` — Retrieves a report which is a collection of properties and statistics for a set of users with the account. For more information, see the User Usage Report guide. For more information about the user re
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws admin-reports --help
+
+# Inspect a method's required params, types, and defaults
+gws schema admin-reports.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-admin/SKILL.md b/skills/gws-admin/SKILL.md
new file mode 100644
index 00000000..0bbe172c
--- /dev/null
+++ b/skills/gws-admin/SKILL.md
@@ -0,0 +1,183 @@
+---
+name: gws-admin
+version: 1.0.0
+description: "USE WHEN the user wants to manage users, groups, and devices via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws admin --help"
+---
+
+# admin (directory_v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws admin <resource> <method> [flags]
+```
+
+## API Resources
+
+### asps
+
+  - `delete` — Deletes an ASP issued by a user.
+  - `get` — Gets information about an ASP issued by a user.
+  - `list` — Lists the ASPs issued by a user.
+
+### channels
+
+  - `stop` — Stops watching resources through this channel.
+
+### chromeosdevices
+
+  - `action` — Use [BatchChangeChromeOsDeviceStatus](https://developers.google.com/workspace/admin/directory/reference/rest/v1/customer.devices.chromeos/batchChangeStatus) instead. Takes an action that affects a Chr
+  - `get` — Retrieves a Chrome OS device's properties.
+  - `list` — Retrieves a paginated list of Chrome OS devices within an account.
+  - `moveDevicesToOu` — Moves or inserts multiple Chrome OS devices to an organizational unit. You can move up to 50 devices at once.
+  - `patch` — Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`, or `annotatedAssetId`. This method supports [patch semantics](https://developers.google.c
+  - `update` — Updates a device's updatable properties, such as `annotatedUser`, `annotatedLocation`, `notes`, `orgUnitPath`, or `annotatedAssetId`.
+
+### customer
+
+  - `devices` — Operations on the 'devices' resource
+
+### customers
+
+  - `get` — Retrieves a customer.
+  - `patch` — Patches a customer.
+  - `update` — Updates a customer.
+  - `chrome` — Operations on the 'chrome' resource
+
+### domainAliases
+
+  - `delete` — Deletes a domain Alias of the customer.
+  - `get` — Retrieves a domain alias of the customer.
+  - `insert` — Inserts a domain alias of the customer.
+  - `list` — Lists the domain aliases of the customer.
+
+### domains
+
+  - `delete` — Deletes a domain of the customer.
+  - `get` — Retrieves a domain of the customer.
+  - `insert` — Inserts a domain of the customer.
+  - `list` — Lists the domains of the customer.
+
+### groups
+
+  - `delete` — Deletes a group.
+  - `get` — Retrieves a group's properties.
+  - `insert` — Creates a group.
+  - `list` — Retrieves all groups of a domain or of a user given a userKey (paginated).
+  - `patch` — Updates a group's properties. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
+  - `update` — Updates a group's properties.
+  - `aliases` — Operations on the 'aliases' resource
+
+### members
+
+  - `delete` — Removes a member from a group.
+  - `get` — Retrieves a group member's properties.
+  - `hasMember` — Checks whether the given user is a member of the group. Membership can be direct or nested, but if nested, the `memberKey` and `groupKey` must be entities in the same domain or an `Invalid input` erro
+  - `insert` — Adds a user to the specified group.
+  - `list` — Retrieves a paginated list of all members in a group. This method times out after 60 minutes. For more information, see [Troubleshoot error codes](https://developers.google.com/workspace/admin/directo
+  - `patch` — Updates the membership properties of a user in the specified group. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch).
+  - `update` — Updates the membership of a user in the specified group.
+
+### mobiledevices
+
+  - `action` — Takes an action that affects a mobile device. For example, remotely wiping a device.
+  - `delete` — Removes a mobile device.
+  - `get` — Retrieves a mobile device's properties.
+  - `list` — Retrieves a paginated list of all user-owned mobile devices for an account. To retrieve a list that includes company-owned devices, use the Cloud Identity [Devices API](https://cloud.google.com/identi
+
+### orgunits
+
+  - `delete` — Removes an organizational unit.
+  - `get` — Retrieves an organizational unit.
+  - `insert` — Adds an organizational unit.
+  - `list` — Retrieves a list of all organizational units for an account.
+  - `patch` — Updates an organizational unit. This method supports [patch semantics](https://developers.google.com/workspace/admin/directory/v1/guides/performance#patch)
+  - `update` — Updates an organizational unit.
+
+### privileges
+
+  - `list` — Retrieves a paginated list of all privileges for a customer.
+
+### resources
+
+  - `buildings` — Operations on the 'buildings' resource
+  - `calendars` — Operations on the 'calendars' resource
+  - `features` — Operations on the 'features' resource
+
+### roleAssignments
+
+  - `delete` — Deletes a role assignment.
+  - `get` — Retrieves a role assignment.
+  - `insert` — Creates a role assignment.
+  - `list` — Retrieves a paginated list of all roleAssignments.
+
+### roles
+
+  - `delete` — Deletes a role.
+  - `get` — Retrieves a role.
+  - `insert` — Creates a role.
+  - `list` — Retrieves a paginated list of all the roles in a domain.
+  - `patch` — Patches a role.
+  - `update` — Updates a role.
+
+### schemas
+
+  - `delete` — Deletes a schema.
+  - `get` — Retrieves a schema.
+  - `insert` — Creates a schema.
+  - `list` — Retrieves all schemas for a customer.
+  - `patch` — Patches a schema.
+  - `update` — Updates a schema.
+
+### tokens
+
+  - `delete` — Deletes all access tokens issued by a user for an application.
+  - `get` — Gets information about an access token issued by a user.
+  - `list` — Returns the set of tokens specified user has issued to 3rd party applications.
+
+### twoStepVerification
+
+  - `turnOff` — Turns off 2-Step Verification for user.
+
+### users
+
+  - `createGuest` — Create a guest user with access to a [subset of Workspace capabilities](https://support.google.com/a/answer/16558545?hl=en). This feature is currently in Alpha. Please reach out to support if you are 
+  - `delete` — Deletes a user.
+  - `get` — Retrieves a user.
+  - `insert` — Creates a user. Mutate calls immediately following user creation might sometimes fail as the user isn't fully created due to propagation delay in our backends. Check the error details for the "User cr
+  - `list` — Retrieves a paginated list of either deleted users or all users in a domain.
+  - `makeAdmin` — Makes a user a super administrator.
+  - `patch` — Updates a user using patch semantics. The update method should be used instead, because it also supports patch semantics and has better performance. If you're mapping an external identity to a Google 
+  - `signOut` — Signs a user out of all web and device sessions and reset their sign-in cookies. User will have to sign in by authenticating again.
+  - `undelete` — Undeletes a deleted user.
+  - `update` — Updates a user. This method supports patch semantics, meaning that you only need to include the fields you wish to update. Fields that are not present in the request will be preserved, and fields set 
+  - `watch` — Watches for changes in users list.
+  - `aliases` — Operations on the 'aliases' resource
+  - `photos` — Operations on the 'photos' resource
+
+### verificationCodes
+
+  - `generate` — Generates new backup verification codes for the user.
+  - `invalidate` — Invalidates the current backup verification codes for the user.
+  - `list` — Returns the current set of valid backup verification codes for the specified user.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws admin --help
+
+# Inspect a method's required params, types, and defaults
+gws schema admin.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-alertcenter/SKILL.md b/skills/gws-alertcenter/SKILL.md
new file mode 100644
index 00000000..02de50ae
--- /dev/null
+++ b/skills/gws-alertcenter/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: gws-alertcenter
+version: 1.0.0
+description: "USE WHEN the user wants to manage workspace security alerts via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws alertcenter --help"
+---
+
+# alertcenter (v1beta1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws alertcenter <resource> <method> [flags]
+```
+
+## API Resources
+
+### alerts
+
+  - `batchDelete` — Performs batch delete operation on alerts.
+  - `batchUndelete` — Performs batch undelete operation on alerts.
+  - `delete` — Marks the specified alert for deletion. An alert that has been marked for deletion is removed from Alert Center after 30 days. Marking an alert for deletion has no effect on an alert which has already
+  - `get` — Gets the specified alert. Attempting to get a nonexistent alert returns `NOT_FOUND` error.
+  - `getMetadata` — Returns the metadata of an alert. Attempting to get metadata for a non-existent alert returns `NOT_FOUND` error.
+  - `list` — Lists the alerts.
+  - `undelete` — Restores, or "undeletes", an alert that was marked for deletion within the past 30 days. Attempting to undelete an alert which was marked for deletion over 30 days ago (which has been removed from the
+  - `feedback` — Operations on the 'feedback' resource
+
+### v1beta1
+
+  - `getSettings` — Returns customer-level settings.
+  - `updateSettings` — Updates the customer-level settings.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws alertcenter --help
+
+# Inspect a method's required params, types, and defaults
+gws schema alertcenter.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-apps-script-push/SKILL.md b/skills/gws-apps-script-push/SKILL.md
new file mode 100644
index 00000000..ec5c14fd
--- /dev/null
+++ b/skills/gws-apps-script-push/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: gws-apps-script-push
+version: 1.0.0
+description: "Upload local files to an Apps Script project"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws apps-script +push --help"
+---
+
+# apps-script +push
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Upload local files to an Apps Script project
+
+## Usage
+
+```bash
+gws apps-script +push --script <ID>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--script` | ✓ | — | Script Project ID |
+| `--dir` | — | — | Directory containing script files (defaults to current dir) |
+
+## Examples
+
+```bash
+gws script +push --script SCRIPT_ID
+gws script +push --script SCRIPT_ID --dir ./src
+```
+
+## Tips
+
+- Supports .gs, .js, .html, and appsscript.json files.
+- Skips hidden files and node_modules automatically.
+- This replaces ALL files in the project.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-apps-script](../gws-apps-script/SKILL.md) — All manage and execute apps script projects commands
diff --git a/skills/gws-apps-script/SKILL.md b/skills/gws-apps-script/SKILL.md
new file mode 100644
index 00000000..4ebec093
--- /dev/null
+++ b/skills/gws-apps-script/SKILL.md
@@ -0,0 +1,61 @@
+---
+name: gws-apps-script
+version: 1.0.0
+description: "USE WHEN the user wants to manage and execute apps script projects via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws apps-script --help"
+---
+
+# apps-script (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws apps-script <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+push`](../gws-apps-script-push/SKILL.md) | Upload local files to an Apps Script project |
+
+## API Resources
+
+### processes
+
+  - `list` — List information about processes made by or on behalf of a user, such as process type and current status.
+  - `listScriptProcesses` — List information about a script's executed processes, such as process type and current status.
+
+### projects
+
+  - `create` — Creates a new, empty script project with no script files and a base manifest file.
+  - `get` — Gets a script project's metadata.
+  - `getContent` — Gets the content of the script project, including the code source and metadata for each script file.
+  - `getMetrics` — Get metrics data for scripts, such as number of executions and active users.
+  - `updateContent` — Updates the content of the specified script project. This content is stored as the HEAD version, and is used when the script is executed as a trigger, in the script editor, in add-on preview mode, or 
+  - `deployments` — Operations on the 'deployments' resource
+  - `versions` — Operations on the 'versions' resource
+
+### scripts
+
+  - `run` — 
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws apps-script --help
+
+# Inspect a method's required params, types, and defaults
+gws schema apps-script.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-calendar-agenda/SKILL.md b/skills/gws-calendar-agenda/SKILL.md
new file mode 100644
index 00000000..c5527ecf
--- /dev/null
+++ b/skills/gws-calendar-agenda/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: gws-calendar-agenda
+version: 1.0.0
+description: "Show upcoming events across all calendars"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws calendar +agenda --help"
+---
+
+# calendar +agenda
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Show upcoming events across all calendars
+
+## Usage
+
+```bash
+gws calendar +agenda
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--today` | — | — | Show today's events |
+| `--tomorrow` | — | — | Show tomorrow's events |
+| `--week` | — | — | Show this week's events |
+| `--days` | — | — | Number of days ahead to show |
+| `--calendar` | — | — | Filter to specific calendar name or ID |
+
+## Examples
+
+```bash
+gws calendar +agenda
+gws calendar +agenda --today
+gws calendar +agenda --week --format table
+gws calendar +agenda --days 3 --calendar 'Work'
+```
+
+## Tips
+
+- Read-only — never modifies events.
+- Queries all calendars by default; use --calendar to filter.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-calendar](../gws-calendar/SKILL.md) — All manage calendars and events commands
diff --git a/skills/gws-calendar-insert/SKILL.md b/skills/gws-calendar-insert/SKILL.md
new file mode 100644
index 00000000..58c882af
--- /dev/null
+++ b/skills/gws-calendar-insert/SKILL.md
@@ -0,0 +1,55 @@
+---
+name: gws-calendar-insert
+version: 1.0.0
+description: "create a new event"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws calendar +insert --help"
+---
+
+# calendar +insert
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+create a new event
+
+## Usage
+
+```bash
+gws calendar +insert --summary <TEXT> --start <TIME> --end <TIME>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--calendar` | — | primary | Calendar ID (default: primary) |
+| `--summary` | ✓ | — | Event summary/title |
+| `--start` | ✓ | — | Start time (ISO 8601, e.g., 2024-01-01T10:00:00Z) |
+| `--end` | ✓ | — | End time (ISO 8601) |
+| `--location` | — | — | Event location |
+| `--description` | — | — | Event description/body |
+| `--attendee` | — | — | Attendee email (can be used multiple times) |
+
+## Examples
+
+```bash
+gws calendar +insert --summary 'Standup' --start '2026-06-17T09:00:00-07:00' --end '2026-06-17T09:30:00-07:00'
+gws calendar +insert --summary 'Review' --start ... --end ... --attendee alice@example.com
+```
+
+## Tips
+
+- Use RFC3339 format for times (e.g. 2026-06-17T09:00:00-07:00).
+- For recurring events or conference links, use the raw API instead.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-calendar](../gws-calendar/SKILL.md) — All manage calendars and events commands
diff --git a/skills/gws-calendar/SKILL.md b/skills/gws-calendar/SKILL.md
new file mode 100644
index 00000000..834c89da
--- /dev/null
+++ b/skills/gws-calendar/SKILL.md
@@ -0,0 +1,108 @@
+---
+name: gws-calendar
+version: 1.0.0
+description: "USE WHEN the user wants to manage calendars and events via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws calendar --help"
+---
+
+# calendar (v3)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws calendar <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+insert`](../gws-calendar-insert/SKILL.md) | create a new event |
+| [`+agenda`](../gws-calendar-agenda/SKILL.md) | Show upcoming events across all calendars |
+
+## API Resources
+
+### acl
+
+  - `delete` — Deletes an access control rule.
+  - `get` — Returns an access control rule.
+  - `insert` — Creates an access control rule.
+  - `list` — Returns the rules in the access control list for the calendar.
+  - `patch` — Updates an access control rule. This method supports patch semantics.
+  - `update` — Updates an access control rule.
+  - `watch` — Watch for changes to ACL resources.
+
+### calendarList
+
+  - `delete` — Removes a calendar from the user's calendar list.
+  - `get` — Returns a calendar from the user's calendar list.
+  - `insert` — Inserts an existing calendar into the user's calendar list.
+  - `list` — Returns the calendars on the user's calendar list.
+  - `patch` — Updates an existing calendar on the user's calendar list. This method supports patch semantics.
+  - `update` — Updates an existing calendar on the user's calendar list.
+  - `watch` — Watch for changes to CalendarList resources.
+
+### calendars
+
+  - `clear` — Clears a primary calendar. This operation deletes all events associated with the primary calendar of an account.
+  - `delete` — Deletes a secondary calendar. Use calendars.clear for clearing all events on primary calendars.
+  - `get` — Returns metadata for a calendar.
+  - `insert` — Creates a secondary calendar.
+The authenticated user for the request is made the data owner of the new calendar.
+
+Note: We recommend to authenticate as the intended data owner of the calendar. You can
+  - `patch` — Updates metadata for a calendar. This method supports patch semantics.
+  - `update` — Updates metadata for a calendar.
+
+### channels
+
+  - `stop` — Stop watching resources through this channel
+
+### colors
+
+  - `get` — Returns the color definitions for calendars and events.
+
+### events
+
+  - `delete` — Deletes an event.
+  - `get` — Returns an event based on its Google Calendar ID. To retrieve an event using its iCalendar ID, call the events.list method using the iCalUID parameter.
+  - `import` — Imports an event. This operation is used to add a private copy of an existing event to a calendar. Only events with an eventType of default may be imported.
+Deprecated behavior: If a non-default event
+  - `insert` — Creates an event.
+  - `instances` — Returns instances of the specified recurring event.
+  - `list` — Returns events on the specified calendar.
+  - `move` — Moves an event to another calendar, i.e. changes an event's organizer. Note that only default events can be moved; birthday, focusTime, fromGmail, outOfOffice and workingLocation events cannot be move
+  - `patch` — Updates an event. This method supports patch semantics.
+  - `quickAdd` — Creates an event based on a simple text string.
+  - `update` — Updates an event.
+  - `watch` — Watch for changes to Events resources.
+
+### freebusy
+
+  - `query` — Returns free/busy information for a set of calendars.
+
+### settings
+
+  - `get` — Returns a single user setting.
+  - `list` — Returns all user settings for the authenticated user.
+  - `watch` — Watch for changes to Settings resources.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws calendar --help
+
+# Inspect a method's required params, types, and defaults
+gws schema calendar.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-chat-send/SKILL.md b/skills/gws-chat-send/SKILL.md
new file mode 100644
index 00000000..6a9517e9
--- /dev/null
+++ b/skills/gws-chat-send/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: gws-chat-send
+version: 1.0.0
+description: "Send a message to a space"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws chat +send --help"
+---
+
+# chat +send
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Send a message to a space
+
+## Usage
+
+```bash
+gws chat +send --space <NAME> --text <TEXT>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--space` | ✓ | — | Space name (e.g. spaces/AAAA...) |
+| `--text` | ✓ | — | Message text (plain text) |
+
+## Examples
+
+```bash
+gws chat +send --space spaces/AAAAxxxx --text 'Hello team!'
+```
+
+## Tips
+
+- Use 'gws chat spaces list' to find space names.
+- For cards or threaded replies, use the raw API instead.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-chat](../gws-chat/SKILL.md) — All manage chat spaces and messages commands
diff --git a/skills/gws-chat/SKILL.md b/skills/gws-chat/SKILL.md
new file mode 100644
index 00000000..3be23749
--- /dev/null
+++ b/skills/gws-chat/SKILL.md
@@ -0,0 +1,73 @@
+---
+name: gws-chat
+version: 1.0.0
+description: "USE WHEN the user wants to manage chat spaces and messages via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws chat --help"
+---
+
+# chat (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws chat <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+send`](../gws-chat-send/SKILL.md) | Send a message to a space |
+
+## API Resources
+
+### customEmojis
+
+  - `create` — Creates a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [Learn about cu
+  - `delete` — Deletes a custom emoji. By default, users can only delete custom emoji they created. [Emoji managers](https://support.google.com/a/answer/12850085) assigned by the administrator can delete any custom 
+  - `get` — Returns details about a custom emoji. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more information, see [
+  - `list` — Lists custom emojis visible to the authenticated user. Custom emojis are only available for Google Workspace accounts, and the administrator must turn custom emojis on for the organization. For more i
+
+### media
+
+  - `download` — Downloads media. Download is supported on the URI `/v1/media/{+name}?alt=media`.
+  - `upload` — Uploads an attachment. For an example, see [Upload media as a file attachment](https://developers.google.com/workspace/chat/upload-media-attachments). Requires user [authentication](https://developers
+
+### spaces
+
+  - `completeImport` — Completes the [import process](https://developers.google.com/workspace/chat/import-data) for the specified space and makes it visible to users. Requires [user authentication](https://developers.google
+  - `create` — Creates a space. Can be used to create a named space, or a group chat in `Import mode`. For an example, see [Create a space](https://developers.google.com/workspace/chat/create-spaces). Supports the f
+  - `delete` — Deletes a named space. Always performs a cascading delete, which means that the space's child resources—like messages posted in the space and memberships in the space—are also deleted. For an example,
+  - `findDirectMessage` — Returns the existing direct message with the specified user. If no direct message space is found, returns a `404 NOT_FOUND` error. For an example, see [Find a direct message](/chat/api/guides/v1/space
+  - `get` — Returns details about a space. For an example, see [Get details about a space](https://developers.google.com/workspace/chat/get-spaces). Supports the following types of [authentication](https://develo
+  - `list` — Lists spaces the caller is a member of. Group chats and DMs aren't listed until the first message is sent. For an example, see [List spaces](https://developers.google.com/workspace/chat/list-spaces). 
+  - `patch` — Updates a space. For an example, see [Update a space](https://developers.google.com/workspace/chat/update-spaces). If you're updating the `displayName` field and receive the error message `ALREADY_EXI
+  - `search` — Returns a list of spaces in a Google Workspace organization based on an administrator's search. In the request, set `use_admin_access` to `true`. For an example, see [Search for and manage spaces](htt
+  - `setup` — Creates a space and adds specified users to it. The calling user is automatically added to the space, and shouldn't be specified as a membership in the request. For an example, see [Set up a space wit
+  - `members` — Operations on the 'members' resource
+  - `messages` — Operations on the 'messages' resource
+  - `spaceEvents` — Operations on the 'spaceEvents' resource
+
+### users
+
+  - `spaces` — Operations on the 'spaces' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws chat --help
+
+# Inspect a method's required params, types, and defaults
+gws schema chat.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-classroom/SKILL.md b/skills/gws-classroom/SKILL.md
new file mode 100644
index 00000000..d8227de5
--- /dev/null
+++ b/skills/gws-classroom/SKILL.md
@@ -0,0 +1,75 @@
+---
+name: gws-classroom
+version: 1.0.0
+description: "USE WHEN the user wants to manage classes, rosters, and coursework via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws classroom --help"
+---
+
+# classroom (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws classroom <resource> <method> [flags]
+```
+
+## API Resources
+
+### courses
+
+  - `create` — Creates a course. The user specified in `ownerId` is the owner of the created course and added as a teacher. A non-admin requesting user can only create a course with themselves as the owner. Domain a
+  - `delete` — Deletes a course. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to delete the requested course or for access errors. * `NOT_FOUND` if no 
+  - `get` — Returns a course. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to access the requested course or for access errors. * `NOT_FOUND` if no 
+  - `getGradingPeriodSettings` — Returns the grading period settings in a course. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user isn't permitted to access the grading period settings in th
+  - `list` — Returns a list of courses that the requesting user is permitted to view, restricted to those that match the request. Returned courses are ordered by creation time, with the most recently created comin
+  - `patch` — Updates one or more fields in a course. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to modify the requested course or for access errors
+  - `update` — Updates a course. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to modify the requested course or for access errors. * `NOT_FOUND` if no 
+  - `updateGradingPeriodSettings` — Updates grading period settings of a course. Individual grading periods can be added, removed, or modified using this method. The requesting user and course owner must be eligible to modify Grading Pe
+  - `aliases` — Operations on the 'aliases' resource
+  - `announcements` — Operations on the 'announcements' resource
+  - `courseWork` — Operations on the 'courseWork' resource
+  - `courseWorkMaterials` — Operations on the 'courseWorkMaterials' resource
+  - `posts` — Operations on the 'posts' resource
+  - `studentGroups` — Operations on the 'studentGroups' resource
+  - `students` — Operations on the 'students' resource
+  - `teachers` — Operations on the 'teachers' resource
+  - `topics` — Operations on the 'topics' resource
+
+### invitations
+
+  - `accept` — Accepts an invitation, removing it and adding the invited user to the teachers or students (as appropriate) of the specified course. Only the invited user may accept an invitation. This method returns
+  - `create` — Creates an invitation. Only one invitation for a user and course may exist at a time. Delete and re-create an invitation to make changes. This method returns the following error codes: * `PERMISSION_D
+  - `delete` — Deletes an invitation. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to delete the requested invitation or for access errors. * `NOT_FOUN
+  - `get` — Returns an invitation. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to view the requested invitation or for access errors. * `NOT_FOUND`
+  - `list` — Returns a list of invitations that the requesting user is permitted to view, restricted to those that match the list request. *Note:* At least one of `user_id` or `course_id` must be supplied. Both fi
+
+### registrations
+
+  - `create` — Creates a `Registration`, causing Classroom to start sending notifications from the provided `feed` to the destination provided in `cloudPubSubTopic`. Returns the created `Registration`. Currently, th
+  - `delete` — Deletes a `Registration`, causing Classroom to stop sending notifications for that `Registration`.
+
+### userProfiles
+
+  - `get` — Returns a user profile. This method returns the following error codes: * `PERMISSION_DENIED` if the requesting user is not permitted to access this user profile, if no profile exists with the requeste
+  - `guardianInvitations` — Operations on the 'guardianInvitations' resource
+  - `guardians` — Operations on the 'guardians' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws classroom --help
+
+# Inspect a method's required params, types, and defaults
+gws schema classroom.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-cloudidentity/SKILL.md b/skills/gws-cloudidentity/SKILL.md
new file mode 100644
index 00000000..61f68e1a
--- /dev/null
+++ b/skills/gws-cloudidentity/SKILL.md
@@ -0,0 +1,93 @@
+---
+name: gws-cloudidentity
+version: 1.0.0
+description: "USE WHEN the user wants to manage identity groups and memberships via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws cloudidentity --help"
+---
+
+# cloudidentity (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws cloudidentity <resource> <method> [flags]
+```
+
+## API Resources
+
+### customers
+
+  - `userinvitations` — Operations on the 'userinvitations' resource
+
+### devices
+
+  - `cancelWipe` — Cancels an unfinished device wipe. This operation can be used to cancel device wipe in the gap between the wipe operation returning success and the device being wiped. This operation is possible when 
+  - `create` — Creates a device. Only company-owned device may be created. **Note**: This method is available only to customers who have one of the following SKUs: Enterprise Standard, Enterprise Plus, Enterprise fo
+  - `delete` — Deletes the specified device.
+  - `get` — Retrieves the specified device.
+  - `list` — Lists/Searches devices.
+  - `wipe` — Wipes all data on the specified device.
+  - `deviceUsers` — Operations on the 'deviceUsers' resource
+
+### groups
+
+  - `create` — Creates a Group.
+  - `delete` — Deletes a `Group`.
+  - `get` — Retrieves a `Group`.
+  - `getSecuritySettings` — Get Security Settings
+  - `list` — Lists the `Group` resources under a customer or namespace.
+  - `lookup` — Looks up the [resource name](https://cloud.google.com/apis/design/resource_names) of a `Group` by its `EntityKey`.
+  - `patch` — Updates a `Group`.
+  - `search` — Searches for `Group` resources matching a specified query.
+  - `updateSecuritySettings` — Update Security Settings
+  - `memberships` — Operations on the 'memberships' resource
+
+### inboundOidcSsoProfiles
+
+  - `create` — Creates an InboundOidcSsoProfile for a customer. When the target customer has enabled [Multi-party approval for sensitive actions](https://support.google.com/a/answer/13790448), the `Operation` in the
+  - `delete` — Deletes an InboundOidcSsoProfile.
+  - `get` — Gets an InboundOidcSsoProfile.
+  - `list` — Lists InboundOidcSsoProfile objects for a Google enterprise customer.
+  - `patch` — Updates an InboundOidcSsoProfile. When the target customer has enabled [Multi-party approval for sensitive actions](https://support.google.com/a/answer/13790448), the `Operation` in the response will 
+
+### inboundSamlSsoProfiles
+
+  - `create` — Creates an InboundSamlSsoProfile for a customer. When the target customer has enabled [Multi-party approval for sensitive actions](https://support.google.com/a/answer/13790448), the `Operation` in the
+  - `delete` — Deletes an InboundSamlSsoProfile.
+  - `get` — Gets an InboundSamlSsoProfile.
+  - `list` — Lists InboundSamlSsoProfiles for a customer.
+  - `patch` — Updates an InboundSamlSsoProfile. When the target customer has enabled [Multi-party approval for sensitive actions](https://support.google.com/a/answer/13790448), the `Operation` in the response will 
+  - `idpCredentials` — Operations on the 'idpCredentials' resource
+
+### inboundSsoAssignments
+
+  - `create` — Creates an InboundSsoAssignment for users and devices in a `Customer` under a given `Group` or `OrgUnit`.
+  - `delete` — Deletes an InboundSsoAssignment. To disable SSO, Create (or Update) an assignment that has `sso_mode` == `SSO_OFF`.
+  - `get` — Gets an InboundSsoAssignment.
+  - `list` — Lists the InboundSsoAssignments for a `Customer`.
+  - `patch` — Updates an InboundSsoAssignment. The body of this request is the `inbound_sso_assignment` field and the `update_mask` is relative to that. For example: a PATCH to `/v1/inboundSsoAssignments/0abcdefg12
+
+### policies
+
+  - `get` — Get a policy.
+  - `list` — List policies.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws cloudidentity --help
+
+# Inspect a method's required params, types, and defaults
+gws schema cloudidentity.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-docs-write/SKILL.md b/skills/gws-docs-write/SKILL.md
new file mode 100644
index 00000000..c9e358d0
--- /dev/null
+++ b/skills/gws-docs-write/SKILL.md
@@ -0,0 +1,49 @@
+---
+name: gws-docs-write
+version: 1.0.0
+description: "Append text to a document"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws docs +write --help"
+---
+
+# docs +write
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Append text to a document
+
+## Usage
+
+```bash
+gws docs +write --document <ID> --text <TEXT>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--document` | ✓ | — | Document ID |
+| `--text` | ✓ | — | Text to append (plain text) |
+
+## Examples
+
+```bash
+gws docs +write --document DOC_ID --text 'Hello, world!'
+```
+
+## Tips
+
+- Text is inserted at the end of the document body.
+- For rich formatting, use the raw batchUpdate API instead.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-docs](../gws-docs/SKILL.md) — All read and write google docs commands
diff --git a/skills/gws-docs/SKILL.md b/skills/gws-docs/SKILL.md
new file mode 100644
index 00000000..78fa9763
--- /dev/null
+++ b/skills/gws-docs/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: gws-docs
+version: 1.0.0
+description: "USE WHEN the user wants to read and write google docs via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws docs --help"
+---
+
+# docs (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws docs <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+write`](../gws-docs-write/SKILL.md) | Append text to a document |
+
+## API Resources
+
+### documents
+
+  - `batchUpdate` — Applies one or more updates to the document. Each request is validated before being applied. If any request is not valid, then the entire request will fail and nothing will be applied. Some requests h
+  - `create` — Creates a blank document using the title given in the request. Other fields in the request, including any provided content, are ignored. Returns the created document.
+  - `get` — Gets the latest version of the specified document.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws docs --help
+
+# Inspect a method's required params, types, and defaults
+gws schema docs.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-drive-upload/SKILL.md b/skills/gws-drive-upload/SKILL.md
new file mode 100644
index 00000000..ab6f1350
--- /dev/null
+++ b/skills/gws-drive-upload/SKILL.md
@@ -0,0 +1,52 @@
+---
+name: gws-drive-upload
+version: 1.0.0
+description: "Upload a file with automatic metadata"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws drive +upload --help"
+---
+
+# drive +upload
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Upload a file with automatic metadata
+
+## Usage
+
+```bash
+gws drive +upload <file>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `<file>` | ✓ | — | Path to file to upload |
+| `--parent` | — | — | Parent folder ID |
+| `--name` | — | — | Target filename (defaults to source filename) |
+
+## Examples
+
+```bash
+gws drive +upload ./report.pdf
+gws drive +upload ./report.pdf --parent FOLDER_ID
+gws drive +upload ./data.csv --name 'Sales Data.csv'
+```
+
+## Tips
+
+- MIME type is detected automatically.
+- Filename is inferred from the local path unless --name is given.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-drive](../gws-drive/SKILL.md) — All manage files, folders, and shared drives commands
diff --git a/skills/gws-drive/SKILL.md b/skills/gws-drive/SKILL.md
new file mode 100644
index 00000000..ed875383
--- /dev/null
+++ b/skills/gws-drive/SKILL.md
@@ -0,0 +1,141 @@
+---
+name: gws-drive
+version: 1.0.0
+description: "USE WHEN the user wants to manage files, folders, and shared drives via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws drive --help"
+---
+
+# drive (v3)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws drive <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+upload`](../gws-drive-upload/SKILL.md) | Upload a file with automatic metadata |
+
+## API Resources
+
+### about
+
+  - `get` — Gets information about the user, the user's Drive, and system capabilities. For more information, see [Return user info](https://developers.google.com/workspace/drive/api/guides/user-info). Required: 
+
+### accessproposals
+
+  - `get` — Retrieves an access proposal by ID. For more information, see [Manage pending access proposals](https://developers.google.com/workspace/drive/api/guides/pending-access).
+  - `list` — List the access proposals on a file. For more information, see [Manage pending access proposals](https://developers.google.com/workspace/drive/api/guides/pending-access). Note: Only approvers are able
+  - `resolve` — Approves or denies an access proposal. For more information, see [Manage pending access proposals](https://developers.google.com/workspace/drive/api/guides/pending-access).
+
+### approvals
+
+  - `get` — Gets an Approval by ID.
+  - `list` — Lists the Approvals on a file.
+
+### apps
+
+  - `get` — Gets a specific app. For more information, see [Return user info](https://developers.google.com/workspace/drive/api/guides/user-info).
+  - `list` — Lists a user's installed apps. For more information, see [Return user info](https://developers.google.com/workspace/drive/api/guides/user-info).
+
+### changes
+
+  - `getStartPageToken` — Gets the starting pageToken for listing future changes. For more information, see [Retrieve changes](https://developers.google.com/workspace/drive/api/guides/manage-changes).
+  - `list` — Lists the changes for a user or shared drive. For more information, see [Retrieve changes](https://developers.google.com/workspace/drive/api/guides/manage-changes).
+  - `watch` — Subscribes to changes for a user. For more information, see [Notifications for resource changes](https://developers.google.com/workspace/drive/api/guides/push).
+
+### channels
+
+  - `stop` — Stops watching resources through this channel. For more information, see [Notifications for resource changes](https://developers.google.com/workspace/drive/api/guides/push).
+
+### comments
+
+  - `create` — Creates a comment on a file. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments). Required: The `fields` parameter must be
+  - `delete` — Deletes a comment. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+  - `get` — Gets a comment by ID. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments). Required: The `fields` parameter must be set. T
+  - `list` — Lists a file's comments. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments). Required: The `fields` parameter must be set
+  - `update` — Updates a comment with patch semantics. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments). Required: The `fields` parame
+
+### drives
+
+  - `create` — Creates a shared drive. For more information, see [Manage shared drives](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives).
+  - `delete` — Permanently deletes a shared drive for which the user is an `organizer`. The shared drive cannot contain any untrashed items. For more information, see [Manage shared drives](https://developers.google
+  - `get` — Gets a shared drive's metadata by ID. For more information, see [Manage shared drives](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives).
+  - `hide` — Hides a shared drive from the default view. For more information, see [Manage shared drives](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives).
+  - `list` —  Lists the user's shared drives. This method accepts the `q` parameter, which is a search query combining one or more search terms. For more information, see the [Search for shared drives](/workspace/
+  - `unhide` — Restores a shared drive to the default view. For more information, see [Manage shared drives](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives).
+  - `update` — Updates the metadata for a shared drive. For more information, see [Manage shared drives](https://developers.google.com/workspace/drive/api/guides/manage-shareddrives).
+
+### files
+
+  - `copy` — Creates a copy of a file and applies any requested updates with patch semantics. For more information, see [Create and manage files](https://developers.google.com/workspace/drive/api/guides/create-fil
+  - `create` —  Creates a file. For more information, see [Create and manage files](/workspace/drive/api/guides/create-file). This method supports an */upload* URI and accepts uploaded media with the following chara
+  - `delete` — Permanently deletes a file owned by the user without moving it to the trash. For more information, see [Trash or delete files and folders](https://developers.google.com/workspace/drive/api/guides/dele
+  - `download` — Downloads the content of a file. For more information, see [Download and export files](https://developers.google.com/workspace/drive/api/guides/manage-downloads). Operations are valid for 24 hours fro
+  - `emptyTrash` — Permanently deletes all of the user's trashed files. For more information, see [Trash or delete files and folders](https://developers.google.com/workspace/drive/api/guides/delete).
+  - `export` — Exports a Google Workspace document to the requested MIME type and returns exported byte content. For more information, see [Download and export files](https://developers.google.com/workspace/drive/ap
+  - `generateIds` — Generates a set of file IDs which can be provided in create or copy requests. For more information, see [Create and manage files](https://developers.google.com/workspace/drive/api/guides/create-file).
+  - `get` —  Gets a file's metadata or content by ID. For more information, see [Search for files and folders](/workspace/drive/api/guides/search-files). If you provide the URL parameter `alt=media`, then the res
+  - `list` —  Lists the user's files. For more information, see [Search for files and folders](/workspace/drive/api/guides/search-files). This method accepts the `q` parameter, which is a search query combining on
+  - `listLabels` — Lists the labels on a file. For more information, see [List labels on a file](https://developers.google.com/workspace/drive/api/guides/list-labels).
+  - `modifyLabels` — Modifies the set of labels applied to a file. For more information, see [Set a label field on a file](https://developers.google.com/workspace/drive/api/guides/set-label). Returns a list of the labels 
+  - `update` —  Updates a file's metadata, content, or both. When calling this method, only populate fields in the request that you want to modify. When updating fields, some fields might be changed automatically, s
+  - `watch` — Subscribes to changes to a file. For more information, see [Notifications for resource changes](https://developers.google.com/workspace/drive/api/guides/push).
+
+### operations
+
+  - `get` — Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+### permissions
+
+  - `create` — Creates a permission for a file or shared drive. For more information, see [Share files, folders, and drives](https://developers.google.com/workspace/drive/api/guides/manage-sharing). **Warning:** Con
+  - `delete` — Deletes a permission. For more information, see [Share files, folders, and drives](https://developers.google.com/workspace/drive/api/guides/manage-sharing). **Warning:** Concurrent permissions operati
+  - `get` — Gets a permission by ID. For more information, see [Share files, folders, and drives](https://developers.google.com/workspace/drive/api/guides/manage-sharing).
+  - `list` — Lists a file's or shared drive's permissions. For more information, see [Share files, folders, and drives](https://developers.google.com/workspace/drive/api/guides/manage-sharing).
+  - `update` — Updates a permission with patch semantics. For more information, see [Share files, folders, and drives](https://developers.google.com/workspace/drive/api/guides/manage-sharing). **Warning:** Concurren
+
+### replies
+
+  - `create` — Creates a reply to a comment. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+  - `delete` — Deletes a reply. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+  - `get` — Gets a reply by ID. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+  - `list` — Lists a comment's replies. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+  - `update` — Updates a reply with patch semantics. For more information, see [Manage comments and replies](https://developers.google.com/workspace/drive/api/guides/manage-comments).
+
+### revisions
+
+  - `delete` — Permanently deletes a file version. You can only delete revisions for files with binary content in Google Drive, like images or videos. Revisions for other files, like Google Docs or Sheets, and the l
+  - `get` — Gets a revision's metadata or content by ID. For more information, see [Manage file revisions](https://developers.google.com/workspace/drive/api/guides/manage-revisions).
+  - `list` — Lists a file's revisions. For more information, see [Manage file revisions](https://developers.google.com/workspace/drive/api/guides/manage-revisions). **Important:** The list of revisions returned by
+  - `update` — Updates a revision with patch semantics. For more information, see [Manage file revisions](https://developers.google.com/workspace/drive/api/guides/manage-revisions).
+
+### teamdrives
+
+  - `create` — Deprecated: Use `drives.create` instead.
+  - `delete` — Deprecated: Use `drives.delete` instead.
+  - `get` — Deprecated: Use `drives.get` instead.
+  - `list` — Deprecated: Use `drives.list` instead.
+  - `update` — Deprecated: Use `drives.update` instead.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws drive --help
+
+# Inspect a method's required params, types, and defaults
+gws schema drive.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-events-renew/SKILL.md b/skills/gws-events-renew/SKILL.md
new file mode 100644
index 00000000..34f4f319
--- /dev/null
+++ b/skills/gws-events-renew/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: gws-events-renew
+version: 1.0.0
+description: "Renew/reactivate Workspace Events subscriptions"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws events +renew --help"
+---
+
+# events +renew
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Renew/reactivate Workspace Events subscriptions
+
+## Usage
+
+```bash
+gws events +renew
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--name` | — | — | Subscription name to reactivate (e.g., subscriptions/SUB_ID) |
+| `--all` | — | — | Renew all subscriptions expiring within --within window |
+| `--within` | — | 1h | Time window for --all (e.g., 1h, 30m, 2d) |
+
+## Examples
+
+```bash
+gws events +renew --name subscriptions/SUB_ID
+gws events +renew --all --within 2d
+```
+
+## Tips
+
+- Subscriptions expire if not renewed periodically.
+- Use --all with a cron job to keep subscriptions alive.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-events](../gws-events/SKILL.md) — All subscribe to google workspace events commands
diff --git a/skills/gws-events-subscribe/SKILL.md b/skills/gws-events-subscribe/SKILL.md
new file mode 100644
index 00000000..29acd7d9
--- /dev/null
+++ b/skills/gws-events-subscribe/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: gws-events-subscribe
+version: 1.0.0
+description: "Subscribe to Workspace events and stream them as NDJSON"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws events +subscribe --help"
+---
+
+# events +subscribe
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Subscribe to Workspace events and stream them as NDJSON
+
+## Usage
+
+```bash
+gws events +subscribe
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--target` | — | — | Workspace resource URI (e.g., //chat.googleapis.com/spaces/SPACE_ID) |
+| `--event-types` | — | — | Comma-separated CloudEvents types to subscribe to |
+| `--project` | — | — | GCP project ID for Pub/Sub resources |
+| `--subscription` | — | — | Existing Pub/Sub subscription name (skip setup) |
+| `--max-messages` | — | 10 | Max messages per pull batch (default: 10) |
+| `--poll-interval` | — | 5 | Seconds between pulls (default: 5) |
+| `--once` | — | — | Pull once and exit |
+| `--cleanup` | — | — | Delete created Pub/Sub resources on exit |
+| `--no-ack` | — | — | Don't auto-acknowledge messages |
+| `--output-dir` | — | — | Write each event to a separate JSON file in this directory |
+
+## Examples
+
+```bash
+gws events +subscribe --target '//chat.googleapis.com/spaces/SPACE' --event-types 'google.workspace.chat.message.v1.created' --project my-project
+gws events +subscribe --subscription projects/p/subscriptions/my-sub --once
+gws events +subscribe ... --cleanup --output-dir ./events
+```
+
+## Tips
+
+- Without --cleanup, Pub/Sub resources persist for reconnection.
+- Press Ctrl-C to stop gracefully.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-events](../gws-events/SKILL.md) — All subscribe to google workspace events commands
diff --git a/skills/gws-events/SKILL.md b/skills/gws-events/SKILL.md
new file mode 100644
index 00000000..e1e07494
--- /dev/null
+++ b/skills/gws-events/SKILL.md
@@ -0,0 +1,67 @@
+---
+name: gws-events
+version: 1.0.0
+description: "USE WHEN the user wants to subscribe to google workspace events via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws events --help"
+---
+
+# events (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws events <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+subscribe`](../gws-events-subscribe/SKILL.md) | Subscribe to Workspace events and stream them as NDJSON |
+| [`+renew`](../gws-events-renew/SKILL.md) | Renew/reactivate Workspace Events subscriptions |
+
+## API Resources
+
+### message
+
+  - `stream` — SendStreamingMessage is a streaming call that will return a stream of task update events until the Task is in an interrupted or terminal state.
+
+### operations
+
+  - `get` — Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+
+### subscriptions
+
+  - `create` — Creates a Google Workspace subscription. To learn how to use this method, see [Create a Google Workspace subscription](https://developers.google.com/workspace/events/guides/create-subscription). For a
+  - `delete` — Deletes a Google Workspace subscription. To learn how to use this method, see [Delete a Google Workspace subscription](https://developers.google.com/workspace/events/guides/delete-subscription).
+  - `get` — Gets details about a Google Workspace subscription. To learn how to use this method, see [Get details about a Google Workspace subscription](https://developers.google.com/workspace/events/guides/get-s
+  - `list` — Lists Google Workspace subscriptions. To learn how to use this method, see [List Google Workspace subscriptions](https://developers.google.com/workspace/events/guides/list-subscriptions).
+  - `patch` — Updates or renews a Google Workspace subscription. To learn how to use this method, see [Update or renew a Google Workspace subscription](https://developers.google.com/workspace/events/guides/update-s
+  - `reactivate` — Reactivates a suspended Google Workspace subscription. This method resets your subscription's `State` field to `ACTIVE`. Before you use this method, you must fix the error that suspended the subscript
+
+### tasks
+
+  - `cancel` — Cancel a task from the agent. If supported one should expect no more task updates for the task.
+  - `get` — Get the current state of a task from the agent.
+  - `subscribe` — TaskSubscription is a streaming call that will return a stream of task update events. This attaches the stream to an existing in process task. If the task is complete the stream will return the comple
+  - `pushNotificationConfigs` — Operations on the 'pushNotificationConfigs' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws events --help
+
+# Inspect a method's required params, types, and defaults
+gws schema events.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-forms/SKILL.md b/skills/gws-forms/SKILL.md
new file mode 100644
index 00000000..38a9f65a
--- /dev/null
+++ b/skills/gws-forms/SKILL.md
@@ -0,0 +1,45 @@
+---
+name: gws-forms
+version: 1.0.0
+description: "USE WHEN the user wants to read and write google forms via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws forms --help"
+---
+
+# forms (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws forms <resource> <method> [flags]
+```
+
+## API Resources
+
+### forms
+
+  - `batchUpdate` — Change the form with a batch of updates.
+  - `create` — Create a new form using the title given in the provided form message in the request. *Important:* Only the form.info.title and form.info.document_title fields are copied to the new form. All other fie
+  - `get` — Get a form.
+  - `setPublishSettings` — Updates the publish settings of a form. Legacy forms aren't supported because they don't have the `publish_settings` field.
+  - `responses` — Operations on the 'responses' resource
+  - `watches` — Operations on the 'watches' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws forms --help
+
+# Inspect a method's required params, types, and defaults
+gws schema forms.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-gmail-send/SKILL.md b/skills/gws-gmail-send/SKILL.md
new file mode 100644
index 00000000..d8ff8fd6
--- /dev/null
+++ b/skills/gws-gmail-send/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: gws-gmail-send
+version: 1.0.0
+description: "Send an email"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws gmail +send --help"
+---
+
+# gmail +send
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Send an email
+
+## Usage
+
+```bash
+gws gmail +send --to <EMAIL> --subject <SUBJECT> --body <TEXT>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--to` | ✓ | — | Recipient email address |
+| `--subject` | ✓ | — | Email subject |
+| `--body` | ✓ | — | Email body (plain text) |
+
+## Examples
+
+```bash
+gws gmail +send --to alice@example.com --subject 'Hello' --body 'Hi Alice!'
+```
+
+## Tips
+
+- Handles RFC 2822 formatting and base64 encoding automatically.
+- For HTML bodies, attachments, or CC/BCC, use the raw API instead:
+- gws gmail users messages send --json '...'
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands
diff --git a/skills/gws-gmail-triage/SKILL.md b/skills/gws-gmail-triage/SKILL.md
new file mode 100644
index 00000000..2d7f4a70
--- /dev/null
+++ b/skills/gws-gmail-triage/SKILL.md
@@ -0,0 +1,50 @@
+---
+name: gws-gmail-triage
+version: 1.0.0
+description: "Show unread inbox summary (sender, subject, date)"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws gmail +triage --help"
+---
+
+# gmail +triage
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Show unread inbox summary (sender, subject, date)
+
+## Usage
+
+```bash
+gws gmail +triage
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--max` | — | 20 | Maximum messages to show (default: 20) |
+| `--query` | — | — | Gmail search query (default: is:unread) |
+| `--labels` | — | — | Include label names in output |
+
+## Examples
+
+```bash
+gws gmail +triage
+gws gmail +triage --max 5 --query 'from:boss'
+gws gmail +triage --format json | jq '.[].subject'
+gws gmail +triage --labels
+```
+
+## Tips
+
+- Read-only — never modifies your mailbox.
+- Defaults to table output format.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands
diff --git a/skills/gws-gmail-watch/SKILL.md b/skills/gws-gmail-watch/SKILL.md
new file mode 100644
index 00000000..c30039ad
--- /dev/null
+++ b/skills/gws-gmail-watch/SKILL.md
@@ -0,0 +1,58 @@
+---
+name: gws-gmail-watch
+version: 1.0.0
+description: "Watch for new emails and stream them as NDJSON"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws gmail +watch --help"
+---
+
+# gmail +watch
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Watch for new emails and stream them as NDJSON
+
+## Usage
+
+```bash
+gws gmail +watch
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--project` | — | — | GCP project ID for Pub/Sub resources |
+| `--subscription` | — | — | Existing Pub/Sub subscription name (skip setup) |
+| `--topic` | — | — | Existing Pub/Sub topic with Gmail push permission already granted |
+| `--label-ids` | — | — | Comma-separated Gmail label IDs to filter (e.g., INBOX,UNREAD) |
+| `--max-messages` | — | 10 | Max messages per pull batch |
+| `--poll-interval` | — | 5 | Seconds between pulls |
+| `--msg-format` | — | full | Gmail message format: full, metadata, minimal, raw |
+| `--once` | — | — | Pull once and exit |
+| `--cleanup` | — | — | Delete created Pub/Sub resources on exit |
+| `--output-dir` | — | — | Write each message to a separate JSON file in this directory |
+
+## Examples
+
+```bash
+gws gmail +watch --project my-gcp-project
+gws gmail +watch --project my-project --label-ids INBOX --once
+gws gmail +watch --subscription projects/p/subscriptions/my-sub
+gws gmail +watch --project my-project --cleanup --output-dir ./emails
+```
+
+## Tips
+
+- Gmail watch expires after 7 days — re-run to renew.
+- Without --cleanup, Pub/Sub resources persist for reconnection.
+- Press Ctrl-C to stop gracefully.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-gmail](../gws-gmail/SKILL.md) — All send, read, and manage email commands
diff --git a/skills/gws-gmail/SKILL.md b/skills/gws-gmail/SKILL.md
new file mode 100644
index 00000000..f7cb7090
--- /dev/null
+++ b/skills/gws-gmail/SKILL.md
@@ -0,0 +1,56 @@
+---
+name: gws-gmail
+version: 1.0.0
+description: "USE WHEN the user wants to send, read, and manage email via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws gmail --help"
+---
+
+# gmail (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws gmail <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+send`](../gws-gmail-send/SKILL.md) | Send an email |
+| [`+triage`](../gws-gmail-triage/SKILL.md) | Show unread inbox summary (sender, subject, date) |
+| [`+watch`](../gws-gmail-watch/SKILL.md) | Watch for new emails and stream them as NDJSON |
+
+## API Resources
+
+### users
+
+  - `getProfile` — Gets the current user's Gmail profile.
+  - `stop` — Stop receiving push notifications for the given user mailbox.
+  - `watch` — Set up or update a push notification watch on the given user mailbox.
+  - `drafts` — Operations on the 'drafts' resource
+  - `history` — Operations on the 'history' resource
+  - `labels` — Operations on the 'labels' resource
+  - `messages` — Operations on the 'messages' resource
+  - `settings` — Operations on the 'settings' resource
+  - `threads` — Operations on the 'threads' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws gmail --help
+
+# Inspect a method's required params, types, and defaults
+gws schema gmail.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-groupssettings/SKILL.md b/skills/gws-groupssettings/SKILL.md
new file mode 100644
index 00000000..30004353
--- /dev/null
+++ b/skills/gws-groupssettings/SKILL.md
@@ -0,0 +1,42 @@
+---
+name: gws-groupssettings
+version: 1.0.0
+description: "USE WHEN the user wants to manage google groups settings via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws groupssettings --help"
+---
+
+# groupssettings (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws groupssettings <resource> <method> [flags]
+```
+
+## API Resources
+
+### groups
+
+  - `get` — Gets one resource by id.
+  - `patch` — Updates an existing resource. This method supports patch semantics.
+  - `update` — Updates an existing resource.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws groupssettings --help
+
+# Inspect a method's required params, types, and defaults
+gws schema groupssettings.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-keep/SKILL.md b/skills/gws-keep/SKILL.md
new file mode 100644
index 00000000..8e81b0dc
--- /dev/null
+++ b/skills/gws-keep/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: gws-keep
+version: 1.0.0
+description: "USE WHEN the user wants to manage google keep notes via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws keep --help"
+---
+
+# keep (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws keep <resource> <method> [flags]
+```
+
+## API Resources
+
+### media
+
+  - `download` — Gets an attachment. To download attachment media via REST requires the alt=media query parameter. Returns a 400 bad request error if attachment media is not available in the requested MIME type.
+
+### notes
+
+  - `create` — Creates a new note.
+  - `delete` — Deletes a note. Caller must have the `OWNER` role on the note to delete. Deleting a note removes the resource immediately and cannot be undone. Any collaborators will lose access to the note.
+  - `get` — Gets a note.
+  - `list` — Lists notes. Every list call returns a page of results with `page_size` as the upper bound of returned items. A `page_size` of zero allows the server to choose the upper bound. The ListNotesResponse c
+  - `permissions` — Operations on the 'permissions' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws keep --help
+
+# Inspect a method's required params, types, and defaults
+gws schema keep.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-licensing/SKILL.md b/skills/gws-licensing/SKILL.md
new file mode 100644
index 00000000..27b9b7f6
--- /dev/null
+++ b/skills/gws-licensing/SKILL.md
@@ -0,0 +1,46 @@
+---
+name: gws-licensing
+version: 1.0.0
+description: "USE WHEN the user wants to manage product licenses via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws licensing --help"
+---
+
+# licensing (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws licensing <resource> <method> [flags]
+```
+
+## API Resources
+
+### licenseAssignments
+
+  - `delete` — Revoke a license.
+  - `get` — Get a specific user's license by product SKU.
+  - `insert` — Assign a license.
+  - `listForProduct` — List all users assigned licenses for a specific product SKU.
+  - `listForProductAndSku` — List all users assigned licenses for a specific product SKU.
+  - `patch` — Reassign a user's product SKU with a different SKU in the same product. This method supports patch semantics.
+  - `update` — Reassign a user's product SKU with a different SKU in the same product.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws licensing --help
+
+# Inspect a method's required params, types, and defaults
+gws schema licensing.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-meet/SKILL.md b/skills/gws-meet/SKILL.md
new file mode 100644
index 00000000..e3d090f3
--- /dev/null
+++ b/skills/gws-meet/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: gws-meet
+version: 1.0.0
+description: "USE WHEN the user wants to manage google meet conferences via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws meet --help"
+---
+
+# meet (v2)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws meet <resource> <method> [flags]
+```
+
+## API Resources
+
+### conferenceRecords
+
+  - `get` — Gets a conference record by conference ID.
+  - `list` — Lists the conference records. By default, ordered by start time and in descending order.
+  - `participants` — Operations on the 'participants' resource
+  - `recordings` — Operations on the 'recordings' resource
+  - `transcripts` — Operations on the 'transcripts' resource
+
+### spaces
+
+  - `create` — Creates a space.
+  - `endActiveConference` — Ends an active conference (if there's one). For an example, see [End active conference](https://developers.google.com/workspace/meet/api/guides/meeting-spaces#end-active-conference).
+  - `get` — Gets details about a meeting space. For an example, see [Get a meeting space](https://developers.google.com/workspace/meet/api/guides/meeting-spaces#get-meeting-space).
+  - `patch` — Updates details about a meeting space. For an example, see [Update a meeting space](https://developers.google.com/workspace/meet/api/guides/meeting-spaces#update-meeting-space).
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws meet --help
+
+# Inspect a method's required params, types, and defaults
+gws schema meet.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-modelarmor-create-template/SKILL.md b/skills/gws-modelarmor-create-template/SKILL.md
new file mode 100644
index 00000000..83bfb50b
--- /dev/null
+++ b/skills/gws-modelarmor-create-template/SKILL.md
@@ -0,0 +1,53 @@
+---
+name: gws-modelarmor-create-template
+version: 1.0.0
+description: "Create a new Model Armor template"
+metadata:
+  openclaw:
+    category: "security"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws modelarmor +create-template --help"
+---
+
+# modelarmor +create-template
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Create a new Model Armor template
+
+## Usage
+
+```bash
+gws modelarmor +create-template --project <PROJECT> --location <LOCATION> --template-id <ID>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--project` | ✓ | — | GCP project ID |
+| `--location` | ✓ | — | GCP location (e.g. us-central1) |
+| `--template-id` | ✓ | — | Template ID to create |
+| `--preset` | — | — | Use a preset template: jailbreak |
+| `--json` | — | — | JSON body for the template configuration (overrides --preset) |
+
+## Examples
+
+```bash
+gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --preset jailbreak
+gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --json '{...}'
+```
+
+## Tips
+
+- Defaults to the jailbreak preset if neither --preset nor --json is given.
+- Use the resulting template name with +sanitize-prompt and +sanitize-response.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands
diff --git a/skills/gws-modelarmor-sanitize-prompt/SKILL.md b/skills/gws-modelarmor-sanitize-prompt/SKILL.md
new file mode 100644
index 00000000..fece02c0
--- /dev/null
+++ b/skills/gws-modelarmor-sanitize-prompt/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: gws-modelarmor-sanitize-prompt
+version: 1.0.0
+description: "Sanitize a user prompt through a Model Armor template"
+metadata:
+  openclaw:
+    category: "security"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws modelarmor +sanitize-prompt --help"
+---
+
+# modelarmor +sanitize-prompt
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Sanitize a user prompt through a Model Armor template
+
+## Usage
+
+```bash
+gws modelarmor +sanitize-prompt --template <NAME>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) |
+| `--text` | — | — | Text content to sanitize |
+| `--json` | — | — | Full JSON request body (overrides --text) |
+
+## Examples
+
+```bash
+gws modelarmor +sanitize-prompt --template projects/P/locations/L/templates/T --text 'user input'
+echo 'prompt' | gws modelarmor +sanitize-prompt --template ...
+```
+
+## Tips
+
+- If neither --text nor --json is given, reads from stdin.
+- For outbound safety, use +sanitize-response instead.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands
diff --git a/skills/gws-modelarmor-sanitize-response/SKILL.md b/skills/gws-modelarmor-sanitize-response/SKILL.md
new file mode 100644
index 00000000..d4d8a62a
--- /dev/null
+++ b/skills/gws-modelarmor-sanitize-response/SKILL.md
@@ -0,0 +1,48 @@
+---
+name: gws-modelarmor-sanitize-response
+version: 1.0.0
+description: "Sanitize a model response through a Model Armor template"
+metadata:
+  openclaw:
+    category: "security"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws modelarmor +sanitize-response --help"
+---
+
+# modelarmor +sanitize-response
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Sanitize a model response through a Model Armor template
+
+## Usage
+
+```bash
+gws modelarmor +sanitize-response --template <NAME>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--template` | ✓ | — | Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE) |
+| `--text` | — | — | Text content to sanitize |
+| `--json` | — | — | Full JSON request body (overrides --text) |
+
+## Examples
+
+```bash
+gws modelarmor +sanitize-response --template projects/P/locations/L/templates/T --text 'model output'
+model_cmd | gws modelarmor +sanitize-response --template ...
+```
+
+## Tips
+
+- Use for outbound safety (model -> user).
+- For inbound safety (user -> model), use +sanitize-prompt.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-modelarmor](../gws-modelarmor/SKILL.md) — All filter user-generated content for safety commands
diff --git a/skills/gws-modelarmor/SKILL.md b/skills/gws-modelarmor/SKILL.md
new file mode 100644
index 00000000..7514c035
--- /dev/null
+++ b/skills/gws-modelarmor/SKILL.md
@@ -0,0 +1,42 @@
+---
+name: gws-modelarmor
+version: 1.0.0
+description: "USE WHEN the user wants to filter user-generated content for safety via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws modelarmor --help"
+---
+
+# modelarmor (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws modelarmor <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+sanitize-prompt`](../gws-modelarmor-sanitize-prompt/SKILL.md) | Sanitize a user prompt through a Model Armor template |
+| [`+sanitize-response`](../gws-modelarmor-sanitize-response/SKILL.md) | Sanitize a model response through a Model Armor template |
+| [`+create-template`](../gws-modelarmor-create-template/SKILL.md) | Create a new Model Armor template |
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws modelarmor --help
+
+# Inspect a method's required params, types, and defaults
+gws schema modelarmor.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-people/SKILL.md b/skills/gws-people/SKILL.md
new file mode 100644
index 00000000..f50ad00f
--- /dev/null
+++ b/skills/gws-people/SKILL.md
@@ -0,0 +1,69 @@
+---
+name: gws-people
+version: 1.0.0
+description: "USE WHEN the user wants to manage contacts and profiles via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws people --help"
+---
+
+# people (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws people <resource> <method> [flags]
+```
+
+## API Resources
+
+### contactGroups
+
+  - `batchGet` — Get a list of contact groups owned by the authenticated user by specifying a list of contact group resource names.
+  - `create` — Create a new contact group owned by the authenticated user. Created contact group names must be unique to the users contact groups. Attempting to create a group with a duplicate name will return a HTT
+  - `delete` — Delete an existing contact group owned by the authenticated user by specifying a contact group resource name. Mutate requests for the same user should be sent sequentially to avoid increased latency a
+  - `get` — Get a specific contact group owned by the authenticated user by specifying a contact group resource name.
+  - `list` — List all contact groups owned by the authenticated user. Members of the contact groups are not populated.
+  - `update` — Update the name of an existing contact group owned by the authenticated user. Updated contact group names must be unique to the users contact groups. Attempting to create a group with a duplicate name
+  - `members` — Operations on the 'members' resource
+
+### otherContacts
+
+  - `copyOtherContactToMyContactsGroup` — Copies an "Other contact" to a new contact in the user's "myContacts" group Mutate requests for the same user should be sent sequentially to avoid increased latency and failures.
+  - `list` — List all "Other contacts", that is contacts that are not in a contact group. "Other contacts" are typically auto created contacts from interactions. Sync tokens expire 7 days after the full sync. A re
+  - `search` — Provides a list of contacts in the authenticated user's other contacts that matches the search query. The query matches on a contact's `names`, `emailAddresses`, and `phoneNumbers` fields that are fro
+
+### people
+
+  - `batchCreateContacts` — Create a batch of new contacts and return the PersonResponses for the newly Mutate requests for the same user should be sent sequentially to avoid increased latency and failures.
+  - `batchDeleteContacts` — Delete a batch of contacts. Any non-contact data will not be deleted. Mutate requests for the same user should be sent sequentially to avoid increased latency and failures.
+  - `batchUpdateContacts` — Update a batch of contacts and return a map of resource names to PersonResponses for the updated contacts. Mutate requests for the same user should be sent sequentially to avoid increased latency and 
+  - `createContact` — Create a new contact and return the person resource for that contact. The request returns a 400 error if more than one field is specified on a field that is a singleton for contact sources: * biograph
+  - `deleteContact` — Delete a contact person. Any non-contact data will not be deleted. Mutate requests for the same user should be sent sequentially to avoid increased latency and failures.
+  - `deleteContactPhoto` — Delete a contact's photo. Mutate requests for the same user should be done sequentially to avoid // lock contention.
+  - `get` — Provides information about a person by specifying a resource name. Use `people/me` to indicate the authenticated user. The request returns a 400 error if 'personFields' is not specified.
+  - `getBatchGet` — Provides information about a list of specific people by specifying a list of requested resource names. Use `people/me` to indicate the authenticated user. The request returns a 400 error if 'personFie
+  - `listDirectoryPeople` — Provides a list of domain profiles and domain contacts in the authenticated user's domain directory. When the `sync_token` is specified, resources deleted since the last sync will be returned as a per
+  - `searchContacts` — Provides a list of contacts in the authenticated user's grouped contacts that matches the search query. The query matches on a contact's `names`, `nickNames`, `emailAddresses`, `phoneNumbers`, and `or
+  - `searchDirectoryPeople` — Provides a list of domain profiles and domain contacts in the authenticated user's domain directory that match the search query.
+  - `updateContact` — Update contact data for an existing contact person. Any non-contact data will not be modified. Any non-contact data in the person to update will be ignored. All fields specified in the `update_mask` w
+  - `updateContactPhoto` — Update a contact's photo. Mutate requests for the same user should be sent sequentially to avoid increased latency and failures.
+  - `connections` — Operations on the 'connections' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws people --help
+
+# Inspect a method's required params, types, and defaults
+gws schema people.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-reseller/SKILL.md b/skills/gws-reseller/SKILL.md
new file mode 100644
index 00000000..c36b73f7
--- /dev/null
+++ b/skills/gws-reseller/SKILL.md
@@ -0,0 +1,62 @@
+---
+name: gws-reseller
+version: 1.0.0
+description: "USE WHEN the user wants to manage workspace subscriptions via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws reseller --help"
+---
+
+# reseller (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws reseller <resource> <method> [flags]
+```
+
+## API Resources
+
+### customers
+
+  - `get` — Gets a customer account. Use this operation to see a customer account already in your reseller management, or to see the minimal account information for an existing customer that you do not manage. Fo
+  - `insert` — Orders a new customer's account. Before ordering a new customer account, establish whether the customer account already exists using the [`customers.get`](https://developers.google.com/workspace/admin
+  - `patch` — Updates a customer account's settings. This method supports patch semantics. You cannot update `customerType` via the Reseller API, but a `"team"` customer can verify their domain and become `customer
+  - `update` — Updates a customer account's settings. You cannot update `customerType` via the Reseller API, but a `"team"` customer can verify their domain and become `customerType = "domain"`. For more information
+
+### resellernotify
+
+  - `getwatchdetails` — Returns all the details of the watch corresponding to the reseller.
+  - `register` — Registers a Reseller for receiving notifications.
+  - `unregister` — Unregisters a Reseller for receiving notifications.
+
+### subscriptions
+
+  - `activate` — Activates a subscription previously suspended by the reseller. If you did not suspend the customer subscription and it is suspended for any other reason, such as for abuse or a pending ToS acceptance,
+  - `changePlan` — Updates a subscription plan. Use this method to update a plan for a 30-day trial or a flexible plan subscription to an annual commitment plan with monthly or yearly payments. How a plan is updated dif
+  - `changeRenewalSettings` — Updates a user license's renewal settings. This is applicable for accounts with annual commitment plans only. For more information, see the description in [manage subscriptions](https://developers.goo
+  - `changeSeats` — Updates a subscription's user license settings. For more information about updating an annual commitment plan or a flexible plan subscription’s licenses, see [Manage Subscriptions](https://developers.
+  - `delete` — Cancels, suspends, or transfers a subscription to direct.
+  - `get` — Gets a specific subscription. The `subscriptionId` can be found using the [Retrieve all reseller subscriptions](https://developers.google.com/workspace/admin/reseller/v1/how-tos/manage_subscriptions#g
+  - `insert` — Creates or transfer a subscription. Create a subscription for a customer's account that you ordered using the [Order a new customer account](https://developers.google.com/workspace/admin/reseller/v1/r
+  - `list` — Lists of subscriptions managed by the reseller. The list can be all subscriptions, all of a customer's subscriptions, or all of a customer's transferable subscriptions. Optionally, this method can fil
+  - `startPaidService` — Immediately move a 30-day free trial subscription to a paid service subscription. This method is only applicable if a payment plan has already been set up for the 30-day trial subscription. For more i
+  - `suspend` — Suspends an active subscription. You can use this method to suspend a paid subscription that is currently in the `ACTIVE` state. * For `FLEXIBLE` subscriptions, billing is paused. * For `ANNUAL_MONTHL
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws reseller --help
+
+# Inspect a method's required params, types, and defaults
+gws schema reseller.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-shared/SKILL.md b/skills/gws-shared/SKILL.md
new file mode 100644
index 00000000..3b22e6a2
--- /dev/null
+++ b/skills/gws-shared/SKILL.md
@@ -0,0 +1,59 @@
+---
+name: gws-shared
+version: 1.0.0
+description: "Shared patterns, authentication, and global flags for all gws commands."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+---
+
+# gws — Shared Reference
+
+## Installation
+
+The `gws` binary must be on `$PATH`. See the project README for install options.
+
+## Authentication
+
+```bash
+# Browser-based OAuth (interactive)
+gws auth login
+
+# Service Account
+export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
+```
+
+## Global Flags
+
+| Flag | Description |
+|------|-------------|
+| `--format <FORMAT>` | Output format: `json` (default), `table`, `yaml`, `csv` |
+| `--dry-run` | Validate locally without calling the API |
+| `--sanitize <TEMPLATE>` | Screen responses through Model Armor |
+
+## CLI Syntax
+
+```bash
+gws <service> <resource> [sub-resource] <method> [flags]
+```
+
+### Method Flags
+
+| Flag | Description |
+|------|-------------|
+| `--params '{"key": "val"}'` | URL/query parameters |
+| `--json '{"key": "val"}'` | Request body |
+| `-o, --output <PATH>` | Save binary responses to file |
+| `--upload <PATH>` | Upload file content (multipart) |
+| `--page-all` | Auto-paginate (NDJSON output) |
+| `--page-limit <N>` | Max pages when using --page-all (default: 10) |
+| `--page-delay <MS>` | Delay between pages in ms (default: 100) |
+
+## Security Rules
+
+- **Never** output secrets (API keys, tokens) directly
+- **Always** confirm with user before executing write/delete commands
+- Prefer `--dry-run` for destructive operations
+- Use `--sanitize` for PII/content safety screening
diff --git a/skills/gws-sheets-append/SKILL.md b/skills/gws-sheets-append/SKILL.md
new file mode 100644
index 00000000..58daae6d
--- /dev/null
+++ b/skills/gws-sheets-append/SKILL.md
@@ -0,0 +1,51 @@
+---
+name: gws-sheets-append
+version: 1.0.0
+description: "Append a row to a spreadsheet"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws sheets +append --help"
+---
+
+# sheets +append
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Append a row to a spreadsheet
+
+## Usage
+
+```bash
+gws sheets +append --spreadsheet <ID>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--spreadsheet` | ✓ | — | Spreadsheet ID |
+| `--values` | — | — | Comma-separated values (simple strings) |
+| `--json-values` | — | — | JSON array of rows, e.g. '[["a","b"],["c","d"]]' |
+
+## Examples
+
+```bash
+gws sheets +append --spreadsheet ID --values 'Alice,100,true'
+gws sheets +append --spreadsheet ID --json-values '[["a","b"],["c","d"]]'
+```
+
+## Tips
+
+- Use --values for simple single-row appends.
+- Use --json-values for bulk multi-row inserts.
+
+> [!CAUTION]
+> This is a **write** command — confirm with the user before executing.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-sheets](../gws-sheets/SKILL.md) — All read and write spreadsheets commands
diff --git a/skills/gws-sheets-read/SKILL.md b/skills/gws-sheets-read/SKILL.md
new file mode 100644
index 00000000..5223be7d
--- /dev/null
+++ b/skills/gws-sheets-read/SKILL.md
@@ -0,0 +1,47 @@
+---
+name: gws-sheets-read
+version: 1.0.0
+description: "Read values from a spreadsheet"
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws sheets +read --help"
+---
+
+# sheets +read
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+Read values from a spreadsheet
+
+## Usage
+
+```bash
+gws sheets +read --spreadsheet <ID> --range <RANGE>
+```
+
+## Flags
+
+| Flag | Required | Default | Description |
+|------|----------|---------|-------------|
+| `--spreadsheet` | ✓ | — | Spreadsheet ID |
+| `--range` | ✓ | — | Range to read (e.g. 'Sheet1!A1:B2') |
+
+## Examples
+
+```bash
+gws sheets +read --spreadsheet ID --range 'Sheet1!A1:D10'
+gws sheets +read --spreadsheet ID --range Sheet1
+```
+
+## Tips
+
+- Read-only — never modifies the spreadsheet.
+- For advanced options, use the raw values.get API.
+
+## See Also
+
+- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth
+- [gws-sheets](../gws-sheets/SKILL.md) — All read and write spreadsheets commands
diff --git a/skills/gws-sheets/SKILL.md b/skills/gws-sheets/SKILL.md
new file mode 100644
index 00000000..6428ece7
--- /dev/null
+++ b/skills/gws-sheets/SKILL.md
@@ -0,0 +1,53 @@
+---
+name: gws-sheets
+version: 1.0.0
+description: "USE WHEN the user wants to read and write spreadsheets via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws sheets --help"
+---
+
+# sheets (v4)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws sheets <resource> <method> [flags]
+```
+
+## Helper Commands
+
+| Command | Description |
+|---------|-------------|
+| [`+append`](../gws-sheets-append/SKILL.md) | Append a row to a spreadsheet |
+| [`+read`](../gws-sheets-read/SKILL.md) | Read values from a spreadsheet |
+
+## API Resources
+
+### spreadsheets
+
+  - `batchUpdate` — Applies one or more updates to the spreadsheet. Each request is validated before being applied. If any request is not valid then the entire request will fail and nothing will be applied. Some requests
+  - `create` — Creates a spreadsheet, returning the newly created spreadsheet.
+  - `get` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. By default, data within grids is not returned. You can include grid data in one of 2 ways: * Specify a [field mask]
+  - `getByDataFilter` — Returns the spreadsheet at the given ID. The caller must specify the spreadsheet ID. For more information, see [Read, write, and search metadata](https://developers.google.com/workspace/sheets/api/gui
+  - `developerMetadata` — Operations on the 'developerMetadata' resource
+  - `sheets` — Operations on the 'sheets' resource
+  - `values` — Operations on the 'values' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws sheets --help
+
+# Inspect a method's required params, types, and defaults
+gws schema sheets.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-slides/SKILL.md b/skills/gws-slides/SKILL.md
new file mode 100644
index 00000000..63258aba
--- /dev/null
+++ b/skills/gws-slides/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: gws-slides
+version: 1.0.0
+description: "USE WHEN the user wants to read and write presentations via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws slides --help"
+---
+
+# slides (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws slides <resource> <method> [flags]
+```
+
+## API Resources
+
+### presentations
+
+  - `batchUpdate` — Applies one or more updates to the presentation. Each request is validated before being applied. If any request is not valid, then the entire request will fail and nothing will be applied. Some reques
+  - `create` — Creates a blank presentation using the title given in the request. If a `presentationId` is provided, it is used as the ID of the new presentation. Otherwise, a new ID is generated. Other fields in th
+  - `get` — Gets the latest version of the specified presentation.
+  - `pages` — Operations on the 'pages' resource
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws slides --help
+
+# Inspect a method's required params, types, and defaults
+gws schema slides.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-tasks/SKILL.md b/skills/gws-tasks/SKILL.md
new file mode 100644
index 00000000..8f1cb6b1
--- /dev/null
+++ b/skills/gws-tasks/SKILL.md
@@ -0,0 +1,56 @@
+---
+name: gws-tasks
+version: 1.0.0
+description: "USE WHEN the user wants to manage task lists and tasks via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws tasks --help"
+---
+
+# tasks (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws tasks <resource> <method> [flags]
+```
+
+## API Resources
+
+### tasklists
+
+  - `delete` — Deletes the authenticated user's specified task list. If the list contains assigned tasks, both the assigned tasks and the original tasks in the assignment surface (Docs, Chat Spaces) are deleted.
+  - `get` — Returns the authenticated user's specified task list.
+  - `insert` — Creates a new task list and adds it to the authenticated user's task lists. A user can have up to 2000 lists at a time.
+  - `list` — Returns all the authenticated user's task lists. A user can have up to 2000 lists at a time.
+  - `patch` — Updates the authenticated user's specified task list. This method supports patch semantics.
+  - `update` — Updates the authenticated user's specified task list.
+
+### tasks
+
+  - `clear` — Clears all completed tasks from the specified task list. The affected tasks will be marked as 'hidden' and no longer be returned by default when retrieving all tasks for a task list.
+  - `delete` — Deletes the specified task from the task list. If the task is assigned, both the assigned task and the original task (in Docs, Chat Spaces) are deleted. To delete the assigned task only, navigate to t
+  - `get` — Returns the specified task.
+  - `insert` — Creates a new task on the specified task list. Tasks assigned from Docs or Chat Spaces cannot be inserted from Tasks Public API; they can only be created by assigning them from Docs or Chat Spaces. A 
+  - `list` — Returns all tasks in the specified task list. Doesn't return assigned tasks by default (from Docs, Chat Spaces). A user can have up to 20,000 non-hidden tasks per list and up to 100,000 tasks in total
+  - `move` — Moves the specified task to another position in the destination task list. If the destination list is not specified, the task is moved within its current list. This can include putting it as a child t
+  - `patch` — Updates the specified task. This method supports patch semantics.
+  - `update` — Updates the specified task.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws tasks --help
+
+# Inspect a method's required params, types, and defaults
+gws schema tasks.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/skills/gws-vault/SKILL.md b/skills/gws-vault/SKILL.md
new file mode 100644
index 00000000..94323184
--- /dev/null
+++ b/skills/gws-vault/SKILL.md
@@ -0,0 +1,60 @@
+---
+name: gws-vault
+version: 1.0.0
+description: "USE WHEN the user wants to manage ediscovery holds and exports via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws vault --help"
+---
+
+# vault (v1)
+
+> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
+
+```bash
+gws vault <resource> <method> [flags]
+```
+
+## API Resources
+
+### matters
+
+  - `addPermissions` — Adds an account as a matter collaborator.
+  - `close` — Closes the specified matter. Returns the matter with updated state.
+  - `count` — Counts the accounts processed by the specified query.
+  - `create` — Creates a matter with the given name and description. The initial state is open, and the owner is the method caller. Returns the created matter with default view.
+  - `delete` — Deletes the specified matter. Returns the matter with updated state.
+  - `get` — Gets the specified matter.
+  - `list` — Lists matters the requestor has access to.
+  - `removePermissions` — Removes an account as a matter collaborator.
+  - `reopen` — Reopens the specified matter. Returns the matter with updated state.
+  - `undelete` — Undeletes the specified matter. Returns the matter with updated state.
+  - `update` — Updates the specified matter. This updates only the name and description of the matter, identified by matter ID. Changes to any other fields are ignored. Returns the default view of the matter.
+  - `exports` — Operations on the 'exports' resource
+  - `holds` — Operations on the 'holds' resource
+  - `savedQueries` — Operations on the 'savedQueries' resource
+
+### operations
+
+  - `cancel` — Starts asynchronous cancellation on a long-running operation. The server makes a best effort to cancel the operation, but success is not guaranteed. If the server doesn't support this method, it retur
+  - `delete` — Deletes a long-running operation. This method indicates that the client is no longer interested in the operation result. It does not cancel the operation. If the server doesn't support this method, it
+  - `get` — Gets the latest state of a long-running operation. Clients can use this method to poll the operation result at intervals as recommended by the API service.
+  - `list` — Lists operations that match the specified filter in the request. If the server doesn't support this method, it returns `UNIMPLEMENTED`.
+
+## Discovering Commands
+
+Before calling any API method, inspect it:
+
+```bash
+# Browse resources and methods
+gws vault --help
+
+# Inspect a method's required params, types, and defaults
+gws schema vault.<resource>.<method>
+```
+
+Use `gws schema` output to build your `--params` and `--json` flags.
+
diff --git a/src/auth.rs b/src/auth.rs
new file mode 100644
index 00000000..1f2f2d09
--- /dev/null
+++ b/src/auth.rs
@@ -0,0 +1,367 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Authentication and Credential Management
+//!
+//! Handles obtaining OAuth 2.0 access tokens and Service Account tokens.
+//! Supports local user flow (via a loopback server) and Application Default Credentials,
+//! with token caching to minimize repeated authentication overhead.
+
+use std::path::PathBuf;
+
+use anyhow::Context;
+
+use crate::credential_store;
+
+/// Types of credentials we support
+#[derive(Debug)]
+enum Credential {
+    AuthorizedUser(yup_oauth2::authorized_user::AuthorizedUserSecret),
+    ServiceAccount(yup_oauth2::ServiceAccountKey),
+}
+
+/// Builds an OAuth2 authenticator and returns an access token.
+///
+/// Tries credentials in order:
+/// 0. `GOOGLE_WORKSPACE_CLI_TOKEN` env var (raw access token, highest priority)
+/// 1. `GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE` env var (plaintext JSON, can be User or Service Account)
+/// 2. Encrypted credentials at `~/.config/gws/credentials.enc` (User only)
+/// 3. Plaintext credentials at `~/.config/gws/credentials.json` (User only)
+pub async fn get_token(scopes: &[&str]) -> anyhow::Result<String> {
+    // 0. Direct token from env var (highest priority, bypasses all credential loading)
+    if let Ok(token) = std::env::var("GOOGLE_WORKSPACE_CLI_TOKEN") {
+        if !token.is_empty() {
+            return Ok(token);
+        }
+    }
+
+    let creds_file = std::env::var("GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE").ok();
+    let impersonated_user = std::env::var("GOOGLE_WORKSPACE_CLI_IMPERSONATED_USER").ok();
+    let config_dir = dirs::config_dir()
+        .unwrap_or_else(|| PathBuf::from("."))
+        .join("gws");
+
+    let enc_path = credential_store::encrypted_credentials_path();
+    let default_path = config_dir.join("credentials.json");
+
+    let creds = load_credentials_inner(creds_file.as_deref(), &enc_path, &default_path).await?;
+
+    get_token_inner(scopes, creds, &config_dir, impersonated_user.as_deref()).await
+}
+
+async fn get_token_inner(
+    scopes: &[&str],
+    creds: Credential,
+    config_dir: &std::path::Path,
+    impersonated_user: Option<&str>,
+) -> anyhow::Result<String> {
+    match creds {
+        Credential::AuthorizedUser(secret) => {
+            let token_cache = config_dir.join("token_cache.json");
+            let auth = yup_oauth2::AuthorizedUserAuthenticator::builder(secret)
+                .with_storage(Box::new(crate::token_storage::EncryptedTokenStorage::new(
+                    token_cache,
+                )))
+                .build()
+                .await
+                .context("Failed to build authorized user authenticator")?;
+
+            let token = auth.token(scopes).await.context("Failed to get token")?;
+            Ok(token
+                .token()
+                .ok_or_else(|| anyhow::anyhow!("Token response contained no access token"))?
+                .to_string())
+        }
+        Credential::ServiceAccount(key) => {
+            let token_cache = config_dir.join("service_account_token_cache.json");
+            let mut builder =
+                yup_oauth2::ServiceAccountAuthenticator::builder(key).with_storage(Box::new(
+                    crate::token_storage::EncryptedTokenStorage::new(token_cache),
+                ));
+
+            // Check for impersonation
+            if let Some(user) = impersonated_user {
+                if !user.trim().is_empty() {
+                    builder = builder.subject(user.to_string());
+                }
+            }
+
+            let auth = builder
+                .build()
+                .await
+                .context("Failed to build service account authenticator")?;
+
+            let token = auth.token(scopes).await.context("Failed to get token")?;
+            Ok(token
+                .token()
+                .ok_or_else(|| anyhow::anyhow!("Token response contained no access token"))?
+                .to_string())
+        }
+    }
+}
+
+async fn load_credentials_inner(
+    env_file: Option<&str>,
+    enc_path: &std::path::Path,
+    default_path: &std::path::Path,
+) -> anyhow::Result<Credential> {
+    // 1. Explicit env var — plaintext file (User or Service Account)
+    if let Some(path) = env_file {
+        let p = PathBuf::from(path);
+        if p.exists() {
+            // Read file content first to determine type
+            let content = tokio::fs::read_to_string(&p)
+                .await
+                .with_context(|| format!("Failed to read credentials from {path}"))?;
+
+            let json: serde_json::Value =
+                serde_json::from_str(&content).context("Failed to parse credentials JSON")?;
+
+            // Check for "type" field
+            if let Some(type_str) = json.get("type").and_then(|v| v.as_str()) {
+                if type_str == "service_account" {
+                    let key = yup_oauth2::parse_service_account_key(&content)
+                        .context("Failed to parse service account key")?;
+                    return Ok(Credential::ServiceAccount(key));
+                }
+            }
+
+            // Default to parsed authorized user secret if not service account
+            // We re-parse specifically to AuthorizedUserSecret to validate fields
+            let secret: yup_oauth2::authorized_user::AuthorizedUserSecret =
+                serde_json::from_str(&content)
+                    .context("Failed to parse authorized user credentials")?;
+            return Ok(Credential::AuthorizedUser(secret));
+        }
+        anyhow::bail!(
+            "GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE points to {path}, but file does not exist"
+        );
+    }
+
+    // 2. Encrypted credentials (always AuthorizedUser for now)
+    if enc_path.exists() {
+        let json_str = credential_store::load_encrypted_from_path(enc_path)
+            .context("Failed to decrypt credentials")?;
+
+        let creds: serde_json::Value =
+            serde_json::from_str(&json_str).context("Failed to parse decrypted credentials")?;
+
+        let client_id = creds["client_id"]
+            .as_str()
+            .ok_or_else(|| anyhow::anyhow!("Missing client_id in encrypted credentials"))?;
+        let client_secret = creds["client_secret"]
+            .as_str()
+            .ok_or_else(|| anyhow::anyhow!("Missing client_secret in encrypted credentials"))?;
+        // refresh_token is optional now in some flows, but strictly required for this storage format
+        let refresh_token = creds["refresh_token"]
+            .as_str()
+            .ok_or_else(|| anyhow::anyhow!("Missing refresh_token in encrypted credentials"))?;
+
+        return Ok(Credential::AuthorizedUser(
+            yup_oauth2::authorized_user::AuthorizedUserSecret {
+                client_id: client_id.to_string(),
+                client_secret: client_secret.to_string(),
+                refresh_token: refresh_token.to_string(),
+                key_type: "authorized_user".to_string(),
+            },
+        ));
+    }
+
+    // 3. Plaintext credentials at default path (Default to AuthorizedUser)
+    if default_path.exists() {
+        return Ok(Credential::AuthorizedUser(
+            yup_oauth2::read_authorized_user_secret(default_path)
+                .await
+                .with_context(|| {
+                    format!("Failed to read credentials from {}", default_path.display())
+                })?,
+        ));
+    }
+
+    anyhow::bail!(
+        "No credentials found. Run `gws auth setup` to configure, \
+         `gws auth login` to authenticate, or set GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use tempfile::NamedTempFile;
+
+    #[tokio::test]
+    async fn test_load_credentials_no_options() {
+        let err = load_credentials_inner(
+            None,
+            &PathBuf::from("/does/not/exist1"),
+            &PathBuf::from("/does/not/exist2"),
+        )
+        .await;
+        assert!(err.is_err());
+        assert!(err
+            .unwrap_err()
+            .to_string()
+            .contains("No credentials found"));
+    }
+
+    #[tokio::test]
+    async fn test_load_credentials_env_file_missing() {
+        let err = load_credentials_inner(
+            Some("/does/not/exist"),
+            &PathBuf::from("/also/missing"),
+            &PathBuf::from("/still/missing"),
+        )
+        .await;
+        assert!(err.is_err());
+        assert!(err.unwrap_err().to_string().contains("does not exist"));
+    }
+
+    #[tokio::test]
+    async fn test_load_credentials_env_file_authorized_user() {
+        let mut file = NamedTempFile::new().unwrap();
+        let json = r#"{
+            "client_id": "test_id",
+            "client_secret": "test_secret",
+            "refresh_token": "test_refresh",
+            "type": "authorized_user"
+        }"#;
+        file.write_all(json.as_bytes()).unwrap();
+
+        let res = load_credentials_inner(
+            Some(file.path().to_str().unwrap()),
+            &PathBuf::from("/also/missing"),
+            &PathBuf::from("/still/missing"),
+        )
+        .await
+        .unwrap();
+
+        match res {
+            Credential::AuthorizedUser(secret) => {
+                assert_eq!(secret.client_id, "test_id");
+                assert_eq!(secret.refresh_token, "test_refresh");
+            }
+            _ => panic!("Expected AuthorizedUser"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_load_credentials_env_file_service_account() {
+        let mut file = NamedTempFile::new().unwrap();
+        let json = r#"{
+            "type": "service_account",
+            "project_id": "test",
+            "private_key_id": "test-key-id",
+            "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASC\n-----END PRIVATE KEY-----\n",
+            "client_email": "test@test.iam.gserviceaccount.com",
+            "client_id": "123",
+            "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+            "token_uri": "https://oauth2.googleapis.com/token"
+        }"#;
+        file.write_all(json.as_bytes()).unwrap();
+
+        let res = load_credentials_inner(
+            Some(file.path().to_str().unwrap()),
+            &PathBuf::from("/also/missing"),
+            &PathBuf::from("/still/missing"),
+        )
+        .await
+        .unwrap();
+
+        match res {
+            Credential::ServiceAccount(key) => {
+                assert_eq!(key.client_email, "test@test.iam.gserviceaccount.com");
+            }
+            _ => panic!("Expected ServiceAccount"),
+        }
+    }
+
+    #[tokio::test]
+    async fn test_load_credentials_default_path_authorized_user() {
+        let mut file = NamedTempFile::new().unwrap();
+        let json = r#"{
+            "client_id": "default_id",
+            "client_secret": "default_secret",
+            "refresh_token": "default_refresh",
+            "type": "authorized_user"
+        }"#;
+        file.write_all(json.as_bytes()).unwrap();
+
+        let res = load_credentials_inner(None, &PathBuf::from("/also/missing"), file.path())
+            .await
+            .unwrap();
+
+        match res {
+            Credential::AuthorizedUser(secret) => {
+                assert_eq!(secret.client_id, "default_id");
+            }
+            _ => panic!("Expected AuthorizedUser"),
+        }
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn test_get_token_from_env_var() {
+        // Save the old token
+        let old_token = std::env::var("GOOGLE_WORKSPACE_CLI_TOKEN").ok();
+
+        // Set the token env var
+        unsafe {
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_TOKEN", "my-test-token");
+        }
+
+        let result = get_token(&["https://www.googleapis.com/auth/drive"]).await;
+
+        unsafe {
+            if let Some(t) = old_token {
+                std::env::set_var("GOOGLE_WORKSPACE_CLI_TOKEN", t);
+            } else {
+                std::env::remove_var("GOOGLE_WORKSPACE_CLI_TOKEN");
+            }
+        }
+
+        assert!(result.is_ok());
+        assert_eq!(result.unwrap(), "my-test-token");
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn test_get_token_env_var_empty_falls_through() {
+        // An empty token should not short-circuit — it should be ignored
+        // and fall through to normal credential loading.
+        // We test with non-existent credential paths to ensure fallthrough.
+        unsafe {
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_TOKEN", "");
+        }
+
+        let result = load_credentials_inner(
+            None,
+            &PathBuf::from("/does/not/exist1"),
+            &PathBuf::from("/does/not/exist2"),
+        )
+        .await;
+
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_TOKEN");
+        }
+
+        // Should fall through to normal credential loading, which fails
+        // because we pointed at non-existent paths
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("No credentials found"));
+    }
+}
diff --git a/src/auth_commands.rs b/src/auth_commands.rs
new file mode 100644
index 00000000..2e811469
--- /dev/null
+++ b/src/auth_commands.rs
@@ -0,0 +1,1230 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::path::PathBuf;
+
+use serde_json::json;
+
+use crate::credential_store;
+use crate::error::GwsError;
+
+/// Default scopes for login — broad Workspace access.
+pub const DEFAULT_SCOPES: &[&str] = &[
+    "https://www.googleapis.com/auth/drive",
+    "https://www.googleapis.com/auth/spreadsheets",
+    "https://www.googleapis.com/auth/gmail.modify",
+    "https://www.googleapis.com/auth/calendar",
+    "https://www.googleapis.com/auth/documents",
+    "https://www.googleapis.com/auth/presentations",
+    "https://www.googleapis.com/auth/tasks",
+    "https://www.googleapis.com/auth/pubsub",
+    "https://www.googleapis.com/auth/cloud-platform",
+];
+
+/// Readonly scopes — read-only Workspace access.
+const READONLY_SCOPES: &[&str] = &[
+    "https://www.googleapis.com/auth/drive.readonly",
+    "https://www.googleapis.com/auth/spreadsheets.readonly",
+    "https://www.googleapis.com/auth/gmail.readonly",
+    "https://www.googleapis.com/auth/calendar.readonly",
+    "https://www.googleapis.com/auth/documents.readonly",
+    "https://www.googleapis.com/auth/presentations.readonly",
+    "https://www.googleapis.com/auth/tasks.readonly",
+];
+
+pub fn config_dir() -> PathBuf {
+    dirs::config_dir()
+        .unwrap_or_else(|| PathBuf::from("."))
+        .join("gws")
+}
+
+fn plain_credentials_path() -> PathBuf {
+    if let Ok(path) = std::env::var("GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE") {
+        return PathBuf::from(path);
+    }
+    config_dir().join("credentials.json")
+}
+
+fn token_cache_path() -> PathBuf {
+    config_dir().join("token_cache.json")
+}
+
+/// Handle `gws auth <subcommand>`.
+pub async fn handle_auth_command(args: &[String]) -> Result<(), GwsError> {
+    if args.is_empty() {
+        return Err(GwsError::Validation(
+            "Usage: gws auth <login|setup|status|export|logout>\n\n\
+              login   Authenticate via OAuth2 (opens browser)\n\
+                      --readonly   Request read-only scopes\n\
+                      --scopes     Comma-separated custom scopes\n\
+              setup   Configure GCP project + OAuth client (requires gcloud)\n\
+                      --project    Use a specific GCP project\n\
+              status  Show current authentication state\n\
+              export  Print decrypted credentials to stdout\n\
+              logout  Clear saved credentials and token cache"
+                .to_string(),
+        ));
+    }
+
+    match args[0].as_str() {
+        "login" => handle_login(&args[1..]).await,
+        "setup" => crate::setup::run_setup(&args[1..]).await,
+        "status" => handle_status().await,
+        "export" => {
+            let unmasked = args.len() > 1 && args[1] == "--unmasked";
+            handle_export(unmasked).await
+        }
+        "logout" => handle_logout(),
+        other => Err(GwsError::Validation(format!(
+            "Unknown auth subcommand: '{other}'. Use: login, setup, status, export, logout"
+        ))),
+    }
+}
+/// Custom delegate that prints the OAuth URL on its own line for easy copying.
+struct CliFlowDelegate;
+
+impl yup_oauth2::authenticator_delegate::InstalledFlowDelegate for CliFlowDelegate {
+    fn present_user_url<'a>(
+        &'a self,
+        url: &'a str,
+        _need_code: bool,
+    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<String, String>> + Send + 'a>>
+    {
+        Box::pin(async move {
+            eprintln!("Open this URL in your browser to authenticate:\n");
+            eprintln!("  {url}\n");
+            Ok(String::new())
+        })
+    }
+}
+
+async fn handle_login(args: &[String]) -> Result<(), GwsError> {
+    // Resolve client_id and client_secret:
+    // 1. Env vars (highest priority)
+    // 2. Saved client_secret.json from `gws auth setup` or manual download
+    let (client_id, client_secret, project_id) = resolve_client_credentials()?;
+
+    // Persist credentials to client_secret.json if not already saved,
+    // so they survive env var removal or shell session changes.
+    if !crate::oauth_config::client_config_path().exists() {
+        let _ = crate::oauth_config::save_client_config(
+            &client_id,
+            &client_secret,
+            project_id.as_deref().unwrap_or(""),
+        );
+    }
+
+    // Determine scopes: explicit flags > interactive TUI > defaults
+    let scopes = resolve_scopes(args, project_id.as_deref()).await;
+
+    let secret = yup_oauth2::ApplicationSecret {
+        client_id: client_id.clone(),
+        client_secret: client_secret.clone(),
+        auth_uri: "https://accounts.google.com/o/oauth2/auth".to_string(),
+        token_uri: "https://oauth2.googleapis.com/token".to_string(),
+        redirect_uris: vec!["http://localhost".to_string()],
+        ..Default::default()
+    };
+
+    // Use a temp file for yup-oauth2's token persistence, then encrypt it
+    let temp_path = config_dir().join("credentials.tmp");
+
+    // Always start fresh — delete any stale temp cache from prior login attempts.
+    // Without this, yup-oauth2 finds a cached access token and skips the browser flow,
+    // which means no refresh_token is returned.
+    let _ = std::fs::remove_file(&temp_path);
+
+    // Ensure config directory exists
+    if let Some(parent) = temp_path.parent() {
+        std::fs::create_dir_all(parent)
+            .map_err(|e| GwsError::Validation(format!("Failed to create config directory: {e}")))?;
+    }
+
+    let auth = yup_oauth2::InstalledFlowAuthenticator::builder(
+        secret,
+        yup_oauth2::InstalledFlowReturnMethod::HTTPRedirect,
+    )
+    .with_storage(Box::new(crate::token_storage::EncryptedTokenStorage::new(
+        temp_path.clone(),
+    )))
+    .force_account_selection(true) // Adds prompt=consent so Google always returns a refresh_token
+    .flow_delegate(Box::new(CliFlowDelegate))
+    .build()
+    .await
+    .map_err(|e| GwsError::Auth(format!("Failed to build authenticator: {e}")))?;
+
+    // Request a token — this triggers the browser OAuth flow
+    let scope_refs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+    let token = auth
+        .token(&scope_refs)
+        .await
+        .map_err(|e| GwsError::Auth(format!("OAuth flow failed: {e}")))?;
+
+    if token.token().is_some() {
+        // Read yup-oauth2's token cache to extract the refresh_token.
+        let token_data = std::fs::read_to_string(&temp_path).unwrap_or_default();
+        let refresh_token = extract_refresh_token(&token_data).ok_or_else(|| {
+            GwsError::Auth(
+                "OAuth flow completed but no refresh token was returned. \
+                     Ensure the OAuth consent screen includes 'offline' access."
+                    .to_string(),
+            )
+        })?;
+
+        // Build credentials in the standard authorized_user format
+        let creds_json = json!({
+            "type": "authorized_user",
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "refresh_token": refresh_token,
+        });
+
+        let creds_str = serde_json::to_string_pretty(&creds_json)
+            .map_err(|e| GwsError::Validation(format!("Failed to serialize credentials: {e}")))?;
+
+        // Save encrypted
+        let enc_path = credential_store::save_encrypted(&creds_str)
+            .map_err(|e| GwsError::Auth(format!("Failed to encrypt credentials: {e}")))?;
+
+        // Clean up temp file
+        let _ = std::fs::remove_file(&temp_path);
+
+        let output = json!({
+            "status": "success",
+            "message": "Authentication successful. Encrypted credentials saved.",
+            "credentials_file": enc_path.display().to_string(),
+            "encryption": "AES-256-GCM (key secured by OS Keyring or local `.encryption_key`)",
+            "scopes": scopes,
+        });
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&output).unwrap_or_default()
+        );
+        Ok(())
+    } else {
+        // Clean up temp file on failure
+        let _ = std::fs::remove_file(&temp_path);
+        Err(GwsError::Auth(
+            "OAuth flow completed but no token was returned.".to_string(),
+        ))
+    }
+}
+
+async fn handle_export(unmasked: bool) -> Result<(), GwsError> {
+    let enc_path = credential_store::encrypted_credentials_path();
+    if !enc_path.exists() {
+        return Err(GwsError::Auth(
+            "No encrypted credentials found. Run 'gws auth login' first.".to_string(),
+        ));
+    }
+
+    match credential_store::load_encrypted() {
+        Ok(contents) => {
+            if unmasked {
+                println!("{contents}");
+            } else if let Ok(mut creds) = serde_json::from_str::<serde_json::Value>(&contents) {
+                if let Some(obj) = creds.as_object_mut() {
+                    if let Some(serde_json::Value::String(s)) = obj.get("client_secret") {
+                        obj.insert(
+                            "client_secret".to_string(),
+                            json!(format!("{}...{}", &s[..4], &s[s.len().min(4)..])),
+                        );
+                    }
+                    if let Some(serde_json::Value::String(s)) = obj.get("refresh_token") {
+                        obj.insert(
+                            "refresh_token".to_string(),
+                            json!(format!("{}...{}", &s[..4], &s[s.len().min(4)..])),
+                        );
+                    }
+                }
+                println!("{}", serde_json::to_string_pretty(&creds).unwrap());
+            } else {
+                println!("{contents}");
+            }
+            Ok(())
+        }
+        Err(e) => Err(GwsError::Auth(format!(
+            "Failed to decrypt credentials: {e}. May have been created on a different machine.",
+        ))),
+    }
+}
+
+/// Resolve OAuth client credentials from env vars or saved config file.
+fn resolve_client_credentials() -> Result<(String, String, Option<String>), GwsError> {
+    // 1. Try env vars first
+    let env_id = std::env::var("GOOGLE_WORKSPACE_CLI_CLIENT_ID").ok();
+    let env_secret = std::env::var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET").ok();
+
+    if let (Some(id), Some(secret)) = (env_id, env_secret) {
+        // Still try to load project_id from config file for the scope picker
+        let project_id = crate::oauth_config::load_client_config()
+            .ok()
+            .map(|c| c.project_id);
+        return Ok((id, secret, project_id));
+    }
+
+    // 2. Try saved client_secret.json
+    match crate::oauth_config::load_client_config() {
+        Ok(config) => Ok((
+            config.client_id,
+            config.client_secret,
+            Some(config.project_id),
+        )),
+        Err(_) => Err(GwsError::Auth(
+            "No OAuth client configured.\n\n\
+             Either:\n  \
+               1. Run `gws auth setup` to configure a GCP project and OAuth client\n  \
+               2. Download client_secret.json from Google Cloud Console and save it to:\n     \
+                  ~/.config/gws/client_secret.json\n  \
+               3. Set env vars: GOOGLE_WORKSPACE_CLI_CLIENT_ID and GOOGLE_WORKSPACE_CLI_CLIENT_SECRET"
+                .to_string(),
+        )),
+    }
+}
+
+/// Resolve OAuth scopes: explicit flags > interactive picker > defaults.
+async fn resolve_scopes(args: &[String], project_id: Option<&str>) -> Vec<String> {
+    // Explicit --scopes flag takes priority
+    for i in 0..args.len() {
+        if args[i] == "--scopes" && i + 1 < args.len() {
+            return args[i + 1]
+                .split(',')
+                .map(|s| s.trim().to_string())
+                .collect();
+        }
+    }
+    if args.iter().any(|a| a == "--readonly") {
+        return READONLY_SCOPES.iter().map(|s| s.to_string()).collect();
+    }
+
+    // Interactive scope picker when running in a TTY
+    if !cfg!(test) && std::io::IsTerminal::is_terminal(&std::io::stdin()) {
+        // If we have a project_id, use discovery-based scope picker (rich templates)
+        if let Some(pid) = project_id {
+            let enabled_apis = crate::setup::get_enabled_apis(pid);
+            if !enabled_apis.is_empty() {
+                let api_ids: Vec<String> = enabled_apis;
+                let scopes = crate::setup::fetch_scopes_for_apis(&api_ids).await;
+                if !scopes.is_empty() {
+                    if let Some(selected) = run_discovery_scope_picker(&scopes) {
+                        return selected;
+                    }
+                }
+            }
+        }
+
+        // Fallback: simple scope picker using static SCOPE_ENTRIES
+        if let Some(selected) = run_simple_scope_picker() {
+            return selected;
+        }
+    }
+
+    DEFAULT_SCOPES.iter().map(|s| s.to_string()).collect()
+}
+
+/// Run the rich discovery-based scope picker with templates.
+fn run_discovery_scope_picker(
+    relevant_scopes: &[crate::setup::DiscoveredScope],
+) -> Option<Vec<String>> {
+    use crate::setup::{ScopeClassification, PLATFORM_SCOPE};
+    use crate::setup_tui::{PickerResult, SelectItem};
+
+    let mut recommended_scopes = vec![];
+    let mut readonly_scopes = vec![];
+    let mut all_scopes = vec![];
+
+    // Collect all short names for hierarchical dedup of Full Access template
+    let all_shorts: Vec<&str> = relevant_scopes
+        .iter()
+        .filter(|e| !is_app_only_scope(&e.url))
+        .map(|e| e.short.as_str())
+        .collect();
+
+    for entry in relevant_scopes {
+        // Skip app-only scopes that can't be used with user OAuth
+        if is_app_only_scope(&entry.url) {
+            continue;
+        }
+
+        let is_recommended = if entry.is_readonly {
+            let superset = entry.url.strip_suffix(".readonly").unwrap();
+            let superset_is_recommended = relevant_scopes
+                .iter()
+                .any(|s| s.url == superset && s.classification != ScopeClassification::Restricted);
+            !superset_is_recommended
+        } else {
+            entry.classification != ScopeClassification::Restricted
+        };
+
+        if is_recommended && !entry.short.starts_with("admin.") {
+            recommended_scopes.push(entry.short.to_string());
+        }
+        if entry.is_readonly {
+            readonly_scopes.push(entry.short.to_string());
+        }
+        // For "Full Access": skip if a broader scope exists (hierarchical dedup)
+        // e.g. "drive.metadata" is subsumed by "drive", "calendar.events" by "calendar"
+        let is_subsumed = all_shorts.iter().any(|&other| {
+            other != entry.short
+                && entry.short.starts_with(other)
+                && entry.short.as_bytes().get(other.len()) == Some(&b'.')
+        });
+        if !is_subsumed {
+            all_scopes.push(entry.short.to_string());
+        }
+    }
+
+    let mut items: Vec<SelectItem> = vec![
+        SelectItem {
+            label: "✨ Recommended (All Non-Restricted + Readonly)".to_string(),
+            description: "Selects non-restricted write scopes and all readonly scopes".to_string(),
+            selected: true,
+            is_fixed: false,
+            is_template: true,
+            template_selects: recommended_scopes,
+        },
+        SelectItem {
+            label: "🔒 Read Only".to_string(),
+            description: "Selects only readonly scopes for enabled APIs".to_string(),
+            selected: false,
+            is_fixed: false,
+            is_template: true,
+            template_selects: readonly_scopes,
+        },
+        SelectItem {
+            label: "⚠️ Full Access (All Scopes)".to_string(),
+            description: "Selects ALL scopes, including restricted write scopes".to_string(),
+            selected: false,
+            is_fixed: false,
+            is_template: true,
+            template_selects: all_scopes,
+        },
+    ];
+    let template_count = items.len();
+
+    let mut valid_scope_indices: Vec<usize> = Vec::new();
+    for (idx, entry) in relevant_scopes.iter().enumerate() {
+        // Skip app-only scopes from the picker entirely
+        if is_app_only_scope(&entry.url) {
+            continue;
+        }
+
+        let (prefix, emoji) = match entry.classification {
+            ScopeClassification::Restricted => ("RESTRICTED ", "⛔ "),
+            ScopeClassification::Sensitive => ("SENSITIVE ", "⚠️  "),
+            ScopeClassification::NonSensitive => ("", ""),
+        };
+
+        let desc_str = if entry.description.is_empty() {
+            entry.url.clone()
+        } else {
+            entry.description.clone()
+        };
+
+        let description = if prefix.is_empty() {
+            desc_str
+        } else {
+            format!("{}{}{}", emoji, prefix, desc_str)
+        };
+
+        let is_recommended = if entry.is_readonly {
+            let superset = entry.url.strip_suffix(".readonly").unwrap();
+            let superset_is_recommended = relevant_scopes
+                .iter()
+                .any(|s| s.url == superset && s.classification != ScopeClassification::Restricted);
+            !superset_is_recommended
+        } else {
+            entry.classification != ScopeClassification::Restricted
+        };
+
+        items.push(SelectItem {
+            label: entry.short.to_string(),
+            description,
+            selected: is_recommended,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        });
+        valid_scope_indices.push(idx);
+    }
+
+    match crate::setup_tui::run_picker(
+        "Select OAuth scopes",
+        "Space to toggle, Enter to confirm",
+        items,
+        true,
+    ) {
+        Ok(PickerResult::Confirmed(items)) => {
+            let recommended = items.first().is_some_and(|i| i.selected);
+            let readonly = items.get(1).is_some_and(|i| i.selected);
+            let full = items.get(2).is_some_and(|i| i.selected);
+
+            let mut selected: Vec<String> = Vec::new();
+
+            if full && !recommended && !readonly {
+                // Full Access: include all non-app-only scopes
+                // (hierarchical dedup is applied in post-processing below)
+                for entry in relevant_scopes {
+                    if is_app_only_scope(&entry.url) {
+                        continue;
+                    }
+                    selected.push(entry.url.to_string());
+                }
+            } else if recommended && !full && !readonly {
+                // Recommended: non-restricted + readonly, but exclude admin.* scopes
+                for entry in relevant_scopes {
+                    if is_app_only_scope(&entry.url) {
+                        continue;
+                    }
+                    if entry.short.starts_with("admin.") {
+                        continue;
+                    }
+                    if entry.is_readonly || entry.classification != ScopeClassification::Restricted
+                    {
+                        selected.push(entry.url.to_string());
+                    }
+                }
+            } else if readonly && !full && !recommended {
+                for entry in relevant_scopes {
+                    if is_app_only_scope(&entry.url) {
+                        continue;
+                    }
+                    if entry.is_readonly {
+                        selected.push(entry.url.to_string());
+                    }
+                }
+            } else {
+                for (i, item) in items.iter().enumerate().skip(template_count) {
+                    if item.selected {
+                        let picker_idx = i - template_count;
+                        if let Some(&scope_idx) = valid_scope_indices.get(picker_idx) {
+                            if let Some(entry) = relevant_scopes.get(scope_idx) {
+                                selected.push(entry.url.to_string());
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Always include cloud-platform scope
+            if !selected.contains(&PLATFORM_SCOPE.to_string()) {
+                selected.push(PLATFORM_SCOPE.to_string());
+            }
+
+            // Hierarchical dedup: if we have both a broad scope (e.g. `.../auth/drive`)
+            // and a narrower scope (e.g. `.../auth/drive.metadata`, `.../auth/drive.readonly`),
+            // drop the narrower one since the broad scope subsumes it.
+            let prefix = "https://www.googleapis.com/auth/";
+            let shorts: Vec<&str> = selected
+                .iter()
+                .filter_map(|s| s.strip_prefix(prefix))
+                .collect();
+
+            let mut deduplicated: Vec<String> = Vec::new();
+            for scope in &selected {
+                if let Some(short) = scope.strip_prefix(prefix) {
+                    // Check if any OTHER selected scope is a prefix of this one
+                    // e.g. "drive" is a prefix of "drive.metadata" → drop "drive.metadata"
+                    let is_subsumed = shorts.iter().any(|&other| {
+                        other != short
+                            && short.starts_with(other)
+                            && short.as_bytes().get(other.len()) == Some(&b'.')
+                    });
+                    if is_subsumed {
+                        continue;
+                    }
+                }
+                deduplicated.push(scope.clone());
+            }
+
+            if deduplicated.len() > 30 {
+                eprintln!(
+                    "⚠️  Warning: {} scopes selected. Unverified OAuth apps may fail with this many scopes.",
+                    deduplicated.len()
+                );
+            }
+
+            if deduplicated.is_empty() {
+                None
+            } else {
+                Some(deduplicated)
+            }
+        }
+        _ => None, // GoBack, Cancelled, or error
+    }
+}
+
+/// Run the simple static scope picker (fallback when no project_id available).
+fn run_simple_scope_picker() -> Option<Vec<String>> {
+    use crate::setup_tui::{PickerResult, SelectItem};
+
+    let items: Vec<SelectItem> = SCOPE_ENTRIES
+        .iter()
+        .map(|entry| SelectItem {
+            label: entry.label.to_string(),
+            description: entry.scope.to_string(),
+            selected: true,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        })
+        .collect();
+
+    match crate::setup_tui::run_picker(
+        "Select OAuth scopes",
+        "Space to toggle, 'a' to select all, Enter to confirm",
+        items,
+        true,
+    ) {
+        Ok(PickerResult::Confirmed(items)) => {
+            let selected: Vec<String> = items
+                .iter()
+                .enumerate()
+                .filter(|(_, item)| item.selected)
+                .map(|(i, _)| SCOPE_ENTRIES[i].scope.to_string())
+                .collect();
+            if selected.is_empty() {
+                None
+            } else {
+                Some(selected)
+            }
+        }
+        _ => None,
+    }
+}
+
+async fn handle_status() -> Result<(), GwsError> {
+    let plain_path = plain_credentials_path();
+    let enc_path = credential_store::encrypted_credentials_path();
+    let token_cache = token_cache_path();
+
+    let has_encrypted = enc_path.exists();
+    let has_plain = plain_path.exists();
+    let has_token_cache = token_cache.exists();
+
+    let auth_method = if has_encrypted || has_plain {
+        "oauth2"
+    } else {
+        "none"
+    };
+
+    let storage = if has_encrypted {
+        "encrypted"
+    } else if has_plain {
+        "plaintext"
+    } else {
+        "none"
+    };
+
+    let mut output = json!({
+        "auth_method": auth_method,
+        "storage": storage,
+        "encrypted_credentials": enc_path.display().to_string(),
+        "encrypted_credentials_exists": has_encrypted,
+        "plain_credentials": plain_path.display().to_string(),
+        "plain_credentials_exists": has_plain,
+        "token_cache_exists": has_token_cache,
+    });
+
+    // Show client config (client_secret.json) status
+    let config_path = crate::oauth_config::client_config_path();
+    let has_config = config_path.exists();
+    output["client_config"] = json!(config_path.display().to_string());
+    output["client_config_exists"] = json!(has_config);
+
+    if has_config {
+        match crate::oauth_config::load_client_config() {
+            Ok(config) => {
+                output["project_id"] = json!(config.project_id);
+                let masked_id = if config.client_id.len() > 12 {
+                    format!(
+                        "{}...{}",
+                        &config.client_id[..8],
+                        &config.client_id[config.client_id.len() - 4..]
+                    )
+                } else {
+                    config.client_id.clone()
+                };
+                output["config_client_id"] = json!(masked_id);
+            }
+            Err(e) => {
+                output["client_config_error"] = json!(e.to_string());
+            }
+        }
+    }
+
+    // Show credential source by attempting actual resolution
+    let has_token_env = std::env::var("GOOGLE_WORKSPACE_CLI_TOKEN")
+        .ok()
+        .filter(|t| !t.is_empty())
+        .is_some();
+
+    let credential_source = if has_token_env {
+        output["token_env_var"] = json!(true);
+        "token_env_var"
+    } else {
+        match resolve_client_credentials() {
+            Ok((_, _, _)) => {
+                let has_env_id = std::env::var("GOOGLE_WORKSPACE_CLI_CLIENT_ID").is_ok();
+                let has_env_secret = std::env::var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET").is_ok();
+                if has_env_id && has_env_secret {
+                    "environment_variables"
+                } else {
+                    "client_secret.json"
+                }
+            }
+            Err(_) => "none",
+        }
+    };
+    output["credential_source"] = json!(credential_source);
+
+    // Try to read and show masked info from encrypted credentials
+    // Skip real credential/network access in test builds
+    if !cfg!(test) {
+        if has_encrypted {
+            match credential_store::load_encrypted() {
+                Ok(contents) => {
+                    if let Ok(creds) = serde_json::from_str::<serde_json::Value>(&contents) {
+                        if let Some(client_id) = creds.get("client_id").and_then(|v| v.as_str()) {
+                            let masked = if client_id.len() > 12 {
+                                format!(
+                                    "{}...{}",
+                                    &client_id[..8],
+                                    &client_id[client_id.len() - 4..]
+                                )
+                            } else {
+                                client_id.to_string()
+                            };
+                            output["client_id"] = json!(masked);
+                        }
+                        output["has_refresh_token"] = json!(creds
+                            .get("refresh_token")
+                            .and_then(|v| v.as_str())
+                            .is_some());
+                    }
+                    output["encryption_valid"] = json!(true);
+                }
+                Err(_) => {
+                    output["encryption_valid"] = json!(false);
+                    output["encryption_error"] =
+                        json!("Could not decrypt. May have been created on a different machine.");
+                }
+            }
+        } else if has_plain {
+            match tokio::fs::read_to_string(&plain_path).await {
+                Ok(contents) => {
+                    if let Ok(creds) = serde_json::from_str::<serde_json::Value>(&contents) {
+                        if let Some(client_id) = creds.get("client_id").and_then(|v| v.as_str()) {
+                            let masked = if client_id.len() > 12 {
+                                format!(
+                                    "{}...{}",
+                                    &client_id[..8],
+                                    &client_id[client_id.len() - 4..]
+                                )
+                            } else {
+                                client_id.to_string()
+                            };
+                            output["client_id"] = json!(masked);
+                        }
+                        output["has_refresh_token"] = json!(creds.get("refresh_token").is_some());
+                    }
+                }
+                Err(_) => {
+                    output["credentials_readable"] = json!(false);
+                }
+            }
+        }
+    } // end !cfg!(test)
+
+    // If we have credentials, try to get live info (user, scopes, APIs)
+    // Skip all network calls and subprocess spawning in test builds
+    if !cfg!(test) {
+        let creds_json_str = if has_encrypted {
+            credential_store::load_encrypted().ok()
+        } else if has_plain {
+            tokio::fs::read_to_string(&plain_path).await.ok()
+        } else {
+            None
+        };
+
+        if let Some(creds_str) = creds_json_str {
+            if let Ok(creds) = serde_json::from_str::<serde_json::Value>(&creds_str) {
+                let client_id = creds.get("client_id").and_then(|v| v.as_str());
+                let client_secret = creds.get("client_secret").and_then(|v| v.as_str());
+                let refresh_token = creds.get("refresh_token").and_then(|v| v.as_str());
+
+                if let (Some(cid), Some(csec), Some(rt)) = (client_id, client_secret, refresh_token)
+                {
+                    // Exchange refresh token for access token
+                    let http_client = reqwest::Client::new();
+                    let token_resp = http_client
+                        .post("https://oauth2.googleapis.com/token")
+                        .form(&[
+                            ("client_id", cid),
+                            ("client_secret", csec),
+                            ("refresh_token", rt),
+                            ("grant_type", "refresh_token"),
+                        ])
+                        .send()
+                        .await;
+
+                    if let Ok(resp) = token_resp {
+                        if let Ok(token_json) = resp.json::<serde_json::Value>().await {
+                            if let Some(access_token) =
+                                token_json.get("access_token").and_then(|v| v.as_str())
+                            {
+                                output["token_valid"] = json!(true);
+
+                                // Get user info
+                                if let Ok(user_resp) = http_client
+                                    .get("https://www.googleapis.com/oauth2/v1/userinfo")
+                                    .bearer_auth(access_token)
+                                    .send()
+                                    .await
+                                {
+                                    if let Ok(user_json) =
+                                        user_resp.json::<serde_json::Value>().await
+                                    {
+                                        if let Some(email) =
+                                            user_json.get("email").and_then(|v| v.as_str())
+                                        {
+                                            output["user"] = json!(email);
+                                        }
+                                    }
+                                }
+
+                                // Get granted scopes via tokeninfo
+                                let tokeninfo_url = format!(
+                                    "https://oauth2.googleapis.com/tokeninfo?access_token={}",
+                                    access_token
+                                );
+                                if let Ok(info_resp) = http_client.get(&tokeninfo_url).send().await
+                                {
+                                    if let Ok(info_json) =
+                                        info_resp.json::<serde_json::Value>().await
+                                    {
+                                        if let Some(scope_str) =
+                                            info_json.get("scope").and_then(|v| v.as_str())
+                                        {
+                                            let scopes: Vec<&str> = scope_str.split(' ').collect();
+                                            output["scopes"] = json!(scopes);
+                                            output["scope_count"] = json!(scopes.len());
+                                        }
+                                    }
+                                }
+                            } else {
+                                output["token_valid"] = json!(false);
+                                if let Some(err) =
+                                    token_json.get("error_description").and_then(|v| v.as_str())
+                                {
+                                    output["token_error"] = json!(err);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        // Show enabled APIs if we have a project_id
+        if let Some(pid) = output.get("project_id").and_then(|v| v.as_str()) {
+            let enabled = crate::setup::get_enabled_apis(pid);
+            if !enabled.is_empty() {
+                output["enabled_apis"] = json!(enabled);
+                output["enabled_api_count"] = json!(enabled.len());
+            }
+        }
+    } // end !cfg!(test)
+
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&output).unwrap_or_default()
+    );
+    Ok(())
+}
+
+fn handle_logout() -> Result<(), GwsError> {
+    let plain_path = plain_credentials_path();
+    let enc_path = credential_store::encrypted_credentials_path();
+    let token_cache = token_cache_path();
+
+    let mut removed = Vec::new();
+
+    for path in [&enc_path, &plain_path, &token_cache] {
+        if path.exists() {
+            std::fs::remove_file(path).map_err(|e| {
+                GwsError::Validation(format!("Failed to remove {}: {e}", path.display()))
+            })?;
+            removed.push(path.display().to_string());
+        }
+    }
+
+    let output = if removed.is_empty() {
+        json!({
+            "status": "success",
+            "message": "No credentials found to remove.",
+        })
+    } else {
+        json!({
+            "status": "success",
+            "message": "Logged out. Credentials and token cache removed.",
+            "removed": removed,
+        })
+    };
+
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&output).unwrap_or_default()
+    );
+    Ok(())
+}
+
+/// Extract refresh_token from yup-oauth2 v12 token cache.
+/// Format: [{"scopes":[...], "token":{"access_token":..., "refresh_token":...}}]
+pub fn extract_refresh_token(token_data: &str) -> Option<String> {
+    let cache: serde_json::Value = serde_json::from_str(token_data).ok()?;
+    cache.as_array()?.iter().find_map(|entry| {
+        entry
+            .get("token")
+            .and_then(|t| t.get("refresh_token"))
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+    })
+}
+
+/// Parse --scopes or --readonly from args, falling back to DEFAULT_SCOPES.
+/// Scope entry with a human-readable label for the TUI picker.
+struct ScopeEntry {
+    scope: &'static str,
+    label: &'static str,
+}
+
+const SCOPE_ENTRIES: &[ScopeEntry] = &[
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/drive",
+        label: "Google Drive",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/spreadsheets",
+        label: "Google Sheets",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/gmail.modify",
+        label: "Gmail",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/calendar",
+        label: "Google Calendar",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/documents",
+        label: "Google Docs",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/presentations",
+        label: "Google Slides",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/tasks",
+        label: "Google Tasks",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/pubsub",
+        label: "Cloud Pub/Sub",
+    },
+    ScopeEntry {
+        scope: "https://www.googleapis.com/auth/cloud-platform",
+        label: "Cloud Platform",
+    },
+];
+
+// (parse_scopes removed — replaced by resolve_scopes above)
+
+/// Helper: check if a scope is an app-only scope that can't be used with user OAuth
+fn is_app_only_scope(url: &str) -> bool {
+    url.contains("/auth/chat.app.")
+        || url.contains("/auth/chat.bot")
+        || url.contains("/auth/chat.import")
+        || url.contains("/auth/keep")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Helper to run resolve_scopes in tests (async).
+    fn run_resolve_scopes(args: &[String], project_id: Option<&str>) -> Vec<String> {
+        let rt = tokio::runtime::Runtime::new().unwrap();
+        rt.block_on(resolve_scopes(args, project_id))
+    }
+
+    #[test]
+    fn resolve_scopes_returns_defaults_when_no_flag() {
+        let args: Vec<String> = vec![];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), DEFAULT_SCOPES.len());
+        assert_eq!(scopes[0], "https://www.googleapis.com/auth/drive");
+    }
+
+    #[test]
+    fn resolve_scopes_returns_custom_scopes() {
+        let args: Vec<String> = vec![
+            "--scopes".to_string(),
+            "https://www.googleapis.com/auth/drive.readonly".to_string(),
+        ];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), 1);
+        assert_eq!(scopes[0], "https://www.googleapis.com/auth/drive.readonly");
+    }
+
+    #[test]
+    fn resolve_scopes_handles_multiple_comma_separated() {
+        let args: Vec<String> = vec![
+            "--scopes".to_string(),
+            "https://www.googleapis.com/auth/drive, https://www.googleapis.com/auth/gmail.readonly"
+                .to_string(),
+        ];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), 2);
+        assert_eq!(scopes[0], "https://www.googleapis.com/auth/drive");
+        assert_eq!(scopes[1], "https://www.googleapis.com/auth/gmail.readonly");
+    }
+
+    #[test]
+    fn resolve_scopes_ignores_trailing_flag() {
+        // --scopes with no value should use defaults
+        let args: Vec<String> = vec!["--scopes".to_string()];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), DEFAULT_SCOPES.len());
+    }
+
+    #[test]
+    fn resolve_scopes_readonly_returns_readonly_scopes() {
+        let args = vec!["--readonly".to_string()];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), READONLY_SCOPES.len());
+        for scope in &scopes {
+            assert!(
+                scope.ends_with(".readonly"),
+                "Expected readonly scope, got: {scope}"
+            );
+        }
+    }
+
+    #[test]
+    fn resolve_scopes_custom_overrides_readonly() {
+        // --scopes takes priority over --readonly
+        let args = vec![
+            "--scopes".to_string(),
+            "https://www.googleapis.com/auth/drive".to_string(),
+            "--readonly".to_string(),
+        ];
+        let scopes = run_resolve_scopes(&args, None);
+        assert_eq!(scopes.len(), 1);
+        assert_eq!(scopes[0], "https://www.googleapis.com/auth/drive");
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn resolve_client_credentials_from_env_vars() {
+        unsafe {
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID", "test-id");
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET", "test-secret");
+        }
+        let result = resolve_client_credentials();
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID");
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET");
+        }
+        let (id, secret, _project_id) = result.unwrap();
+        assert_eq!(id, "test-id");
+        assert_eq!(secret, "test-secret");
+        // project_id may be Some if client_secret.json exists on the machine
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn resolve_client_credentials_missing_env_vars_uses_config() {
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID");
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET");
+        }
+        // Result depends on whether client_secret.json exists on the machine
+        let result = resolve_client_credentials();
+        if crate::oauth_config::client_config_path().exists() {
+            assert!(
+                result.is_ok(),
+                "Should succeed when client_secret.json exists"
+            );
+        } else {
+            assert!(result.is_err());
+            let err_msg = result.unwrap_err().to_string();
+            assert!(err_msg.contains("No OAuth client configured"));
+        }
+    }
+
+    #[test]
+    fn config_dir_returns_gws_subdir() {
+        let path = config_dir();
+        assert!(path.ends_with("gws"));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn plain_credentials_path_defaults_to_config_dir() {
+        // Without env var, should be in config dir
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE");
+        }
+        let path = plain_credentials_path();
+        assert!(path.ends_with("credentials.json"));
+        assert!(path.starts_with(config_dir()));
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn plain_credentials_path_respects_env_var() {
+        unsafe {
+            std::env::set_var(
+                "GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE",
+                "/tmp/test-creds.json",
+            );
+        }
+        let path = plain_credentials_path();
+        assert_eq!(path, PathBuf::from("/tmp/test-creds.json"));
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE");
+        }
+    }
+
+    #[test]
+    fn token_cache_path_is_in_config_dir() {
+        let path = token_cache_path();
+        assert!(path.ends_with("token_cache.json"));
+        assert!(path.starts_with(config_dir()));
+    }
+
+    #[tokio::test]
+    async fn handle_auth_command_empty_args_returns_usage() {
+        let args: Vec<String> = vec![];
+        let result = handle_auth_command(&args).await;
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            GwsError::Validation(msg) => assert!(msg.contains("login|setup|status|export|logout")),
+            other => panic!("Expected Validation error, got: {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn handle_auth_command_invalid_subcommand() {
+        let args = vec!["frobnicate".to_string()];
+        let result = handle_auth_command(&args).await;
+        assert!(result.is_err());
+        match result.unwrap_err() {
+            GwsError::Validation(msg) => assert!(msg.contains("frobnicate")),
+            other => panic!("Expected Validation error, got: {other:?}"),
+        }
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn resolve_credentials_fails_without_env_vars_or_config() {
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID");
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET");
+        }
+        // When no env vars AND no client_secret.json on disk, should fail
+        let result = resolve_client_credentials();
+        if !crate::oauth_config::client_config_path().exists() {
+            assert!(result.is_err());
+            match result.unwrap_err() {
+                GwsError::Auth(msg) => assert!(msg.contains("No OAuth client configured")),
+                other => panic!("Expected Auth error, got: {other:?}"),
+            }
+        }
+        // If client_secret.json exists on the dev machine, credentials resolve
+        // successfully — that's correct behavior, not a test failure.
+    }
+
+    #[test]
+    #[serial_test::serial]
+    fn resolve_credentials_uses_env_vars_when_present() {
+        unsafe {
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID", "test-id");
+            std::env::set_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET", "test-secret");
+        }
+
+        let result = resolve_client_credentials();
+
+        // Clean up immediately
+        unsafe {
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_ID");
+            std::env::remove_var("GOOGLE_WORKSPACE_CLI_CLIENT_SECRET");
+        }
+
+        let (id, secret, _) = result.unwrap();
+        assert_eq!(id, "test-id");
+        assert_eq!(secret, "test-secret");
+    }
+
+    #[tokio::test]
+    async fn handle_status_succeeds_without_credentials() {
+        // status should always succeed and report "none"
+        let args = vec!["status".to_string()];
+        let result = handle_auth_command(&args).await;
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn credential_store_save_load_round_trip() {
+        // Use encrypt/decrypt directly to avoid writing to the real config dir
+        let json = r#"{"client_id":"test","client_secret":"secret","refresh_token":"tok"}"#;
+        let encrypted = credential_store::encrypt(json.as_bytes()).expect("encrypt should succeed");
+        let decrypted = credential_store::decrypt(&encrypted).expect("decrypt should succeed");
+        assert_eq!(String::from_utf8(decrypted).unwrap(), json);
+    }
+
+    #[test]
+    fn extract_refresh_token_from_yup_oauth2_format() {
+        // Actual format produced by yup-oauth2 v12
+        let data = r#"[{"scopes":["https://www.googleapis.com/auth/drive"],"token":{"access_token":"ya29.test","refresh_token":"1//test-refresh-token","expires_at":[2026,43,19,44,15,0,0,0,0],"id_token":null}}]"#;
+        assert_eq!(
+            extract_refresh_token(data),
+            Some("1//test-refresh-token".to_string())
+        );
+    }
+
+    #[test]
+    fn extract_refresh_token_missing_token() {
+        let data = r#"[{"scopes":["scope"],"token":{"access_token":"ya29.test"}}]"#;
+        assert_eq!(extract_refresh_token(data), None);
+    }
+
+    #[test]
+    fn extract_refresh_token_empty_array() {
+        assert_eq!(extract_refresh_token("[]"), None);
+    }
+
+    #[test]
+    fn extract_refresh_token_invalid_json() {
+        assert_eq!(extract_refresh_token("not json"), None);
+    }
+
+    #[test]
+    fn extract_refresh_token_object_format() {
+        // Should return None — we only support array format
+        let data = r#"{"key":{"access_token":"ya29","refresh_token":"1//tok"}}"#;
+        assert_eq!(extract_refresh_token(data), None);
+    }
+}
diff --git a/src/client.rs b/src/client.rs
new file mode 100644
index 00000000..7e237dbb
--- /dev/null
+++ b/src/client.rs
@@ -0,0 +1,59 @@
+use reqwest::header::{HeaderMap, HeaderValue};
+
+pub fn build_client() -> Result<reqwest::Client, crate::error::GwsError> {
+    let mut headers = HeaderMap::new();
+    let name = env!("CARGO_PKG_NAME");
+    let version = env!("CARGO_PKG_VERSION");
+
+    // Format: name/version
+    let client_header = format!("{}/{}", name, version);
+    if let Ok(header_value) = HeaderValue::from_str(&client_header) {
+        headers.insert("x-goog-api-client", header_value);
+    }
+
+    reqwest::Client::builder()
+        .default_headers(headers)
+        .build()
+        .map_err(|e| {
+            crate::error::GwsError::Other(anyhow::anyhow!("Failed to build HTTP client: {e}"))
+        })
+}
+
+const MAX_RETRIES: u32 = 3;
+
+/// Send an HTTP request with automatic retry on 429 (rate limit) responses.
+/// Respects the `Retry-After` header; falls back to exponential backoff (1s, 2s, 4s).
+pub async fn send_with_retry(
+    build_request: impl Fn() -> reqwest::RequestBuilder,
+) -> Result<reqwest::Response, reqwest::Error> {
+    for attempt in 0..MAX_RETRIES {
+        let resp = build_request().send().await?;
+
+        if resp.status() != reqwest::StatusCode::TOO_MANY_REQUESTS {
+            return Ok(resp);
+        }
+
+        // Parse Retry-After header (seconds), fall back to exponential backoff
+        let retry_after = resp
+            .headers()
+            .get("retry-after")
+            .and_then(|v| v.to_str().ok())
+            .and_then(|s| s.parse::<u64>().ok())
+            .unwrap_or(1 << attempt); // 1, 2, 4 seconds
+
+        tokio::time::sleep(std::time::Duration::from_secs(retry_after)).await;
+    }
+
+    // Final attempt — return whatever we get
+    build_request().send().await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn build_client_succeeds() {
+        assert!(build_client().is_ok());
+    }
+}
diff --git a/src/commands.rs b/src/commands.rs
new file mode 100644
index 00000000..c40b707e
--- /dev/null
+++ b/src/commands.rs
@@ -0,0 +1,278 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use clap::{Arg, Command};
+
+use crate::discovery::{RestDescription, RestResource};
+
+/// Builds the full CLI command tree from a Discovery Document.
+pub fn build_cli(doc: &RestDescription) -> Command {
+    let about_text = doc
+        .description
+        .clone()
+        .unwrap_or_else(|| "Google Workspace CLI".to_string());
+    let mut root = Command::new("gws")
+        .about(about_text)
+        .subcommand_required(true)
+        .arg_required_else_help(true)
+        .arg(
+            clap::Arg::new("sanitize")
+                .long("sanitize")
+                .help("Sanitize API responses through a Model Armor template. Requires cloud-platform scope. Format: projects/PROJECT/locations/LOCATION/templates/TEMPLATE. Also reads GWS_SANITIZE_TEMPLATE env var.")
+                .value_name("TEMPLATE")
+                .global(true),
+        )
+        .arg(
+            clap::Arg::new("dry-run")
+                .long("dry-run")
+                .help("Validate the request locally without sending it to the API")
+                .action(clap::ArgAction::SetTrue)
+                .global(true),
+        )
+        .arg(
+            clap::Arg::new("format")
+                .long("format")
+                .help("Output format: json (default), table, yaml, csv")
+                .value_name("FORMAT")
+                .global(true),
+        );
+
+    // Inject helper commands
+    let helper = crate::helpers::get_helper(&doc.name);
+    if let Some(ref helper) = helper {
+        root = helper.inject_commands(root, doc);
+    }
+
+    // Add resource subcommands (unless helper suppresses them)
+    let skip_resources = helper.as_ref().is_some_and(|h| h.helper_only());
+    if !skip_resources {
+        let mut resource_names: Vec<_> = doc.resources.keys().collect();
+        resource_names.sort();
+        for name in resource_names {
+            let resource = &doc.resources[name];
+            if let Some(cmd) = build_resource_command(name, resource) {
+                root = root.subcommand(cmd);
+            }
+        }
+    }
+
+    root
+}
+
+/// Recursively builds a Command for a resource.
+/// Returns None if the resource has no methods or sub-resources.
+fn build_resource_command(name: &str, resource: &RestResource) -> Option<Command> {
+    let mut cmd = Command::new(name.to_string())
+        .about(format!("Operations on the '{name}' resource"))
+        .subcommand_required(true)
+        .arg_required_else_help(true);
+
+    let mut has_children = false;
+
+    // Add method subcommands
+    let mut method_names: Vec<_> = resource.methods.keys().collect();
+    method_names.sort();
+    for method_name in method_names {
+        let method = &resource.methods[method_name];
+
+        has_children = true;
+
+        let about = method
+            .description
+            .as_deref()
+            .unwrap_or("")
+            // Truncate long descriptions for help text
+            .chars()
+            .take(200)
+            .collect::<String>();
+
+        let mut method_cmd = Command::new(method_name.to_string())
+            .about(about)
+            .arg(
+                Arg::new("params")
+                    .long("params")
+                    .help("JSON string for URL/Query parameters")
+                    .value_name("JSON"),
+            )
+            .arg(
+                Arg::new("output")
+                    .long("output")
+                    .short('o')
+                    .help("Output file path for binary responses")
+                    .value_name("PATH"),
+            );
+
+        // Only add --json flag if the method accepts a request body
+        if method.request.is_some() {
+            method_cmd = method_cmd.arg(
+                Arg::new("json")
+                    .long("json")
+                    .help("JSON string for the request body")
+                    .value_name("JSON"),
+            );
+        }
+
+        // Add --upload flag if the method supports media upload
+        if method.supports_media_upload {
+            method_cmd = method_cmd.arg(
+                Arg::new("upload")
+                    .long("upload")
+                    .help("Local file path to upload as media content (multipart upload)")
+                    .value_name("PATH"),
+            );
+        }
+
+        // Pagination flags
+        method_cmd = method_cmd
+            .arg(
+                Arg::new("page-all")
+                    .long("page-all")
+                    .help("Auto-paginate through all results, outputting one JSON line per page (NDJSON)")
+                    .action(clap::ArgAction::SetTrue),
+            )
+            .arg(
+                Arg::new("page-limit")
+                    .long("page-limit")
+                    .help("Maximum number of pages to fetch when using --page-all (default: 10)")
+                    .value_name("N")
+                    .value_parser(clap::value_parser!(u32)),
+            )
+            .arg(
+                Arg::new("page-delay")
+                    .long("page-delay")
+                    .help("Delay in milliseconds between page fetches (default: 100)")
+                    .value_name("MS")
+                    .value_parser(clap::value_parser!(u64)),
+            );
+
+        cmd = cmd.subcommand(method_cmd);
+    }
+
+    // Add sub-resource subcommands (recursive)
+    let mut sub_names: Vec<_> = resource.resources.keys().collect();
+    sub_names.sort();
+    for sub_name in sub_names {
+        let sub_resource = &resource.resources[sub_name];
+        if let Some(sub_cmd) = build_resource_command(sub_name, sub_resource) {
+            has_children = true;
+            cmd = cmd.subcommand(sub_cmd);
+        }
+    }
+
+    if has_children {
+        Some(cmd)
+    } else {
+        None
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery::{RestMethod, RestResource};
+    use std::collections::HashMap;
+
+    fn make_doc() -> RestDescription {
+        let mut methods = HashMap::new();
+        methods.insert(
+            "list".to_string(),
+            RestMethod {
+                id: None,
+                description: None,
+                http_method: "GET".to_string(),
+                path: "list".to_string(),
+                parameters: HashMap::new(),
+                parameter_order: vec![],
+                request: None,
+                response: None,
+                scopes: vec!["https://www.googleapis.com/auth/drive.readonly".to_string()],
+                flat_path: None,
+                supports_media_download: false,
+                supports_media_upload: false,
+                media_upload: None,
+            },
+        );
+
+        methods.insert(
+            "delete".to_string(),
+            RestMethod {
+                id: None,
+                description: None,
+                http_method: "DELETE".to_string(),
+                path: "delete".to_string(),
+                parameters: HashMap::new(),
+                parameter_order: vec![],
+                request: None,
+                response: None,
+                scopes: vec!["https://www.googleapis.com/auth/drive".to_string()],
+                flat_path: None,
+                supports_media_download: false,
+                supports_media_upload: false,
+                media_upload: None,
+            },
+        );
+
+        let mut resources = HashMap::new();
+        resources.insert(
+            "files".to_string(),
+            RestResource {
+                methods,
+                resources: HashMap::new(),
+            },
+        );
+
+        RestDescription {
+            name: "drive".to_string(),
+            version: "v3".to_string(),
+            title: None,
+            description: None,
+            root_url: "".to_string(),
+            service_path: "".to_string(),
+            base_url: None,
+            schemas: HashMap::new(),
+            resources,
+            parameters: HashMap::new(),
+            auth: None,
+        }
+    }
+
+    #[test]
+    fn test_all_commands_always_shown() {
+        let doc = make_doc();
+        let cmd = build_cli(&doc);
+
+        // Should have "files" subcommand
+        let files_cmd = cmd
+            .find_subcommand("files")
+            .expect("files resource missing");
+
+        // All methods should always be visible regardless of auth state
+        assert!(files_cmd.find_subcommand("list").is_some());
+        assert!(files_cmd.find_subcommand("delete").is_some());
+    }
+
+    #[test]
+    fn test_sanitize_arg_present() {
+        let doc = make_doc();
+        let cmd = build_cli(&doc);
+
+        // The --sanitize global arg should be available
+        let args: Vec<_> = cmd.get_arguments().collect();
+        let sanitize_arg = args.iter().find(|a| a.get_id() == "sanitize");
+        assert!(
+            sanitize_arg.is_some(),
+            "--sanitize arg should be present on root command"
+        );
+    }
+}
diff --git a/src/credential_store.rs b/src/credential_store.rs
new file mode 100644
index 00000000..d146be92
--- /dev/null
+++ b/src/credential_store.rs
@@ -0,0 +1,314 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::path::PathBuf;
+
+use aes_gcm::aead::{Aead, KeyInit, OsRng};
+use aes_gcm::{AeadCore, Aes256Gcm, Nonce};
+
+use keyring::Entry;
+use rand::RngCore;
+use std::sync::OnceLock;
+
+/// Returns the encryption key derived from the OS keyring, or falls back to a local file.
+/// Generates a random 256-bit key and stores it securely if it doesn't exist.
+fn get_or_create_key() -> anyhow::Result<[u8; 32]> {
+    static KEY: OnceLock<[u8; 32]> = OnceLock::new();
+
+    if let Some(key) = KEY.get() {
+        return Ok(*key);
+    }
+
+    let username = std::env::var("USER")
+        .or_else(|_| std::env::var("USERNAME"))
+        .unwrap_or_else(|_| "unknown-user".to_string());
+
+    let entry = Entry::new("gws-cli", &username);
+
+    if let Ok(entry) = entry {
+        match entry.get_password() {
+            Ok(b64_key) => {
+                use base64::{engine::general_purpose::STANDARD, Engine as _};
+                if let Ok(decoded) = STANDARD.decode(&b64_key) {
+                    if decoded.len() == 32 {
+                        let mut arr = [0u8; 32];
+                        arr.copy_from_slice(&decoded);
+                        let _ = KEY.set(arr);
+                        return Ok(arr);
+                    }
+                }
+            }
+            Err(keyring::Error::NoEntry) => {
+                // Generate a random 32-byte key
+                let mut key = [0u8; 32];
+                rand::thread_rng().fill_bytes(&mut key);
+
+                use base64::{engine::general_purpose::STANDARD, Engine as _};
+                let b64_key = STANDARD.encode(key);
+
+                if entry.set_password(&b64_key).is_ok() {
+                    let _ = KEY.set(key);
+                    return Ok(key);
+                }
+            }
+            Err(_) => {} // Fallthrough to file storage
+        }
+    }
+
+    // Fallback: Local file `.encryption_key`
+    let key_file = crate::auth_commands::config_dir().join(".encryption_key");
+    if key_file.exists() {
+        if let Ok(b64_key) = std::fs::read_to_string(&key_file) {
+            use base64::{engine::general_purpose::STANDARD, Engine as _};
+            if let Ok(decoded) = STANDARD.decode(b64_key.trim()) {
+                if decoded.len() == 32 {
+                    let mut arr = [0u8; 32];
+                    arr.copy_from_slice(&decoded);
+                    let _ = KEY.set(arr);
+                    return Ok(arr);
+                }
+            }
+        }
+    }
+
+    // Generate new key and save to local file
+    let mut key = [0u8; 32];
+    rand::thread_rng().fill_bytes(&mut key);
+
+    use base64::{engine::general_purpose::STANDARD, Engine as _};
+    let b64_key = STANDARD.encode(key);
+
+    if let Some(parent) = key_file.parent() {
+        let _ = std::fs::create_dir_all(parent);
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700));
+        }
+    }
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create(true).truncate(true).mode(0o600);
+        if let Ok(mut file) = options.open(&key_file) {
+            use std::io::Write;
+            let _ = file.write_all(b64_key.as_bytes());
+        }
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = std::fs::write(&key_file, b64_key);
+    }
+
+    let _ = KEY.set(key);
+    Ok(key)
+}
+
+/// Encrypts plaintext bytes using AES-256-GCM with a machine-derived key.
+/// Returns nonce (12 bytes) || ciphertext.
+pub fn encrypt(plaintext: &[u8]) -> anyhow::Result<Vec<u8>> {
+    let key = get_or_create_key()?;
+    let cipher = Aes256Gcm::new_from_slice(&key)
+        .map_err(|e| anyhow::anyhow!("Failed to create cipher: {e}"))?;
+
+    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+    let ciphertext = cipher
+        .encrypt(&nonce, plaintext)
+        .map_err(|e| anyhow::anyhow!("Encryption failed: {e}"))?;
+
+    // Prepend nonce to ciphertext
+    let mut result = nonce.to_vec();
+    result.extend_from_slice(&ciphertext);
+    Ok(result)
+}
+
+/// Decrypts data produced by `encrypt()`.
+pub fn decrypt(data: &[u8]) -> anyhow::Result<Vec<u8>> {
+    if data.len() < 12 {
+        anyhow::bail!("Encrypted data too short");
+    }
+
+    let key = get_or_create_key()?;
+    let cipher = Aes256Gcm::new_from_slice(&key)
+        .map_err(|e| anyhow::anyhow!("Failed to create cipher: {e}"))?;
+
+    let nonce = Nonce::from_slice(&data[..12]);
+    let plaintext = cipher.decrypt(nonce, &data[12..]).map_err(|_| {
+        anyhow::anyhow!(
+            "Decryption failed. Credentials may have been created on a different machine. \
+                 Run `gws auth logout` and `gws auth login` to re-authenticate."
+        )
+    })?;
+
+    Ok(plaintext)
+}
+
+/// Returns the path for encrypted credentials.
+pub fn encrypted_credentials_path() -> PathBuf {
+    crate::auth_commands::config_dir().join("credentials.enc")
+}
+
+/// Saves credentials JSON to an encrypted file.
+pub fn save_encrypted(json: &str) -> anyhow::Result<PathBuf> {
+    let path = encrypted_credentials_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700));
+        }
+    }
+
+    let encrypted = encrypt(json.as_bytes())?;
+
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        let mut options = std::fs::OpenOptions::new();
+        options.write(true).create(true).truncate(true).mode(0o600);
+        let mut file = options.open(&path)?;
+        use std::io::Write;
+        file.write_all(&encrypted)?;
+    }
+    #[cfg(not(unix))]
+    {
+        std::fs::write(&path, encrypted)?;
+    }
+
+    Ok(path)
+}
+
+/// Loads and decrypts credentials JSON from a specific path.
+pub fn load_encrypted_from_path(path: &std::path::Path) -> anyhow::Result<String> {
+    let data = std::fs::read(path)?;
+    let plaintext = decrypt(&data)?;
+    Ok(String::from_utf8(plaintext)?)
+}
+
+/// Loads and decrypts credentials JSON from the default encrypted file.
+pub fn load_encrypted() -> anyhow::Result<String> {
+    load_encrypted_from_path(&encrypted_credentials_path())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn encrypt_decrypt_round_trip() {
+        let plaintext = b"hello, world!";
+        let encrypted = encrypt(plaintext).expect("encryption should succeed");
+
+        // Encrypted data should be different from plaintext
+        assert_ne!(&encrypted, plaintext);
+
+        // Should be nonce (12) + ciphertext (plaintext + 16 byte tag)
+        assert_eq!(encrypted.len(), 12 + plaintext.len() + 16);
+
+        let decrypted = decrypt(&encrypted).expect("decryption should succeed");
+        assert_eq!(decrypted, plaintext);
+    }
+
+    #[test]
+    fn encrypt_decrypt_empty() {
+        let plaintext = b"";
+        let encrypted = encrypt(plaintext).expect("encryption should succeed");
+        let decrypted = decrypt(&encrypted).expect("decryption should succeed");
+        assert_eq!(decrypted, plaintext);
+    }
+
+    #[test]
+    fn encrypt_decrypt_json_credentials() {
+        let json = r#"{"type":"authorized_user","client_id":"test.apps.googleusercontent.com","client_secret":"secret","refresh_token":"1//token"}"#;
+        let encrypted = encrypt(json.as_bytes()).expect("encryption should succeed");
+        let decrypted = decrypt(&encrypted).expect("decryption should succeed");
+        assert_eq!(String::from_utf8(decrypted).unwrap(), json);
+    }
+
+    #[test]
+    fn encrypt_decrypt_large_payload() {
+        let plaintext: Vec<u8> = (0..10_000).map(|i| (i % 256) as u8).collect();
+        let encrypted = encrypt(&plaintext).expect("encryption should succeed");
+        let decrypted = decrypt(&encrypted).expect("decryption should succeed");
+        assert_eq!(decrypted, plaintext);
+    }
+
+    #[test]
+    fn decrypt_rejects_short_data() {
+        let result = decrypt(&[0u8; 11]);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("too short"));
+    }
+
+    #[test]
+    fn decrypt_rejects_tampered_ciphertext() {
+        let encrypted = encrypt(b"secret data").expect("encryption should succeed");
+
+        // Tamper with the ciphertext (after the 12-byte nonce)
+        let mut tampered = encrypted.clone();
+        if tampered.len() > 12 {
+            tampered[12] ^= 0xFF;
+        }
+
+        let result = decrypt(&tampered);
+        assert!(result.is_err());
+        assert!(result
+            .unwrap_err()
+            .to_string()
+            .contains("Decryption failed"));
+    }
+
+    #[test]
+    fn decrypt_rejects_tampered_nonce() {
+        let encrypted = encrypt(b"secret data").expect("encryption should succeed");
+
+        let mut tampered = encrypted.clone();
+        tampered[0] ^= 0xFF;
+
+        let result = decrypt(&tampered);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn each_encryption_produces_different_output() {
+        let plaintext = b"same input";
+        let enc1 = encrypt(plaintext).expect("encryption should succeed");
+        let enc2 = encrypt(plaintext).expect("encryption should succeed");
+
+        // Different nonces should produce different ciphertext
+        assert_ne!(enc1, enc2);
+
+        // But both should decrypt to the same plaintext
+        let dec1 = decrypt(&enc1).unwrap();
+        let dec2 = decrypt(&enc2).unwrap();
+        assert_eq!(dec1, dec2);
+        assert_eq!(dec1, plaintext);
+    }
+
+    #[test]
+    fn get_or_create_key_is_deterministic() {
+        let key1 = get_or_create_key().unwrap();
+        let key2 = get_or_create_key().unwrap();
+        assert_eq!(key1, key2);
+    }
+
+    #[test]
+    fn get_or_create_key_produces_256_bits() {
+        let key = get_or_create_key().unwrap();
+        assert_eq!(key.len(), 32);
+    }
+}
diff --git a/src/discovery.rs b/src/discovery.rs
new file mode 100644
index 00000000..5f5fbafd
--- /dev/null
+++ b/src/discovery.rs
@@ -0,0 +1,311 @@
+#![allow(dead_code)]
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Discovery Document Parsing and Management
+//!
+//! Handles fetching, caching, and parsing Google API Discovery Documents.
+//! These JSON schemas define the shapes of API requests and responses, forming
+//! the foundation of the dynamically generated CLI commands.
+
+use std::collections::HashMap;
+
+use serde::Deserialize;
+
+/// Top-level Discovery REST Description document.
+#[derive(Debug, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct RestDescription {
+    pub name: String,
+    pub version: String,
+    pub title: Option<String>,
+    pub description: Option<String>,
+    pub root_url: String,
+    #[serde(default)]
+    pub service_path: String,
+    pub base_url: Option<String>,
+    #[serde(default)]
+    pub schemas: HashMap<String, JsonSchema>,
+    #[serde(default)]
+    pub resources: HashMap<String, RestResource>,
+    #[serde(default)]
+    pub parameters: HashMap<String, MethodParameter>,
+    pub auth: Option<AuthDescription>,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub struct AuthDescription {
+    pub oauth2: Option<OAuth2Description>,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub struct OAuth2Description {
+    pub scopes: Option<HashMap<String, ScopeDescription>>,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub struct ScopeDescription {
+    pub description: Option<String>,
+}
+
+/// A resource in the Discovery Document, which can contain methods and nested sub-resources.
+#[derive(Debug, Deserialize, Default)]
+pub struct RestResource {
+    #[serde(default)]
+    pub methods: HashMap<String, RestMethod>,
+    #[serde(default)]
+    pub resources: HashMap<String, RestResource>,
+}
+
+/// A single API method.
+#[derive(Debug, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct RestMethod {
+    pub id: Option<String>,
+    pub description: Option<String>,
+    pub http_method: String,
+    pub path: String,
+    #[serde(default)]
+    pub parameters: HashMap<String, MethodParameter>,
+    #[serde(default)]
+    pub parameter_order: Vec<String>,
+    pub request: Option<SchemaRef>,
+    pub response: Option<SchemaRef>,
+    #[serde(default)]
+    pub scopes: Vec<String>,
+    pub flat_path: Option<String>,
+    #[serde(default)]
+    pub supports_media_download: bool,
+    #[serde(default)]
+    pub supports_media_upload: bool,
+    pub media_upload: Option<MediaUpload>,
+}
+
+/// Media upload metadata from the Discovery Document.
+#[derive(Debug, Deserialize, Default)]
+pub struct MediaUpload {
+    pub protocols: Option<MediaUploadProtocols>,
+    pub accept: Option<Vec<String>>,
+}
+
+/// Upload protocol details.
+#[derive(Debug, Deserialize, Default)]
+pub struct MediaUploadProtocols {
+    pub simple: Option<MediaUploadProtocol>,
+}
+
+/// A single upload protocol entry.
+#[derive(Debug, Deserialize, Default)]
+pub struct MediaUploadProtocol {
+    pub path: String,
+    pub multipart: Option<bool>,
+}
+
+/// A reference to a schema (e.g., `{ "$ref": "File" }`).
+#[derive(Debug, Deserialize, Default)]
+pub struct SchemaRef {
+    #[serde(rename = "$ref")]
+    pub schema_ref: Option<String>,
+    #[serde(rename = "parameterName")]
+    pub parameter_name: Option<String>,
+}
+
+/// A parameter definition for a method.
+#[derive(Debug, Clone, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct MethodParameter {
+    #[serde(rename = "type")]
+    pub param_type: Option<String>,
+    pub description: Option<String>,
+    pub location: Option<String>,
+    #[serde(default)]
+    pub required: bool,
+    pub format: Option<String>,
+    pub default: Option<String>,
+    #[serde(rename = "enum")]
+    pub enum_values: Option<Vec<String>>,
+    pub enum_descriptions: Option<Vec<String>>,
+    #[serde(default)]
+    pub repeated: bool,
+    pub minimum: Option<String>,
+    pub maximum: Option<String>,
+    #[serde(default)]
+    pub deprecated: bool,
+}
+
+/// JSON Schema definition for request/response bodies.
+#[derive(Debug, Clone, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct JsonSchema {
+    pub id: Option<String>,
+    #[serde(rename = "type")]
+    pub schema_type: Option<String>,
+    pub description: Option<String>,
+    #[serde(default)]
+    pub properties: HashMap<String, JsonSchemaProperty>,
+    #[serde(rename = "$ref")]
+    pub schema_ref: Option<String>,
+    pub items: Option<Box<JsonSchemaProperty>>,
+    #[serde(default)]
+    pub required: Vec<String>,
+    pub additional_properties: Option<Box<JsonSchemaProperty>>,
+}
+
+/// A property within a JSON Schema.
+#[derive(Debug, Clone, Deserialize, Default)]
+#[serde(rename_all = "camelCase")]
+pub struct JsonSchemaProperty {
+    #[serde(rename = "type")]
+    pub prop_type: Option<String>,
+    pub description: Option<String>,
+    #[serde(rename = "$ref")]
+    pub schema_ref: Option<String>,
+    pub format: Option<String>,
+    pub items: Option<Box<JsonSchemaProperty>>,
+    #[serde(default)]
+    pub properties: HashMap<String, JsonSchemaProperty>,
+    #[serde(default)]
+    pub read_only: bool,
+    pub default: Option<String>,
+    #[serde(rename = "enum")]
+    pub enum_values: Option<Vec<String>>,
+    pub additional_properties: Option<Box<JsonSchemaProperty>>,
+}
+
+/// Fetches and caches a Google Discovery Document.
+pub async fn fetch_discovery_document(
+    service: &str,
+    version: &str,
+) -> anyhow::Result<RestDescription> {
+    let cache_dir = dirs::config_dir()
+        .unwrap_or_else(|| std::path::PathBuf::from("."))
+        .join("gws")
+        .join("cache");
+    std::fs::create_dir_all(&cache_dir)?;
+
+    let cache_file = cache_dir.join(format!("{service}_{version}.json"));
+
+    // Check cache (24hr TTL)
+    if cache_file.exists() {
+        if let Ok(metadata) = std::fs::metadata(&cache_file) {
+            if let Ok(modified) = metadata.modified() {
+                if modified.elapsed().unwrap_or_default() < std::time::Duration::from_secs(86400) {
+                    let data = std::fs::read_to_string(&cache_file)?;
+                    let doc: RestDescription = serde_json::from_str(&data)?;
+                    return Ok(doc);
+                }
+            }
+        }
+    }
+
+    let url = format!("https://www.googleapis.com/discovery/v1/apis/{service}/{version}/rest");
+
+    let client = crate::client::build_client()?;
+    let resp = client.get(&url).send().await?;
+
+    let body = if resp.status().is_success() {
+        resp.text().await?
+    } else {
+        // Try the $discovery/rest URL pattern used by newer APIs (Forms, Keep, Meet, etc.)
+        let alt_url = format!("https://{service}.googleapis.com/$discovery/rest?version={version}");
+        let alt_resp = client.get(&alt_url).send().await?;
+        if !alt_resp.status().is_success() {
+            anyhow::bail!(
+                "Failed to fetch Discovery Document for {service}/{version}: HTTP {} (tried both standard and $discovery URLs)",
+                alt_resp.status()
+            );
+        }
+        alt_resp.text().await?
+    };
+
+    // Write to cache
+    if let Err(e) = std::fs::write(&cache_file, &body) {
+        // Non-fatal: just warn via stderr-safe approach
+        let _ = e;
+    }
+
+    let doc: RestDescription = serde_json::from_str(&body)?;
+    Ok(doc)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_deserialize_rest_description() {
+        let json = r#"{
+            "name": "drive",
+            "version": "v3",
+            "rootUrl": "https://www.googleapis.com/",
+            "servicePath": "drive/v3/",
+            "resources": {
+                "files": {
+                    "methods": {
+                        "list": {
+                            "httpMethod": "GET",
+                            "path": "files",
+                            "response": { "$ref": "FileList" }
+                        }
+                    }
+                }
+            },
+            "schemas": {
+                "FileList": {
+                    "id": "FileList",
+                    "type": "object",
+                    "properties": {
+                        "files": {
+                            "type": "array",
+                            "items": { "$ref": "File" }
+                        }
+                    }
+                }
+            }
+        }"#;
+
+        let doc: RestDescription = serde_json::from_str(json).unwrap();
+        assert_eq!(doc.name, "drive");
+        assert_eq!(doc.version, "v3");
+        assert_eq!(doc.root_url, "https://www.googleapis.com/");
+        assert_eq!(doc.service_path, "drive/v3/");
+
+        // precise resource checking
+        let files = doc.resources.get("files").expect("files resource missing");
+        let list = files.methods.get("list").expect("list method missing");
+        assert_eq!(list.http_method, "GET");
+        assert_eq!(list.path, "files");
+
+        // schema checking
+        let file_list = doc
+            .schemas
+            .get("FileList")
+            .expect("FileList schema missing");
+        assert_eq!(file_list.id.as_deref(), Some("FileList"));
+    }
+
+    #[test]
+    fn test_deserialize_defaults() {
+        let json = r#"{
+            "name": "admin",
+            "version": "directory_v1",
+            "rootUrl": "https://admin.googleapis.com/"
+        }"#;
+
+        let doc: RestDescription = serde_json::from_str(json).unwrap();
+        assert_eq!(doc.service_path, ""); // default empty string
+        assert!(doc.resources.is_empty());
+        assert!(doc.schemas.is_empty());
+    }
+}
diff --git a/src/error.rs b/src/error.rs
new file mode 100644
index 00000000..e8ec1d95
--- /dev/null
+++ b/src/error.rs
@@ -0,0 +1,147 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use serde_json::json;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum GwsError {
+    #[error("{message}")]
+    Api {
+        code: u16,
+        message: String,
+        reason: String,
+    },
+
+    #[error("{0}")]
+    Validation(String),
+
+    #[error("{0}")]
+    Auth(String),
+
+    #[error("{0}")]
+    Discovery(String),
+
+    #[error(transparent)]
+    Other(#[from] anyhow::Error),
+}
+
+impl GwsError {
+    pub fn to_json(&self) -> serde_json::Value {
+        match self {
+            GwsError::Api {
+                code,
+                message,
+                reason,
+            } => json!({
+                "error": {
+                    "code": code,
+                    "message": message,
+                    "reason": reason,
+                }
+            }),
+            GwsError::Validation(msg) => json!({
+                "error": {
+                    "code": 400,
+                    "message": msg,
+                    "reason": "validationError",
+                }
+            }),
+            GwsError::Auth(msg) => json!({
+                "error": {
+                    "code": 401,
+                    "message": msg,
+                    "reason": "authError",
+                }
+            }),
+            GwsError::Discovery(msg) => json!({
+                "error": {
+                    "code": 500,
+                    "message": msg,
+                    "reason": "discoveryError",
+                }
+            }),
+            GwsError::Other(e) => json!({
+                "error": {
+                    "code": 500,
+                    "message": format!("{e:#}"),
+                    "reason": "internalError",
+                }
+            }),
+        }
+    }
+}
+
+/// Formats any error as a JSON object and prints to stdout.
+pub fn print_error_json(err: &GwsError) {
+    let json = err.to_json();
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&json).unwrap_or_default()
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_error_to_json_api() {
+        let err = GwsError::Api {
+            code: 404,
+            message: "Not Found".to_string(),
+            reason: "notFound".to_string(),
+        };
+        let json = err.to_json();
+        assert_eq!(json["error"]["code"], 404);
+        assert_eq!(json["error"]["message"], "Not Found");
+        assert_eq!(json["error"]["reason"], "notFound");
+    }
+
+    #[test]
+    fn test_error_to_json_validation() {
+        let err = GwsError::Validation("Invalid input".to_string());
+        let json = err.to_json();
+        assert_eq!(json["error"]["code"], 400);
+        assert_eq!(json["error"]["message"], "Invalid input");
+        assert_eq!(json["error"]["reason"], "validationError");
+    }
+
+    #[test]
+    fn test_error_to_json_auth() {
+        let err = GwsError::Auth("Token expired".to_string());
+        let json = err.to_json();
+        assert_eq!(json["error"]["code"], 401);
+        assert_eq!(json["error"]["message"], "Token expired");
+        assert_eq!(json["error"]["reason"], "authError");
+    }
+
+    #[test]
+    fn test_error_to_json_discovery() {
+        let err = GwsError::Discovery("Failed to fetch doc".to_string());
+        let json = err.to_json();
+        assert_eq!(json["error"]["code"], 500);
+        assert_eq!(json["error"]["message"], "Failed to fetch doc");
+        assert_eq!(json["error"]["reason"], "discoveryError");
+    }
+
+    #[test]
+    fn test_error_to_json_other() {
+        let err = GwsError::Other(anyhow::anyhow!("Something went wrong"));
+        let json = err.to_json();
+        assert_eq!(json["error"]["code"], 500);
+        assert_eq!(json["error"]["message"], "Something went wrong");
+        assert_eq!(json["error"]["reason"], "internalError");
+    }
+}
diff --git a/src/executor.rs b/src/executor.rs
new file mode 100644
index 00000000..f985c1e7
--- /dev/null
+++ b/src/executor.rs
@@ -0,0 +1,1296 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! API Request Execution
+//!
+//! Handles building and dispatching HTTP requests to Google Workspace APIs.
+//! Responsibilities include multipart file uploads, response pagination,
+//! error mapping, and optionally running text content through Model Armor for sanitization.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use anyhow::Context;
+use futures_util::StreamExt;
+use serde_json::{json, Map, Value};
+use tokio::io::AsyncWriteExt;
+
+use crate::discovery::{RestDescription, RestMethod};
+use crate::error::GwsError;
+
+/// Tracks what authentication method was used for the request.
+#[derive(Debug, Clone, PartialEq)]
+pub enum AuthMethod {
+    /// OAuth2 bearer token from credentials file
+    OAuth,
+    /// No authentication was provided
+    None,
+}
+
+/// Configuration for auto-pagination.
+#[derive(Debug, Clone)]
+pub struct PaginationConfig {
+    /// Whether to auto-paginate through all pages.
+    pub page_all: bool,
+    /// Maximum number of pages to fetch (default: 10).
+    pub page_limit: u32,
+    /// Delay between page fetches in milliseconds (default: 100).
+    pub page_delay_ms: u64,
+}
+
+impl Default for PaginationConfig {
+    fn default() -> Self {
+        Self {
+            page_all: false,
+            page_limit: 10,
+            page_delay_ms: 100,
+        }
+    }
+}
+
+/// Parsed and validated inputs ready for request execution.
+#[allow(dead_code)]
+struct ExecutionInput {
+    params: Map<String, Value>,
+    body: Option<Value>,
+    full_url: String,
+    query_params: HashMap<String, String>,
+    is_upload: bool,
+}
+
+/// Parse parameters and body JSON, validate against schema, check required params, and build the URL.
+fn parse_and_validate_inputs(
+    doc: &RestDescription,
+    method: &RestMethod,
+    params_json: Option<&str>,
+    body_json: Option<&str>,
+    upload_path: Option<&str>,
+) -> Result<ExecutionInput, GwsError> {
+    let params: Map<String, Value> = if let Some(p) = params_json {
+        serde_json::from_str(p)
+            .map_err(|e| GwsError::Validation(format!("Invalid --params JSON: {e}")))?
+    } else {
+        Map::new()
+    };
+
+    let body: Option<Value> = if let Some(b) = body_json {
+        let val: Value = serde_json::from_str(b)
+            .map_err(|e| GwsError::Validation(format!("Invalid --json body: {e}")))?;
+
+        if let Some(ref req_ref) = method.request {
+            if let Some(ref schema_name) = req_ref.schema_ref {
+                validate_body_against_schema(&val, schema_name, doc)?;
+            }
+        }
+
+        Some(val)
+    } else {
+        None
+    };
+
+    for param_name in &method.parameter_order {
+        if let Some(param_def) = method.parameters.get(param_name) {
+            if param_def.required
+                && param_def.location.as_deref() == Some("path")
+                && !params.contains_key(param_name)
+            {
+                return Err(GwsError::Validation(format!(
+                    "Required path parameter {} is missing. Provide it via --params",
+                    param_name
+                )));
+            }
+        }
+    }
+
+    for (param_name, param_def) in &method.parameters {
+        if param_def.required && !params.contains_key(param_name) {
+            return Err(GwsError::Validation(format!(
+                "Required parameter '{}' is missing. Provide it via --params",
+                param_name
+            )));
+        }
+    }
+
+    let (full_url, query_params) = build_url(doc, method, &params, upload_path.is_some())?;
+    let is_upload = upload_path.is_some() && method.supports_media_upload;
+
+    Ok(ExecutionInput {
+        params,
+        body,
+        full_url,
+        query_params,
+        is_upload,
+    })
+}
+
+/// Build an HTTP request with auth, query params, page token, and body/multipart attachment.
+#[allow(clippy::too_many_arguments)]
+async fn build_http_request(
+    client: &reqwest::Client,
+    method: &RestMethod,
+    input: &ExecutionInput,
+    token: Option<&str>,
+    auth_method: &AuthMethod,
+    page_token: Option<&str>,
+    pages_fetched: u32,
+    upload_path: Option<&str>,
+) -> Result<reqwest::RequestBuilder, GwsError> {
+    let mut request = match method.http_method.as_str() {
+        "GET" => client.get(&input.full_url),
+        "POST" => client.post(&input.full_url),
+        "PUT" => client.put(&input.full_url),
+        "PATCH" => client.patch(&input.full_url),
+        "DELETE" => client.delete(&input.full_url),
+        other => {
+            return Err(GwsError::Other(anyhow::anyhow!(
+                "Unsupported HTTP method: {other}"
+            )))
+        }
+    };
+
+    if let Some(token) = token {
+        if *auth_method == AuthMethod::OAuth {
+            request = request.bearer_auth(token);
+        }
+    }
+
+    for (key, value) in &input.query_params {
+        request = request.query(&[(key, value)]);
+    }
+
+    if let Some(pt) = page_token {
+        request = request.query(&[("pageToken", pt)]);
+    }
+
+    if pages_fetched == 0 {
+        if input.is_upload {
+            let upload_path = upload_path.expect("upload_path must be Some when is_upload is true");
+
+            let file_bytes = tokio::fs::read(upload_path).await.map_err(|e| {
+                GwsError::Validation(format!(
+                    "Failed to read upload file '{}': {}",
+                    upload_path, e
+                ))
+            })?;
+
+            request = request.query(&[("uploadType", "multipart")]);
+            let (multipart_body, content_type) = build_multipart_body(&input.body, &file_bytes)?;
+            request = request.header("Content-Type", content_type);
+            request = request.body(multipart_body);
+        } else if let Some(ref body_val) = input.body {
+            request = request.header("Content-Type", "application/json");
+            request = request.json(body_val);
+        }
+    }
+
+    Ok(request)
+}
+
+/// Handle a JSON response: parse, sanitize via Model Armor, output, and check pagination.
+/// Returns `Ok(true)` if the pagination loop should continue.
+async fn handle_json_response(
+    body_text: &str,
+    pagination: &PaginationConfig,
+    sanitize_template: Option<&str>,
+    sanitize_mode: &crate::helpers::modelarmor::SanitizeMode,
+    output_format: &crate::formatter::OutputFormat,
+    pages_fetched: &mut u32,
+    page_token: &mut Option<String>,
+) -> Result<bool, GwsError> {
+    if let Ok(mut json_val) = serde_json::from_str::<Value>(body_text) {
+        *pages_fetched += 1;
+
+        // Run Model Armor sanitization if --sanitize is enabled
+        if let Some(template) = sanitize_template {
+            let text_to_check = serde_json::to_string(&json_val).unwrap_or_default();
+            match crate::helpers::modelarmor::sanitize_text(template, &text_to_check).await {
+                Ok(result) => {
+                    let is_match = result.filter_match_state == "MATCH_FOUND";
+                    if is_match {
+                        eprintln!("⚠️  Model Armor: prompt injection detected (filterMatchState: MATCH_FOUND)");
+                    }
+
+                    if is_match && *sanitize_mode == crate::helpers::modelarmor::SanitizeMode::Block
+                    {
+                        let blocked = serde_json::json!({
+                            "error": "Content blocked by Model Armor",
+                            "sanitizationResult": serde_json::to_value(&result).unwrap_or_default(),
+                        });
+                        println!(
+                            "{}",
+                            serde_json::to_string_pretty(&blocked).unwrap_or_default()
+                        );
+                        return Err(GwsError::Other(anyhow::anyhow!(
+                            "Content blocked by Model Armor"
+                        )));
+                    }
+
+                    if let Some(obj) = json_val.as_object_mut() {
+                        obj.insert(
+                            "_sanitization".to_string(),
+                            serde_json::to_value(&result).unwrap_or_default(),
+                        );
+                    }
+                }
+                Err(e) => {
+                    eprintln!("⚠️  Model Armor sanitization failed: {e}");
+                }
+            }
+        }
+
+        if pagination.page_all {
+            println!(
+                "{}",
+                crate::formatter::format_value_compact(&json_val, output_format)
+            );
+        } else {
+            println!(
+                "{}",
+                crate::formatter::format_value(&json_val, output_format)
+            );
+        }
+
+        // Check for nextPageToken to continue pagination
+        if pagination.page_all {
+            if let Some(next_token) = json_val.get("nextPageToken").and_then(|v| v.as_str()) {
+                if *pages_fetched < pagination.page_limit {
+                    *page_token = Some(next_token.to_string());
+                    if pagination.page_delay_ms > 0 {
+                        tokio::time::sleep(std::time::Duration::from_millis(
+                            pagination.page_delay_ms,
+                        ))
+                        .await;
+                    }
+                    return Ok(true); // continue paginating
+                }
+            }
+        }
+    } else {
+        // Not valid JSON, output as-is
+        if !body_text.is_empty() {
+            println!("{body_text}");
+        }
+    }
+
+    Ok(false)
+}
+
+/// Handle a binary response by streaming it to a file.
+async fn handle_binary_response(
+    response: reqwest::Response,
+    content_type: &str,
+    output_path: Option<&str>,
+    output_format: &crate::formatter::OutputFormat,
+) -> Result<(), GwsError> {
+    let file_path = if let Some(p) = output_path {
+        PathBuf::from(p)
+    } else {
+        let ext = mime_to_extension(content_type);
+        PathBuf::from(format!("download.{ext}"))
+    };
+
+    let mut file = tokio::fs::File::create(&file_path)
+        .await
+        .context("Failed to create output file")?;
+
+    let mut stream = response.bytes_stream();
+    let mut total_bytes: u64 = 0;
+
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.context("Failed to read response chunk")?;
+        file.write_all(&chunk)
+            .await
+            .context("Failed to write to file")?;
+        total_bytes += chunk.len() as u64;
+    }
+
+    file.flush().await.context("Failed to flush file")?;
+
+    let result = json!({
+        "status": "success",
+        "saved_file": file_path.display().to_string(),
+        "mimeType": content_type,
+        "bytes": total_bytes,
+    });
+    println!("{}", crate::formatter::format_value(&result, output_format));
+
+    Ok(())
+}
+
+/// Executes an API method call.
+///
+/// This is the core function of the CLI that handles:
+/// 1. Parameter validation and URL construction.
+/// 2. Request body validation against the Discovery Document schema.
+/// 3. Authentication (OAuth or none).
+/// 4. Sending the HTTP request (GET/POST/etc).
+/// 5. Handling various response types (JSON, binary).
+/// 6. Auto-pagination for list endpoints.
+/// 7. Model Armor prompt injection scanning.
+#[allow(clippy::too_many_arguments)]
+pub async fn execute_method(
+    doc: &RestDescription,
+    method: &RestMethod,
+    params_json: Option<&str>,
+    body_json: Option<&str>,
+    token: Option<&str>,
+    auth_method: AuthMethod,
+    output_path: Option<&str>,
+    upload_path: Option<&str>,
+    dry_run: bool,
+    pagination: &PaginationConfig,
+    sanitize_template: Option<&str>,
+    sanitize_mode: &crate::helpers::modelarmor::SanitizeMode,
+    output_format: &crate::formatter::OutputFormat,
+) -> Result<(), GwsError> {
+    let input = parse_and_validate_inputs(doc, method, params_json, body_json, upload_path)?;
+
+    if dry_run {
+        let dry_run_info = json!({
+            "dry_run": true,
+            "url": input.full_url,
+            "method": method.http_method,
+            "query_params": input.query_params,
+            "body": input.body,
+            "is_multipart_upload": input.is_upload,
+        });
+        println!(
+            "{}",
+            crate::formatter::format_value(&dry_run_info, output_format)
+        );
+        return Ok(());
+    }
+
+    let mut page_token: Option<String> = None;
+    let mut pages_fetched: u32 = 0;
+
+    loop {
+        let client = crate::client::build_client()?;
+        let request = build_http_request(
+            &client,
+            method,
+            &input,
+            token,
+            &auth_method,
+            page_token.as_deref(),
+            pages_fetched,
+            upload_path,
+        )
+        .await?;
+
+        let response = request.send().await.context("HTTP request failed")?;
+
+        let status = response.status();
+        let content_type = response
+            .headers()
+            .get("content-type")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+            .to_string();
+
+        if !status.is_success() {
+            let error_body = response.text().await.unwrap_or_default();
+            return handle_error_response(status, &error_body, &auth_method);
+        }
+
+        let is_json =
+            content_type.contains("application/json") || content_type.contains("text/json");
+
+        if is_json || content_type.is_empty() {
+            let body_text = response
+                .text()
+                .await
+                .context("Failed to read response body")?;
+
+            let should_continue = handle_json_response(
+                &body_text,
+                pagination,
+                sanitize_template,
+                sanitize_mode,
+                output_format,
+                &mut pages_fetched,
+                &mut page_token,
+            )
+            .await?;
+
+            if should_continue {
+                continue;
+            }
+        } else {
+            handle_binary_response(response, &content_type, output_path, output_format).await?;
+        }
+
+        break;
+    }
+
+    Ok(())
+}
+
+fn build_url(
+    doc: &RestDescription,
+    method: &RestMethod,
+    params: &Map<String, Value>,
+    is_upload: bool,
+) -> Result<(String, HashMap<String, String>), GwsError> {
+    // Build URL base and path
+
+    // Actually we need to construct base URL properly if not present
+    let base_url = if let Some(b) = &doc.base_url {
+        b.clone()
+    } else {
+        format!("{}{}", doc.root_url, doc.service_path)
+    };
+
+    let path_template = method.flat_path.as_deref().unwrap_or(&method.path);
+
+    // Substitute path parameters and separate query parameters
+    let mut url_path = path_template.to_string();
+    let mut query_params: HashMap<String, String> = HashMap::new();
+
+    for (key, value) in params {
+        let val_str = match value {
+            Value::String(s) => s.clone(),
+            other => other.to_string(),
+        };
+
+        let placeholder = format!("{{{key}}}");
+        // Also handle {+key} style
+        let plus_placeholder = format!("{{+{key}}}");
+
+        if url_path.contains(&placeholder) {
+            url_path = url_path.replace(&placeholder, &val_str);
+        } else if url_path.contains(&plus_placeholder) {
+            url_path = url_path.replace(&plus_placeholder, &val_str);
+        } else {
+            // It's a query parameter
+            query_params.insert(key.clone(), val_str);
+        }
+    }
+
+    let full_url = if is_upload {
+        // Use the upload endpoint from the Discovery Document
+        let upload_endpoint = method
+            .media_upload
+            .as_ref()
+            .and_then(|mu| mu.protocols.as_ref())
+            .and_then(|p| p.simple.as_ref())
+            .map(|s| s.path.as_str())
+            .ok_or_else(|| {
+                GwsError::Validation(
+                    "Method supports media upload but no upload path found in Discovery Document"
+                        .to_string(),
+                )
+            })?;
+        format!("{}{}", doc.root_url.trim_end_matches('/'), upload_endpoint)
+    } else {
+        format!("{base_url}{url_path}")
+    };
+
+    Ok((full_url, query_params))
+}
+
+fn handle_error_response(
+    status: reqwest::StatusCode,
+    error_body: &str,
+    auth_method: &AuthMethod,
+) -> Result<(), GwsError> {
+    // If 401/403 and no auth was provided, give a helpful message
+    if (status.as_u16() == 401 || status.as_u16() == 403) && *auth_method == AuthMethod::None {
+        return Err(GwsError::Auth(
+            "Access denied. No credentials provided. Run `gws auth login` or set \
+             GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE to an OAuth credentials JSON file."
+                .to_string(),
+        ));
+    }
+
+    // Try to parse as Google API error
+    if let Ok(error_json) = serde_json::from_str::<Value>(error_body) {
+        if let Some(err_obj) = error_json.get("error") {
+            let code = err_obj
+                .get("code")
+                .and_then(|c| c.as_u64())
+                .unwrap_or(status.as_u16() as u64) as u16;
+            let message = err_obj
+                .get("message")
+                .and_then(|m| m.as_str())
+                .unwrap_or("Unknown error")
+                .to_string();
+            let reason = err_obj
+                .get("errors")
+                .and_then(|e| e.as_array())
+                .and_then(|arr| arr.first())
+                .and_then(|e| e.get("reason"))
+                .and_then(|r| r.as_str())
+                .unwrap_or("unknown")
+                .to_string();
+
+            return Err(GwsError::Api {
+                code,
+                message,
+                reason,
+            });
+        }
+    }
+
+    Err(GwsError::Api {
+        code: status.as_u16(),
+        message: error_body.to_string(),
+        reason: "httpError".to_string(),
+    })
+}
+
+/// Builds a multipart/related body for media upload requests.
+///
+/// Returns the body bytes and the Content-Type header value (with boundary).
+fn build_multipart_body(
+    metadata: &Option<Value>,
+    file_bytes: &[u8],
+) -> Result<(Vec<u8>, String), GwsError> {
+    let boundary = format!("gws_boundary_{:016x}", rand::random::<u64>());
+
+    // Determine the media MIME type from the metadata's mimeType field, or fall back
+    let media_mime = metadata
+        .as_ref()
+        .and_then(|m| m.get("mimeType"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("application/octet-stream");
+
+    // Build multipart/related body
+    let metadata_json = metadata
+        .as_ref()
+        .map(|m| serde_json::to_string(m).unwrap_or_else(|_| "{}".to_string()))
+        .unwrap_or_else(|| "{}".to_string());
+
+    let mut body = Vec::new();
+    // Part 1: JSON metadata
+    body.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
+    body.extend_from_slice(b"Content-Type: application/json; charset=UTF-8\r\n\r\n");
+    body.extend_from_slice(metadata_json.as_bytes());
+    body.extend_from_slice(b"\r\n");
+    // Part 2: File content
+    body.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
+    body.extend_from_slice(format!("Content-Type: {media_mime}\r\n\r\n").as_bytes());
+    body.extend_from_slice(file_bytes);
+    body.extend_from_slice(b"\r\n");
+    // Closing boundary
+    body.extend_from_slice(format!("--{boundary}--\r\n").as_bytes());
+
+    let content_type = format!("multipart/related; boundary={boundary}");
+    Ok((body, content_type))
+}
+
+/// Validates a JSON body against a Discovery Document schema.
+fn validate_body_against_schema(
+    body: &Value,
+    schema_name: &str,
+    doc: &RestDescription,
+) -> Result<(), GwsError> {
+    let mut errors = Vec::new();
+    validate_value(body, schema_name, doc, "$", &mut errors);
+
+    if !errors.is_empty() {
+        return Err(GwsError::Validation(format!(
+            "Request body failed schema validation:\n- {}",
+            errors.join("\n- ")
+        )));
+    }
+
+    Ok(())
+}
+
+fn validate_value(
+    value: &Value,
+    schema_ref_name: &str,
+    doc: &RestDescription,
+    path: &str,
+    errors: &mut Vec<String>,
+) {
+    let schema = match doc.schemas.get(schema_ref_name) {
+        Some(s) => s,
+        None => {
+            errors.push(format!("{path}: Schema '{schema_ref_name}' not found"));
+            return;
+        }
+    };
+
+    // If the top-level schema is an object
+    if schema.schema_type.as_deref() == Some("object") || !schema.properties.is_empty() {
+        if let Value::Object(obj) = value {
+            validate_properties(obj, &schema.properties, &schema.required, doc, path, errors);
+        } else {
+            errors.push(format!("{path}: Expected object"));
+        }
+    }
+}
+
+fn validate_properties(
+    obj: &Map<String, Value>,
+    properties: &HashMap<String, crate::discovery::JsonSchemaProperty>,
+    required_keys: &[String],
+    doc: &RestDescription,
+    path: &str,
+    errors: &mut Vec<String>,
+) {
+    let valid_keys: std::collections::HashSet<&String> = properties.keys().collect();
+
+    // Check required keys first
+    for req_key in required_keys {
+        if !obj.contains_key(req_key) {
+            errors.push(format!("{path}: Missing required property '{req_key}'"));
+        }
+    }
+
+    for (key, val) in obj {
+        let current_path = if path == "$" {
+            key.clone()
+        } else {
+            format!("{path}.{key}")
+        };
+
+        if !valid_keys.contains(key) {
+            errors.push(format!(
+                "{current_path}: Unknown property. Valid properties: {:?}",
+                valid_keys.iter().map(|k| k.as_str()).collect::<Vec<_>>()
+            ));
+            continue;
+        }
+
+        let prop_schema = &properties[key];
+        validate_property(val, prop_schema, doc, &current_path, errors);
+    }
+}
+
+fn validate_property(
+    value: &Value,
+    prop_schema: &crate::discovery::JsonSchemaProperty,
+    doc: &RestDescription,
+    path: &str,
+    errors: &mut Vec<String>,
+) {
+    // 1. Resolve $ref if present
+    if let Some(ref_name) = &prop_schema.schema_ref {
+        validate_value(value, ref_name, doc, path, errors);
+        return;
+    }
+
+    // 2. Type checking
+    if let Some(expected_type) = &prop_schema.prop_type {
+        let type_matches = match (expected_type.as_str(), value) {
+            ("string", Value::String(_)) => true,
+            ("integer", Value::Number(n)) => n.is_i64() || n.is_u64(),
+            ("number", Value::Number(_)) => true,
+            ("boolean", Value::Bool(_)) => true,
+            ("array", Value::Array(_)) => true,
+            ("object", Value::Object(_)) => true,
+            ("any", _) => true,
+            _ => false,
+        };
+
+        if !type_matches {
+            errors.push(format!(
+                "{path}: Expected type '{expected_type}', found {}",
+                get_value_type(value)
+            ));
+            return; // Stop further validation for this property if the type is wrong
+        }
+    }
+
+    // 3. Array items validation
+    if prop_schema.prop_type.as_deref() == Some("array") {
+        if let Some(items_schema) = &prop_schema.items {
+            if let Value::Array(arr) = value {
+                for (i, item) in arr.iter().enumerate() {
+                    let item_path = format!("{path}[{i}]");
+                    validate_property(item, items_schema, doc, &item_path, errors);
+                }
+            }
+        }
+    }
+
+    // 4. Object properties validation
+    if prop_schema.prop_type.as_deref() == Some("object") && !prop_schema.properties.is_empty() {
+        if let Value::Object(obj) = value {
+            validate_properties(obj, &prop_schema.properties, &[], doc, path, errors);
+        }
+    }
+
+    // 5. Enum validation
+    if let Some(enum_values) = &prop_schema.enum_values {
+        if let Value::String(s) = value {
+            if !enum_values.contains(s) {
+                errors.push(format!(
+                    "{path}: Value '{s}' is not a valid enum member. Valid options: {:?}",
+                    enum_values
+                ));
+            }
+        }
+    }
+}
+
+fn get_value_type(val: &Value) -> &'static str {
+    match val {
+        Value::Null => "null",
+        Value::Bool(_) => "boolean",
+        Value::Number(n) if n.is_f64() => "number (float)",
+        Value::Number(_) => "integer",
+        Value::String(_) => "string",
+        Value::Array(_) => "array",
+        Value::Object(_) => "object",
+    }
+}
+
+/// Maps a MIME type to a file extension.
+pub fn mime_to_extension(mime: &str) -> &str {
+    if mime.contains("pdf") {
+        "pdf"
+    } else if mime.contains("png") {
+        "png"
+    } else if mime.contains("jpeg") || mime.contains("jpg") {
+        "jpg"
+    } else if mime.contains("gif") {
+        "gif"
+    } else if mime.contains("csv") {
+        "csv"
+    } else if mime.contains("zip") {
+        "zip"
+    } else if mime.contains("xml") {
+        "xml"
+    } else if mime.contains("html") {
+        "html"
+    } else if mime.contains("plain") {
+        "txt"
+    } else if mime.contains("octet-stream") {
+        "bin"
+    } else if mime.contains("spreadsheet") || mime.contains("xlsx") {
+        "xlsx"
+    } else if mime.contains("document") || mime.contains("docx") {
+        "docx"
+    } else if mime.contains("presentation") || mime.contains("pptx") {
+        "pptx"
+    } else if mime.contains("script") {
+        "json"
+    } else {
+        "bin"
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery::{JsonSchema, JsonSchemaProperty, RestDescription, RestMethod};
+    use serde_json::json;
+
+    #[test]
+    fn test_pagination_config_default() {
+        let config = PaginationConfig::default();
+        assert_eq!(config.page_all, false);
+        assert_eq!(config.page_limit, 10);
+        assert_eq!(config.page_delay_ms, 100);
+    }
+
+    #[test]
+    fn test_auth_method_equality() {
+        assert_eq!(AuthMethod::OAuth, AuthMethod::OAuth);
+        assert_eq!(AuthMethod::None, AuthMethod::None);
+        assert_ne!(AuthMethod::OAuth, AuthMethod::None);
+    }
+
+    #[test]
+    fn test_mime_to_extension_more_types() {
+        assert_eq!(mime_to_extension("text/plain"), "txt");
+        assert_eq!(mime_to_extension("text/csv"), "csv");
+        assert_eq!(mime_to_extension("application/zip"), "zip");
+        assert_eq!(mime_to_extension("application/xml"), "xml");
+        assert_eq!(mime_to_extension("text/html"), "html");
+        assert_eq!(mime_to_extension("application/json"), "bin"); // Default for unknown specific json types if not scripts
+        assert_eq!(
+            mime_to_extension("application/vnd.google-apps.script"),
+            "json"
+        );
+        assert_eq!(
+            mime_to_extension("application/vnd.google-apps.presentation"),
+            "pptx"
+        );
+    }
+
+    #[test]
+    fn test_validate_body_valid() {
+        let mut properties = HashMap::new();
+        properties.insert(
+            "name".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                ..Default::default()
+            },
+        );
+
+        let mut schemas = HashMap::new();
+        schemas.insert(
+            "File".to_string(),
+            JsonSchema {
+                properties,
+                ..Default::default()
+            },
+        );
+
+        let doc = RestDescription {
+            schemas,
+            ..Default::default()
+        };
+
+        let body = json!({ "name": "My File" });
+        assert!(validate_body_against_schema(&body, "File", &doc).is_ok());
+    }
+
+    #[test]
+    fn test_validate_body_unknown_field() {
+        let mut properties = HashMap::new();
+        properties.insert(
+            "name".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                ..Default::default()
+            },
+        );
+
+        let mut schemas = HashMap::new();
+        schemas.insert(
+            "File".to_string(),
+            JsonSchema {
+                schema_type: Some("object".to_string()),
+                properties,
+                ..Default::default()
+            },
+        );
+
+        let doc = RestDescription {
+            schemas,
+            ..Default::default()
+        };
+
+        let body = json!({ "name": "My File", "invalidField": 123 });
+        let result = validate_body_against_schema(&body, "File", &doc);
+        assert!(result.is_err());
+        assert!(result.unwrap_err().to_string().contains("Unknown property"));
+    }
+
+    #[test]
+    fn test_validate_body_deep_validation() {
+        let mut properties = HashMap::new();
+        properties.insert(
+            "name".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                ..Default::default()
+            },
+        );
+        properties.insert(
+            "status".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                enum_values: Some(vec!["ACTIVE".to_string(), "INACTIVE".to_string()]),
+                ..Default::default()
+            },
+        );
+        properties.insert(
+            "count".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("integer".to_string()),
+                ..Default::default()
+            },
+        );
+        properties.insert(
+            "tags".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("array".to_string()),
+                items: Some(Box::new(JsonSchemaProperty {
+                    prop_type: Some("string".to_string()),
+                    ..Default::default()
+                })),
+                ..Default::default()
+            },
+        );
+        properties.insert(
+            "parent".to_string(),
+            JsonSchemaProperty {
+                schema_ref: Some("Parent".to_string()),
+                ..Default::default()
+            },
+        );
+
+        let mut parent_props = HashMap::new();
+        parent_props.insert(
+            "id".to_string(),
+            JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                ..Default::default()
+            },
+        );
+
+        let mut schemas = HashMap::new();
+        schemas.insert(
+            "File".to_string(),
+            JsonSchema {
+                schema_type: Some("object".to_string()),
+                required: vec!["name".to_string(), "status".to_string()],
+                properties,
+                ..Default::default()
+            },
+        );
+        schemas.insert(
+            "Parent".to_string(),
+            JsonSchema {
+                schema_type: Some("object".to_string()),
+                properties: parent_props,
+                ..Default::default()
+            },
+        );
+
+        let doc = RestDescription {
+            schemas,
+            ..Default::default()
+        };
+
+        // Valid Request
+        let body = json!({
+            "name": "My File",
+            "status": "ACTIVE",
+            "count": 10,
+            "tags": ["one", "two"],
+            "parent": { "id": "123" }
+        });
+        assert!(validate_body_against_schema(&body, "File", &doc).is_ok());
+
+        // Missing Required Field
+        let body_missing = json!({ "name": "My File" });
+        let err = validate_body_against_schema(&body_missing, "File", &doc).unwrap_err();
+        assert!(err
+            .to_string()
+            .contains("Missing required property 'status'"));
+
+        // Invalid Enum Value
+        let body_bad_enum = json!({ "name": "My File", "status": "UNKNOWN" });
+        let err = validate_body_against_schema(&body_bad_enum, "File", &doc).unwrap_err();
+        assert!(err.to_string().contains("not a valid enum member"));
+
+        // Invalid Type
+        let body_bad_type = json!({ "name": "My File", "status": "ACTIVE", "count": "10" });
+        let err = validate_body_against_schema(&body_bad_type, "File", &doc).unwrap_err();
+        assert!(err
+            .to_string()
+            .contains("Expected type 'integer', found string"));
+
+        // Deep Schema Reference Validation Failure
+        let body_bad_ref = json!({
+            "name": "My File",
+            "status": "ACTIVE",
+            "parent": { "invalidField": "123" }
+        });
+        let err = validate_body_against_schema(&body_bad_ref, "File", &doc).unwrap_err();
+        assert!(err.to_string().contains("Unknown property"));
+
+        // Expected Object Type Failure
+        let body_not_object = json!([]);
+        let err = validate_body_against_schema(&body_not_object, "File", &doc).unwrap_err();
+        assert!(err.to_string().contains("Expected object"));
+    }
+    #[tokio::test]
+    async fn test_build_multipart_body() {
+        let metadata = Some(json!({ "name": "test.txt", "mimeType": "text/plain" }));
+        let content = b"Hello world";
+
+        let (body, content_type) = build_multipart_body(&metadata, content).unwrap();
+
+        // Check content type has boundary
+        assert!(content_type.starts_with("multipart/related; boundary="));
+        let boundary = content_type.split("boundary=").nth(1).unwrap();
+
+        let body_str = String::from_utf8(body).unwrap();
+
+        // Verify structure
+        assert!(body_str.contains(boundary));
+        assert!(body_str.contains("Content-Type: application/json"));
+        assert!(body_str.contains("{\"mimeType\":\"text/plain\",\"name\":\"test.txt\"}"));
+        assert!(body_str.contains("Content-Type: text/plain"));
+        assert!(body_str.contains("Hello world"));
+    }
+
+    #[tokio::test]
+    async fn test_build_multipart_body_no_metadata() {
+        let metadata = None;
+        let content = b"Binary data";
+
+        let (body, content_type) = build_multipart_body(&metadata, content).unwrap();
+        let boundary = content_type.split("boundary=").nth(1).unwrap();
+        let body_str = String::from_utf8(body).unwrap();
+
+        assert!(body_str.contains(boundary));
+        assert!(body_str.contains("application/octet-stream")); // Fallback mime
+        assert!(body_str.contains("Binary data"));
+    }
+
+    #[test]
+    fn test_build_url_basic() {
+        let doc = RestDescription {
+            base_url: Some("https://api.example.com/".to_string()),
+            ..Default::default()
+        };
+        let method = RestMethod {
+            path: "files".to_string(),
+            flat_path: Some("files".to_string()),
+            ..Default::default()
+        };
+        let params = Map::new();
+
+        let (url, _) = build_url(&doc, &method, &params, false).unwrap();
+        assert_eq!(url, "https://api.example.com/files");
+    }
+
+    #[test]
+    fn test_build_url_substitution() {
+        let doc = RestDescription {
+            base_url: Some("https://api.example.com/".to_string()),
+            ..Default::default()
+        };
+        let method = RestMethod {
+            path: "files/{fileId}".to_string(),
+            flat_path: Some("files/{fileId}".to_string()),
+            ..Default::default()
+        };
+        let mut params = Map::new();
+        params.insert("fileId".to_string(), json!("123"));
+
+        let (url, _) = build_url(&doc, &method, &params, false).unwrap();
+        assert_eq!(url, "https://api.example.com/files/123");
+    }
+
+    #[test]
+    fn test_build_url_query_params() {
+        let doc = RestDescription {
+            base_url: Some("https://api.example.com/".to_string()),
+            ..Default::default()
+        };
+        let method = RestMethod {
+            path: "files".to_string(),
+            flat_path: Some("files".to_string()),
+            ..Default::default()
+        };
+        let mut params = Map::new();
+        params.insert("q".to_string(), json!("search term"));
+
+        let (url, query) = build_url(&doc, &method, &params, false).unwrap();
+        assert_eq!(url, "https://api.example.com/files");
+        assert_eq!(query.get("q").unwrap(), "search term");
+    }
+
+    #[test]
+    fn test_handle_error_response_401() {
+        let err = handle_error_response(
+            reqwest::StatusCode::UNAUTHORIZED,
+            "Unauthorized",
+            &AuthMethod::None,
+        )
+        .unwrap_err();
+        match err {
+            GwsError::Auth(msg) => assert!(msg.contains("Access denied")),
+            _ => panic!("Expected Auth error"),
+        }
+    }
+
+    #[test]
+    fn test_handle_error_response_api_error() {
+        let json_err = json!({
+            "error": {
+                "code": 400,
+                "message": "Bad Request",
+                "errors": [{ "reason": "bad" }]
+            }
+        })
+        .to_string();
+
+        let err = handle_error_response(
+            reqwest::StatusCode::BAD_REQUEST,
+            &json_err,
+            &AuthMethod::OAuth,
+        )
+        .unwrap_err();
+        match err {
+            GwsError::Api {
+                code,
+                message,
+                reason,
+            } => {
+                assert_eq!(code, 400);
+                assert_eq!(message, "Bad Request");
+                assert_eq!(reason, "bad");
+            }
+            _ => panic!("Expected Api error"),
+        }
+    }
+}
+
+#[tokio::test]
+async fn test_execute_method_dry_run() {
+    let mut schemas = HashMap::new();
+    let mut properties = HashMap::new();
+    properties.insert(
+        "name".to_string(),
+        crate::discovery::JsonSchemaProperty {
+            prop_type: Some("string".to_string()),
+            ..Default::default()
+        },
+    );
+    schemas.insert(
+        "File".to_string(),
+        crate::discovery::JsonSchema {
+            schema_type: Some("object".to_string()),
+            properties,
+            ..Default::default()
+        },
+    );
+
+    let doc = RestDescription {
+        root_url: "https://example.googleapis.com/".to_string(),
+        service_path: "v1/".to_string(),
+        schemas,
+        ..Default::default()
+    };
+
+    let mut parameters = HashMap::new();
+    parameters.insert(
+        "fileId".to_string(),
+        crate::discovery::MethodParameter {
+            location: Some("path".to_string()),
+            required: true,
+            ..Default::default()
+        },
+    );
+
+    let method = RestMethod {
+        http_method: "POST".to_string(),
+        id: Some("example.files.create".to_string()),
+        path: "files/{fileId}".to_string(),
+        parameter_order: vec!["fileId".to_string()],
+        parameters,
+        request: Some(crate::discovery::SchemaRef {
+            schema_ref: Some("File".to_string()),
+            parameter_name: None,
+        }),
+        ..Default::default()
+    };
+
+    let params_json = r#"{"fileId": "123"}"#;
+    let body_json = r#"{"name": "test.txt"}"#;
+
+    let sanitize_mode = crate::helpers::modelarmor::SanitizeMode::Warn;
+    let pagination = PaginationConfig::default();
+
+    let result = execute_method(
+        &doc,
+        &method,
+        Some(params_json),
+        Some(body_json),
+        None,
+        AuthMethod::None,
+        None,
+        None,
+        true, // dry_run
+        &pagination,
+        None,
+        &sanitize_mode,
+        &crate::formatter::OutputFormat::default(),
+    )
+    .await;
+
+    assert!(result.is_ok());
+}
+
+#[tokio::test]
+async fn test_execute_method_missing_path_param() {
+    // Same setup but missing required fileId in params
+    let mut parameters = HashMap::new();
+    parameters.insert(
+        "fileId".to_string(),
+        crate::discovery::MethodParameter {
+            location: Some("path".to_string()),
+            required: true,
+            ..Default::default()
+        },
+    );
+    let doc = RestDescription::default();
+    let method = RestMethod {
+        http_method: "POST".to_string(),
+        path: "files/{fileId}".to_string(),
+        parameter_order: vec!["fileId".to_string()],
+        parameters,
+        ..Default::default()
+    };
+
+    let sanitize_mode = crate::helpers::modelarmor::SanitizeMode::Warn;
+    let result = execute_method(
+        &doc,
+        &method,
+        None, // No params provided
+        None,
+        None,
+        AuthMethod::None,
+        None,
+        None,
+        true,
+        &PaginationConfig::default(),
+        None,
+        &sanitize_mode,
+        &crate::formatter::OutputFormat::default(),
+    )
+    .await;
+
+    assert!(result.is_err());
+    assert!(result
+        .unwrap_err()
+        .to_string()
+        .contains("Required path parameter"));
+}
+
+#[test]
+fn test_handle_error_response_non_json() {
+    let err = handle_error_response(
+        reqwest::StatusCode::INTERNAL_SERVER_ERROR,
+        "Internal Server Error Text",
+        &AuthMethod::OAuth,
+    )
+    .unwrap_err();
+    match err {
+        GwsError::Api {
+            code,
+            message,
+            reason,
+        } => {
+            assert_eq!(code, 500);
+            assert_eq!(message, "Internal Server Error Text");
+            assert_eq!(reason, "httpError");
+        }
+        _ => panic!("Expected Api error"),
+    }
+}
+
+#[test]
+fn test_get_value_type_helper() {
+    assert_eq!(get_value_type(&json!(null)), "null");
+    assert_eq!(get_value_type(&json!(true)), "boolean");
+    assert_eq!(get_value_type(&json!(42)), "integer");
+    assert_eq!(get_value_type(&json!(3.5)), "number (float)");
+    assert_eq!(get_value_type(&json!("string")), "string");
+    assert_eq!(get_value_type(&json!([1, 2])), "array");
+    assert_eq!(get_value_type(&json!({"a": 1})), "object");
+}
diff --git a/src/formatter.rs b/src/formatter.rs
new file mode 100644
index 00000000..de134df8
--- /dev/null
+++ b/src/formatter.rs
@@ -0,0 +1,421 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Output Formatting
+//!
+//! Transforms JSON API responses into human-readable formats (table, YAML, CSV).
+
+use serde_json::Value;
+use std::fmt::Write;
+
+/// Supported output formats.
+#[derive(Debug, Clone, PartialEq, Default)]
+pub enum OutputFormat {
+    /// Pretty-printed JSON (default).
+    #[default]
+    Json,
+    /// Aligned text table.
+    Table,
+    /// YAML.
+    Yaml,
+    /// Comma-separated values.
+    Csv,
+}
+
+impl OutputFormat {
+    /// Parse from a string argument.
+    pub fn from_str(s: &str) -> Self {
+        match s.to_lowercase().as_str() {
+            "table" => Self::Table,
+            "yaml" | "yml" => Self::Yaml,
+            "csv" => Self::Csv,
+            _ => Self::Json,
+        }
+    }
+}
+
+/// Format a JSON value according to the specified output format.
+pub fn format_value(value: &Value, format: &OutputFormat) -> String {
+    match format {
+        OutputFormat::Json => serde_json::to_string_pretty(value).unwrap_or_default(),
+        OutputFormat::Table => format_table(value),
+        OutputFormat::Yaml => format_yaml(value),
+        OutputFormat::Csv => format_csv(value),
+    }
+}
+
+/// Format a JSON value as compact JSON (for NDJSON pagination mode).
+pub fn format_value_compact(value: &Value, format: &OutputFormat) -> String {
+    match format {
+        OutputFormat::Json => serde_json::to_string(value).unwrap_or_default(),
+        _ => format_value(value, format),
+    }
+}
+
+/// Extract a "data array" from a typical Google API list response.
+/// Google APIs return lists as `{ "files": [...], "nextPageToken": "..." }`
+/// where the array key varies by resource type.
+fn extract_items(value: &Value) -> Option<(&str, &Vec<Value>)> {
+    if let Value::Object(obj) = value {
+        for (key, val) in obj {
+            if key == "nextPageToken" || key == "kind" || key.starts_with('_') {
+                continue;
+            }
+            if let Value::Array(arr) = val {
+                if !arr.is_empty() {
+                    return Some((key, arr));
+                }
+            }
+        }
+    }
+    None
+}
+
+fn format_table(value: &Value) -> String {
+    // Try to extract a list of items from standard Google API response
+    let items = extract_items(value);
+
+    if let Some((_key, arr)) = items {
+        format_array_as_table(arr)
+    } else if let Value::Array(arr) = value {
+        format_array_as_table(arr)
+    } else if let Value::Object(obj) = value {
+        // Single object: key/value table
+        let mut output = String::new();
+        let max_key_len = obj.keys().map(|k| k.len()).max().unwrap_or(0);
+        for (key, val) in obj {
+            let val_str = value_to_cell(val);
+            let _ = writeln!(output, "{:width$}  {}", key, val_str, width = max_key_len);
+        }
+        output
+    } else {
+        value.to_string()
+    }
+}
+
+fn format_array_as_table(arr: &[Value]) -> String {
+    if arr.is_empty() {
+        return "(empty)\n".to_string();
+    }
+
+    // Collect all unique keys across all objects
+    let mut columns: Vec<String> = Vec::new();
+    for item in arr {
+        if let Value::Object(obj) = item {
+            for key in obj.keys() {
+                if !columns.contains(key) {
+                    columns.push(key.clone());
+                }
+            }
+        }
+    }
+
+    if columns.is_empty() {
+        // Array of non-objects
+        let mut output = String::new();
+        for item in arr {
+            let _ = writeln!(output, "{}", value_to_cell(item));
+        }
+        return output;
+    }
+
+    // Calculate column widths
+    let mut widths: Vec<usize> = columns.iter().map(|c| c.len()).collect();
+    let rows: Vec<Vec<String>> = arr
+        .iter()
+        .map(|item| {
+            columns
+                .iter()
+                .enumerate()
+                .map(|(i, col)| {
+                    let cell = if let Value::Object(obj) = item {
+                        obj.get(col).map(value_to_cell).unwrap_or_default()
+                    } else {
+                        String::new()
+                    };
+                    if cell.len() > widths[i] {
+                        widths[i] = cell.len();
+                    }
+                    // Cap column width at 60
+                    if widths[i] > 60 {
+                        widths[i] = 60;
+                    }
+                    cell
+                })
+                .collect()
+        })
+        .collect();
+
+    let mut output = String::new();
+
+    // Header
+    let header: Vec<String> = columns
+        .iter()
+        .enumerate()
+        .map(|(i, c)| format!("{:width$}", c, width = widths[i]))
+        .collect();
+    let _ = writeln!(output, "{}", header.join("  "));
+
+    // Separator
+    let sep: Vec<String> = widths.iter().map(|w| "─".repeat(*w)).collect();
+    let _ = writeln!(output, "{}", sep.join("  "));
+
+    // Rows
+    for row in &rows {
+        let cells: Vec<String> = row
+            .iter()
+            .enumerate()
+            .map(|(i, c)| {
+                let truncated = if c.len() > widths[i] {
+                    format!("{}…", &c[..widths[i] - 1])
+                } else {
+                    c.clone()
+                };
+                format!("{:width$}", truncated, width = widths[i])
+            })
+            .collect();
+        let _ = writeln!(output, "{}", cells.join("  "));
+    }
+
+    output
+}
+
+fn format_yaml(value: &Value) -> String {
+    json_to_yaml(value, 0)
+}
+
+fn json_to_yaml(value: &Value, indent: usize) -> String {
+    let prefix = "  ".repeat(indent);
+    match value {
+        Value::Null => "null".to_string(),
+        Value::Bool(b) => b.to_string(),
+        Value::Number(n) => n.to_string(),
+        Value::String(s) => {
+            if s.contains('\n') || s.contains(':') || s.contains('#') {
+                format!(
+                    "|\n{}",
+                    s.lines()
+                        .map(|l| format!("{prefix}  {l}"))
+                        .collect::<Vec<_>>()
+                        .join("\n")
+                )
+            } else {
+                format!("\"{s}\"")
+            }
+        }
+        Value::Array(arr) => {
+            if arr.is_empty() {
+                return "[]".to_string();
+            }
+            let mut out = String::new();
+            for item in arr {
+                let val_str = json_to_yaml(item, indent + 1);
+                let _ = write!(out, "\n{prefix}- {val_str}");
+            }
+            out
+        }
+        Value::Object(obj) => {
+            if obj.is_empty() {
+                return "{}".to_string();
+            }
+            let mut out = String::new();
+            for (key, val) in obj {
+                match val {
+                    Value::Object(_) | Value::Array(_) => {
+                        let val_str = json_to_yaml(val, indent + 1);
+                        let _ = write!(out, "\n{prefix}{key}:{val_str}");
+                    }
+                    _ => {
+                        let val_str = json_to_yaml(val, indent);
+                        let _ = write!(out, "\n{prefix}{key}: {val_str}");
+                    }
+                }
+            }
+            out
+        }
+    }
+}
+
+fn format_csv(value: &Value) -> String {
+    let items = extract_items(value);
+
+    let arr = if let Some((_key, arr)) = items {
+        arr.as_slice()
+    } else if let Value::Array(arr) = value {
+        arr.as_slice()
+    } else {
+        // Single value — just output it
+        return value_to_cell(value);
+    };
+
+    if arr.is_empty() {
+        return String::new();
+    }
+
+    // Collect columns
+    let mut columns: Vec<String> = Vec::new();
+    for item in arr {
+        if let Value::Object(obj) = item {
+            for key in obj.keys() {
+                if !columns.contains(key) {
+                    columns.push(key.clone());
+                }
+            }
+        }
+    }
+
+    let mut output = String::new();
+
+    // Header
+    let _ = writeln!(output, "{}", columns.join(","));
+
+    // Rows
+    for item in arr {
+        let cells: Vec<String> = columns
+            .iter()
+            .map(|col| {
+                if let Value::Object(obj) = item {
+                    csv_escape(&value_to_cell(obj.get(col).unwrap_or(&Value::Null)))
+                } else {
+                    String::new()
+                }
+            })
+            .collect();
+        let _ = writeln!(output, "{}", cells.join(","));
+    }
+
+    output
+}
+
+fn csv_escape(s: &str) -> String {
+    if s.contains(',') || s.contains('"') || s.contains('\n') {
+        format!("\"{}\"", s.replace('"', "\"\""))
+    } else {
+        s.to_string()
+    }
+}
+
+fn value_to_cell(value: &Value) -> String {
+    match value {
+        Value::Null => String::new(),
+        Value::String(s) => s.clone(),
+        Value::Bool(b) => b.to_string(),
+        Value::Number(n) => n.to_string(),
+        Value::Array(arr) => {
+            let items: Vec<String> = arr.iter().map(value_to_cell).collect();
+            items.join(", ")
+        }
+        Value::Object(_) => serde_json::to_string(value).unwrap_or_default(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn test_output_format_from_str() {
+        assert_eq!(OutputFormat::from_str("json"), OutputFormat::Json);
+        assert_eq!(OutputFormat::from_str("table"), OutputFormat::Table);
+        assert_eq!(OutputFormat::from_str("yaml"), OutputFormat::Yaml);
+        assert_eq!(OutputFormat::from_str("yml"), OutputFormat::Yaml);
+        assert_eq!(OutputFormat::from_str("csv"), OutputFormat::Csv);
+        assert_eq!(OutputFormat::from_str("unknown"), OutputFormat::Json);
+    }
+
+    #[test]
+    fn test_format_json() {
+        let val = json!({"name": "test"});
+        let output = format_value(&val, &OutputFormat::Json);
+        assert!(output.contains("\"name\""));
+        assert!(output.contains("\"test\""));
+    }
+
+    #[test]
+    fn test_format_table_array_of_objects() {
+        let val = json!({
+            "files": [
+                {"id": "1", "name": "hello.txt"},
+                {"id": "2", "name": "world.txt"}
+            ]
+        });
+        let output = format_value(&val, &OutputFormat::Table);
+        assert!(output.contains("id"));
+        assert!(output.contains("name"));
+        assert!(output.contains("hello.txt"));
+        assert!(output.contains("world.txt"));
+        // Check separator line
+        assert!(output.contains("──"));
+    }
+
+    #[test]
+    fn test_format_table_single_object() {
+        let val = json!({"id": "abc", "name": "test"});
+        let output = format_value(&val, &OutputFormat::Table);
+        assert!(output.contains("id"));
+        assert!(output.contains("abc"));
+    }
+
+    #[test]
+    fn test_format_csv() {
+        let val = json!({
+            "files": [
+                {"id": "1", "name": "hello"},
+                {"id": "2", "name": "world"}
+            ]
+        });
+        let output = format_value(&val, &OutputFormat::Csv);
+        assert!(output.contains("id,name"));
+        assert!(output.contains("1,hello"));
+        assert!(output.contains("2,world"));
+    }
+
+    #[test]
+    fn test_format_csv_escape() {
+        assert_eq!(csv_escape("simple"), "simple");
+        assert_eq!(csv_escape("has,comma"), "\"has,comma\"");
+        assert_eq!(csv_escape("has\"quote"), "\"has\"\"quote\"");
+    }
+
+    #[test]
+    fn test_format_yaml() {
+        let val = json!({"name": "test", "count": 42});
+        let output = format_value(&val, &OutputFormat::Yaml);
+        assert!(output.contains("name: \"test\""));
+        assert!(output.contains("count: 42"));
+    }
+
+    #[test]
+    fn test_format_table_empty_array() {
+        let val = json!({"files": []});
+        // No items to extract, falls back to single-object table
+        let output = format_value(&val, &OutputFormat::Table);
+        assert!(output.contains("files"));
+    }
+
+    #[test]
+    fn test_extract_items() {
+        let val = json!({"files": [{"id": "1"}], "nextPageToken": "abc"});
+        let (key, items) = extract_items(&val).unwrap();
+        assert_eq!(key, "files");
+        assert_eq!(items.len(), 1);
+    }
+
+    #[test]
+    fn test_extract_items_none() {
+        let val = json!({"status": "ok"});
+        assert!(extract_items(&val).is_none());
+    }
+}
diff --git a/src/generate_skills.rs b/src/generate_skills.rs
new file mode 100644
index 00000000..2f6e5b3a
--- /dev/null
+++ b/src/generate_skills.rs
@@ -0,0 +1,493 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Generates SKILL.md files from the CLI's own clap metadata.
+//!
+//! Usage: `gws generate-skills [--output-dir skills/]`
+
+use crate::commands;
+use crate::discovery;
+use crate::error::GwsError;
+use crate::services;
+use clap::Command;
+use std::path::Path;
+
+/// Entry point for `gws generate-skills`.
+pub async fn handle_generate_skills(args: &[String]) -> Result<(), GwsError> {
+    let output_dir = parse_output_dir(args);
+    let output_path = Path::new(&output_dir);
+    let filter = parse_filter(args);
+
+    // Generate gws-shared skill if no filter or "shared" is in the filter
+    if filter
+        .as_ref()
+        .is_none_or(|f| "shared".contains(f.as_str()))
+    {
+        generate_shared_skill(output_path)?;
+    }
+
+    for entry in services::SERVICES {
+        let alias = entry.aliases[0];
+
+        let skill_name = format!("gws-{alias}");
+
+        eprintln!(
+            "Generating skills for {alias} ({}/{})...",
+            entry.api_name, entry.version
+        );
+
+        // Fetch discovery doc
+        let doc = match discovery::fetch_discovery_document(entry.api_name, entry.version).await {
+            Ok(d) => d,
+            Err(e) => {
+                eprintln!("  WARNING: Failed to fetch discovery doc for {alias}: {e}");
+                continue;
+            }
+        };
+
+        // Build the CLI tree (includes helpers)
+        let cli = commands::build_cli(&doc);
+
+        // Collect helper commands (start with '+') and resource commands
+        let mut helpers = Vec::new();
+        let mut resources = Vec::new();
+
+        for sub in cli.get_subcommands() {
+            let name = sub.get_name();
+            if name.starts_with('+') {
+                helpers.push(sub);
+            } else {
+                resources.push(sub);
+            }
+        }
+
+        // Generate service-level skill (only if service itself is in the filter, or no filter)
+        let emit_service = match filter {
+            Some(ref f) => alias.contains(f.as_str()),
+            None => true,
+        };
+        if emit_service {
+            let service_md = render_service_skill(alias, entry, &helpers, &resources);
+            write_skill(output_path, &skill_name, &service_md)?;
+        }
+
+        // Generate per-helper skills
+        for helper in &helpers {
+            let helper_name = helper.get_name();
+            // +triage -> triage
+            let short = helper_name.trim_start_matches('+');
+            let helper_key = format!("{alias}-{short}");
+
+            let emit_helper = match filter {
+                Some(ref f) => helper_key.contains(f.as_str()),
+                None => true,
+            };
+            if emit_helper {
+                let helper_skill_name = format!("gws-{helper_key}");
+                let helper_md = render_helper_skill(alias, helper_name, helper, entry);
+                write_skill(output_path, &helper_skill_name, &helper_md)?;
+            }
+        }
+    }
+
+    eprintln!("\nDone. Skills written to {output_dir}/");
+    Ok(())
+}
+
+fn parse_output_dir(args: &[String]) -> String {
+    for (i, arg) in args.iter().enumerate() {
+        if arg == "--output-dir" {
+            if let Some(val) = args.get(i + 1) {
+                return val.clone();
+            }
+        }
+    }
+    "skills".to_string()
+}
+
+/// Parse `--filter <match>` into a substring filter.
+fn parse_filter(args: &[String]) -> Option<String> {
+    for (i, arg) in args.iter().enumerate() {
+        if arg == "--filter" {
+            if let Some(val) = args.get(i + 1) {
+                return Some(val.trim().to_string());
+            }
+        }
+    }
+    None
+}
+
+fn write_skill(base: &Path, name: &str, content: &str) -> Result<(), GwsError> {
+    let dir = base.join(name);
+    std::fs::create_dir_all(&dir).map_err(|e| {
+        GwsError::Validation(format!("Failed to create dir {}: {e}", dir.display()))
+    })?;
+    let path = dir.join("SKILL.md");
+    std::fs::write(&path, content)
+        .map_err(|e| GwsError::Validation(format!("Failed to write {}: {e}", path.display())))?;
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// Renderers
+// ---------------------------------------------------------------------------
+
+fn render_service_skill(
+    alias: &str,
+    entry: &services::ServiceEntry,
+    helpers: &[&Command],
+    resources: &[&Command],
+) -> String {
+    let mut out = String::new();
+
+    // Frontmatter
+    out.push_str(&format!(
+        r#"---
+name: gws-{alias}
+version: 1.0.0
+description: "USE WHEN the user wants to {description} via the `gws` CLI."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws {alias} --help"
+---
+
+"#,
+        description = entry.description.to_lowercase(),
+    ));
+
+    // Title
+    let api_version = entry.version;
+    out.push_str(&format!("# {alias} ({api_version})\n\n"));
+
+    out.push_str(
+        "> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.\n\n",
+    );
+
+    out.push_str(&format!(
+        "```bash\ngws {alias} <resource> <method> [flags]\n```\n\n",
+    ));
+
+    // Helper commands
+    if !helpers.is_empty() {
+        out.push_str("## Helper Commands\n\n");
+        out.push_str("| Command | Description |\n");
+        out.push_str("|---------|-------------|\n");
+        for h in helpers {
+            let name = h.get_name();
+            let short = name.trim_start_matches('+');
+            let about = h.get_about().map(|s| s.to_string()).unwrap_or_default();
+            // Strip the "[Helper] " prefix if present
+            let about = about.strip_prefix("[Helper] ").unwrap_or(&about);
+            out.push_str(&format!(
+                "| [`{name}`](../gws-{alias}-{short}/SKILL.md) | {about} |\n"
+            ));
+        }
+        out.push('\n');
+    }
+
+    // API resources
+    if !resources.is_empty() {
+        out.push_str("## API Resources\n\n");
+        for res in resources {
+            let res_name = res.get_name();
+            let methods: Vec<String> = res
+                .get_subcommands()
+                .map(|m| {
+                    let mname = m.get_name().to_string();
+                    let mabout = m.get_about().map(|s| s.to_string()).unwrap_or_default();
+                    format!("  - `{mname}` — {mabout}")
+                })
+                .collect();
+
+            if methods.is_empty() {
+                // Might have sub-resources, list them
+                let subs: Vec<String> = res
+                    .get_subcommands()
+                    .filter(|s| s.get_subcommands().next().is_some())
+                    .map(|s| format!("  - `{}`", s.get_name()))
+                    .collect();
+                if !subs.is_empty() {
+                    out.push_str(&format!("### {res_name}\n\n"));
+                    for s in subs {
+                        out.push_str(&s);
+                        out.push('\n');
+                    }
+                    out.push('\n');
+                }
+            } else {
+                out.push_str(&format!("### {res_name}\n\n"));
+                for m in &methods {
+                    out.push_str(m);
+                    out.push('\n');
+                }
+                out.push('\n');
+            }
+        }
+    }
+
+    // Discovering commands section
+    out.push_str("## Discovering Commands\n\n");
+    out.push_str("Before calling any API method, inspect it:\n\n");
+    out.push_str(&format!("```bash\n# Browse resources and methods\ngws {alias} --help\n\n# Inspect a method's required params, types, and defaults\ngws schema {alias}.<resource>.<method>\n```\n\n"));
+    out.push_str("Use `gws schema` output to build your `--params` and `--json` flags.\n\n");
+
+    out
+}
+
+fn render_helper_skill(
+    alias: &str,
+    cmd_name: &str,
+    cmd: &Command,
+    entry: &services::ServiceEntry,
+) -> String {
+    let mut out = String::new();
+
+    let about_raw = cmd.get_about().map(|s| s.to_string()).unwrap_or_default();
+    let about = about_raw.strip_prefix("[Helper] ").unwrap_or(&about_raw);
+
+    let short = cmd_name.trim_start_matches('+');
+
+    // Determine if write command
+    let is_write = matches!(
+        short,
+        "send"
+            | "write"
+            | "upload"
+            | "push"
+            | "insert"
+            | "append"
+            | "create-template"
+            | "subscribe"
+    );
+    let category = if alias == "modelarmor" {
+        "security"
+    } else {
+        "productivity"
+    };
+
+    // Frontmatter
+    out.push_str(&format!(
+        r#"---
+name: gws-{alias}-{short}
+version: 1.0.0
+description: "{about}"
+metadata:
+  openclaw:
+    category: "{category}"
+    requires:
+      bins: ["gws"]
+    cliHelp: "gws {alias} {cmd_name} --help"
+---
+
+"#,
+    ));
+
+    // Title
+    out.push_str(&format!("# {alias} {cmd_name}\n\n"));
+
+    out.push_str(
+        "> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.\n\n",
+    );
+
+    out.push_str(&format!("{about}\n\n"));
+
+    // Usage
+    out.push_str("## Usage\n\n");
+    out.push_str(&format!("```bash\ngws {alias} {cmd_name}"));
+
+    // Show required args inline
+    let args: Vec<_> = cmd
+        .get_arguments()
+        .filter(|a| a.get_id() != "help")
+        .collect();
+    for arg in &args {
+        if arg.is_required_set() {
+            if let Some(long) = arg.get_long() {
+                let val_name = arg
+                    .get_value_names()
+                    .and_then(|v| v.first())
+                    .map(|s| s.to_string())
+                    .unwrap_or_else(|| "VALUE".to_string());
+                out.push_str(&format!(" --{long} <{val_name}>"));
+            } else {
+                let id = arg.get_id().as_str();
+                out.push_str(&format!(" <{id}>"));
+            }
+        }
+    }
+
+    out.push_str("\n```\n\n");
+
+    // Flags table
+    if !args.is_empty() {
+        out.push_str("## Flags\n\n");
+        out.push_str("| Flag | Required | Default | Description |\n");
+        out.push_str("|------|----------|---------|-------------|\n");
+
+        for arg in &args {
+            let flag = if let Some(long) = arg.get_long() {
+                format!("`--{long}`")
+            } else {
+                format!("`<{}>`", arg.get_id().as_str())
+            };
+
+            let required = if arg.is_required_set() { "✓" } else { "—" };
+
+            // Get default value
+            let default = arg
+                .get_default_values()
+                .first()
+                .map(|v| v.to_string_lossy().to_string())
+                .unwrap_or_else(|| "—".to_string());
+
+            let help = arg
+                .get_help()
+                .map(|s| s.to_string())
+                .unwrap_or_else(|| "—".to_string());
+
+            out.push_str(&format!("| {flag} | {required} | {default} | {help} |\n"));
+        }
+        out.push('\n');
+    }
+
+    // After-help (examples, tips) — format as proper markdown
+    if let Some(after) = cmd.get_after_help() {
+        let after_str = after.to_string();
+        if !after_str.is_empty() {
+            let mut in_examples = false;
+            let mut in_tips = false;
+            let mut examples = Vec::new();
+            let mut tips = Vec::new();
+
+            for line in after_str.lines() {
+                let trimmed = line.trim();
+                if trimmed == "EXAMPLES:" {
+                    in_examples = true;
+                    in_tips = false;
+                    continue;
+                }
+                if trimmed == "TIPS:" {
+                    in_tips = true;
+                    in_examples = false;
+                    continue;
+                }
+                if in_examples && !trimmed.is_empty() {
+                    examples.push(trimmed.to_string());
+                }
+                if in_tips && !trimmed.is_empty() {
+                    tips.push(trimmed.to_string());
+                }
+            }
+
+            if !examples.is_empty() {
+                out.push_str("## Examples\n\n```bash\n");
+                for ex in &examples {
+                    out.push_str(ex);
+                    out.push('\n');
+                }
+                out.push_str("```\n\n");
+            }
+
+            if !tips.is_empty() {
+                out.push_str("## Tips\n\n");
+                for tip in &tips {
+                    out.push_str(&format!("- {tip}\n"));
+                }
+                out.push('\n');
+            }
+        }
+    }
+
+    // Write warning
+    if is_write {
+        out.push_str("> [!CAUTION]\n");
+        out.push_str("> This is a **write** command — confirm with the user before executing.\n\n");
+    }
+
+    // Cross-reference
+    out.push_str(&format!(
+        "## See Also\n\n- [gws-shared](../gws-shared/SKILL.md) — Global flags and auth\n- [gws-{alias}](../gws-{alias}/SKILL.md) — All {} commands\n",
+        entry.description.to_lowercase(),
+    ));
+
+    out
+}
+
+fn generate_shared_skill(base: &Path) -> Result<(), GwsError> {
+    let content = r#"---
+name: gws-shared
+version: 1.0.0
+description: "Shared patterns, authentication, and global flags for all gws commands."
+metadata:
+  openclaw:
+    category: "productivity"
+    requires:
+      bins: ["gws"]
+---
+
+# gws — Shared Reference
+
+## Installation
+
+The `gws` binary must be on `$PATH`. See the project README for install options.
+
+## Authentication
+
+```bash
+# Browser-based OAuth (interactive)
+gws auth login
+
+# Service Account
+export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
+```
+
+## Global Flags
+
+| Flag | Description |
+|------|-------------|
+| `--format <FORMAT>` | Output format: `json` (default), `table`, `yaml`, `csv` |
+| `--dry-run` | Validate locally without calling the API |
+| `--sanitize <TEMPLATE>` | Screen responses through Model Armor |
+
+## CLI Syntax
+
+```bash
+gws <service> <resource> [sub-resource] <method> [flags]
+```
+
+### Method Flags
+
+| Flag | Description |
+|------|-------------|
+| `--params '{"key": "val"}'` | URL/query parameters |
+| `--json '{"key": "val"}'` | Request body |
+| `-o, --output <PATH>` | Save binary responses to file |
+| `--upload <PATH>` | Upload file content (multipart) |
+| `--page-all` | Auto-paginate (NDJSON output) |
+| `--page-limit <N>` | Max pages when using --page-all (default: 10) |
+| `--page-delay <MS>` | Delay between pages in ms (default: 100) |
+
+## Security Rules
+
+- **Never** output secrets (API keys, tokens) directly
+- **Always** confirm with user before executing write/delete commands
+- Prefer `--dry-run` for destructive operations
+- Use `--sanitize` for PII/content safety screening
+"#;
+
+    write_skill(base, "gws-shared", content)
+}
diff --git a/src/helpers/README.md b/src/helpers/README.md
new file mode 100644
index 00000000..7d7a22d3
--- /dev/null
+++ b/src/helpers/README.md
@@ -0,0 +1,66 @@
+# Helper Modules
+
+This directory contains "Helper" implementations that provide high-value, simplified commands for complex Google Workspace API operations.
+
+## Philosophy
+
+The goal of the `gws` CLI is to provide raw access to the Google Workspace APIs. However, some operations are common but complex to execute via raw API calls (e.g., sending an email, appending a row to a sheet).
+
+**Helper commands should only be added if they offer "High Usefulness":**
+
+*   **Complex Abstraction:** Does it abstract away significant complexity (e.g., MIME encoding, complex JSON structures, multiple API calls)?
+*   **Format Conversion:** Does it handle data format conversions that are tedious for the user?
+*   **Not Just an Alias:** Avoid adding helpers that simply alias a single, straightforward API call.
+
+## Architecture
+
+Helpers are implemented using the `Helper` trait defined in `mod.rs`.
+
+```rust
+pub trait Helper: Send + Sync {
+    fn inject_commands(
+        &self,
+        cmd: Command,
+        doc: &crate::discovery::RestDescription,
+    ) -> Command;
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>>;
+}
+```
+
+*   **`inject_commands`**: Adds subcommands to the main service command. All helper commands are always shown regardless of authentication state.
+*   **`handle`**: implementation of the command logic. Returns `Ok(true)` if the command was handled, or `Ok(false)` to let the default raw resource handler attempt to handle it.
+
+### Catalogue
+
+| Service | Command | Usage | Description | Equivalent Raw Command (Example) |
+| :--- | :--- | :--- | :--- | :--- |
+| **Gmail** | `+send` | `gws gmail +send ...` | Sends an email. | `gws gmail users messages send ...` |
+| **Sheets** | `+append` | `gws sheets +append ...` | Appends a row. | `gws sheets spreadsheets values append ...` |
+| **Sheets** | `+read` | `gws sheets +read ...` | Reads values. | `gws sheets spreadsheets values get ...` |
+| **Docs** | `+write` | `gws docs +write ...` | Appends text. | `gws docs documents batchUpdate ...` |
+| **Chat** | `+send` | `gws chat +send ...` | Sends message. | `gws chat spaces messages create ...` |
+| **Drive** | `+upload` | `gws drive +upload ...` | Uploads file. | `gws drive files create --upload ...` |
+| **Calendar** | `+insert` | `gws calendar +insert ...` | Creates event. | `gws calendar events insert ...` |
+| **Script** | `+push` | `gws script +push --script <ID>` | Pushes files. | `gws script projects updateContent ...` |
+| **Events** | `+subscribe` | `gws events +subscribe ...` | Subscribe & stream events. | Pub/Sub REST + Workspace Events API |
+| **Events** | `+renew` | `gws events +renew ...` | Renew subscriptions. | `gws events subscriptions reactivate ...` |
+
+### Development
+
+To add a new helper:
+1.  Create `src/helpers/<service>.rs`.
+2.  Implement the `Helper` trait.
+3.  Register it in `src/helpers/mod.rs`.
+4.  **Prefix** the command with `+` (e.g., `+create`).
+
+## Current Helpers
+
+*   **Gmail**: Sending emails (abstracts RFC 2822 encoding).
+*   **Sheets**: Appending rows (abstracts `ValueRange` JSON construction).
+*   **Docs**: Appending text (abstracts `batchUpdate` requests).
+*   **Chat**: Sending messages to spaces.
diff --git a/src/helpers/calendar.rs b/src/helpers/calendar.rs
new file mode 100644
index 00000000..942a993a
--- /dev/null
+++ b/src/helpers/calendar.rs
@@ -0,0 +1,538 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use clap::{Arg, ArgAction, ArgMatches, Command};
+use serde_json::json;
+use serde_json::Value;
+use std::future::Future;
+use std::pin::Pin;
+
+pub struct CalendarHelper;
+
+impl Helper for CalendarHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+insert")
+                .about("[Helper] create a new event")
+                .arg(
+                    Arg::new("calendar")
+                        .long("calendar")
+                        .help("Calendar ID (default: primary)")
+                        .default_value("primary")
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("summary")
+                        .long("summary")
+                        .help("Event summary/title")
+                        .required(true)
+                        .value_name("TEXT"),
+                )
+                .arg(
+                    Arg::new("start")
+                        .long("start")
+                        .help("Start time (ISO 8601, e.g., 2024-01-01T10:00:00Z)")
+                        .required(true)
+                        .value_name("TIME"),
+                )
+                .arg(
+                    Arg::new("end")
+                        .long("end")
+                        .help("End time (ISO 8601)")
+                        .required(true)
+                        .value_name("TIME"),
+                )
+                .arg(
+                    Arg::new("location")
+                        .long("location")
+                        .help("Event location")
+                        .value_name("TEXT"),
+                )
+                .arg(
+                    Arg::new("description")
+                        .long("description")
+                        .help("Event description/body")
+                        .value_name("TEXT"),
+                )
+                .arg(
+                    Arg::new("attendee")
+                        .long("attendee")
+                        .help("Attendee email (can be used multiple times)")
+                        .value_name("EMAIL")
+                        .action(ArgAction::Append),
+                )
+                .after_help("\
+EXAMPLES:
+  gws calendar +insert --summary 'Standup' --start '2026-06-17T09:00:00-07:00' --end '2026-06-17T09:30:00-07:00'
+  gws calendar +insert --summary 'Review' --start ... --end ... --attendee alice@example.com
+
+TIPS:
+  Use RFC3339 format for times (e.g. 2026-06-17T09:00:00-07:00).
+  For recurring events or conference links, use the raw API instead."),
+        );
+        cmd = cmd.subcommand(
+            Command::new("+agenda")
+                .about("[Helper] Show upcoming events across all calendars")
+                .arg(
+                    Arg::new("today")
+                        .long("today")
+                        .help("Show today's events")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("tomorrow")
+                        .long("tomorrow")
+                        .help("Show tomorrow's events")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("week")
+                        .long("week")
+                        .help("Show this week's events")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("days")
+                        .long("days")
+                        .help("Number of days ahead to show")
+                        .value_name("N"),
+                )
+                .arg(
+                    Arg::new("calendar")
+                        .long("calendar")
+                        .help("Filter to specific calendar name or ID")
+                        .value_name("NAME"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws calendar +agenda
+  gws calendar +agenda --today
+  gws calendar +agenda --week --format table
+  gws calendar +agenda --days 3 --calendar 'Work'
+
+TIPS:
+  Read-only — never modifies events.
+  Queries all calendars by default; use --calendar to filter.",
+                ),
+        );
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+insert") {
+                let (params_str, body_str, scopes) = build_insert_request(matches, doc)?;
+
+                let scopes_str: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scopes_str).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                let events_res = doc.resources.get("events").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'events' not found".to_string())
+                })?;
+                let insert_method = events_res.methods.get("insert").ok_or_else(|| {
+                    GwsError::Discovery("Method 'events.insert' not found".to_string())
+                })?;
+
+                executor::execute_method(
+                    doc,
+                    insert_method,
+                    Some(&params_str),
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &executor::PaginationConfig::default(),
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+            if let Some(matches) = matches.subcommand_matches("+agenda") {
+                handle_agenda(matches).await?;
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+async fn handle_agenda(matches: &ArgMatches) -> Result<(), GwsError> {
+    let cal_scope = "https://www.googleapis.com/auth/calendar.readonly";
+    let token = auth::get_token(&[cal_scope])
+        .await
+        .map_err(|e| GwsError::Auth(format!("Calendar auth failed: {e}")))?;
+
+    let output_format = matches
+        .get_one::<String>("format")
+        .map(|s| crate::formatter::OutputFormat::from_str(s))
+        .unwrap_or(crate::formatter::OutputFormat::Table);
+
+    // Determine time range
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    let days: u64 = if matches.get_flag("tomorrow") {
+        // Start from tomorrow, 1 day
+        1
+    } else if matches.get_flag("week") {
+        7
+    } else {
+        matches
+            .get_one::<String>("days")
+            .and_then(|s| s.parse::<u64>().ok())
+            .unwrap_or(1)
+    };
+
+    let (time_min_epoch, time_max_epoch) = if matches.get_flag("tomorrow") {
+        // Tomorrow: start of tomorrow to end of tomorrow
+        let day_seconds = 86400;
+        let tomorrow_start = (now / day_seconds + 1) * day_seconds;
+        (tomorrow_start, tomorrow_start + day_seconds)
+    } else {
+        // Start from now
+        (now, now + days * 86400)
+    };
+
+    let time_min = epoch_to_rfc3339(time_min_epoch);
+    let time_max = epoch_to_rfc3339(time_max_epoch);
+
+    let client = crate::client::build_client()?;
+    let calendar_filter = matches.get_one::<String>("calendar");
+
+    // 1. List all calendars
+    let list_url = "https://www.googleapis.com/calendar/v3/users/me/calendarList";
+    let list_resp = client
+        .get(list_url)
+        .bearer_auth(&token)
+        .send()
+        .await
+        .map_err(|e| GwsError::Other(anyhow::anyhow!("Failed to list calendars: {e}")))?;
+
+    if !list_resp.status().is_success() {
+        let err = list_resp.text().await.unwrap_or_default();
+        return Err(GwsError::Api {
+            code: 0,
+            message: err,
+            reason: "calendarList_failed".to_string(),
+        });
+    }
+
+    let list_json: Value = list_resp
+        .json()
+        .await
+        .map_err(|e| GwsError::Other(anyhow::anyhow!("Failed to parse calendar list: {e}")))?;
+
+    let calendars = list_json
+        .get("items")
+        .and_then(|i| i.as_array())
+        .cloned()
+        .unwrap_or_default();
+
+    // 2. For each calendar, fetch events concurrently
+    use futures_util::stream::{self, StreamExt};
+
+    // Pre-filter calendars and collect owned data to avoid lifetime issues
+    struct CalInfo {
+        id: String,
+        summary: String,
+    }
+    let filtered_calendars: Vec<CalInfo> = calendars
+        .iter()
+        .filter_map(|cal| {
+            let cal_id = cal.get("id").and_then(|v| v.as_str()).unwrap_or("");
+            let cal_summary = cal
+                .get("summary")
+                .and_then(|v| v.as_str())
+                .unwrap_or(cal_id);
+
+            // Apply calendar filter
+            if let Some(filter) = calendar_filter {
+                if !cal_summary.contains(filter.as_str()) && cal_id != filter.as_str() {
+                    return None;
+                }
+            }
+
+            Some(CalInfo {
+                id: cal_id.to_string(),
+                summary: cal_summary.to_string(),
+            })
+        })
+        .collect();
+
+    let mut all_events: Vec<Value> = stream::iter(filtered_calendars)
+        .map(|cal| {
+            let client = &client;
+            let token = &token;
+            let time_min = &time_min;
+            let time_max = &time_max;
+            async move {
+                let events_url = format!(
+                    "https://www.googleapis.com/calendar/v3/calendars/{}/events?timeMin={}&timeMax={}&singleEvents=true&orderBy=startTime&maxResults=50",
+                    urlencoded(&cal.id),
+                    urlencoded(time_min),
+                    urlencoded(time_max),
+                );
+
+                let resp = crate::client::send_with_retry(|| {
+                    client.get(&events_url).bearer_auth(token)
+                })
+                .await;
+
+                let resp = match resp {
+                    Ok(r) if r.status().is_success() => r,
+                    _ => return vec![],
+                };
+
+                let events_json: Value = match resp.json().await {
+                    Ok(v) => v,
+                    Err(_) => return vec![],
+                };
+
+                let mut events = Vec::new();
+                if let Some(items) = events_json.get("items").and_then(|i| i.as_array()) {
+                    for event in items {
+                        let start = event
+                            .get("start")
+                            .and_then(|s| s.get("dateTime").or_else(|| s.get("date")))
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        let end = event
+                            .get("end")
+                            .and_then(|s| s.get("dateTime").or_else(|| s.get("date")))
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        let summary = event
+                            .get("summary")
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("(No title)")
+                            .to_string();
+                        let location = event
+                            .get("location")
+                            .and_then(|v| v.as_str())
+                            .unwrap_or("")
+                            .to_string();
+
+                        events.push(json!({
+                            "start": start,
+                            "end": end,
+                            "summary": summary,
+                            "calendar": cal.summary,
+                            "location": location,
+                        }));
+                    }
+                }
+                events
+            }
+        })
+        .buffer_unordered(5)
+        .flat_map(stream::iter)
+        .collect()
+        .await;
+
+    // 3. Sort by start time
+    all_events.sort_by(|a, b| {
+        let a_start = a.get("start").and_then(|v| v.as_str()).unwrap_or("");
+        let b_start = b.get("start").and_then(|v| v.as_str()).unwrap_or("");
+        a_start.cmp(b_start)
+    });
+
+    let output = json!({
+        "events": all_events,
+        "count": all_events.len(),
+        "timeMin": time_min,
+        "timeMax": time_max,
+    });
+
+    println!(
+        "{}",
+        crate::formatter::format_value(&output, &output_format)
+    );
+    Ok(())
+}
+
+fn epoch_to_rfc3339(epoch: u64) -> String {
+    use chrono::{TimeZone, Utc};
+    Utc.timestamp_opt(epoch as i64, 0).unwrap().to_rfc3339()
+}
+
+fn urlencoded(s: &str) -> String {
+    s.replace('%', "%25")
+        .replace(' ', "%20")
+        .replace('@', "%40")
+        .replace('+', "%2B")
+        .replace(':', "%3A")
+}
+
+fn build_insert_request(
+    matches: &ArgMatches,
+    doc: &crate::discovery::RestDescription,
+) -> Result<(String, String, Vec<String>), GwsError> {
+    let calendar_id = matches.get_one::<String>("calendar").unwrap();
+    let summary = matches.get_one::<String>("summary").unwrap();
+    let start = matches.get_one::<String>("start").unwrap();
+    let end = matches.get_one::<String>("end").unwrap();
+    let location = matches.get_one::<String>("location");
+    let description = matches.get_one::<String>("description");
+    let attendees_vals = matches.get_many::<String>("attendee");
+
+    // Find method: events.insert checks
+    let events_res = doc
+        .resources
+        .get("events")
+        .ok_or_else(|| GwsError::Discovery("Resource 'events' not found".to_string()))?;
+    let insert_method = events_res
+        .methods
+        .get("insert")
+        .ok_or_else(|| GwsError::Discovery("Method 'events.insert' not found".to_string()))?;
+
+    // Build body
+    let mut body = json!({
+        "summary": summary,
+        "start": { "dateTime": start },
+        "end": { "dateTime": end },
+    });
+
+    if let Some(loc) = location {
+        body["location"] = json!(loc);
+    }
+    if let Some(desc) = description {
+        body["description"] = json!(desc);
+    }
+
+    if let Some(atts) = attendees_vals {
+        let attendees_list: Vec<_> = atts.map(|email| json!({ "email": email })).collect();
+        body["attendees"] = json!(attendees_list);
+    }
+
+    let body_str = body.to_string();
+    let scopes: Vec<String> = insert_method.scopes.iter().map(|s| s.to_string()).collect();
+
+    // events.insert requires 'calendarId' path parameter
+    let params = json!({
+        "calendarId": calendar_id
+    });
+    let params_str = params.to_string();
+
+    Ok((params_str, body_str, scopes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_mock_doc() -> crate::discovery::RestDescription {
+        let mut doc = crate::discovery::RestDescription::default();
+        let mut events_res = crate::discovery::RestResource::default();
+        let mut insert_method = crate::discovery::RestMethod::default();
+        insert_method.scopes.push("https://scope".to_string());
+        events_res
+            .methods
+            .insert("insert".to_string(), insert_method);
+        doc.resources.insert("events".to_string(), events_res);
+        doc
+    }
+
+    fn make_matches_insert(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(
+                Arg::new("calendar")
+                    .long("calendar")
+                    .default_value("primary"),
+            )
+            .arg(Arg::new("summary").long("summary").required(true))
+            .arg(Arg::new("start").long("start").required(true))
+            .arg(Arg::new("end").long("end").required(true))
+            .arg(Arg::new("location").long("location"))
+            .arg(Arg::new("description").long("description"))
+            .arg(
+                Arg::new("attendee")
+                    .long("attendee")
+                    .action(ArgAction::Append),
+            );
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_build_insert_request() {
+        let doc = make_mock_doc();
+        let matches = make_matches_insert(&[
+            "test",
+            "--summary",
+            "Meeting",
+            "--start",
+            "2024-01-01T10:00:00Z",
+            "--end",
+            "2024-01-01T11:00:00Z",
+        ]);
+        let (params, body, scopes) = build_insert_request(&matches, &doc).unwrap();
+
+        assert!(params.contains("primary"));
+        assert!(body.contains("Meeting"));
+        assert!(body.contains("2024-01-01T10:00:00Z"));
+        assert_eq!(scopes[0], "https://scope");
+    }
+
+    #[test]
+    fn test_build_insert_request_with_optional_fields() {
+        let doc = make_mock_doc();
+        let matches = make_matches_insert(&[
+            "test",
+            "--summary",
+            "Meeting",
+            "--start",
+            "2024-01-01T10:00:00Z",
+            "--end",
+            "2024-01-01T11:00:00Z",
+            "--location",
+            "Room 1",
+            "--description",
+            "Discuss stuff",
+            "--attendee",
+            "a@b.com",
+            "--attendee",
+            "c@d.com",
+        ]);
+        let (_, body, _) = build_insert_request(&matches, &doc).unwrap();
+
+        assert!(body.contains("Room 1"));
+        assert!(body.contains("Discuss stuff"));
+        assert!(body.contains("a@b.com"));
+        assert!(body.contains("c@d.com"));
+    }
+}
diff --git a/src/helpers/chat.rs b/src/helpers/chat.rs
new file mode 100644
index 00000000..8cc469da
--- /dev/null
+++ b/src/helpers/chat.rs
@@ -0,0 +1,259 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use clap::{Arg, ArgMatches, Command};
+use serde_json::json;
+use std::future::Future;
+use std::pin::Pin;
+
+pub struct ChatHelper;
+
+impl Helper for ChatHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+send")
+                .about("[Helper] Send a message to a space")
+                .arg(
+                    Arg::new("space")
+                        .long("space")
+                        .help("Space name (e.g. spaces/AAAA...)")
+                        .required(true)
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("text")
+                        .long("text")
+                        .help("Message text (plain text)")
+                        .required(true)
+                        .value_name("TEXT"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws chat +send --space spaces/AAAAxxxx --text 'Hello team!'
+
+TIPS:
+  Use 'gws chat spaces list' to find space names.
+  For cards or threaded replies, use the raw API instead.",
+                ),
+        );
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        // We use `Box::pin` to create a pinned future on the heap.
+        // This is necessary because the `Helper` trait returns a generic `Future`,
+        // and async blocks in Rust are anonymous types that need to be erased
+        // (via `dyn Future`) to be returned from a trait method.
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+send") {
+                // Parse arguments into our config struct config
+                let config = parse_send_args(matches);
+                // The `?` operator here will propagate any errors from `build_send_request`
+                // immediately, returning `Err(GwsError)` from the async block.
+                let (params_str, body_str, scopes) = build_send_request(&config, doc)?;
+
+                let scope_strs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scope_strs).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                // Method: spaces.messages.create
+                let spaces_res = doc.resources.get("spaces").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spaces' not found".to_string())
+                })?;
+                let messages_res = spaces_res.resources.get("messages").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spaces.messages' not found".to_string())
+                })?;
+                let create_method = messages_res.methods.get("create").ok_or_else(|| {
+                    GwsError::Discovery("Method 'spaces.messages.create' not found".to_string())
+                })?;
+
+                let pagination = executor::PaginationConfig {
+                    page_all: false,
+                    page_limit: 10,
+                    page_delay_ms: 100,
+                };
+
+                executor::execute_method(
+                    doc,
+                    create_method,
+                    Some(&params_str),
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &pagination,
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+
+fn build_send_request(
+    config: &SendConfig,
+    doc: &crate::discovery::RestDescription,
+) -> Result<(String, String, Vec<String>), GwsError> {
+    let spaces_res = doc
+        .resources
+        .get("spaces")
+        .ok_or_else(|| GwsError::Discovery("Resource 'spaces' not found".to_string()))?;
+    let messages_res = spaces_res
+        .resources
+        .get("messages")
+        .ok_or_else(|| GwsError::Discovery("Resource 'spaces.messages' not found".to_string()))?;
+    let create_method = messages_res.methods.get("create").ok_or_else(|| {
+        GwsError::Discovery("Method 'spaces.messages.create' not found".to_string())
+    })?;
+
+    let params = json!({
+        "parent": config.space
+    });
+
+    let body = json!({
+        "text": config.text
+    });
+
+    let scopes: Vec<String> = create_method.scopes.iter().map(|s| s.to_string()).collect();
+
+    Ok((params.to_string(), body.to_string(), scopes))
+}
+
+/// Configuration for sending a chat message.
+///
+/// This struct holds the parsed arguments for the `+send` command.
+/// We use `String` here to own the data, as it will be used to construct
+/// the JSON body for the API request.
+pub struct SendConfig {
+    /// The space to send the message to (e.g., "spaces/AAAA...").
+    pub space: String,
+    /// The text content of the message.
+    pub text: String,
+}
+
+/// Parses the command line arguments into a `SendConfig` struct.
+///
+/// # Arguments
+///
+/// * `matches` - The `ArgMatches` from `clap` containing the parsed arguments.
+///
+/// # Returns
+///
+/// * `SendConfig` - The populated configuration struct.
+pub fn parse_send_args(matches: &ArgMatches) -> SendConfig {
+    SendConfig {
+        // We clone the strings here because ArgMatches owns the original strings,
+        // and we need to pass ownership of these values to our config struct
+        // to decouple it from the clap lifetime.
+        space: matches.get_one::<String>("space").unwrap().clone(),
+        text: matches.get_one::<String>("text").unwrap().clone(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery::{RestDescription, RestMethod, RestResource};
+    use std::collections::HashMap;
+
+    fn make_mock_doc() -> RestDescription {
+        let mut methods = HashMap::new();
+        methods.insert(
+            "create".to_string(),
+            RestMethod {
+                scopes: vec!["https://scope".to_string()],
+                ..Default::default()
+            },
+        );
+
+        let mut messages_res = RestResource::default();
+        messages_res.methods = methods;
+
+        let mut spaces_res = RestResource::default();
+        spaces_res
+            .resources
+            .insert("messages".to_string(), messages_res);
+
+        let mut resources = HashMap::new();
+        resources.insert("spaces".to_string(), spaces_res);
+
+        RestDescription {
+            resources,
+            ..Default::default()
+        }
+    }
+
+    fn make_matches_send(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("space").long("space"))
+            .arg(Arg::new("text").long("text"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_build_send_request() {
+        let doc = make_mock_doc();
+        let config = SendConfig {
+            space: "spaces/123".to_string(),
+            text: "hello chat".to_string(),
+        };
+        let (params, body, scopes) = build_send_request(&config, &doc).unwrap();
+
+        assert!(params.contains("spaces/123"));
+        assert!(body.contains("hello chat"));
+        assert_eq!(scopes[0], "https://scope");
+    }
+
+    #[test]
+    fn test_parse_send_args() {
+        let matches = make_matches_send(&["test", "--space", "s", "--text", "t"]);
+        let config = parse_send_args(&matches);
+        assert_eq!(config.space, "s");
+        assert_eq!(config.text, "t");
+    }
+
+    #[test]
+    fn test_inject_commands() {
+        let helper = ChatHelper;
+        let cmd = Command::new("test");
+        let doc = crate::discovery::RestDescription::default();
+
+        let cmd = helper.inject_commands(cmd, &doc);
+        let subcommands: Vec<_> = cmd.get_subcommands().map(|s| s.get_name()).collect();
+        assert!(subcommands.contains(&"+send"));
+    }
+}
diff --git a/src/helpers/docs.rs b/src/helpers/docs.rs
new file mode 100644
index 00000000..b54e053d
--- /dev/null
+++ b/src/helpers/docs.rs
@@ -0,0 +1,204 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use clap::{Arg, ArgMatches, Command};
+use serde_json::json;
+use std::future::Future;
+use std::pin::Pin;
+
+pub struct DocsHelper;
+
+impl Helper for DocsHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+write")
+                .about("[Helper] Append text to a document")
+                .arg(
+                    Arg::new("document")
+                        .long("document")
+                        .help("Document ID")
+                        .required(true)
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("text")
+                        .long("text")
+                        .help("Text to append (plain text)")
+                        .required(true)
+                        .value_name("TEXT"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws docs +write --document DOC_ID --text 'Hello, world!'
+
+TIPS:
+  Text is inserted at the end of the document body.
+  For rich formatting, use the raw batchUpdate API instead.",
+                ),
+        );
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+write") {
+                let (params_str, body_str, scopes) = build_write_request(matches, doc)?;
+
+                let scope_strs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scope_strs).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                // Method: documents.batchUpdate
+                let documents_res = doc.resources.get("documents").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'documents' not found".to_string())
+                })?;
+                let batch_update_method =
+                    documents_res.methods.get("batchUpdate").ok_or_else(|| {
+                        GwsError::Discovery("Method 'documents.batchUpdate' not found".to_string())
+                    })?;
+
+                let pagination = executor::PaginationConfig {
+                    page_all: false,
+                    page_limit: 10,
+                    page_delay_ms: 100,
+                };
+
+                executor::execute_method(
+                    doc,
+                    batch_update_method,
+                    Some(&params_str),
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &pagination,
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+
+fn build_write_request(
+    matches: &ArgMatches,
+    doc: &crate::discovery::RestDescription,
+) -> Result<(String, String, Vec<String>), GwsError> {
+    let document_id = matches.get_one::<String>("document").unwrap();
+    let text = matches.get_one::<String>("text").unwrap();
+
+    let documents_res = doc
+        .resources
+        .get("documents")
+        .ok_or_else(|| GwsError::Discovery("Resource 'documents' not found".to_string()))?;
+    let batch_update_method = documents_res.methods.get("batchUpdate").ok_or_else(|| {
+        GwsError::Discovery("Method 'documents.batchUpdate' not found".to_string())
+    })?;
+
+    let params = json!({
+        "documentId": document_id
+    });
+
+    let body = json!({
+        "requests": [
+            {
+                "insertText": {
+                    "text": text,
+                    "endOfSegmentLocation": {
+                        "segmentId": "" // Empty means body
+                    }
+                }
+            }
+        ]
+    });
+
+    let scopes: Vec<String> = batch_update_method
+        .scopes
+        .iter()
+        .map(|s| s.to_string())
+        .collect();
+
+    Ok((params.to_string(), body.to_string(), scopes))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery::{RestDescription, RestMethod, RestResource};
+    use std::collections::HashMap;
+
+    fn make_mock_doc() -> RestDescription {
+        let mut methods = HashMap::new();
+        methods.insert(
+            "batchUpdate".to_string(),
+            RestMethod {
+                scopes: vec!["https://scope".to_string()],
+                ..Default::default()
+            },
+        );
+
+        let mut documents_res = RestResource::default();
+        documents_res.methods = methods;
+
+        let mut resources = HashMap::new();
+        resources.insert("documents".to_string(), documents_res);
+
+        RestDescription {
+            resources,
+            ..Default::default()
+        }
+    }
+
+    fn make_matches_write(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("document").long("document"))
+            .arg(Arg::new("text").long("text"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_build_write_request() {
+        let doc = make_mock_doc();
+        let matches = make_matches_write(&["test", "--document", "123", "--text", "hello world"]);
+        let (params, body, scopes) = build_write_request(&matches, &doc).unwrap();
+
+        assert!(params.contains("123"));
+        assert!(body.contains("hello world"));
+        assert!(body.contains("endOfSegmentLocation"));
+        assert_eq!(scopes[0], "https://scope");
+    }
+}
diff --git a/src/helpers/drive.rs b/src/helpers/drive.rs
new file mode 100644
index 00000000..0476a9da
--- /dev/null
+++ b/src/helpers/drive.rs
@@ -0,0 +1,191 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use clap::{Arg, ArgMatches, Command};
+use serde_json::{json, Value};
+use std::future::Future;
+use std::path::Path;
+use std::pin::Pin;
+
+pub struct DriveHelper;
+
+impl Helper for DriveHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+upload")
+                .about("[Helper] Upload a file with automatic metadata")
+                .arg(
+                    Arg::new("file")
+                        .help("Path to file to upload")
+                        .required(true)
+                        .index(1),
+                )
+                .arg(
+                    Arg::new("parent")
+                        .long("parent")
+                        .help("Parent folder ID")
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("name")
+                        .long("name")
+                        .help("Target filename (defaults to source filename)")
+                        .value_name("NAME"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws drive +upload ./report.pdf
+  gws drive +upload ./report.pdf --parent FOLDER_ID
+  gws drive +upload ./data.csv --name 'Sales Data.csv'
+
+TIPS:
+  MIME type is detected automatically.
+  Filename is inferred from the local path unless --name is given.",
+                ),
+        );
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+upload") {
+                let file_path = matches.get_one::<String>("file").unwrap();
+                let parent_id = matches.get_one::<String>("parent");
+                let name_arg = matches.get_one::<String>("name");
+
+                // Determine filename
+                let filename = determine_filename(file_path, name_arg.map(|s| s.as_str()))?;
+
+                // Find method: files.create
+                let files_res = doc
+                    .resources
+                    .get("files")
+                    .ok_or_else(|| GwsError::Discovery("Resource 'files' not found".to_string()))?;
+                let create_method = files_res.methods.get("create").ok_or_else(|| {
+                    GwsError::Discovery("Method 'files.create' not found".to_string())
+                })?;
+
+                // Build metadata
+                let metadata = build_metadata(&filename, parent_id.map(|s| s.as_str()));
+
+                let body_str = metadata.to_string();
+
+                let scopes: Vec<&str> = create_method.scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scopes).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                executor::execute_method(
+                    doc,
+                    create_method,
+                    None,
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    Some(file_path),
+                    matches.get_flag("dry-run"),
+                    &executor::PaginationConfig::default(),
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+
+fn determine_filename(file_path: &str, name_arg: Option<&str>) -> Result<String, GwsError> {
+    if let Some(n) = name_arg {
+        Ok(n.to_string())
+    } else {
+        Path::new(file_path)
+            .file_name()
+            .and_then(|n| n.to_str())
+            .map(|s| s.to_string())
+            .ok_or_else(|| GwsError::Validation("Invalid file path".to_string()))
+    }
+}
+
+fn build_metadata(filename: &str, parent_id: Option<&str>) -> Value {
+    let mut metadata = json!({
+        "name": filename
+    });
+
+    if let Some(parent) = parent_id {
+        metadata["parents"] = json!([parent]);
+    }
+
+    metadata
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_determine_filename_explicit() {
+        assert_eq!(
+            determine_filename("path/to/file.txt", Some("custom.txt")).unwrap(),
+            "custom.txt"
+        );
+    }
+
+    #[test]
+    fn test_determine_filename_from_path() {
+        assert_eq!(
+            determine_filename("path/to/file.txt", None).unwrap(),
+            "file.txt"
+        );
+    }
+
+    #[test]
+    fn test_determine_filename_invalid_path() {
+        assert!(determine_filename("", None).is_err());
+        assert!(determine_filename("/", None).is_err()); // Root has no filename component usually
+    }
+
+    #[test]
+    fn test_build_metadata_no_parent() {
+        let meta = build_metadata("file.txt", None);
+        assert_eq!(meta["name"], "file.txt");
+        assert!(meta.get("parents").is_none());
+    }
+
+    #[test]
+    fn test_build_metadata_with_parent() {
+        let meta = build_metadata("file.txt", Some("folder123"));
+        assert_eq!(meta["name"], "file.txt");
+        assert_eq!(meta["parents"][0], "folder123");
+    }
+}
diff --git a/src/helpers/events/mod.rs b/src/helpers/events/mod.rs
new file mode 100644
index 00000000..2e2ccc75
--- /dev/null
+++ b/src/helpers/events/mod.rs
@@ -0,0 +1,235 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+pub mod renew;
+pub mod subscribe;
+
+use renew::handle_renew;
+use subscribe::handle_subscribe;
+
+pub(super) use crate::auth;
+pub(super) use crate::error::GwsError;
+pub(super) use anyhow::Context;
+pub(super) use clap::{Arg, ArgAction, ArgMatches, Command};
+pub(super) use derive_builder::Builder;
+pub(super) use serde_json::{json, Value};
+pub(super) use std::future::Future;
+pub(super) use std::pin::Pin;
+
+pub struct EventsHelper;
+pub(super) const PUBSUB_SCOPE: &str = "https://www.googleapis.com/auth/pubsub";
+pub(super) const WORKSPACE_EVENTS_SCOPE: &str =
+    "https://www.googleapis.com/auth/chat.spaces.readonly";
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProjectId(pub String);
+impl std::fmt::Display for ProjectId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SubscriptionName(pub String);
+impl std::fmt::Display for SubscriptionName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+#[derive(Debug, Clone, Builder)]
+#[builder(setter(into))]
+pub struct SubscribeConfig {
+    #[builder(default)]
+    pub target: Option<String>,
+    #[builder(default)]
+    pub event_types: Vec<String>,
+    #[builder(default)]
+    pub project: Option<ProjectId>,
+    #[builder(default)]
+    pub subscription: Option<SubscriptionName>,
+    #[builder(default = "10")]
+    pub max_messages: u32,
+    #[builder(default = "5")]
+    pub poll_interval: u64,
+    #[builder(default = "false")]
+    pub once: bool,
+    #[builder(default = "false")]
+    pub cleanup: bool,
+    #[builder(default = "false")]
+    pub no_ack: bool,
+    #[builder(default)]
+    pub output_dir: Option<String>,
+}
+
+impl Helper for EventsHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+subscribe")
+                .about("[Helper] Subscribe to Workspace events and stream them as NDJSON")
+                .arg(
+                    Arg::new("target")
+                        .long("target")
+                        .help(
+                            "Workspace resource URI (e.g., //chat.googleapis.com/spaces/SPACE_ID)",
+                        )
+                        .value_name("URI"),
+                )
+                .arg(
+                    Arg::new("event-types")
+                        .long("event-types")
+                        .help("Comma-separated CloudEvents types to subscribe to")
+                        .value_name("TYPES"),
+                )
+                .arg(
+                    Arg::new("project")
+                        .long("project")
+                        .help("GCP project ID for Pub/Sub resources")
+                        .value_name("PROJECT"),
+                )
+                .arg(
+                    Arg::new("subscription")
+                        .long("subscription")
+                        .help("Existing Pub/Sub subscription name (skip setup)")
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("max-messages")
+                        .long("max-messages")
+                        .help("Max messages per pull batch (default: 10)")
+                        .value_name("N")
+                        .default_value("10"),
+                )
+                .arg(
+                    Arg::new("poll-interval")
+                        .long("poll-interval")
+                        .help("Seconds between pulls (default: 5)")
+                        .value_name("SECS")
+                        .default_value("5"),
+                )
+                .arg(
+                    Arg::new("once")
+                        .long("once")
+                        .help("Pull once and exit")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("cleanup")
+                        .long("cleanup")
+                        .help("Delete created Pub/Sub resources on exit")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("no-ack")
+                        .long("no-ack")
+                        .help("Don't auto-acknowledge messages")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("output-dir")
+                        .long("output-dir")
+                        .help("Write each event to a separate JSON file in this directory")
+                        .value_name("DIR"),
+                )
+                .after_help("\
+EXAMPLES:
+  gws events +subscribe --target '//chat.googleapis.com/spaces/SPACE' --event-types 'google.workspace.chat.message.v1.created' --project my-project
+  gws events +subscribe --subscription projects/p/subscriptions/my-sub --once
+  gws events +subscribe ... --cleanup --output-dir ./events
+
+TIPS:
+  Without --cleanup, Pub/Sub resources persist for reconnection.
+  Press Ctrl-C to stop gracefully."),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+renew")
+                .about("[Helper] Renew/reactivate Workspace Events subscriptions")
+                .arg(
+                    Arg::new("name")
+                        .long("name")
+                        .help("Subscription name to reactivate (e.g., subscriptions/SUB_ID)")
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("all")
+                        .long("all")
+                        .help("Renew all subscriptions expiring within --within window")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("within")
+                        .long("within")
+                        .help("Time window for --all (e.g., 1h, 30m, 2d)")
+                        .value_name("DURATION")
+                        .default_value("1h"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws events +renew --name subscriptions/SUB_ID
+  gws events +renew --all --within 2d
+
+TIPS:
+  Subscriptions expire if not renewed periodically.
+  Use --all with a cron job to keep subscriptions alive.",
+                ),
+        );
+
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(sub_matches) = matches.subcommand_matches("+subscribe") {
+                handle_subscribe(doc, sub_matches).await?;
+                return Ok(true);
+            }
+
+            if let Some(renew_matches) = matches.subcommand_matches("+renew") {
+                handle_renew(doc, renew_matches).await?;
+                return Ok(true);
+            }
+
+            Ok(false)
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_inject_commands() {
+        let helper = EventsHelper;
+        let cmd = Command::new("test");
+        let doc = crate::discovery::RestDescription::default();
+
+        let cmd = helper.inject_commands(cmd, &doc);
+        let subcommands: Vec<_> = cmd.get_subcommands().map(|s| s.get_name()).collect();
+        assert!(subcommands.contains(&"+subscribe"));
+        assert!(subcommands.contains(&"+renew"));
+    }
+}
diff --git a/src/helpers/events/renew.rs b/src/helpers/events/renew.rs
new file mode 100644
index 00000000..0d745647
--- /dev/null
+++ b/src/helpers/events/renew.rs
@@ -0,0 +1,254 @@
+use super::*;
+
+#[derive(Debug, PartialEq)]
+pub struct RenewConfig {
+    pub name: Option<String>,
+    pub all: bool,
+    pub within: String,
+}
+
+fn parse_renew_args(matches: &ArgMatches) -> Result<RenewConfig, GwsError> {
+    let name = matches.get_one::<String>("name").cloned();
+    let all = matches.get_flag("all");
+    let within = matches
+        .get_one::<String>("within")
+        .cloned()
+        .unwrap_or_else(|| "1h".to_string());
+
+    if name.is_none() && !all {
+        return Err(GwsError::Validation(
+            "Either --name or --all is required for +renew".to_string(),
+        ));
+    }
+
+    Ok(RenewConfig { name, all, within })
+}
+
+/// Handles the `+renew` command.
+pub(super) async fn handle_renew(
+    _doc: &crate::discovery::RestDescription,
+    matches: &ArgMatches,
+) -> Result<(), GwsError> {
+    let config = parse_renew_args(matches)?;
+    let client = crate::client::build_client()?;
+    let ws_token = auth::get_token(&[WORKSPACE_EVENTS_SCOPE])
+        .await
+        .map_err(|e| GwsError::Auth(format!("Failed to get token: {e}")))?;
+
+    if let Some(name) = config.name {
+        // Reactivate a specific subscription
+        eprintln!("Reactivating subscription: {name}");
+        let resp = client
+            .post(format!(
+                "https://workspaceevents.googleapis.com/v1/{name}:reactivate"
+            ))
+            .bearer_auth(&ws_token)
+            .header("Content-Type", "application/json")
+            .body("{}")
+            .send()
+            .await
+            .context("Failed to reactivate subscription")?;
+
+        let body: Value = resp.json().await.context("Failed to parse response")?;
+
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&body).unwrap_or_default()
+        );
+    } else {
+        let within_secs = parse_duration(&config.within)?;
+
+        // List all subscriptions
+        let resp = client
+            .get("https://workspaceevents.googleapis.com/v1/subscriptions")
+            .bearer_auth(&ws_token)
+            .send()
+            .await
+            .context("Failed to list subscriptions")?;
+
+        let body: Value = resp.json().await.context("Failed to parse response")?;
+
+        let mut renewed = 0;
+        if let Some(subs) = body.get("subscriptions").and_then(|s| s.as_array()) {
+            let now = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_secs();
+
+            let to_renew = filter_subscriptions_to_renew(subs, now, within_secs);
+
+            for name in to_renew {
+                eprintln!("Renewing {name}...");
+                let _ = client
+                    .post(format!(
+                        "https://workspaceevents.googleapis.com/v1/{name}:reactivate"
+                    ))
+                    .bearer_auth(&ws_token)
+                    .header("Content-Type", "application/json")
+                    .body("{}")
+                    .send()
+                    .await;
+                renewed += 1;
+            }
+        }
+
+        let result = json!({
+            "status": "success",
+            "renewed": renewed,
+        });
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&result).unwrap_or_default()
+        );
+    }
+
+    Ok(())
+}
+
+fn filter_subscriptions_to_renew(subs: &[Value], now_secs: u64, within_secs: u64) -> Vec<String> {
+    let mut result = Vec::new();
+    for sub in subs {
+        if let Some(expire_time) = sub.get("expireTime").and_then(|e| e.as_str()) {
+            if let Some(expire_secs) = parse_rfc3339_rough(expire_time) {
+                let remaining = expire_secs.saturating_sub(now_secs);
+                if remaining < within_secs {
+                    if let Some(name) = sub.get("name").and_then(|n| n.as_str()) {
+                        result.push(name.to_string());
+                    }
+                }
+            }
+        }
+    }
+    result
+}
+
+/// Parses a duration string like "1h", "30m", "2d" into seconds.
+fn parse_duration(s: &str) -> Result<u64, GwsError> {
+    let s = s.trim();
+    if s.is_empty() {
+        return Err(GwsError::Validation("Empty duration".to_string()));
+    }
+
+    let (num_str, unit) = s.split_at(s.len() - 1);
+    let num: u64 = num_str
+        .parse()
+        .map_err(|_| GwsError::Validation(format!("Invalid duration: {s}")))?;
+
+    match unit {
+        "s" => Ok(num),
+        "m" => Ok(num * 60),
+        "h" => Ok(num * 3600),
+        "d" => Ok(num * 86400),
+        _ => Err(GwsError::Validation(format!(
+            "Unknown duration unit '{unit}'. Use s, m, h, or d."
+        ))),
+    }
+}
+
+/// Parse an RFC 3339 timestamp to Unix seconds.
+fn parse_rfc3339_rough(s: &str) -> Option<u64> {
+    chrono::DateTime::parse_from_rfc3339(s)
+        .ok()
+        .map(|dt| dt.timestamp() as u64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_matches_renew(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("name").long("name"))
+            .arg(Arg::new("all").long("all").action(ArgAction::SetTrue))
+            .arg(Arg::new("within").long("within").default_value("1h"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_duration_hours() {
+        assert_eq!(parse_duration("1h").unwrap(), 3600);
+        assert_eq!(parse_duration("2h").unwrap(), 7200);
+    }
+
+    #[test]
+    fn test_parse_duration_minutes() {
+        assert_eq!(parse_duration("30m").unwrap(), 1800);
+    }
+
+    #[test]
+    fn test_parse_duration_days() {
+        assert_eq!(parse_duration("1d").unwrap(), 86400);
+        assert_eq!(parse_duration("7d").unwrap(), 604800);
+    }
+
+    #[test]
+    fn test_parse_duration_invalid() {
+        assert!(parse_duration("").is_err());
+        assert!(parse_duration("abc").is_err());
+    }
+
+    #[test]
+    fn test_parse_rfc3339_rough() {
+        // 2026-02-13T10:00:00Z
+        let ts = parse_rfc3339_rough("2026-02-13T10:00:00Z").unwrap();
+        assert!(ts > 0);
+
+        // Check simple calculation logic (not verifying exact epoch seconds against a full library)
+        // just consistency
+        let ts2 = parse_rfc3339_rough("2026-02-13T10:00:01Z").unwrap();
+        assert_eq!(ts2, ts + 1);
+    }
+
+    #[test]
+    fn test_parse_renew_args_name() {
+        let matches = make_matches_renew(&["test", "--name", "subs/123"]);
+        let config = parse_renew_args(&matches).unwrap();
+        assert_eq!(config.name, Some("subs/123".to_string()));
+        assert!(!config.all);
+    }
+
+    #[test]
+    fn test_parse_renew_args_all() {
+        let matches = make_matches_renew(&["test", "--all", "--within", "2h"]);
+        let config = parse_renew_args(&matches).unwrap();
+        assert!(config.name.is_none());
+        assert!(config.all);
+        assert_eq!(config.within, "2h");
+    }
+
+    #[test]
+    fn test_parse_renew_args_missing() {
+        let matches = make_matches_renew(&["test"]);
+        assert!(parse_renew_args(&matches).is_err());
+    }
+
+    #[test]
+    fn test_filter_subscriptions_to_renew() {
+        // Let's use `parse_rfc3339_rough` to get a baseline
+        let base_ts = parse_rfc3339_rough("2026-02-13T10:00:00Z").unwrap();
+
+        // sub1 expires in 30m (1800s from base)
+        let sub1 = json!({
+            "name": "subs/1",
+            "expireTime": "2026-02-13T10:30:00Z"
+        });
+
+        // sub2 expires in 2h (7200s from base)
+        let sub2 = json!({
+            "name": "subs/2",
+            "expireTime": "2026-02-13T12:00:00Z"
+        });
+
+        let subs = vec![sub1, sub2];
+
+        // within 1h (3600s) -> should catch sub1 (1800s < 3600s) but not sub2 (7200s > 3600s)
+        let to_renew = filter_subscriptions_to_renew(&subs, base_ts, 3600);
+
+        assert_eq!(to_renew.len(), 1);
+        assert_eq!(to_renew[0], "subs/1");
+
+        // within 3h (10800s) -> should catch both
+        let to_renew_all = filter_subscriptions_to_renew(&subs, base_ts, 10800);
+        assert_eq!(to_renew_all.len(), 2);
+    }
+}
diff --git a/src/helpers/events/subscribe.rs b/src/helpers/events/subscribe.rs
new file mode 100644
index 00000000..c382e13a
--- /dev/null
+++ b/src/helpers/events/subscribe.rs
@@ -0,0 +1,715 @@
+use super::*;
+
+fn parse_subscribe_args(matches: &ArgMatches) -> Result<SubscribeConfig, GwsError> {
+    let mut builder = SubscribeConfigBuilder::default();
+
+    if let Some(target) = matches.get_one::<String>("target") {
+        builder.target(Some(target.clone()));
+    }
+    if let Some(event_types) = matches.get_one::<String>("event-types") {
+        builder.event_types(
+            event_types
+                .split(',')
+                .map(|t| t.trim().to_string())
+                .collect::<Vec<_>>(),
+        );
+    }
+    if let Some(project) = matches
+        .get_one::<String>("project")
+        .cloned()
+        .or_else(|| std::env::var("GOOGLE_WORKSPACE_PROJECT_ID").ok())
+    {
+        builder.project(Some(ProjectId(project)));
+    }
+    if let Some(subscription) = matches.get_one::<String>("subscription") {
+        builder.subscription(Some(SubscriptionName(subscription.clone())));
+    }
+    if let Some(max_messages) = matches
+        .get_one::<String>("max-messages")
+        .and_then(|s| s.parse::<u32>().ok())
+    {
+        builder.max_messages(max_messages);
+    }
+    if let Some(poll_interval) = matches
+        .get_one::<String>("poll-interval")
+        .and_then(|s| s.parse::<u64>().ok())
+    {
+        builder.poll_interval(poll_interval);
+    }
+    builder.once(matches.get_flag("once"));
+    builder.cleanup(matches.get_flag("cleanup"));
+    builder.no_ack(matches.get_flag("no-ack"));
+    if let Some(output_dir) = matches.get_one::<String>("output-dir") {
+        builder.output_dir(Some(output_dir.clone()));
+    }
+
+    let config = builder
+        .build()
+        .map_err(|e| GwsError::Validation(e.to_string()))?;
+    validate_subscribe_config(&config)?;
+    Ok(config)
+}
+
+fn validate_subscribe_config(config: &SubscribeConfig) -> Result<(), GwsError> {
+    if config.subscription.is_none() {
+        if config.target.is_none() {
+            return Err(GwsError::Validation(
+                "--target is required when not using --subscription".to_string(),
+            ));
+        }
+        if config.event_types.is_empty() {
+            return Err(GwsError::Validation(
+                "--event-types is required when not using --subscription".to_string(),
+            ));
+        }
+        if config.project.is_none() {
+            return Err(GwsError::Validation(
+                "--project is required when not using --subscription (or set GOOGLE_WORKSPACE_PROJECT_ID)".to_string(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// Handles the `+subscribe` command.
+pub(super) async fn handle_subscribe(
+    _doc: &crate::discovery::RestDescription,
+    matches: &ArgMatches,
+) -> Result<(), GwsError> {
+    let config = parse_subscribe_args(matches)?;
+
+    if let Some(ref dir) = config.output_dir {
+        std::fs::create_dir_all(dir).context("Failed to create output dir")?;
+    }
+
+    let client = crate::client::build_client()?;
+
+    // Get Pub/Sub token
+    let pubsub_token = auth::get_token(&[PUBSUB_SCOPE])
+        .await
+        .map_err(|e| GwsError::Auth(format!("Failed to get Pub/Sub token: {e}")))?;
+
+    let (pubsub_subscription, topic_name, ws_subscription_name, created_resources) =
+        if let Some(ref sub_name) = config.subscription {
+            // Use existing subscription — no setup needed
+            (sub_name.0.clone(), None, None, false)
+        } else {
+            // Full setup: create Pub/Sub topic + subscription + Workspace Events subscription
+            let target = config.target.clone().unwrap();
+            let project = config.project.clone().unwrap().0;
+            let event_types_str: Vec<&str> =
+                config.event_types.iter().map(|s| s.as_str()).collect();
+
+            // Generate descriptive names from event types
+            // e.g. "google.workspace.drive.file.v1.updated" -> "drive-file-updated"
+            let slug = derive_slug_from_event_types(&event_types_str);
+            let suffix = format!("{:08x}", rand::random::<u32>());
+            let topic = format!("projects/{project}/topics/gws-{slug}-{suffix}");
+            let sub = format!("projects/{project}/subscriptions/gws-{slug}-{suffix}");
+
+            // 1. Create Pub/Sub topic
+            eprintln!("Creating Pub/Sub topic: {topic}");
+            let resp = client
+                .put(format!("https://pubsub.googleapis.com/v1/{topic}"))
+                .bearer_auth(&pubsub_token)
+                .header("Content-Type", "application/json")
+                .body("{}")
+                .send()
+                .await
+                .context("Failed to create topic")?;
+
+            if !resp.status().is_success() {
+                let body = resp.text().await.unwrap_or_default();
+                return Err(GwsError::Api {
+                    code: 400,
+                    message: format!("Failed to create Pub/Sub topic: {body}"),
+                    reason: "pubsubError".to_string(),
+                });
+            }
+
+            // 2. Create Pub/Sub subscription
+            eprintln!("Creating Pub/Sub subscription: {sub}");
+            let sub_body = json!({
+                "topic": topic,
+                "ackDeadlineSeconds": 60,
+            });
+            let resp = client
+                .put(format!("https://pubsub.googleapis.com/v1/{sub}"))
+                .bearer_auth(&pubsub_token)
+                .header("Content-Type", "application/json")
+                .json(&sub_body)
+                .send()
+                .await
+                .context("Failed to create subscription")?;
+
+            if !resp.status().is_success() {
+                let body = resp.text().await.unwrap_or_default();
+                return Err(GwsError::Api {
+                    code: 400,
+                    message: format!("Failed to create Pub/Sub subscription: {body}"),
+                    reason: "pubsubError".to_string(),
+                });
+            }
+
+            // 3. Create Workspace Events subscription
+            eprintln!("Creating Workspace Events subscription...");
+            let ws_token = auth::get_token(&[WORKSPACE_EVENTS_SCOPE])
+                .await
+                .map_err(|e| {
+                    GwsError::Auth(format!("Failed to get Workspace Events token: {e}"))
+                })?;
+
+            let ws_body = json!({
+                "targetResource": target,
+                "eventTypes": config.event_types,
+                "notificationEndpoint": {
+                    "pubsubTopic": topic,
+                },
+                "payloadOptions": {
+                    "includeResource": true,
+                },
+            });
+
+            let resp = client
+                .post("https://workspaceevents.googleapis.com/v1/subscriptions")
+                .bearer_auth(&ws_token)
+                .header("Content-Type", "application/json")
+                .json(&ws_body)
+                .send()
+                .await
+                .context("Failed to create Workspace Events subscription")?;
+
+            let resp_body: Value = resp
+                .json()
+                .await
+                .context("Failed to parse subscription response")?;
+
+            let ws_sub_name = resp_body
+                // Direct subscription response
+                .get("name")
+                .and_then(|v| v.as_str())
+                .filter(|s| s.starts_with("subscriptions/"))
+                .or_else(|| {
+                    // LRO response — check response.name
+                    resp_body
+                        .get("response")
+                        .and_then(|r| r.get("name"))
+                        .and_then(|v| v.as_str())
+                })
+                .or_else(|| {
+                    // LRO response — check metadata.subscription
+                    resp_body
+                        .get("metadata")
+                        .and_then(|m| m.get("subscription"))
+                        .and_then(|v| v.as_str())
+                })
+                .or_else(|| {
+                    // Fall back to the operation name itself
+                    resp_body.get("name").and_then(|v| v.as_str())
+                })
+                .unwrap_or("pending")
+                .to_string();
+
+            eprintln!("Workspace Events subscription: {ws_sub_name}");
+            eprintln!("Listening for events...\n");
+
+            (sub, Some(topic), Some(ws_sub_name), true)
+        };
+
+    // Pull loop
+    let result = pull_loop(&client, &pubsub_token, &pubsub_subscription, config.clone()).await;
+
+    // On exit, print reconnection info or cleanup
+    if created_resources {
+        if config.cleanup {
+            eprintln!("\nCleaning up Pub/Sub resources...");
+            // Delete Pub/Sub subscription
+            let _ = client
+                .delete(format!(
+                    "https://pubsub.googleapis.com/v1/{pubsub_subscription}"
+                ))
+                .bearer_auth(&pubsub_token)
+                .send()
+                .await;
+            // Delete Pub/Sub topic
+            if let Some(ref topic) = topic_name {
+                let _ = client
+                    .delete(format!("https://pubsub.googleapis.com/v1/{topic}"))
+                    .bearer_auth(&pubsub_token)
+                    .send()
+                    .await;
+            }
+            eprintln!("Cleanup complete.");
+        } else {
+            eprintln!("\n--- Reconnection Info ---");
+            eprintln!(
+                "To reconnect later:\n  gws events +subscribe --subscription {}",
+                pubsub_subscription
+            );
+            if let Some(ref ws_name) = ws_subscription_name {
+                eprintln!("Workspace Events subscription: {ws_name}");
+            }
+            if let Some(ref topic) = topic_name {
+                eprintln!("Pub/Sub topic: {topic}");
+            }
+            eprintln!("Pub/Sub subscription: {pubsub_subscription}");
+            eprintln!("To clean up manually:");
+            if let Some(ref topic) = topic_name {
+                eprintln!(
+                    "  gcloud pubsub subscriptions delete {}",
+                    pubsub_subscription
+                );
+                eprintln!("  gcloud pubsub topics delete {topic}");
+            }
+        }
+    }
+
+    result
+}
+
+/// Pulls messages from a Pub/Sub subscription in a loop.
+async fn pull_loop(
+    client: &reqwest::Client,
+    token: &str,
+    subscription: &str,
+    config: SubscribeConfig,
+) -> Result<(), GwsError> {
+    let mut file_counter: u64 = 0;
+    loop {
+        let pull_body = json!({
+            "maxMessages": config.max_messages,
+        });
+
+        let pull_future = client
+            .post(format!(
+                "https://pubsub.googleapis.com/v1/{subscription}:pull"
+            ))
+            .bearer_auth(token)
+            .header("Content-Type", "application/json")
+            .json(&pull_body)
+            .timeout(std::time::Duration::from_secs(config.poll_interval.max(10)))
+            .send();
+
+        let resp = tokio::select! {
+            result = pull_future => {
+                match result {
+                    Ok(r) => r,
+                    Err(e) if e.is_timeout() => continue,
+                    Err(e) => return Err(anyhow::anyhow!("Pub/Sub pull failed: {e}").into()),
+                }
+            }
+            _ = tokio::signal::ctrl_c() => {
+                eprintln!("\nReceived interrupt, stopping...");
+                return Ok(());
+            }
+        };
+
+        if !resp.status().is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            return Err(GwsError::Api {
+                code: 400,
+                message: format!("Pub/Sub pull failed: {body}"),
+                reason: "pubsubError".to_string(),
+            });
+        }
+
+        let pull_response: Value = resp.json().await.context("Failed to parse pull response")?;
+
+        let (ack_ids, events) = process_events_pull_response(&pull_response);
+
+        for event in events {
+            let json_str =
+                serde_json::to_string_pretty(&event).unwrap_or_else(|_| "{}".to_string());
+            if let Some(ref dir) = config.output_dir {
+                file_counter += 1;
+                let ts = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map(|d| d.as_millis())
+                    .unwrap_or(0);
+                let path = format!("{dir}/{ts}_{file_counter}.json");
+                if let Err(e) = std::fs::write(&path, &json_str) {
+                    eprintln!("Warning: failed to write {path}: {e}");
+                } else {
+                    eprintln!("Wrote {path}");
+                }
+            } else {
+                println!(
+                    "{}",
+                    serde_json::to_string(&event).unwrap_or_else(|_| "{}".to_string())
+                );
+            }
+        }
+
+        // Acknowledge messages
+        if !config.no_ack && !ack_ids.is_empty() {
+            let ack_body = json!({
+                "ackIds": ack_ids,
+            });
+
+            let _ = client
+                .post(format!(
+                    "https://pubsub.googleapis.com/v1/{subscription}:acknowledge"
+                ))
+                .bearer_auth(token)
+                .header("Content-Type", "application/json")
+                .json(&ack_body)
+                .send()
+                .await;
+        }
+
+        if config.once {
+            break;
+        }
+
+        // Check for SIGINT between polls
+        tokio::select! {
+            _ = tokio::time::sleep(std::time::Duration::from_secs(config.poll_interval)) => {},
+            _ = tokio::signal::ctrl_c() => {
+                eprintln!("\nReceived interrupt, stopping...");
+                break;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn process_events_pull_response(response: &Value) -> (Vec<String>, Vec<Value>) {
+    let mut ack_ids = Vec::new();
+    let mut events = Vec::new();
+
+    if let Some(messages) = response.get("receivedMessages").and_then(|m| m.as_array()) {
+        for msg in messages {
+            if let Some(ack_id) = msg.get("ackId").and_then(|a| a.as_str()) {
+                ack_ids.push(ack_id.to_string());
+            }
+
+            if let Some(pubsub_msg) = msg.get("message") {
+                events.push(decode_cloud_event(pubsub_msg));
+            }
+        }
+    }
+
+    (ack_ids, events)
+}
+
+/// Decodes a Pub/Sub message containing a CloudEvent.
+fn decode_cloud_event(pubsub_msg: &Value) -> Value {
+    use base64::{engine::general_purpose::STANDARD, Engine as _};
+
+    let attributes = pubsub_msg.get("attributes").cloned().unwrap_or(json!({}));
+
+    let event_type = attributes
+        .get("type")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown");
+
+    let source = attributes
+        .get("source")
+        .and_then(|v| v.as_str())
+        .unwrap_or("unknown");
+
+    let time = attributes
+        .get("time")
+        .and_then(|v| v.as_str())
+        .unwrap_or("");
+
+    // Decode base64 data
+    let data = pubsub_msg
+        .get("data")
+        .and_then(|d| d.as_str())
+        .and_then(|d| STANDARD.decode(d).ok())
+        .and_then(|bytes| String::from_utf8(bytes).ok())
+        .and_then(|s| serde_json::from_str::<Value>(&s).ok())
+        .unwrap_or(json!(null));
+
+    json!({
+        "type": event_type,
+        "source": source,
+        "time": time,
+        "attributes": attributes,
+        "data": data,
+    })
+}
+
+/// Derives a readable slug from event types for Pub/Sub resource naming.
+/// e.g. ["google.workspace.drive.file.v1.updated"] -> "drive-file-updated"
+/// Multiple types are joined: ["...drive.file.v1.updated", "...drive.file.v1.created"] -> "drive-file-updated-created"
+fn derive_slug_from_event_types(event_types: &[&str]) -> String {
+    let parts: Vec<String> = event_types
+        .iter()
+        .map(|et| {
+            // Strip "google.workspace." prefix and version segment
+            let stripped = et.strip_prefix("google.workspace.").unwrap_or(et);
+            // Split by '.', remove version-like segments (e.g. "v1")
+            let segments: Vec<&str> = stripped
+                .split('.')
+                .filter(|s| {
+                    !s.starts_with('v')
+                        || s.len() > 3
+                        || !s[1..].chars().all(|c| c.is_ascii_digit())
+                })
+                .collect();
+            segments.join("-")
+        })
+        .collect();
+
+    let slug = if parts.len() == 1 {
+        parts[0].clone()
+    } else {
+        // Find common prefix across event types, then append distinct suffixes
+        let first_segments: Vec<&str> = parts[0].split('-').collect();
+        let mut common_len = 0;
+        'outer: for i in 0..first_segments.len() {
+            for p in &parts[1..] {
+                let segs: Vec<&str> = p.split('-').collect();
+                if i >= segs.len() || segs[i] != first_segments[i] {
+                    break 'outer;
+                }
+            }
+            common_len = i + 1;
+        }
+        let prefix = first_segments[..common_len].join("-");
+        let suffixes: Vec<String> = parts
+            .iter()
+            .map(|p| {
+                let segs: Vec<&str> = p.split('-').collect();
+                segs[common_len..].join("-")
+            })
+            .filter(|s| !s.is_empty())
+            .collect();
+
+        if suffixes.is_empty() {
+            prefix
+        } else {
+            format!("{}-{}", prefix, suffixes.join("-"))
+        }
+    };
+
+    // Truncate to keep Pub/Sub resource names within limits
+    let slug = if slug.len() > 40 { &slug[..40] } else { &slug };
+    slug.trim_end_matches('-').to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_matches_subscribe(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("target").long("target"))
+            .arg(Arg::new("event-types").long("event-types"))
+            .arg(Arg::new("project").long("project"))
+            .arg(Arg::new("subscription").long("subscription"))
+            .arg(Arg::new("max-messages").long("max-messages"))
+            .arg(Arg::new("poll-interval").long("poll-interval"))
+            .arg(Arg::new("once").long("once").action(ArgAction::SetTrue))
+            .arg(
+                Arg::new("cleanup")
+                    .long("cleanup")
+                    .action(ArgAction::SetTrue),
+            )
+            .arg(Arg::new("no-ack").long("no-ack").action(ArgAction::SetTrue))
+            .arg(Arg::new("output-dir").long("output-dir"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_subscribe_args() {
+        let matches = make_matches_subscribe(&[
+            "test",
+            "--target",
+            "//chat/spaces/A",
+            "--event-types",
+            "type1,type2",
+            "--project",
+            "my-project",
+            "--max-messages",
+            "20",
+            "--once",
+        ]);
+        let config = parse_subscribe_args(&matches).unwrap();
+
+        assert_eq!(config.target, Some("//chat/spaces/A".to_string()));
+        assert_eq!(config.event_types, vec!["type1", "type2"]);
+        assert_eq!(config.project, Some(ProjectId("my-project".to_string())));
+        assert_eq!(config.max_messages, 20);
+        assert!(config.once);
+        assert!(!config.cleanup);
+    }
+
+    #[test]
+    fn test_parse_subscribe_args_subscription() {
+        let matches = make_matches_subscribe(&["test", "--subscription", "subs/my-sub"]);
+        let config = parse_subscribe_args(&matches).unwrap();
+
+        assert_eq!(
+            config.subscription,
+            Some(SubscriptionName("subs/my-sub".to_string()))
+        );
+        // Others defaults
+        assert_eq!(config.max_messages, 10);
+    }
+
+    #[test]
+    fn test_slug_single_event_type() {
+        let types = vec!["google.workspace.drive.file.v1.updated"];
+        assert_eq!(derive_slug_from_event_types(&types), "drive-file-updated");
+    }
+
+    #[test]
+    fn test_slug_single_event_type_chat() {
+        let types = vec!["google.workspace.chat.message.v1.created"];
+        assert_eq!(derive_slug_from_event_types(&types), "chat-message-created");
+    }
+
+    #[test]
+    fn test_slug_multiple_event_types_common_prefix() {
+        let types = vec![
+            "google.workspace.drive.file.v1.updated",
+            "google.workspace.drive.file.v1.created",
+        ];
+        let slug = derive_slug_from_event_types(&types);
+        assert_eq!(slug, "drive-file-updated-created");
+    }
+
+    #[test]
+    fn test_slug_non_workspace_prefix() {
+        let types = vec!["custom.event.type"];
+        let slug = derive_slug_from_event_types(&types);
+        assert_eq!(slug, "custom-event-type");
+    }
+
+    #[test]
+    fn test_slug_truncation() {
+        // Very long event type should be truncated to 40 chars
+        let types = vec!["google.workspace.very.long.service.name.with.many.segments.v1.updated"];
+        let slug = derive_slug_from_event_types(&types);
+        assert!(slug.len() <= 40);
+    }
+
+    #[test]
+    fn test_decode_cloud_event() {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+
+        let data = json!({"foo": "bar"}).to_string();
+        let encoded = STANDARD.encode(data);
+
+        let msg = json!({
+            "attributes": {
+                "type": "google.workspace.chat.message.v1.created",
+                "source": "//chat.googleapis.com/spaces/AAA",
+                "time": "2026-02-13T10:00:00Z"
+            },
+            "data": encoded
+        });
+
+        let event = decode_cloud_event(&msg);
+
+        assert_eq!(event["type"], "google.workspace.chat.message.v1.created");
+        assert_eq!(event["source"], "//chat.googleapis.com/spaces/AAA");
+        assert_eq!(event["data"]["foo"], "bar");
+    }
+
+    #[test]
+    fn test_process_events_pull_response() {
+        use base64::{engine::general_purpose::STANDARD, Engine as _};
+
+        // Mock a Pub/Sub response with two messages
+        let data1 = json!({"id": "1", "content": "hello"}).to_string();
+        let encoded1 = STANDARD.encode(data1);
+
+        let data2 = json!({"id": "2", "content": "world"}).to_string();
+        let encoded2 = STANDARD.encode(data2);
+
+        let response = json!({
+            "receivedMessages": [
+                {
+                    "ackId": "ack1",
+                    "message": {
+                        "attributes": {
+                            "type": "google.workspace.chat.message.v1.created",
+                            "source": "//chat/spaces/A"
+                        },
+                        "data": encoded1,
+                        "messageId": "msg1"
+                    }
+                },
+                {
+                    "ackId": "ack2",
+                    "message": {
+                        "attributes": {
+                            "type": "google.workspace.drive.file.v1.updated",
+                            "source": "//drive/files/B"
+                        },
+                        "data": encoded2,
+                        "messageId": "msg2"
+                    }
+                }
+            ]
+        });
+
+        let (ack_ids, events) = process_events_pull_response(&response);
+
+        assert_eq!(ack_ids.len(), 2);
+        assert_eq!(ack_ids[0], "ack1");
+        assert_eq!(ack_ids[1], "ack2");
+
+        assert_eq!(events.len(), 2);
+        assert_eq!(
+            events[0]["type"],
+            "google.workspace.chat.message.v1.created"
+        );
+        assert_eq!(events[0]["data"]["id"], "1");
+
+        assert_eq!(events[1]["type"], "google.workspace.drive.file.v1.updated");
+        assert_eq!(events[1]["data"]["id"], "2");
+    }
+
+    #[test]
+    fn test_process_events_pull_response_empty() {
+        let response = json!({});
+        let (ack_ids, events) = process_events_pull_response(&response);
+        assert!(ack_ids.is_empty());
+        assert!(events.is_empty());
+    }
+
+    #[test]
+    fn test_handle_subscribe_validation_missing_target() {
+        let config = SubscribeConfigBuilder::default()
+            .event_types(vec!["type1".to_string()])
+            .project(Some(ProjectId("p1".to_string())))
+            .build()
+            .unwrap();
+        let result = validate_subscribe_config(&config);
+        assert!(result.is_err());
+        let err_msg = result.unwrap_err().to_string();
+        assert!(err_msg.contains("--target is required"));
+    }
+
+    #[test]
+    fn test_handle_subscribe_validation_missing_events() {
+        let config = SubscribeConfigBuilder::default()
+            .target(Some("target1".to_string()))
+            .project(Some(ProjectId("p1".to_string())))
+            .build()
+            .unwrap();
+        let result = validate_subscribe_config(&config);
+        assert!(result.is_err());
+        let err_msg = result.unwrap_err().to_string();
+        assert!(err_msg.contains("--event-types is required"));
+    }
+
+    #[test]
+    fn test_handle_subscribe_validation_missing_project() {
+        let config = SubscribeConfigBuilder::default()
+            .target(Some("target1".to_string()))
+            .event_types(vec!["type1".to_string()])
+            .build()
+            .unwrap();
+        let result = validate_subscribe_config(&config);
+        assert!(result.is_err());
+        let err_msg = result.unwrap_err().to_string();
+        assert!(err_msg.contains("--project is required"));
+    }
+}
diff --git a/src/helpers/gmail/mod.rs b/src/helpers/gmail/mod.rs
new file mode 100644
index 00000000..82ae91be
--- /dev/null
+++ b/src/helpers/gmail/mod.rs
@@ -0,0 +1,245 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+pub mod send;
+pub mod triage;
+pub mod watch;
+
+use send::handle_send;
+use triage::handle_triage;
+use watch::handle_watch;
+
+pub(super) use crate::auth;
+pub(super) use crate::error::GwsError;
+pub(super) use crate::executor;
+pub(super) use anyhow::Context;
+pub(super) use base64::{engine::general_purpose::URL_SAFE, Engine as _};
+pub(super) use clap::{Arg, ArgAction, ArgMatches, Command};
+pub(super) use serde_json::{json, Value};
+use std::future::Future;
+use std::pin::Pin;
+
+pub struct GmailHelper;
+
+pub(super) const GMAIL_SCOPE: &str = "https://www.googleapis.com/auth/gmail.modify";
+pub(super) const PUBSUB_SCOPE: &str = "https://www.googleapis.com/auth/pubsub";
+
+impl Helper for GmailHelper {
+    /// Injects helper subcommands (`+send`, `+watch`) into the main CLI command.
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+send")
+                .about("[Helper] Send an email")
+                .arg(
+                    Arg::new("to")
+                        .long("to")
+                        .help("Recipient email address")
+                        .required(true)
+                        .value_name("EMAIL"),
+                )
+                .arg(
+                    Arg::new("subject")
+                        .long("subject")
+                        .help("Email subject")
+                        .required(true)
+                        .value_name("SUBJECT"),
+                )
+                .arg(
+                    Arg::new("body")
+                        .long("body")
+                        .help("Email body (plain text)")
+                        .required(true)
+                        .value_name("TEXT"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws gmail +send --to alice@example.com --subject 'Hello' --body 'Hi Alice!'
+
+TIPS:
+  Handles RFC 2822 formatting and base64 encoding automatically.
+  For HTML bodies, attachments, or CC/BCC, use the raw API instead:
+    gws gmail users messages send --json '...' ",
+                ),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+triage")
+                .about("[Helper] Show unread inbox summary (sender, subject, date)")
+                .arg(
+                    Arg::new("max")
+                        .long("max")
+                        .help("Maximum messages to show (default: 20)")
+                        .default_value("20")
+                        .value_name("N"),
+                )
+                .arg(
+                    Arg::new("query")
+                        .long("query")
+                        .help("Gmail search query (default: is:unread)")
+                        .value_name("QUERY"),
+                )
+                .arg(
+                    Arg::new("labels")
+                        .long("labels")
+                        .help("Include label names in output")
+                        .action(ArgAction::SetTrue),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws gmail +triage
+  gws gmail +triage --max 5 --query 'from:boss'
+  gws gmail +triage --format json | jq '.[].subject'
+  gws gmail +triage --labels
+
+TIPS:
+  Read-only — never modifies your mailbox.
+  Defaults to table output format.",
+                ),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+watch")
+                .about("[Helper] Watch for new emails and stream them as NDJSON")
+                .arg(
+                    Arg::new("project")
+                        .long("project")
+                        .help("GCP project ID for Pub/Sub resources")
+                        .value_name("PROJECT"),
+                )
+                .arg(
+                    Arg::new("subscription")
+                        .long("subscription")
+                        .help("Existing Pub/Sub subscription name (skip setup)")
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("topic")
+                        .long("topic")
+                        .help("Existing Pub/Sub topic with Gmail push permission already granted")
+                        .value_name("TOPIC"),
+                )
+                .arg(
+                    Arg::new("label-ids")
+                        .long("label-ids")
+                        .help("Comma-separated Gmail label IDs to filter (e.g., INBOX,UNREAD)")
+                        .value_name("LABELS"),
+                )
+                .arg(
+                    Arg::new("max-messages")
+                        .long("max-messages")
+                        .help("Max messages per pull batch")
+                        .value_name("N")
+                        .default_value("10"),
+                )
+                .arg(
+                    Arg::new("poll-interval")
+                        .long("poll-interval")
+                        .help("Seconds between pulls")
+                        .value_name("SECS")
+                        .default_value("5"),
+                )
+                .arg(
+                    Arg::new("msg-format")
+                        .long("msg-format")
+                        .help("Gmail message format: full, metadata, minimal, raw")
+                        .value_name("FORMAT")
+                        .default_value("full"),
+                )
+                .arg(
+                    Arg::new("once")
+                        .long("once")
+                        .help("Pull once and exit")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("cleanup")
+                        .long("cleanup")
+                        .help("Delete created Pub/Sub resources on exit")
+                        .action(ArgAction::SetTrue),
+                )
+                .arg(
+                    Arg::new("output-dir")
+                        .long("output-dir")
+                        .help("Write each message to a separate JSON file in this directory")
+                        .value_name("DIR"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws gmail +watch --project my-gcp-project
+  gws gmail +watch --project my-project --label-ids INBOX --once
+  gws gmail +watch --subscription projects/p/subscriptions/my-sub
+  gws gmail +watch --project my-project --cleanup --output-dir ./emails
+
+TIPS:
+  Gmail watch expires after 7 days — re-run to renew.
+  Without --cleanup, Pub/Sub resources persist for reconnection.
+  Press Ctrl-C to stop gracefully.",
+                ),
+        );
+
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+send") {
+                handle_send(doc, matches).await?;
+                return Ok(true);
+            }
+
+            if let Some(matches) = matches.subcommand_matches("+triage") {
+                handle_triage(matches).await?;
+                return Ok(true);
+            }
+
+            if let Some(matches) = matches.subcommand_matches("+watch") {
+                handle_watch(matches, sanitize_config).await?;
+                return Ok(true);
+            }
+
+            Ok(false)
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_inject_commands() {
+        let helper = GmailHelper;
+        let cmd = Command::new("test");
+        let doc = crate::discovery::RestDescription::default();
+
+        // No scopes granted -> defaults to showing all
+        let cmd = helper.inject_commands(cmd, &doc);
+        let subcommands: Vec<_> = cmd.get_subcommands().map(|s| s.get_name()).collect();
+        assert!(subcommands.contains(&"+watch"));
+        assert!(subcommands.contains(&"+send"));
+    }
+}
diff --git a/src/helpers/gmail/send.rs b/src/helpers/gmail/send.rs
new file mode 100644
index 00000000..078c379a
--- /dev/null
+++ b/src/helpers/gmail/send.rs
@@ -0,0 +1,134 @@
+use super::*;
+
+pub(super) async fn handle_send(
+    doc: &crate::discovery::RestDescription,
+    matches: &ArgMatches,
+) -> Result<(), GwsError> {
+    let config = parse_send_args(matches);
+
+    let message = create_raw_message(&config.to, &config.subject, &config.body_text);
+    let body = create_send_body(&message);
+    let body_str = body.to_string();
+
+    let users_res = doc
+        .resources
+        .get("users")
+        .ok_or_else(|| GwsError::Discovery("Resource 'users' not found".to_string()))?;
+    let messages_res = users_res
+        .resources
+        .get("messages")
+        .ok_or_else(|| GwsError::Discovery("Resource 'users.messages' not found".to_string()))?;
+    let send_method = messages_res
+        .methods
+        .get("send")
+        .ok_or_else(|| GwsError::Discovery("Method 'users.messages.send' not found".to_string()))?;
+
+    let pagination = executor::PaginationConfig {
+        page_all: false,
+        page_limit: 10,
+        page_delay_ms: 100,
+    };
+
+    let params = json!({ "userId": "me" });
+    let params_str = params.to_string();
+
+    let scopes: Vec<&str> = send_method.scopes.iter().map(|s| s.as_str()).collect();
+    let (token, auth_method) = match auth::get_token(&scopes).await {
+        Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+        Err(_) => (None, executor::AuthMethod::None),
+    };
+
+    executor::execute_method(
+        doc,
+        send_method,
+        Some(&params_str),
+        Some(&body_str),
+        token.as_deref(),
+        auth_method,
+        None,
+        None,
+        matches.get_flag("dry-run"),
+        &pagination,
+        None,
+        &crate::helpers::modelarmor::SanitizeMode::Warn,
+        &crate::formatter::OutputFormat::default(),
+    )
+    .await?;
+
+    Ok(())
+}
+
+/// Helper to create a raw MIME email string.
+fn create_raw_message(to: &str, subject: &str, body: &str) -> String {
+    format!("To: {}\r\nSubject: {}\r\n\r\n{}", to, subject, body)
+}
+
+/// Creates a JSON body for sending an email.
+fn create_send_body(raw_msg: &str) -> serde_json::Value {
+    let encoded = URL_SAFE.encode(raw_msg);
+    json!({
+        "raw": encoded
+    })
+}
+
+pub struct SendConfig {
+    pub to: String,
+    pub subject: String,
+    pub body_text: String,
+}
+
+fn parse_send_args(matches: &ArgMatches) -> SendConfig {
+    SendConfig {
+        to: matches.get_one::<String>("to").unwrap().to_string(),
+        subject: matches.get_one::<String>("subject").unwrap().to_string(),
+        body_text: matches.get_one::<String>("body").unwrap().to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_create_raw_message() {
+        let msg = create_raw_message("test@example.com", "Hello", "World");
+        assert_eq!(msg, "To: test@example.com\r\nSubject: Hello\r\n\r\nWorld");
+    }
+
+    #[test]
+    fn test_create_send_body() {
+        let raw = "To: a@b.com\r\nSubject: hi\r\n\r\nbody";
+        let body = create_send_body(raw);
+        let encoded = body["raw"].as_str().unwrap();
+
+        let decoded_bytes = URL_SAFE.decode(encoded).unwrap();
+        let decoded = String::from_utf8(decoded_bytes).unwrap();
+
+        assert_eq!(decoded, raw);
+    }
+
+    fn make_matches_send(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("to").long("to"))
+            .arg(Arg::new("subject").long("subject"))
+            .arg(Arg::new("body").long("body"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_send_args() {
+        let matches = make_matches_send(&[
+            "test",
+            "--to",
+            "me@example.com",
+            "--subject",
+            "Hi",
+            "--body",
+            "Body",
+        ]);
+        let config = parse_send_args(&matches);
+        assert_eq!(config.to, "me@example.com");
+        assert_eq!(config.subject, "Hi");
+        assert_eq!(config.body_text, "Body");
+    }
+}
diff --git a/src/helpers/gmail/triage.rs b/src/helpers/gmail/triage.rs
new file mode 100644
index 00000000..bbfd0d5f
--- /dev/null
+++ b/src/helpers/gmail/triage.rs
@@ -0,0 +1,170 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Gmail `+triage` helper — lists unread messages with sender, subject, date.
+
+use super::*;
+
+/// Handle the `+triage` subcommand.
+pub async fn handle_triage(matches: &ArgMatches) -> Result<(), GwsError> {
+    let max: u32 = matches
+        .get_one::<String>("max")
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(20);
+    let query = matches
+        .get_one::<String>("query")
+        .map(|s| s.as_str())
+        .unwrap_or("is:unread");
+    let show_labels = matches.get_flag("labels");
+    let output_format = matches
+        .get_one::<String>("format")
+        .map(|s| crate::formatter::OutputFormat::from_str(s))
+        .unwrap_or(crate::formatter::OutputFormat::Table);
+
+    // Authenticate
+    let token = auth::get_token(&[GMAIL_SCOPE])
+        .await
+        .map_err(|e| GwsError::Auth(format!("Gmail auth failed: {e}")))?;
+
+    let client = crate::client::build_client()?;
+
+    // 1. List message IDs
+    let list_url = "https://gmail.googleapis.com/gmail/v1/users/me/messages";
+
+    let list_resp = client
+        .get(list_url)
+        .query(&[("q", query), ("maxResults", &max.to_string())])
+        .bearer_auth(&token)
+        .send()
+        .await
+        .map_err(|e| GwsError::Other(anyhow::anyhow!("Failed to list messages: {e}")))?;
+
+    if !list_resp.status().is_success() {
+        let err = list_resp.text().await.unwrap_or_default();
+        return Err(GwsError::Api {
+            code: 0,
+            message: err,
+            reason: "list_failed".to_string(),
+        });
+    }
+
+    let list_json: Value = list_resp
+        .json()
+        .await
+        .map_err(|e| GwsError::Other(anyhow::anyhow!("Failed to parse list response: {e}")))?;
+
+    let messages = match list_json.get("messages").and_then(|m| m.as_array()) {
+        Some(m) => m,
+        None => {
+            println!("No messages found matching query: {query}");
+            return Ok(());
+        }
+    };
+
+    if messages.is_empty() {
+        println!("No messages found matching query: {query}");
+        return Ok(());
+    }
+
+    // 2. Fetch metadata for each message concurrently
+    use futures_util::stream::{self, StreamExt};
+
+    // Collect message IDs upfront (owned) to avoid lifetime issues in async closures
+    let msg_ids: Vec<String> = messages
+        .iter()
+        .filter_map(|m| m.get("id").and_then(|v| v.as_str()).map(|s| s.to_string()))
+        .collect();
+
+    let results: Vec<Value> = stream::iter(msg_ids)
+        .map(|msg_id| {
+            let client = &client;
+            let token = &token;
+            async move {
+                let get_url = format!(
+                    "https://gmail.googleapis.com/gmail/v1/users/me/messages/{}?format=metadata&metadataHeaders=From&metadataHeaders=Subject&metadataHeaders=Date",
+                    msg_id
+                );
+
+                let get_resp = crate::client::send_with_retry(|| {
+                    client.get(&get_url).bearer_auth(token)
+                })
+                .await
+                .ok()?;
+
+                if !get_resp.status().is_success() {
+                    return None;
+                }
+
+                let msg_json: Value = get_resp.json().await.ok()?;
+
+                let headers = msg_json
+                    .get("payload")
+                    .and_then(|p| p.get("headers"))
+                    .and_then(|h| h.as_array());
+
+                let mut from = String::new();
+                let mut subject = String::new();
+                let mut date = String::new();
+
+                if let Some(headers) = headers {
+                    for h in headers {
+                        let name = h.get("name").and_then(|v| v.as_str()).unwrap_or("");
+                        let value = h.get("value").and_then(|v| v.as_str()).unwrap_or("");
+                        match name {
+                            "From" => from = value.to_string(),
+                            "Subject" => subject = value.to_string(),
+                            "Date" => date = value.to_string(),
+                            _ => {}
+                        }
+                    }
+                }
+
+                let mut entry = json!({
+                    "id": msg_id,
+                    "from": from,
+                    "subject": subject,
+                    "date": date,
+                });
+
+                if show_labels {
+                    let labels = msg_json
+                        .get("labelIds")
+                        .cloned()
+                        .unwrap_or(Value::Array(vec![]));
+                    entry["labels"] = labels;
+                }
+
+                Some(entry)
+            }
+        })
+        .buffer_unordered(10)
+        .filter_map(|r| async { r })
+        .collect()
+        .await;
+
+    // 3. Output
+    let result_count = results.len();
+    let output = json!({
+        "messages": results,
+        "resultSizeEstimate": list_json.get("resultSizeEstimate").cloned().unwrap_or(json!(result_count)),
+        "query": query,
+    });
+
+    println!(
+        "{}",
+        crate::formatter::format_value(&output, &output_format)
+    );
+
+    Ok(())
+}
diff --git a/src/helpers/gmail/watch.rs b/src/helpers/gmail/watch.rs
new file mode 100644
index 00000000..aa3609c4
--- /dev/null
+++ b/src/helpers/gmail/watch.rs
@@ -0,0 +1,733 @@
+use super::*;
+
+/// Handles the `+watch` command — Gmail push notifications via Pub/Sub.
+pub(super) async fn handle_watch(
+    matches: &ArgMatches,
+    sanitize_config: &crate::helpers::modelarmor::SanitizeConfig,
+) -> Result<(), GwsError> {
+    let config = parse_watch_args(matches);
+
+    if let Some(ref dir) = config.output_dir {
+        std::fs::create_dir_all(dir).context("Failed to create output dir")?;
+    }
+
+    let client = crate::client::build_client()?;
+
+    // Get tokens
+    let gmail_token = auth::get_token(&[GMAIL_SCOPE])
+        .await
+        .context("Failed to get Gmail token")?;
+    let pubsub_token = auth::get_token(&[PUBSUB_SCOPE])
+        .await
+        .context("Failed to get Pub/Sub token")?;
+
+    let (pubsub_subscription, topic_name, created_resources) = if let Some(ref sub_name) =
+        config.subscription
+    {
+        (sub_name.clone(), None, false)
+    } else {
+        let project = config
+            .project.clone()
+            .or_else(|| std::env::var("GOOGLE_WORKSPACE_PROJECT_ID").ok())
+            .ok_or_else(|| {
+                GwsError::Validation(
+                    "--project is required when not using --subscription (or set GOOGLE_WORKSPACE_PROJECT_ID)".to_string(),
+                )
+            })?;
+
+        let suffix = format!("{:08x}", rand::random::<u32>());
+        let topic = if let Some(ref t) = config.topic {
+            t.clone()
+        } else {
+            let t = format!("projects/{project}/topics/gws-gmail-watch-{suffix}");
+            // Create Pub/Sub topic
+            eprintln!("Creating Pub/Sub topic: {t}");
+            let resp = client
+                .put(format!("https://pubsub.googleapis.com/v1/{t}"))
+                .bearer_auth(&pubsub_token)
+                .header("Content-Type", "application/json")
+                .body("{}")
+                .send()
+                .await
+                .context("Failed to create topic")?;
+
+            if !resp.status().is_success() {
+                let body = resp.text().await.unwrap_or_default();
+                return Err(GwsError::Api {
+                    code: 400,
+                    message: format!("Failed to create Pub/Sub topic: {body}"),
+                    reason: "pubsubError".to_string(),
+                });
+            }
+
+            // Grant Gmail publish permission on the topic
+            eprintln!("Granting Gmail push permission on topic...");
+            let iam_body = json!({
+                "policy": {
+                    "bindings": [{
+                        "role": "roles/pubsub.publisher",
+                        "members": ["serviceAccount:gmail-api-push@system.gserviceaccount.com"]
+                    }]
+                }
+            });
+            let resp = client
+                .post(format!("https://pubsub.googleapis.com/v1/{t}:setIamPolicy"))
+                .bearer_auth(&pubsub_token)
+                .header("Content-Type", "application/json")
+                .json(&iam_body)
+                .send()
+                .await
+                .context("Failed to set topic IAM policy")?;
+
+            if !resp.status().is_success() {
+                let body = resp.text().await.unwrap_or_default();
+                eprintln!("Warning: Could not auto-grant Gmail push permission.");
+                eprintln!("You may need to manually grant publisher access:");
+                eprintln!(
+                    "  gcloud pubsub topics add-iam-policy-binding {} \\",
+                    t.split('/').rfind(|s| !s.is_empty()).unwrap_or(&t)
+                );
+                eprintln!(
+                    "    --member=serviceAccount:gmail-api-push@system.gserviceaccount.com \\"
+                );
+                eprintln!("    --role=roles/pubsub.publisher");
+                eprintln!("Error: {body}");
+            }
+
+            t
+        };
+
+        let sub = format!("projects/{project}/subscriptions/gws-gmail-watch-{suffix}");
+
+        // 3. Create Pub/Sub subscription
+        eprintln!("Creating Pub/Sub subscription: {sub}");
+        let sub_body = json!({
+            "topic": topic,
+            "ackDeadlineSeconds": 60,
+        });
+        let resp = client
+            .put(format!("https://pubsub.googleapis.com/v1/{sub}"))
+            .bearer_auth(&pubsub_token)
+            .header("Content-Type", "application/json")
+            .json(&sub_body)
+            .send()
+            .await
+            .context("Failed to create subscription")?;
+
+        if !resp.status().is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            return Err(GwsError::Api {
+                code: 400,
+                message: format!("Failed to create Pub/Sub subscription: {body}"),
+                reason: "pubsubError".to_string(),
+            });
+        }
+
+        // 4. Call gmail.users.watch
+        eprintln!("Setting up Gmail watch...");
+        let mut watch_body = json!({
+            "topicName": topic,
+        });
+        if let Some(ref label_ids) = config.label_ids {
+            let labels: Vec<&str> = label_ids.split(',').map(|s| s.trim()).collect();
+            watch_body["labelIds"] = json!(labels);
+        }
+
+        let resp = client
+            .post("https://gmail.googleapis.com/gmail/v1/users/me/watch")
+            .bearer_auth(&gmail_token)
+            .header("Content-Type", "application/json")
+            .json(&watch_body)
+            .send()
+            .await
+            .context("Failed to call gmail.users.watch")?;
+
+        let watch_resp: Value = resp
+            .json()
+            .await
+            .context("Failed to parse watch response")?;
+
+        if let Some(err) = watch_resp.get("error") {
+            return Err(GwsError::Api {
+                code: err.get("code").and_then(|c| c.as_u64()).unwrap_or(400) as u16,
+                message: format!(
+                    "gmail.users.watch failed: {}",
+                    serde_json::to_string(err).unwrap_or_default()
+                ),
+                reason: "gmailError".to_string(),
+            });
+        }
+
+        let history_id = watch_resp
+            .get("historyId")
+            .and_then(|h| h.as_str())
+            .unwrap_or("0");
+        let expiration = watch_resp
+            .get("expiration")
+            .and_then(|e| e.as_str())
+            .unwrap_or("unknown");
+
+        eprintln!("Gmail watch active (historyId: {history_id}, expires: {expiration})");
+        eprintln!("Listening for new emails...\n");
+
+        (sub, Some(topic), true)
+    };
+
+    // Get initial historyId for tracking
+    let profile_resp = client
+        .get("https://gmail.googleapis.com/gmail/v1/users/me/profile")
+        .bearer_auth(&gmail_token)
+        .send()
+        .await
+        .context("Failed to get Gmail profile")?;
+
+    let profile: Value = profile_resp.json().await.unwrap_or(json!({}));
+    let mut last_history_id: u64 = profile
+        .get("historyId")
+        .and_then(|h| h.as_str().or_else(|| h.as_u64().map(|_| "")))
+        .and_then(|s| s.parse().ok())
+        .or_else(|| profile.get("historyId").and_then(|h| h.as_u64()))
+        .unwrap_or(0);
+
+    // Pull loop
+    let result = watch_pull_loop(
+        &client,
+        &pubsub_token,
+        &gmail_token,
+        &pubsub_subscription,
+        &mut last_history_id,
+        config.clone(),
+        sanitize_config,
+    )
+    .await;
+
+    // Cleanup or print reconnection info
+    if created_resources {
+        if config.cleanup {
+            eprintln!("\nCleaning up Pub/Sub resources...");
+            let _ = client
+                .delete(format!(
+                    "https://pubsub.googleapis.com/v1/{pubsub_subscription}"
+                ))
+                .bearer_auth(&pubsub_token)
+                .send()
+                .await;
+            if let Some(ref topic) = topic_name {
+                let _ = client
+                    .delete(format!("https://pubsub.googleapis.com/v1/{topic}"))
+                    .bearer_auth(&pubsub_token)
+                    .send()
+                    .await;
+            }
+            eprintln!("Cleanup complete.");
+        } else {
+            eprintln!("\n--- Reconnection Info ---");
+            eprintln!(
+                "To reconnect later:\n  gws gmail +watch --subscription {}",
+                pubsub_subscription
+            );
+            if let Some(ref topic) = topic_name {
+                eprintln!("Pub/Sub topic: {topic}");
+            }
+            eprintln!("Pub/Sub subscription: {pubsub_subscription}");
+            eprintln!("Note: Gmail watch expires after 7 days. Re-run +watch to renew.");
+        }
+    }
+
+    result
+}
+
+/// Pull loop for Gmail watch — polls Pub/Sub, fetches messages via history API.
+async fn watch_pull_loop(
+    client: &reqwest::Client,
+    pubsub_token: &str,
+    gmail_token: &str,
+    subscription: &str,
+    last_history_id: &mut u64,
+    config: WatchConfig,
+    sanitize_config: &crate::helpers::modelarmor::SanitizeConfig,
+) -> Result<(), GwsError> {
+    loop {
+        let pull_body = json!({ "maxMessages": config.max_messages });
+        let pull_future = client
+            .post(format!(
+                "https://pubsub.googleapis.com/v1/{subscription}:pull"
+            ))
+            .bearer_auth(pubsub_token)
+            .header("Content-Type", "application/json")
+            .json(&pull_body)
+            .timeout(std::time::Duration::from_secs(config.poll_interval.max(10)))
+            .send();
+
+        let resp = tokio::select! {
+            result = pull_future => {
+                match result {
+                    Ok(r) => r,
+                    Err(e) if e.is_timeout() => continue,
+                    Err(e) => return Err(GwsError::Other(anyhow::anyhow!("Pub/Sub pull failed: {e}"))),
+                }
+            }
+            _ = tokio::signal::ctrl_c() => {
+                eprintln!("\nReceived interrupt, stopping...");
+                return Ok(());
+            }
+        };
+
+        if !resp.status().is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            return Err(GwsError::Api {
+                code: 400,
+                message: format!("Pub/Sub pull failed: {body}"),
+                reason: "pubsubError".to_string(),
+            });
+        }
+
+        let pull_response: Value = resp.json().await.context("Failed to parse pull response")?;
+
+        let (ack_ids, max_history_id) = process_pull_response(&pull_response);
+
+        if max_history_id > *last_history_id && *last_history_id > 0 {
+            // Fetch new messages via history API
+            fetch_and_output_messages(
+                client,
+                gmail_token,
+                *last_history_id,
+                &config.format,
+                config.output_dir.as_deref(),
+                sanitize_config,
+            )
+            .await?;
+        }
+
+        if max_history_id > *last_history_id {
+            *last_history_id = max_history_id;
+        }
+
+        // Acknowledge messages
+        if !ack_ids.is_empty() {
+            let ack_body = json!({ "ackIds": ack_ids });
+            let _ = client
+                .post(format!(
+                    "https://pubsub.googleapis.com/v1/{subscription}:acknowledge"
+                ))
+                .bearer_auth(pubsub_token)
+                .header("Content-Type", "application/json")
+                .json(&ack_body)
+                .send()
+                .await;
+        }
+
+        if config.once {
+            break;
+        }
+
+        tokio::select! {
+            _ = tokio::time::sleep(std::time::Duration::from_secs(config.poll_interval)) => {},
+            _ = tokio::signal::ctrl_c() => {
+                eprintln!("\nReceived interrupt, stopping...");
+                break;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn process_pull_response(response: &Value) -> (Vec<String>, u64) {
+    let mut ack_ids = Vec::new();
+    let mut max_history_id = 0;
+
+    if let Some(messages) = response.get("receivedMessages").and_then(|m| m.as_array()) {
+        for msg in messages {
+            if let Some(ack_id) = msg.get("ackId").and_then(|a| a.as_str()) {
+                ack_ids.push(ack_id.to_string());
+            }
+
+            // Extract historyId from the notification
+            if let Some(pubsub_msg) = msg.get("message") {
+                let data = pubsub_msg
+                    .get("data")
+                    .and_then(|d| d.as_str())
+                    .and_then(|d| base64::engine::general_purpose::STANDARD.decode(d).ok())
+                    .and_then(|bytes| String::from_utf8(bytes).ok())
+                    .and_then(|s| serde_json::from_str::<Value>(&s).ok());
+
+                if let Some(notification) = data {
+                    let notif_history_id = notification
+                        .get("historyId")
+                        .and_then(|h| h.as_u64().or_else(|| h.as_str()?.parse().ok()))
+                        .unwrap_or(0);
+
+                    if notif_history_id > max_history_id {
+                        max_history_id = notif_history_id;
+                    }
+                }
+            }
+        }
+    }
+
+    (ack_ids, max_history_id)
+}
+
+/// Fetches new messages since `start_history_id` and outputs them as NDJSON.
+async fn fetch_and_output_messages(
+    client: &reqwest::Client,
+    gmail_token: &str,
+    start_history_id: u64,
+    msg_format: &str,
+    output_dir: Option<&str>,
+    sanitize_config: &crate::helpers::modelarmor::SanitizeConfig,
+) -> Result<(), GwsError> {
+    let url = format!(
+        "https://gmail.googleapis.com/gmail/v1/users/me/history?startHistoryId={}&historyTypes=messageAdded",
+        start_history_id
+    );
+
+    let resp = client
+        .get(&url)
+        .bearer_auth(gmail_token)
+        .send()
+        .await
+        .context("Failed to get history")?;
+
+    let body: Value = resp.json().await.unwrap_or(json!({}));
+
+    let msg_ids = extract_message_ids_from_history(&body);
+
+    for msg_id in msg_ids {
+        // Fetch full message
+        let msg_url = format!(
+            "https://gmail.googleapis.com/gmail/v1/users/me/messages/{}?format={}",
+            msg_id, msg_format
+        );
+        let msg_resp = client.get(&msg_url).bearer_auth(gmail_token).send().await;
+
+        if let Ok(resp) = msg_resp {
+            if let Ok(mut full_msg) = resp.json::<Value>().await {
+                // Apply sanitization if configured
+                if let Some(ref template) = sanitize_config.template {
+                    let text_to_check = serde_json::to_string(&full_msg).unwrap_or_default();
+                    match crate::helpers::modelarmor::sanitize_text(template, &text_to_check).await
+                    {
+                        Ok(result) => {
+                            if let Some(sanitized_msg) = apply_sanitization_result(
+                                full_msg,
+                                sanitize_config,
+                                &result,
+                                &msg_id,
+                            ) {
+                                full_msg = sanitized_msg;
+                            } else {
+                                continue;
+                            }
+                        }
+                        Err(e) => {
+                            eprintln!("\x1b[33m[WARNING]\x1b[0m Model Armor sanitization failed for message {msg_id}: {e}");
+                        }
+                    }
+                }
+
+                let json_str =
+                    serde_json::to_string_pretty(&full_msg).unwrap_or_else(|_| "{}".to_string());
+                if let Some(dir) = output_dir {
+                    let path = format!("{dir}/{msg_id}.json");
+                    if let Err(e) = std::fs::write(&path, &json_str) {
+                        eprintln!("Warning: failed to write {path}: {e}");
+                    } else {
+                        eprintln!("Wrote {path}");
+                    }
+                } else {
+                    println!(
+                        "{}",
+                        serde_json::to_string(&full_msg).unwrap_or_else(|_| "{}".to_string())
+                    );
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn apply_sanitization_result(
+    mut full_msg: Value,
+    sanitize_config: &crate::helpers::modelarmor::SanitizeConfig,
+    result: &crate::helpers::modelarmor::SanitizationResult,
+    msg_id: &str,
+) -> Option<Value> {
+    if result.filter_match_state == "MATCH_FOUND" {
+        match sanitize_config.mode {
+            crate::helpers::modelarmor::SanitizeMode::Block => {
+                eprintln!(
+                    "\x1b[31m[BLOCKED]\x1b[0m Message {msg_id} blocked by Model Armor (match found)"
+                );
+                return None;
+            }
+            crate::helpers::modelarmor::SanitizeMode::Warn => {
+                eprintln!("\x1b[33m[WARNING]\x1b[0m Model Armor match found in message {msg_id}");
+                full_msg["_sanitization"] = serde_json::json!({
+                    "filterMatchState": result.filter_match_state,
+                    "filterResults": result.filter_results,
+                });
+            }
+        }
+    }
+    Some(full_msg)
+}
+
+fn extract_message_ids_from_history(history_body: &Value) -> Vec<String> {
+    let mut seen_ids = std::collections::HashSet::new();
+    let mut result = Vec::new();
+
+    if let Some(history) = history_body.get("history").and_then(|h| h.as_array()) {
+        for entry in history {
+            if let Some(added) = entry.get("messagesAdded").and_then(|m| m.as_array()) {
+                for msg_entry in added {
+                    if let Some(msg_id) = msg_entry
+                        .get("message")
+                        .and_then(|m| m.get("id"))
+                        .and_then(|id| id.as_str())
+                    {
+                        if seen_ids.insert(msg_id.to_string()) {
+                            result.push(msg_id.to_string());
+                        }
+                    }
+                }
+            }
+        }
+    }
+    result
+}
+
+#[derive(Clone)]
+struct WatchConfig {
+    project: Option<String>,
+    subscription: Option<String>,
+    topic: Option<String>,
+    label_ids: Option<String>,
+    max_messages: u32,
+    poll_interval: u64,
+    format: String,
+    once: bool,
+    cleanup: bool,
+    output_dir: Option<String>,
+}
+
+fn parse_watch_args(matches: &ArgMatches) -> WatchConfig {
+    WatchConfig {
+        project: matches.get_one::<String>("project").cloned(),
+        subscription: matches.get_one::<String>("subscription").cloned(),
+        topic: matches.get_one::<String>("topic").cloned(),
+        label_ids: matches.get_one::<String>("label-ids").cloned(),
+        max_messages: matches
+            .get_one::<String>("max-messages")
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(10),
+        poll_interval: matches
+            .get_one::<String>("poll-interval")
+            .and_then(|s| s.parse().ok())
+            .unwrap_or(5),
+        format: matches
+            .get_one::<String>("msg-format")
+            .map(|s| s.as_str())
+            .unwrap_or("full")
+            .to_string(),
+        once: matches.get_flag("once"),
+        cleanup: matches.get_flag("cleanup"),
+        output_dir: matches.get_one::<String>("output-dir").cloned(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_extract_message_ids_from_history() {
+        let history = json!({
+            "history": [
+                {
+                    "messagesAdded": [
+                        { "message": { "id": "msg1", "threadId": "t1" } }
+                    ]
+                },
+                {
+                    "messagesAdded": [
+                        { "message": { "id": "msg2", "threadId": "t2" } },
+                        { "message": { "id": "msg1", "threadId": "t1" } } // duplicate
+                    ]
+                }
+            ]
+        });
+
+        let ids = extract_message_ids_from_history(&history);
+        assert_eq!(ids.len(), 2);
+        assert!(ids.contains(&"msg1".to_string()));
+        assert!(ids.contains(&"msg2".to_string()));
+    }
+
+    #[test]
+    fn test_extract_message_ids_empty() {
+        let history = json!({});
+        let ids = extract_message_ids_from_history(&history);
+        assert!(ids.is_empty());
+    }
+
+    #[test]
+    fn test_process_pull_response() {
+        let encoded_data = URL_SAFE
+            .encode(json!({ "emailAddress": "me@example.com", "historyId": 12345 }).to_string());
+        let response = json!({
+            "receivedMessages": [
+                {
+                    "ackId": "ack1",
+                    "message": {
+                        "data": encoded_data,
+                        "messageId": "msg1"
+                    }
+                },
+                {
+                    "ackId": "ack2",
+                    "message": {
+                        "data": URL_SAFE.encode(json!({ "historyId": 100 }).to_string()),
+                        "messageId": "msg2"
+                    }
+                }
+            ]
+        });
+
+        let (ack_ids, max_history) = process_pull_response(&response);
+        assert_eq!(ack_ids.len(), 2);
+        assert!(ack_ids.contains(&"ack1".to_string()));
+        assert!(ack_ids.contains(&"ack2".to_string()));
+        assert_eq!(max_history, 12345);
+    }
+
+    fn make_matches_watch(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("project").long("project"))
+            .arg(Arg::new("subscription").long("subscription"))
+            .arg(Arg::new("topic").long("topic"))
+            .arg(Arg::new("label-ids").long("label-ids"))
+            .arg(Arg::new("max-messages").long("max-messages"))
+            .arg(Arg::new("poll-interval").long("poll-interval"))
+            .arg(Arg::new("msg-format").long("msg-format"))
+            .arg(Arg::new("once").long("once").action(ArgAction::SetTrue))
+            .arg(
+                Arg::new("cleanup")
+                    .long("cleanup")
+                    .action(ArgAction::SetTrue),
+            )
+            .arg(Arg::new("output-dir").long("output-dir"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_watch_args() {
+        let matches = make_matches_watch(&[
+            "test",
+            "--project",
+            "p1",
+            "--subscription",
+            "s1",
+            "--max-messages",
+            "20",
+            "--once",
+        ]);
+        let config = parse_watch_args(&matches);
+        assert_eq!(config.project.unwrap(), "p1");
+        assert_eq!(config.subscription.unwrap(), "s1");
+        assert_eq!(config.max_messages, 20);
+        assert!(config.once);
+        assert!(!config.cleanup);
+        // Default check handled by unwrap_or
+        assert_eq!(config.poll_interval, 5);
+        assert_eq!(config.format, "full");
+        assert_eq!(config.label_ids, None);
+        assert_eq!(config.topic, None);
+        assert_eq!(config.output_dir, None);
+    }
+
+    #[test]
+    fn test_parse_watch_args_defaults() {
+        let matches = make_matches_watch(&["test"]);
+        let config = parse_watch_args(&matches);
+        assert_eq!(config.project, None);
+        assert_eq!(config.subscription, None);
+        assert_eq!(config.max_messages, 10);
+        assert_eq!(config.poll_interval, 5);
+        assert_eq!(config.format, "full");
+        assert!(!config.once);
+        assert!(!config.cleanup);
+    }
+
+    #[test]
+    fn test_parse_watch_args_invalid_numbers() {
+        let matches = make_matches_watch(&[
+            "test",
+            "--max-messages",
+            "not_a_number",
+            "--poll-interval",
+            "invalid",
+        ]);
+        let config = parse_watch_args(&matches);
+        // Should fallback to defaults
+        assert_eq!(config.max_messages, 10);
+        assert_eq!(config.poll_interval, 5);
+    }
+
+    #[test]
+    fn test_apply_sanitization_result_block_mode() {
+        let msg = json!({ "id": "msg1" });
+        let config = crate::helpers::modelarmor::SanitizeConfig {
+            template: Some("projects/x/locations/y/templates/z".to_string()),
+            mode: crate::helpers::modelarmor::SanitizeMode::Block,
+        };
+        let result = crate::helpers::modelarmor::SanitizationResult {
+            filter_match_state: "MATCH_FOUND".to_string(),
+            filter_results: json!([]),
+            invocation_result: "{}".to_string(),
+        };
+
+        let output = apply_sanitization_result(msg, &config, &result, "msg1");
+        assert!(output.is_none());
+    }
+
+    #[test]
+    fn test_apply_sanitization_result_warn_mode() {
+        let msg = json!({ "id": "msg1" });
+        let config = crate::helpers::modelarmor::SanitizeConfig {
+            template: Some("projects/x/locations/y/templates/z".to_string()),
+            mode: crate::helpers::modelarmor::SanitizeMode::Warn,
+        };
+        let result = crate::helpers::modelarmor::SanitizationResult {
+            filter_match_state: "MATCH_FOUND".to_string(),
+            filter_results: json!([]),
+            invocation_result: "{}".to_string(),
+        };
+
+        let output = apply_sanitization_result(msg, &config, &result, "msg1").unwrap();
+        // Warn mode adds the `_sanitization` metadata.
+        assert!(output.get("_sanitization").is_some());
+        assert_eq!(output["_sanitization"]["filterMatchState"], "MATCH_FOUND");
+    }
+
+    #[test]
+    fn test_apply_sanitization_result_no_match() {
+        let msg = json!({ "id": "msg1" });
+        let config = crate::helpers::modelarmor::SanitizeConfig {
+            template: Some("projects/x/locations/y/templates/z".to_string()),
+            mode: crate::helpers::modelarmor::SanitizeMode::Block,
+        };
+        let result = crate::helpers::modelarmor::SanitizationResult {
+            filter_match_state: "NO_MATCH_FOUND".to_string(),
+            filter_results: json!([]),
+            invocation_result: "{}".to_string(),
+        };
+
+        let output = apply_sanitization_result(msg.clone(), &config, &result, "msg1").unwrap();
+        // If no match found, block mode returns the exact input untouched.
+        assert_eq!(output, msg);
+        assert!(output.get("_sanitization").is_none());
+    }
+}
diff --git a/src/helpers/mod.rs b/src/helpers/mod.rs
new file mode 100644
index 00000000..3d696af1
--- /dev/null
+++ b/src/helpers/mod.rs
@@ -0,0 +1,63 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::error::GwsError;
+use clap::{ArgMatches, Command};
+use std::future::Future;
+use std::pin::Pin;
+pub mod calendar;
+pub mod chat;
+pub mod docs;
+pub mod drive;
+pub mod events;
+pub mod gmail;
+pub mod modelarmor;
+pub mod script;
+pub mod sheets;
+
+/// A trait for service-specific CLI helpers that inject custom commands.
+pub trait Helper: Send + Sync {
+    /// Injects subcommands into the service command.
+    fn inject_commands(&self, cmd: Command, doc: &crate::discovery::RestDescription) -> Command;
+
+    /// Attempts to handle a command. Returns Ok(Some(())) if handled,
+    /// Ok(None) if not handled (should fall back to dynamic dispatch),
+    /// or Err if handled but failed.
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        sanitize_config: &'a modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>>;
+
+    /// If true, only helper commands are shown (discovery-generated commands are suppressed).
+    fn helper_only(&self) -> bool {
+        false
+    }
+}
+
+pub fn get_helper(service: &str) -> Option<Box<dyn Helper>> {
+    match service {
+        "gmail" => Some(Box::new(gmail::GmailHelper)),
+        "sheets" => Some(Box::new(sheets::SheetsHelper)),
+        "docs" => Some(Box::new(docs::DocsHelper)),
+        "chat" => Some(Box::new(chat::ChatHelper)),
+        "drive" => Some(Box::new(drive::DriveHelper)),
+        "calendar" => Some(Box::new(calendar::CalendarHelper)),
+        "script" | "apps-script" => Some(Box::new(script::ScriptHelper)),
+        "workspaceevents" => Some(Box::new(events::EventsHelper)),
+        "modelarmor" => Some(Box::new(modelarmor::ModelArmorHelper)),
+        _ => None,
+    }
+}
diff --git a/src/helpers/modelarmor.rs b/src/helpers/modelarmor.rs
new file mode 100644
index 00000000..65dcd887
--- /dev/null
+++ b/src/helpers/modelarmor.rs
@@ -0,0 +1,743 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::discovery::RestDescription;
+use crate::error::GwsError;
+use anyhow::Context;
+use clap::{Arg, ArgMatches, Command};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::future::Future;
+use std::pin::Pin;
+
+/// Result of a Model Armor sanitization check.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SanitizationResult {
+    /// The overall state of the match (e.g., "MATCH_FOUND", "NO_MATCH_FOUND").
+    pub filter_match_state: String,
+    /// Detailed results from specific filters (PI, Jailbreak, etc.).
+    #[serde(default)]
+    pub filter_results: serde_json::Value,
+    /// The final decision based on the policy (e.g., "BLOCK", "ALLOW").
+    #[serde(default)]
+    pub invocation_result: String,
+}
+
+/// Controls behavior when sanitization finds a match.
+#[derive(Debug, Clone, PartialEq)]
+pub enum SanitizeMode {
+    /// Log warning to stderr, annotate output with _sanitization field
+    Warn,
+    /// Suppress response output, exit non-zero
+    Block,
+}
+
+/// Configuration for Model Armor sanitization, threaded through the CLI.
+#[derive(Debug, Clone)]
+pub struct SanitizeConfig {
+    pub template: Option<String>,
+    pub mode: SanitizeMode,
+}
+
+impl Default for SanitizeConfig {
+    /// Provides default values for `SanitizeConfig`.
+    ///
+    /// By default, no template is set (sanitization disabled) and the mode is `Warn`.
+    fn default() -> Self {
+        Self {
+            template: None,
+            mode: SanitizeMode::Warn,
+        }
+    }
+}
+
+impl SanitizeMode {
+    /// Parses a string into a `SanitizeMode`.
+    ///
+    /// * "block" (case-insensitive) -> `Block`
+    /// * Any other value -> `Warn` (safe default)
+    pub fn from_str(s: &str) -> Self {
+        match s.to_lowercase().as_str() {
+            "block" => SanitizeMode::Block,
+            _ => SanitizeMode::Warn,
+        }
+    }
+}
+
+pub struct ModelArmorHelper;
+
+/// Build the regional base URL for Model Armor API.
+/// The discovery doc rootUrl (modelarmor.us.rep.googleapis.com) is incorrect —
+/// Model Armor requires region-specific endpoints: modelarmor.{region}.rep.googleapis.com
+fn regional_base_url(location: &str) -> String {
+    format!("https://modelarmor.{location}.rep.googleapis.com/v1")
+}
+
+/// Extract location from a full template resource name.
+/// e.g. "projects/my-project/locations/us-central1/templates/my-template" -> "us-central1"
+fn extract_location(resource_name: &str) -> Option<&str> {
+    let parts: Vec<&str> = resource_name.split('/').collect();
+    for i in 0..parts.len() {
+        if parts[i] == "locations" && i + 1 < parts.len() {
+            return Some(parts[i + 1]);
+        }
+    }
+    None
+}
+
+impl Helper for ModelArmorHelper {
+    fn inject_commands(&self, mut cmd: Command, _doc: &RestDescription) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+sanitize-prompt")
+                .about("[Helper] Sanitize a user prompt through a Model Armor template")
+                .arg(
+                    Arg::new("template")
+                        .long("template")
+                        .help("Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE)")
+                        .required(true)
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("text")
+                        .long("text")
+                        .help("Text content to sanitize")
+                        .value_name("TEXT"),
+                )
+                .arg(
+                    Arg::new("json")
+                        .long("json")
+                        .help("Full JSON request body (overrides --text)")
+                        .value_name("JSON"),
+                )
+                .after_help("\
+EXAMPLES:
+  gws modelarmor +sanitize-prompt --template projects/P/locations/L/templates/T --text 'user input'
+  echo 'prompt' | gws modelarmor +sanitize-prompt --template ...
+
+TIPS:
+  If neither --text nor --json is given, reads from stdin.
+  For outbound safety, use +sanitize-response instead."),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+sanitize-response")
+                .about("[Helper] Sanitize a model response through a Model Armor template")
+                .arg(
+                    Arg::new("template")
+                        .long("template")
+                        .help("Full template resource name (projects/PROJECT/locations/LOCATION/templates/TEMPLATE)")
+                        .required(true)
+                        .value_name("NAME"),
+                )
+                .arg(
+                    Arg::new("text")
+                        .long("text")
+                        .help("Text content to sanitize")
+                        .value_name("TEXT"),
+                )
+                .arg(
+                    Arg::new("json")
+                        .long("json")
+                        .help("Full JSON request body (overrides --text)")
+                        .value_name("JSON"),
+                )
+                .after_help("\
+EXAMPLES:
+  gws modelarmor +sanitize-response --template projects/P/locations/L/templates/T --text 'model output'
+  model_cmd | gws modelarmor +sanitize-response --template ...
+
+TIPS:
+  Use for outbound safety (model -> user).
+  For inbound safety (user -> model), use +sanitize-prompt."),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+create-template")
+                .about("[Helper] Create a new Model Armor template")
+                .arg(
+                    Arg::new("project")
+                        .long("project")
+                        .help("GCP project ID")
+                        .required(true)
+                        .value_name("PROJECT"),
+                )
+                .arg(
+                    Arg::new("location")
+                        .long("location")
+                        .help("GCP location (e.g. us-central1)")
+                        .required(true)
+                        .value_name("LOCATION"),
+                )
+                .arg(
+                    Arg::new("template-id")
+                        .long("template-id")
+                        .help("Template ID to create")
+                        .required(true)
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("preset")
+                        .long("preset")
+                        .help("Use a preset template: jailbreak")
+                        .value_name("PRESET")
+                        .value_parser(["jailbreak"]),
+                )
+                .arg(
+                    Arg::new("json")
+                        .long("json")
+                        .help("JSON body for the template configuration (overrides --preset)")
+                        .value_name("JSON"),
+                )
+                .after_help("\
+EXAMPLES:
+  gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --preset jailbreak
+  gws modelarmor +create-template --project P --location us-central1 --template-id my-tmpl --json '{...}'
+
+TIPS:
+  Defaults to the jailbreak preset if neither --preset nor --json is given.
+  Use the resulting template name with +sanitize-prompt and +sanitize-response."),
+        );
+
+        cmd
+    }
+
+    fn helper_only(&self) -> bool {
+        true
+    }
+
+    fn handle<'a>(
+        &'a self,
+        _doc: &'a RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(sub) = matches.subcommand_matches("+sanitize-prompt") {
+                handle_sanitize(sub, "sanitizeUserPrompt", "userPromptData").await?;
+                return Ok(true);
+            }
+            if let Some(sub) = matches.subcommand_matches("+sanitize-response") {
+                handle_sanitize(sub, "sanitizeModelResponse", "modelResponseData").await?;
+                return Ok(true);
+            }
+            if let Some(sub) = matches.subcommand_matches("+create-template") {
+                handle_create_template(sub).await?;
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+
+pub const CLOUD_PLATFORM_SCOPE: &str = "https://www.googleapis.com/auth/cloud-platform";
+
+/// Sanitize text through a Model Armor template and return the result.
+/// Template format: projects/PROJECT/locations/LOCATION/templates/TEMPLATE
+pub async fn sanitize_text(template: &str, text: &str) -> Result<SanitizationResult, GwsError> {
+    let (body, url) = build_sanitize_request_data(template, text, "sanitizeUserPrompt")?;
+
+    let token = auth::get_token(&[CLOUD_PLATFORM_SCOPE])
+        .await
+        .context("Failed to get auth token for Model Armor")?;
+
+    let client = crate::client::build_client()?;
+    let resp = client
+        .post(&url)
+        .header("Authorization", format!("Bearer {token}"))
+        .header("Content-Type", "application/json")
+        .body(body)
+        .send()
+        .await
+        .context("Model Armor request failed")?;
+
+    let status = resp.status();
+    let resp_text = resp
+        .text()
+        .await
+        .context("Failed to read Model Armor response")?;
+
+    if !status.is_success() {
+        return Err(GwsError::Other(anyhow::anyhow!(
+            "Model Armor API returned status {status}: {resp_text}"
+        )));
+    }
+
+    parse_sanitize_response(&resp_text)
+}
+
+/// Make a POST request to Model Armor's regional API endpoint.
+async fn model_armor_post(url: &str, body: &str) -> Result<(), GwsError> {
+    let token = auth::get_token(&[CLOUD_PLATFORM_SCOPE])
+        .await
+        .context("Failed to get auth token")?;
+
+    let client = crate::client::build_client()?;
+    let resp = client
+        .post(url)
+        .header("Authorization", format!("Bearer {token}"))
+        .header("Content-Type", "application/json")
+        .body(body.to_string())
+        .send()
+        .await
+        .context("HTTP request failed")?;
+
+    let status = resp.status();
+    let text = resp.text().await.context("Failed to read response")?;
+
+    println!("{text}");
+
+    if !status.is_success() {
+        return Err(GwsError::Other(anyhow::anyhow!(
+            "API returned status {status}"
+        )));
+    }
+
+    Ok(())
+}
+
+/// Handle +sanitize-prompt and +sanitize-response
+async fn handle_sanitize(
+    matches: &ArgMatches,
+    method_name: &str,
+    data_field: &str,
+) -> Result<(), GwsError> {
+    let template = matches.get_one::<String>("template").unwrap();
+
+    let location = extract_location(template).ok_or_else(|| {
+        GwsError::Validation(
+            "Cannot extract location from template name. Expected format: projects/PROJECT/locations/LOCATION/templates/TEMPLATE".to_string(),
+        )
+    })?;
+
+    let body = parse_sanitize_args(matches, data_field)?;
+
+    let base = regional_base_url(location);
+    let url = format!("{base}/{template}:{method_name}");
+
+    model_armor_post(&url, &body).await
+}
+
+#[derive(Debug, PartialEq)]
+pub struct CreateTemplateConfig {
+    pub project: String,
+    pub location: String,
+    pub template_id: String,
+    pub body: String,
+}
+
+fn parse_create_template_args(matches: &ArgMatches) -> Result<CreateTemplateConfig, GwsError> {
+    let project = matches.get_one::<String>("project").unwrap().clone();
+    let location = matches.get_one::<String>("location").unwrap().clone();
+    let template_id = matches.get_one::<String>("template-id").unwrap().clone();
+
+    let body = if let Some(json_str) = matches.get_one::<String>("json") {
+        json_str.clone()
+    } else {
+        let preset = matches
+            .get_one::<String>("preset")
+            .map(|s| s.as_str())
+            .unwrap_or("jailbreak");
+        load_preset_template(preset)?
+    };
+
+    Ok(CreateTemplateConfig {
+        project,
+        location,
+        template_id,
+        body,
+    })
+}
+
+pub fn build_create_template_url(config: &CreateTemplateConfig) -> String {
+    let base = regional_base_url(&config.location);
+    let parent = format!("projects/{}/locations/{}", config.project, config.location);
+    format!(
+        "{base}/{parent}/templates?templateId={}",
+        config.template_id
+    )
+}
+
+/// Handle +create-template
+async fn handle_create_template(matches: &ArgMatches) -> Result<(), GwsError> {
+    let config = parse_create_template_args(matches)?;
+    let url = build_create_template_url(&config);
+
+    eprintln!(
+        "Creating template '{}' with preset: {}",
+        config.template_id,
+        matches
+            .get_one::<String>("preset")
+            .map(|s| s.as_str())
+            .unwrap_or("jailbreak")
+    );
+
+    model_armor_post(&url, &config.body).await
+}
+
+/// Loads a preset template JSON file from the templates/modelarmor/ directory.
+/// Falls back to the embedded template if the file is not found.
+fn load_preset_template(name: &str) -> Result<String, GwsError> {
+    // Try to find templates relative to the executable
+    let exe_path = std::env::current_exe().ok();
+    let search_dirs: Vec<std::path::PathBuf> = [
+        // Relative to current directory
+        Some(std::path::PathBuf::from("templates/modelarmor")),
+        // Relative to executable
+        exe_path
+            .as_ref()
+            .and_then(|p| p.parent())
+            .map(|p| p.join("../templates/modelarmor")),
+        exe_path
+            .as_ref()
+            .and_then(|p| p.parent())
+            .map(|p| p.join("templates/modelarmor")),
+    ]
+    .into_iter()
+    .flatten()
+    .collect();
+
+    let filename = format!("{name}.json");
+
+    for dir in &search_dirs {
+        let path = dir.join(&filename);
+        if path.exists() {
+            let content = std::fs::read_to_string(&path)
+                .with_context(|| format!("Failed to read template '{}'", path.display()))?;
+            eprintln!("Using preset template from: {}", path.display());
+            return Ok(content);
+        }
+    }
+
+    // Fallback: embedded preset
+    eprintln!("Template file not found, using embedded '{}' preset", name);
+    Ok(include_str!("../../templates/modelarmor/jailbreak.json").to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_sanitize_config_default() {
+        let config = SanitizeConfig::default();
+        assert!(config.template.is_none());
+        assert_eq!(config.mode, SanitizeMode::Warn);
+    }
+
+    #[test]
+    fn test_sanitize_config_with_template() {
+        let config = SanitizeConfig {
+            template: Some("projects/p/locations/us-central1/templates/t".to_string()),
+            mode: SanitizeMode::Block,
+        };
+        assert_eq!(
+            config.template.as_deref(),
+            Some("projects/p/locations/us-central1/templates/t")
+        );
+        assert_eq!(config.mode, SanitizeMode::Block);
+    }
+
+    #[test]
+    fn test_sanitize_mode_from_str_warn() {
+        assert_eq!(SanitizeMode::from_str("warn"), SanitizeMode::Warn);
+        assert_eq!(SanitizeMode::from_str("WARN"), SanitizeMode::Warn);
+        assert_eq!(SanitizeMode::from_str("Warn"), SanitizeMode::Warn);
+    }
+
+    #[test]
+    fn test_sanitize_mode_from_str_block() {
+        assert_eq!(SanitizeMode::from_str("block"), SanitizeMode::Block);
+        assert_eq!(SanitizeMode::from_str("BLOCK"), SanitizeMode::Block);
+        assert_eq!(SanitizeMode::from_str("Block"), SanitizeMode::Block);
+    }
+
+    #[test]
+    fn test_sanitize_mode_from_str_unknown_defaults_to_warn() {
+        assert_eq!(SanitizeMode::from_str(""), SanitizeMode::Warn);
+        assert_eq!(SanitizeMode::from_str("invalid"), SanitizeMode::Warn);
+        assert_eq!(SanitizeMode::from_str("stop"), SanitizeMode::Warn);
+    }
+
+    #[test]
+    fn test_extract_location_valid() {
+        assert_eq!(
+            extract_location("projects/my-project/locations/us-central1/templates/my-template"),
+            Some("us-central1")
+        );
+    }
+
+    #[test]
+    fn test_extract_location_different_region() {
+        assert_eq!(
+            extract_location("projects/p/locations/europe-west1/templates/t"),
+            Some("europe-west1")
+        );
+    }
+
+    #[test]
+    fn test_extract_location_no_locations() {
+        assert_eq!(extract_location("projects/my-project/templates/t"), None);
+    }
+
+    #[test]
+    fn test_extract_location_empty() {
+        assert_eq!(extract_location(""), None);
+    }
+
+    #[test]
+    fn test_extract_location_trailing_locations() {
+        // "locations" at the end with no value after
+        assert_eq!(extract_location("projects/p/locations"), None);
+    }
+
+    #[test]
+    fn test_regional_base_url() {
+        assert_eq!(
+            regional_base_url("us-central1"),
+            "https://modelarmor.us-central1.rep.googleapis.com/v1"
+        );
+    }
+
+    #[test]
+    fn test_regional_base_url_different_region() {
+        assert_eq!(
+            regional_base_url("europe-west1"),
+            "https://modelarmor.europe-west1.rep.googleapis.com/v1"
+        );
+    }
+
+    #[test]
+    fn test_cloud_platform_scope_constant() {
+        assert_eq!(
+            CLOUD_PLATFORM_SCOPE,
+            "https://www.googleapis.com/auth/cloud-platform"
+        );
+    }
+
+    #[test]
+    fn test_build_sanitize_request_data() {
+        let template = "projects/p/locations/us-central1/templates/t";
+        let (body, _) =
+            build_sanitize_request_data(template, "some text", "sanitizeUserPrompt").unwrap();
+        let json: serde_json::Value = serde_json::from_str(&body).unwrap();
+        assert_eq!(json["userPromptData"]["text"], "some text");
+    }
+
+    #[test]
+    fn test_parse_sanitize_response_success() {
+        let json_resp = json!({
+            "sanitizationResult": {
+                "filterMatchState": "MATCH_FOUND",
+                "filterResults": {},
+                "invocationResult": "SUCCESS"
+            }
+        })
+        .to_string();
+
+        let res = parse_sanitize_response(&json_resp).unwrap();
+        assert_eq!(res.filter_match_state, "MATCH_FOUND");
+    }
+
+    #[test]
+    fn test_parse_sanitize_response_missing_field() {
+        let json_resp = json!({}).to_string();
+        assert!(parse_sanitize_response(&json_resp).is_err());
+    }
+}
+
+pub fn build_sanitize_request_data(
+    template: &str,
+    text: &str,
+    method: &str,
+) -> Result<(String, String), GwsError> {
+    let location = extract_location(template).ok_or_else(|| {
+        GwsError::Validation(
+            "Cannot extract location from --sanitize template. Expected format: projects/PROJECT/locations/LOCATION/templates/TEMPLATE".to_string(),
+        )
+    })?;
+
+    let base = regional_base_url(location);
+    let url = format!("{base}/{template}:{method}");
+
+    // Identify data field based on method
+    let data_field = if method == "sanitizeUserPrompt" {
+        "userPromptData"
+    } else {
+        "modelResponseData"
+    };
+
+    let body = json!({data_field: {"text": text}}).to_string();
+    Ok((body, url))
+}
+
+pub fn parse_sanitize_response(resp_text: &str) -> Result<SanitizationResult, GwsError> {
+    // Parse the response to extract sanitizationResult
+    let parsed: serde_json::Value =
+        serde_json::from_str(resp_text).context("Failed to parse Model Armor response")?;
+
+    let result = parsed.get("sanitizationResult").ok_or_else(|| {
+        GwsError::Other(anyhow::anyhow!(
+            "No sanitizationResult in Model Armor response"
+        ))
+    })?;
+
+    let res =
+        serde_json::from_value(result.clone()).context("Failed to parse sanitization result")?;
+    Ok(res)
+}
+
+fn parse_sanitize_args(matches: &ArgMatches, data_field: &str) -> Result<String, GwsError> {
+    if let Some(json_str) = matches.get_one::<String>("json") {
+        Ok(json_str.clone())
+    } else if let Some(text) = matches.get_one::<String>("text") {
+        let mut body = serde_json::Map::new();
+        body.insert(data_field.to_string(), json!({"text": text}));
+        Ok(serde_json::Value::Object(body).to_string())
+    } else {
+        // Try to read from stdin, but since we can't easily test stdin in unit tests,
+        // we might check for TTY or empty stdin.
+        // For simplicity here, we assume if we reach here without text/json, we try stdin.
+
+        // Note: We removed the TTY check to avoid adding 'atty' or 'is-terminal' dependency.
+        // This means it will block on stdin if no input is provided, which is standard CLI behavior.
+
+        let stdin_text =
+            std::io::read_to_string(std::io::stdin()).context("Failed to read stdin")?;
+
+        if stdin_text.trim().is_empty() {
+            return Err(GwsError::Validation(
+                "Provide text via --text, --json, or pipe to stdin".to_string(),
+            ));
+        }
+        let mut body = serde_json::Map::new();
+        body.insert(data_field.to_string(), json!({"text": stdin_text.trim()}));
+        Ok(serde_json::Value::Object(body).to_string())
+    }
+}
+
+#[cfg(test)]
+mod parsing_tests {
+    use super::*;
+    use clap::{Arg, Command};
+
+    fn make_matches(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("json").long("json"))
+            .arg(Arg::new("text").long("text"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_sanitize_args_json() {
+        let matches = make_matches(&["test", "--json", "{\"foo\":\"bar\"}"]);
+        let body = parse_sanitize_args(&matches, "field").unwrap();
+        assert_eq!(body, "{\"foo\":\"bar\"}");
+    }
+
+    #[test]
+    fn test_parse_sanitize_args_text() {
+        let matches = make_matches(&["test", "--text", "hello"]);
+        let body = parse_sanitize_args(&matches, "field").unwrap();
+        let json: serde_json::Value = serde_json::from_str(&body).unwrap();
+        assert_eq!(json["field"]["text"], "hello");
+    }
+
+    #[test]
+    fn test_build_create_template_url() {
+        let config = CreateTemplateConfig {
+            project: "p".to_string(),
+            location: "us-central1".to_string(),
+            template_id: "t".to_string(),
+            body: "{}".to_string(),
+        };
+        let url = build_create_template_url(&config);
+        assert_eq!(
+            url,
+            "https://modelarmor.us-central1.rep.googleapis.com/v1/projects/p/locations/us-central1/templates?templateId=t"
+        );
+    }
+
+    fn make_matches_create(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("project").long("project").required(true))
+            .arg(Arg::new("location").long("location").required(true))
+            .arg(Arg::new("template-id").long("template-id").required(true))
+            .arg(Arg::new("json").long("json"))
+            .arg(Arg::new("preset").long("preset"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_parse_create_template_args_json() {
+        let matches = make_matches_create(&[
+            "test",
+            "--project",
+            "p",
+            "--location",
+            "l",
+            "--template-id",
+            "t",
+            "--json",
+            "{\"a\":1}",
+        ]);
+        let config = parse_create_template_args(&matches).unwrap();
+        assert_eq!(config.project, "p");
+        assert_eq!(config.location, "l");
+        assert_eq!(config.template_id, "t");
+        assert_eq!(config.body, "{\"a\":1}");
+    }
+
+    #[test]
+    fn test_parse_create_template_args_preset() {
+        let matches = make_matches_create(&[
+            "test",
+            "--project",
+            "p",
+            "--location",
+            "l",
+            "--template-id",
+            "t",
+            "--preset",
+            "jailbreak",
+        ]);
+        let config = parse_create_template_args(&matches).unwrap();
+        assert_eq!(config.project, "p");
+        assert_eq!(config.location, "l");
+        assert_eq!(config.template_id, "t");
+        assert!(config.body.contains("piAndJailbreakFilterSettings"));
+    }
+
+    #[test]
+    fn test_load_preset_template_fallback() {
+        // Will test loading the built-in preset template
+        let content = load_preset_template("jailbreak").unwrap();
+        assert!(content.contains("piAndJailbreakFilterSettings"));
+    }
+
+    #[test]
+    fn test_inject_commands() {
+        let helper = ModelArmorHelper;
+        let cmd = Command::new("test");
+        let doc = crate::discovery::RestDescription::default();
+
+        let cmd = helper.inject_commands(cmd, &doc);
+        let subcommands: Vec<_> = cmd.get_subcommands().map(|s| s.get_name()).collect();
+        assert!(subcommands.contains(&"+sanitize-prompt"));
+        assert!(subcommands.contains(&"+sanitize-response"));
+        assert!(subcommands.contains(&"+create-template"));
+    }
+}
diff --git a/src/helpers/script.rs b/src/helpers/script.rs
new file mode 100644
index 00000000..5590bec0
--- /dev/null
+++ b/src/helpers/script.rs
@@ -0,0 +1,287 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use anyhow::Context;
+use clap::{Arg, ArgMatches, Command};
+use serde_json::json;
+use std::fs;
+use std::future::Future;
+use std::path::Path;
+use std::pin::Pin;
+
+pub struct ScriptHelper;
+
+impl Helper for ScriptHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+push")
+                .about("[Helper] Upload local files to an Apps Script project")
+                .arg(
+                    Arg::new("script")
+                        .long("script")
+                        .help("Script Project ID")
+                        .required(true)
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("dir")
+                        .long("dir")
+                        .help("Directory containing script files (defaults to current dir)")
+                        .value_name("DIR"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws script +push --script SCRIPT_ID
+  gws script +push --script SCRIPT_ID --dir ./src
+
+TIPS:
+  Supports .gs, .js, .html, and appsscript.json files.
+  Skips hidden files and node_modules automatically.
+  This replaces ALL files in the project.",
+                ),
+        );
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+push") {
+                let script_id = matches.get_one::<String>("script").unwrap();
+                let dir_path = matches
+                    .get_one::<String>("dir")
+                    .map(|s| s.as_str())
+                    .unwrap_or(".");
+
+                let mut files = Vec::new();
+                visit_dirs(Path::new(dir_path), &mut files)?;
+
+                if files.is_empty() {
+                    return Err(GwsError::Validation(format!(
+                        "No eligible files found in '{}'",
+                        dir_path
+                    )));
+                }
+
+                // Find method: projects.updateContent
+                let projects_res = doc.resources.get("projects").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'projects' not found".to_string())
+                })?;
+                let update_method = projects_res.methods.get("updateContent").ok_or_else(|| {
+                    GwsError::Discovery("Method 'projects.updateContent' not found".to_string())
+                })?;
+
+                // Build body
+                let body = json!({
+                    "files": files
+                });
+                let body_str = body.to_string();
+
+                let scopes: Vec<&str> = update_method.scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scopes).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                let params = json!({
+                    "scriptId": script_id
+                });
+                let params_str = params.to_string();
+
+                executor::execute_method(
+                    doc,
+                    update_method,
+                    Some(&params_str),
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &executor::PaginationConfig::default(),
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+            Ok(false)
+        })
+    }
+}
+
+fn visit_dirs(dir: &Path, files: &mut Vec<serde_json::Value>) -> Result<(), GwsError> {
+    if dir.is_dir() {
+        for entry in fs::read_dir(dir).context("Failed to read dir")? {
+            let entry = entry.context("Failed to read entry")?;
+            let path = entry.path();
+            if path.is_dir() {
+                visit_dirs(&path, files)?;
+            } else if let Some(file_obj) = process_file(&path)? {
+                files.push(file_obj);
+            }
+        }
+    }
+    Ok(())
+}
+
+fn process_file(path: &Path) -> Result<Option<serde_json::Value>, GwsError> {
+    let filename = path.file_name().and_then(|s| s.to_str()).unwrap_or("");
+    let extension = path.extension().and_then(|s| s.to_str()).unwrap_or("");
+
+    // Skip hidden files, node_modules, .git, etc. (basic filtering)
+    if filename.starts_with('.') || path.components().any(|c| c.as_os_str() == "node_modules") {
+        return Ok(None);
+    }
+
+    let (type_val, name_val) = match extension {
+        "gs" | "js" => (
+            "SERVER_JS",
+            filename.trim_end_matches(".js").trim_end_matches(".gs"),
+        ),
+        "html" => ("HTML", filename.trim_end_matches(".html")),
+        "json" => {
+            if filename == "appsscript.json" {
+                ("JSON", "appsscript")
+            } else {
+                return Ok(None);
+            }
+        }
+        _ => return Ok(None),
+    };
+
+    let content = fs::read_to_string(path).map_err(|e| {
+        GwsError::Validation(format!("Failed to read file '{}': {}", path.display(), e))
+    })?;
+
+    Ok(Some(json!({
+        "name": name_val,
+        "type": type_val,
+        "source": content
+    })))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs::File;
+    use std::io::Write;
+    use tempfile::tempdir;
+
+    #[test]
+    fn test_process_file_server_js() {
+        let dir = tempdir().unwrap();
+        let file_path = dir.path().join("code.gs");
+        let mut file = File::create(&file_path).unwrap();
+        writeln!(file, "function foo() {{}}").unwrap();
+
+        let result = process_file(&file_path).unwrap().unwrap();
+        assert_eq!(result["name"], "code");
+        assert_eq!(result["type"], "SERVER_JS");
+        assert_eq!(
+            result["source"].as_str().unwrap().trim(),
+            "function foo() {}"
+        );
+    }
+
+    #[test]
+    fn test_process_file_html() {
+        let dir = tempdir().unwrap();
+        let file_path = dir.path().join("index.html");
+        let mut file = File::create(&file_path).unwrap();
+        writeln!(file, "<html></html>").unwrap();
+
+        let result = process_file(&file_path).unwrap().unwrap();
+        assert_eq!(result["name"], "index");
+        assert_eq!(result["type"], "HTML");
+    }
+
+    #[test]
+    fn test_process_file_appsscript_json() {
+        let dir = tempdir().unwrap();
+        let file_path = dir.path().join("appsscript.json");
+        let mut file = File::create(&file_path).unwrap();
+        writeln!(file, "{{}}").unwrap();
+
+        let result = process_file(&file_path).unwrap().unwrap();
+        assert_eq!(result["name"], "appsscript");
+        assert_eq!(result["type"], "JSON");
+    }
+
+    #[test]
+    fn test_process_file_ignored() {
+        let dir = tempdir().unwrap();
+
+        // Random JSON
+        let p1 = dir.path().join("other.json");
+        File::create(&p1).unwrap();
+        assert!(process_file(&p1).unwrap().is_none());
+
+        // Hidden file
+        let p2 = dir.path().join(".hidden.gs");
+        File::create(&p2).unwrap();
+        assert!(process_file(&p2).unwrap().is_none());
+
+        // node_modules
+        let node_modules = dir.path().join("node_modules");
+        fs::create_dir(&node_modules).unwrap();
+        let p3 = node_modules.join("dep.gs");
+        File::create(&p3).unwrap();
+        assert!(process_file(&p3).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_visit_dirs() {
+        let dir = tempdir().unwrap();
+
+        // Root file
+        let f1 = dir.path().join("root.gs");
+        File::create(&f1).unwrap();
+
+        // Subdir file
+        let sub = dir.path().join("src");
+        fs::create_dir(&sub).unwrap();
+        let f2 = sub.join("utils.js");
+        File::create(&f2).unwrap();
+
+        // Ignored file
+        let f3 = dir.path().join("ignore.txt");
+        File::create(&f3).unwrap();
+
+        let mut files = Vec::new();
+        visit_dirs(dir.path(), &mut files).unwrap();
+
+        assert_eq!(files.len(), 2);
+
+        let names: Vec<&str> = files.iter().map(|f| f["name"].as_str().unwrap()).collect();
+
+        assert!(names.contains(&"root"));
+        assert!(names.contains(&"utils"));
+    }
+}
diff --git a/src/helpers/sheets.rs b/src/helpers/sheets.rs
new file mode 100644
index 00000000..e35c61cd
--- /dev/null
+++ b/src/helpers/sheets.rs
@@ -0,0 +1,418 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use super::Helper;
+use crate::auth;
+use crate::error::GwsError;
+use crate::executor;
+use clap::{Arg, ArgMatches, Command};
+use serde_json::json;
+use std::future::Future;
+use std::pin::Pin;
+
+pub struct SheetsHelper;
+
+impl Helper for SheetsHelper {
+    fn inject_commands(
+        &self,
+        mut cmd: Command,
+        _doc: &crate::discovery::RestDescription,
+    ) -> Command {
+        cmd = cmd.subcommand(
+            Command::new("+append")
+                .about("[Helper] Append a row to a spreadsheet")
+                .arg(
+                    Arg::new("spreadsheet")
+                        .long("spreadsheet")
+                        .help("Spreadsheet ID")
+                        .required(true)
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("values")
+                        .long("values")
+                        .help("Comma-separated values (simple strings)")
+                        .value_name("VALUES"),
+                )
+                .arg(
+                    Arg::new("json-values")
+                        .long("json-values")
+                        .help("JSON array of rows, e.g. '[[\"a\",\"b\"],[\"c\",\"d\"]]'")
+                        .value_name("JSON"),
+                )
+                .after_help(
+                    r#"EXAMPLES:
+  gws sheets +append --spreadsheet ID --values 'Alice,100,true'
+  gws sheets +append --spreadsheet ID --json-values '[["a","b"],["c","d"]]'
+
+TIPS:
+  Use --values for simple single-row appends.
+  Use --json-values for bulk multi-row inserts."#,
+                ),
+        );
+
+        cmd = cmd.subcommand(
+            Command::new("+read")
+                .about("[Helper] Read values from a spreadsheet")
+                .arg(
+                    Arg::new("spreadsheet")
+                        .long("spreadsheet")
+                        .help("Spreadsheet ID")
+                        .required(true)
+                        .value_name("ID"),
+                )
+                .arg(
+                    Arg::new("range")
+                        .long("range")
+                        .help("Range to read (e.g. 'Sheet1!A1:B2')")
+                        .required(true)
+                        .value_name("RANGE"),
+                )
+                .after_help(
+                    "\
+EXAMPLES:
+  gws sheets +read --spreadsheet ID --range 'Sheet1!A1:D10'
+  gws sheets +read --spreadsheet ID --range Sheet1
+
+TIPS:
+  Read-only — never modifies the spreadsheet.
+  For advanced options, use the raw values.get API.",
+                ),
+        );
+
+        cmd
+    }
+
+    fn handle<'a>(
+        &'a self,
+        doc: &'a crate::discovery::RestDescription,
+        matches: &'a ArgMatches,
+        _sanitize_config: &'a crate::helpers::modelarmor::SanitizeConfig,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, GwsError>> + Send + 'a>> {
+        Box::pin(async move {
+            if let Some(matches) = matches.subcommand_matches("+append") {
+                let config = parse_append_args(matches);
+                let (params_str, body_str, scopes) = build_append_request(&config, doc)?;
+
+                let scope_strs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scope_strs).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                let spreadsheets_res = doc.resources.get("spreadsheets").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spreadsheets' not found".to_string())
+                })?;
+                let values_res = spreadsheets_res.resources.get("values").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spreadsheets.values' not found".to_string())
+                })?;
+                let append_method = values_res.methods.get("append").ok_or_else(|| {
+                    GwsError::Discovery("Method 'spreadsheets.values.append' not found".to_string())
+                })?;
+
+                let pagination = executor::PaginationConfig {
+                    page_all: false,
+                    page_limit: 10,
+                    page_delay_ms: 100,
+                };
+
+                executor::execute_method(
+                    doc,
+                    append_method,
+                    Some(&params_str),
+                    Some(&body_str),
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &pagination,
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+
+            if let Some(matches) = matches.subcommand_matches("+read") {
+                let config = parse_read_args(matches);
+                let (params_str, scopes) = build_read_request(&config, doc)?;
+
+                // Re-find method
+                let spreadsheets_res = doc.resources.get("spreadsheets").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spreadsheets' not found".to_string())
+                })?;
+                let values_res = spreadsheets_res.resources.get("values").ok_or_else(|| {
+                    GwsError::Discovery("Resource 'spreadsheets.values' not found".to_string())
+                })?;
+                let get_method = values_res.methods.get("get").ok_or_else(|| {
+                    GwsError::Discovery("Method 'spreadsheets.values.get' not found".to_string())
+                })?;
+
+                let scope_strs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
+                let (token, auth_method) = match auth::get_token(&scope_strs).await {
+                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                    Err(_) => (None, executor::AuthMethod::None),
+                };
+
+                executor::execute_method(
+                    doc,
+                    get_method,
+                    Some(&params_str),
+                    None,
+                    token.as_deref(),
+                    auth_method,
+                    None,
+                    None,
+                    matches.get_flag("dry-run"),
+                    &executor::PaginationConfig::default(),
+                    None,
+                    &crate::helpers::modelarmor::SanitizeMode::Warn,
+                    &crate::formatter::OutputFormat::default(),
+                )
+                .await?;
+
+                return Ok(true);
+            }
+
+            Ok(false)
+        })
+    }
+}
+
+fn build_append_request(
+    config: &AppendConfig,
+    doc: &crate::discovery::RestDescription,
+) -> Result<(String, String, Vec<String>), GwsError> {
+    let spreadsheets_res = doc
+        .resources
+        .get("spreadsheets")
+        .ok_or_else(|| GwsError::Discovery("Resource 'spreadsheets' not found".to_string()))?;
+    let values_res = spreadsheets_res.resources.get("values").ok_or_else(|| {
+        GwsError::Discovery("Resource 'spreadsheets.values' not found".to_string())
+    })?;
+    let append_method = values_res.methods.get("append").ok_or_else(|| {
+        GwsError::Discovery("Method 'spreadsheets.values.append' not found".to_string())
+    })?;
+
+    let range = "A1";
+
+    let params = json!({
+        "spreadsheetId": config.spreadsheet_id,
+        "range": range,
+        "valueInputOption": "USER_ENTERED"
+    });
+
+    // We use `json!` macro to construct a generic JSON Value for the request body.
+    // This allows us to easily create nested objects without defining explicit structs
+    // for every API request body.
+    let body = json!({
+        "values": [config.values]
+    });
+
+    // Map `&String` scope URLs to owned `String`s for the return value
+    let scopes: Vec<String> = append_method.scopes.iter().map(|s| s.to_string()).collect();
+
+    Ok((params.to_string(), body.to_string(), scopes))
+}
+
+fn build_read_request(
+    config: &ReadConfig,
+    doc: &crate::discovery::RestDescription,
+) -> Result<(String, Vec<String>), GwsError> {
+    // ... resource lookup omitted for brevity ...
+    let spreadsheets_res = doc
+        .resources
+        .get("spreadsheets")
+        .ok_or_else(|| GwsError::Discovery("Resource 'spreadsheets' not found".to_string()))?;
+    let values_res = spreadsheets_res.resources.get("values").ok_or_else(|| {
+        GwsError::Discovery("Resource 'spreadsheets.values' not found".to_string())
+    })?;
+    let get_method = values_res.methods.get("get").ok_or_else(|| {
+        GwsError::Discovery("Method 'spreadsheets.values.get' not found".to_string())
+    })?;
+
+    let params = json!({
+        "spreadsheetId": config.spreadsheet_id,
+        "range": config.range
+    });
+
+    let scopes: Vec<String> = get_method.scopes.iter().map(|s| s.to_string()).collect();
+
+    Ok((params.to_string(), scopes))
+}
+
+/// Configuration for appending values to a spreadsheet.
+///
+/// Holds the parsed arguments for the `+append` subcommand.
+pub struct AppendConfig {
+    /// The ID of the spreadsheet to append to.
+    pub spreadsheet_id: String,
+    /// The values to append, as a vector of strings.
+    pub values: Vec<String>,
+}
+
+/// Parses arguments for the `+append` command.
+///
+/// Splits the comma-separated `values` argument into a `Vec<String>`.
+pub fn parse_append_args(matches: &ArgMatches) -> AppendConfig {
+    let values = if let Some(json_str) = matches.get_one::<String>("json-values") {
+        // Parse JSON array of rows
+        if let Ok(parsed) = serde_json::from_str::<Vec<Vec<String>>>(json_str) {
+            parsed.into_iter().flatten().collect()
+        } else {
+            // Treat as single row JSON array
+            serde_json::from_str::<Vec<String>>(json_str).unwrap_or_default()
+        }
+    } else if let Some(values_str) = matches.get_one::<String>("values") {
+        values_str.split(',').map(|s| s.to_string()).collect()
+    } else {
+        Vec::new()
+    };
+
+    AppendConfig {
+        spreadsheet_id: matches.get_one::<String>("spreadsheet").unwrap().clone(),
+        values,
+    }
+}
+
+/// Configuration for reading values from a spreadsheet.
+pub struct ReadConfig {
+    pub spreadsheet_id: String,
+    /// A1 notation range (e.g. "Sheet1!A1:B2").
+    pub range: String,
+}
+
+pub fn parse_read_args(matches: &ArgMatches) -> ReadConfig {
+    ReadConfig {
+        spreadsheet_id: matches.get_one::<String>("spreadsheet").unwrap().clone(),
+        range: matches.get_one::<String>("range").unwrap().clone(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::discovery::{RestDescription, RestMethod, RestResource};
+    use std::collections::HashMap;
+
+    fn make_mock_doc() -> RestDescription {
+        let mut methods = HashMap::new();
+        methods.insert(
+            "append".to_string(),
+            RestMethod {
+                scopes: vec!["https://scope".to_string()],
+                ..Default::default()
+            },
+        );
+        methods.insert(
+            "get".to_string(),
+            RestMethod {
+                scopes: vec!["https://scope".to_string()],
+                ..Default::default()
+            },
+        );
+
+        let mut values_res = RestResource::default();
+        values_res.methods = methods;
+
+        let mut spreadsheets_res = RestResource::default();
+        spreadsheets_res
+            .resources
+            .insert("values".to_string(), values_res);
+
+        let mut resources = HashMap::new();
+        resources.insert("spreadsheets".to_string(), spreadsheets_res);
+
+        RestDescription {
+            resources,
+            ..Default::default()
+        }
+    }
+
+    fn make_matches_append(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("spreadsheet").long("spreadsheet"))
+            .arg(Arg::new("values").long("values"))
+            .arg(Arg::new("json-values").long("json-values"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    fn make_matches_read(args: &[&str]) -> ArgMatches {
+        let cmd = Command::new("test")
+            .arg(Arg::new("spreadsheet").long("spreadsheet"))
+            .arg(Arg::new("range").long("range"));
+        cmd.try_get_matches_from(args).unwrap()
+    }
+
+    #[test]
+    fn test_build_append_request() {
+        let doc = make_mock_doc();
+        let config = AppendConfig {
+            spreadsheet_id: "123".to_string(),
+            values: vec!["a".to_string(), "b".to_string(), "c".to_string()],
+        };
+        let (params, body, scopes) = build_append_request(&config, &doc).unwrap();
+
+        assert!(params.contains("123"));
+        assert!(params.contains("USER_ENTERED"));
+        assert!(body.contains("a"));
+        assert!(body.contains("b"));
+        assert_eq!(scopes[0], "https://scope");
+    }
+
+    #[test]
+    fn test_build_read_request() {
+        let doc = make_mock_doc();
+        let config = ReadConfig {
+            spreadsheet_id: "123".to_string(),
+            range: "A1:B2".to_string(),
+        };
+        let (params, scopes) = build_read_request(&config, &doc).unwrap();
+
+        assert!(params.contains("123"));
+        assert!(params.contains("A1:B2"));
+        assert_eq!(scopes[0], "https://scope");
+    }
+
+    #[test]
+    fn test_parse_append_args() {
+        let matches = make_matches_append(&["test", "--spreadsheet", "123", "--values", "a,b,c"]);
+        let config = parse_append_args(&matches);
+        assert_eq!(config.spreadsheet_id, "123");
+        assert_eq!(config.values, vec!["a", "b", "c"]);
+    }
+
+    #[test]
+    fn test_parse_read_args() {
+        let matches = make_matches_read(&["test", "--spreadsheet", "123", "--range", "A1:B2"]);
+        let config = parse_read_args(&matches);
+        assert_eq!(config.spreadsheet_id, "123");
+        assert_eq!(config.range, "A1:B2");
+    }
+
+    #[test]
+    fn test_inject_commands() {
+        let helper = SheetsHelper;
+        let cmd = Command::new("test");
+        let doc = crate::discovery::RestDescription::default();
+
+        let cmd = helper.inject_commands(cmd, &doc);
+        let subcommands: Vec<_> = cmd.get_subcommands().map(|s| s.get_name()).collect();
+        assert!(subcommands.contains(&"+append"));
+        assert!(subcommands.contains(&"+read"));
+    }
+}
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 00000000..2d6bb14a
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,511 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Google Workspace CLI (gws)
+//!
+//! A dynamic, schema-driven CLI for Google Workspace APIs.
+//! This tool dynamically parses Google API Discovery Documents to construct CLI commands.
+//! It supports deep schema validation, OAuth / Service Account authentication,
+//! interactive prompts, and integration with Model Armor.
+
+mod auth;
+pub(crate) mod auth_commands;
+mod client;
+mod commands;
+pub(crate) mod credential_store;
+mod discovery;
+mod error;
+mod executor;
+mod formatter;
+mod generate_skills;
+mod helpers;
+mod oauth_config;
+mod schema;
+mod services;
+mod setup;
+mod setup_tui;
+mod token_storage;
+
+use error::{print_error_json, GwsError};
+
+#[tokio::main]
+async fn main() {
+    // Load .env file if present (silently ignored if missing)
+    let _ = dotenvy::dotenv();
+
+    if let Err(err) = run().await {
+        print_error_json(&err);
+        std::process::exit(1);
+    }
+}
+
+async fn run() -> Result<(), GwsError> {
+    let args: Vec<String> = std::env::args().collect();
+
+    if args.len() < 2 {
+        print_usage();
+        return Err(GwsError::Validation(
+            "No service specified. Usage: gws <service> <resource> [sub-resource] <method> [flags]"
+                .to_string(),
+        ));
+    }
+
+    let first_arg = &args[1];
+
+    // Handle --help and --version at top level
+    if first_arg == "--help" || first_arg == "-h" {
+        print_usage();
+        return Ok(());
+    }
+
+    if first_arg == "--version" || first_arg == "-V" {
+        println!("gws {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
+    }
+
+    // Handle the `schema` command
+    if first_arg == "schema" {
+        if args.len() < 3 {
+            return Err(GwsError::Validation(
+                "Usage: gws schema <service.resource.method> (e.g., gws schema drive.files.list) [--resolve-refs]"
+                    .to_string(),
+            ));
+        }
+        let resolve_refs = args.iter().any(|arg| arg == "--resolve-refs");
+        // Remove the flag if it exists so it doesn't mess up path parsing, or just pass the path
+        // The path is args[2], flags might follow.
+        let path = &args[2];
+        return schema::handle_schema_command(path, resolve_refs).await;
+    }
+
+    // Handle the `generate-skills` command
+    if first_arg == "generate-skills" {
+        let gen_args: Vec<String> = args.iter().skip(2).cloned().collect();
+        return generate_skills::handle_generate_skills(&gen_args).await;
+    }
+
+    // Handle the `auth` command
+    if first_arg == "auth" {
+        let auth_args: Vec<String> = args.iter().skip(2).cloned().collect();
+        return auth_commands::handle_auth_command(&auth_args).await;
+    }
+
+    // Parse service name and optional version override
+    let (api_name, version) = parse_service_and_version(&args, first_arg)?;
+
+    // Fetch the Discovery Document
+    let doc = discovery::fetch_discovery_document(&api_name, &version)
+        .await
+        .map_err(|e| GwsError::Discovery(format!("{e:#}")))?;
+
+    // Build the dynamic command tree (all commands shown regardless of auth state)
+    let cli = commands::build_cli(&doc);
+
+    // Re-parse args (skip argv[0] which is the binary, and argv[1] which is the service name)
+    // Filter out --api-version and its value
+    // Prepend "gws" as the program name since try_get_matches_from expects argv[0]
+    let sub_args = filter_args_for_subcommand(&args);
+
+    let matches = cli.try_get_matches_from(&sub_args).map_err(|e| {
+        // If it's a help or version display, print it and exit cleanly
+        if e.kind() == clap::error::ErrorKind::DisplayHelp
+            || e.kind() == clap::error::ErrorKind::DisplayVersion
+        {
+            print!("{e}");
+            std::process::exit(0);
+        }
+        GwsError::Validation(e.to_string())
+    })?;
+
+    // Resolve --format flag
+    let output_format = matches
+        .get_one::<String>("format")
+        .map(|s| formatter::OutputFormat::from_str(s))
+        .unwrap_or_default();
+
+    // Resolve --sanitize template (flag or env var)
+    let sanitize_template = matches
+        .get_one::<String>("sanitize")
+        .cloned()
+        .or_else(|| std::env::var("GOOGLE_WORKSPACE_CLI_SANITIZE_TEMPLATE").ok());
+
+    let sanitize_mode = std::env::var("GOOGLE_WORKSPACE_CLI_SANITIZE_MODE")
+        .map(|v| helpers::modelarmor::SanitizeMode::from_str(&v))
+        .unwrap_or(helpers::modelarmor::SanitizeMode::Warn);
+
+    let sanitize_config = parse_sanitize_config(sanitize_template, &sanitize_mode)?;
+
+    // Check if a helper wants to handle this command
+    if let Some(helper) = helpers::get_helper(&doc.name) {
+        if helper.handle(&doc, &matches, &sanitize_config).await? {
+            return Ok(());
+        }
+    }
+
+    // Walk the subcommand tree to find the target method
+    let (method, matched_args) = resolve_method_from_matches(&doc, &matches)?;
+
+    let params_json = matched_args.get_one::<String>("params").map(|s| s.as_str());
+    let body_json = matched_args
+        .try_get_one::<String>("json")
+        .ok()
+        .flatten()
+        .map(|s| s.as_str());
+    let output_path = matched_args.get_one::<String>("output").map(|s| s.as_str());
+    let upload_path = matched_args
+        .try_get_one::<String>("upload")
+        .ok()
+        .flatten()
+        .map(|s| s.as_str());
+
+    let dry_run = matched_args.get_flag("dry-run");
+
+    // Build pagination config from flags
+    let pagination = parse_pagination_config(matched_args);
+
+    // Get scopes from the method
+    let scopes: Vec<&str> = method.scopes.iter().map(|s| s.as_str()).collect();
+
+    // Authenticate: try OAuth, otherwise proceed unauthenticated
+    let (token, auth_method) = match auth::get_token(&scopes).await {
+        Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+        Err(_) => (None, executor::AuthMethod::None),
+    };
+
+    // Execute
+    executor::execute_method(
+        &doc,
+        method,
+        params_json,
+        body_json,
+        token.as_deref(),
+        auth_method,
+        output_path,
+        upload_path,
+        dry_run,
+        &pagination,
+        sanitize_config.template.as_deref(),
+        &sanitize_config.mode,
+        &output_format,
+    )
+    .await
+}
+
+fn parse_pagination_config(matches: &clap::ArgMatches) -> executor::PaginationConfig {
+    executor::PaginationConfig {
+        page_all: matches.get_flag("page-all"),
+        page_limit: matches.get_one::<u32>("page-limit").copied().unwrap_or(10),
+        page_delay_ms: matches.get_one::<u64>("page-delay").copied().unwrap_or(100),
+    }
+}
+
+pub fn parse_service_and_version(
+    args: &[String],
+    first_arg: &str,
+) -> Result<(String, String), GwsError> {
+    let mut service_arg = first_arg;
+    let mut version_override: Option<String> = None;
+
+    // Check for --api-version flag anywhere in args
+    for i in 0..args.len() {
+        if args[i] == "--api-version" && i + 1 < args.len() {
+            version_override = Some(args[i + 1].clone());
+        }
+    }
+
+    // Support "service:version" syntax on the service arg itself
+    if let Some((svc, ver)) = service_arg.split_once(':') {
+        service_arg = svc;
+        if version_override.is_none() {
+            version_override = Some(ver.to_string());
+        }
+    }
+
+    let (api_name, default_version) = services::resolve_service(service_arg)?;
+    let version = version_override.unwrap_or(default_version);
+    Ok((api_name, version))
+}
+
+pub fn filter_args_for_subcommand(args: &[String]) -> Vec<String> {
+    let mut sub_args: Vec<String> = vec!["gws".to_string()];
+    let mut skip_next = false;
+    for arg in args.iter().skip(2) {
+        if skip_next {
+            skip_next = false;
+            continue;
+        }
+        if arg == "--api-version" {
+            skip_next = true;
+            continue;
+        }
+        sub_args.push(arg.clone());
+    }
+    sub_args
+}
+
+fn parse_sanitize_config(
+    template: Option<String>,
+    mode: &helpers::modelarmor::SanitizeMode,
+) -> Result<helpers::modelarmor::SanitizeConfig, GwsError> {
+    Ok(helpers::modelarmor::SanitizeConfig {
+        template,
+        mode: mode.clone(),
+    })
+}
+
+/// Recursively walks clap ArgMatches to find the leaf method and its matches.
+fn resolve_method_from_matches<'a>(
+    doc: &'a discovery::RestDescription,
+    matches: &'a clap::ArgMatches,
+) -> Result<(&'a discovery::RestMethod, &'a clap::ArgMatches), GwsError> {
+    // Walk the subcommand chain
+    let mut path: Vec<&str> = Vec::new();
+    let mut current_matches = matches;
+
+    while let Some((sub_name, sub_matches)) = current_matches.subcommand() {
+        path.push(sub_name);
+        current_matches = sub_matches;
+    }
+
+    if path.is_empty() {
+        return Err(GwsError::Validation(
+            "No resource or method specified".to_string(),
+        ));
+    }
+
+    // path looks like ["files", "list"] or ["files", "permissions", "list"]
+    // Walk the Discovery Document resources to find the method
+    let resource_name = path[0];
+    let resource = doc
+        .resources
+        .get(resource_name)
+        .ok_or_else(|| GwsError::Validation(format!("Resource '{resource_name}' not found")))?;
+
+    let mut current_resource = resource;
+
+    // Navigate sub-resources (everything except the last element, which is the method)
+    for &name in &path[1..path.len() - 1] {
+        // Check if this is a sub-resource
+        if let Some(sub) = current_resource.resources.get(name) {
+            current_resource = sub;
+        } else {
+            return Err(GwsError::Validation(format!(
+                "Sub-resource '{name}' not found"
+            )));
+        }
+    }
+
+    // The last element is the method name
+    let method_name = path[path.len() - 1];
+
+    // Check if this is a method on the current resource
+    if let Some(method) = current_resource.methods.get(method_name) {
+        return Ok((method, current_matches));
+    }
+
+    // Maybe it's a resource that has methods — need one more subcommand
+    Err(GwsError::Validation(format!(
+        "Method '{method_name}' not found on resource. Available methods: {:?}",
+        current_resource.methods.keys().collect::<Vec<_>>()
+    )))
+}
+
+fn print_usage() {
+    println!("gws — Google Workspace CLI");
+    println!();
+    println!("USAGE:");
+    println!("    gws <service> <resource> [sub-resource] <method> [flags]");
+    println!("    gws schema <service.resource.method> [--resolve-refs]");
+    println!();
+    println!("EXAMPLES:");
+    println!("    gws drive files list --params '{{\"pageSize\": 10}}'");
+    println!("    gws drive files get --params '{{\"fileId\": \"abc123\"}}'");
+    println!("    gws sheets spreadsheets get --params '{{\"spreadsheetId\": \"...\"}}'");
+    println!("    gws gmail users messages list --params '{{\"userId\": \"me\"}}'");
+    println!("    gws schema drive.files.list");
+    println!();
+    println!("FLAGS:");
+    println!("    --params <JSON>       URL/Query parameters as JSON");
+    println!("    --json <JSON>         Request body as JSON (POST/PATCH/PUT)");
+    println!("    --upload <PATH>       Local file to upload as media content (multipart)");
+    println!("    --output <PATH>       Output file path for binary responses");
+    println!("    --format <FMT>        Output format: json (default), table, yaml, csv");
+    println!("    --api-version <VER>   Override the API version (e.g., v2, v3)");
+    println!("    --page-all            Auto-paginate, one JSON line per page (NDJSON)");
+    println!("    --page-limit <N>      Max pages to fetch with --page-all (default: 10)");
+    println!("    --page-delay <MS>     Delay between pages in ms (default: 100)");
+    println!();
+    println!("SERVICES:");
+    for entry in services::SERVICES {
+        let name = entry.aliases[0];
+        let aliases = if entry.aliases.len() > 1 {
+            format!(" (also: {})", entry.aliases[1..].join(", "))
+        } else {
+            String::new()
+        };
+        println!("    {:<20} {}{}", name, entry.description, aliases);
+    }
+    println!();
+    println!("ENVIRONMENT:");
+    println!("    GOOGLE_WORKSPACE_CLI_TOKEN               Pre-obtained OAuth2 access token (highest priority)");
+    println!("    GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE    Path to OAuth credentials JSON file");
+    println!("    GOOGLE_WORKSPACE_CLI_CLIENT_ID           OAuth client ID (for gws auth login)");
+    println!(
+        "    GOOGLE_WORKSPACE_CLI_CLIENT_SECRET       OAuth client secret (for gws auth login)"
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_pagination_config_defaults() {
+        let matches = clap::Command::new("test")
+            .arg(
+                clap::Arg::new("page-all")
+                    .long("page-all")
+                    .action(clap::ArgAction::SetTrue),
+            )
+            .arg(
+                clap::Arg::new("page-limit")
+                    .long("page-limit")
+                    .value_parser(clap::value_parser!(u32)),
+            )
+            .arg(
+                clap::Arg::new("page-delay")
+                    .long("page-delay")
+                    .value_parser(clap::value_parser!(u64)),
+            )
+            .get_matches_from(vec!["test"]);
+
+        let config = parse_pagination_config(&matches);
+        assert_eq!(config.page_all, false);
+        assert_eq!(config.page_limit, 10);
+        assert_eq!(config.page_delay_ms, 100);
+    }
+
+    #[test]
+    fn test_parse_pagination_config_custom() {
+        let matches = clap::Command::new("test")
+            .arg(
+                clap::Arg::new("page-all")
+                    .long("page-all")
+                    .action(clap::ArgAction::SetTrue),
+            )
+            .arg(
+                clap::Arg::new("page-limit")
+                    .long("page-limit")
+                    .value_parser(clap::value_parser!(u32)),
+            )
+            .arg(
+                clap::Arg::new("page-delay")
+                    .long("page-delay")
+                    .value_parser(clap::value_parser!(u64)),
+            )
+            .get_matches_from(vec![
+                "test",
+                "--page-all",
+                "--page-limit",
+                "20",
+                "--page-delay",
+                "500",
+            ]);
+
+        let config = parse_pagination_config(&matches);
+        assert_eq!(config.page_all, true);
+        assert_eq!(config.page_limit, 20);
+        assert_eq!(config.page_delay_ms, 500);
+    }
+
+    #[test]
+    fn test_parse_sanitize_config_valid() {
+        let config = parse_sanitize_config(
+            Some("tpl".to_string()),
+            &helpers::modelarmor::SanitizeMode::Warn,
+        )
+        .unwrap();
+        assert_eq!(config.template.as_deref(), Some("tpl"));
+    }
+
+    #[test]
+    fn test_parse_sanitize_config_no_template() {
+        let config =
+            parse_sanitize_config(None, &helpers::modelarmor::SanitizeMode::Block).unwrap();
+        assert!(config.template.is_none());
+        assert_eq!(config.mode, helpers::modelarmor::SanitizeMode::Block);
+    }
+
+    #[test]
+    fn test_resolve_method_from_matches_basic() {
+        let mut resources = std::collections::HashMap::new();
+        let mut files_res = crate::discovery::RestResource::default();
+        files_res.methods.insert(
+            "list".to_string(),
+            crate::discovery::RestMethod {
+                id: Some("drive.files.list".to_string()),
+                http_method: "GET".to_string(),
+                ..Default::default()
+            },
+        );
+        resources.insert("files".to_string(), files_res);
+
+        let doc = discovery::RestDescription {
+            name: "drive".to_string(),
+            resources,
+            ..Default::default()
+        };
+
+        // Simulate CLI structure
+        let cmd = clap::Command::new("gws")
+            .subcommand(clap::Command::new("files").subcommand(clap::Command::new("list")));
+
+        let matches = cmd.get_matches_from(vec!["gws", "files", "list"]);
+        let (method, _) = resolve_method_from_matches(&doc, &matches).unwrap();
+        assert_eq!(method.id.as_deref(), Some("drive.files.list"));
+    }
+
+    #[test]
+    fn test_resolve_method_from_matches_nested() {
+        let mut resources = std::collections::HashMap::new();
+        let mut files_res = crate::discovery::RestResource::default();
+        let mut permissions_res = crate::discovery::RestResource::default();
+        permissions_res.methods.insert(
+            "get".to_string(),
+            crate::discovery::RestMethod {
+                id: Some("drive.files.permissions.get".to_string()),
+                ..Default::default()
+            },
+        );
+        files_res
+            .resources
+            .insert("permissions".to_string(), permissions_res);
+        resources.insert("files".to_string(), files_res);
+
+        let doc = discovery::RestDescription {
+            name: "drive".to_string(),
+            resources,
+            ..Default::default()
+        };
+
+        let cmd =
+            clap::Command::new("gws").subcommand(clap::Command::new("files").subcommand(
+                clap::Command::new("permissions").subcommand(clap::Command::new("get")),
+            ));
+
+        let matches = cmd.get_matches_from(vec!["gws", "files", "permissions", "get"]);
+        let (method, _) = resolve_method_from_matches(&doc, &matches).unwrap();
+        assert_eq!(method.id.as_deref(), Some("drive.files.permissions.get"));
+    }
+}
diff --git a/src/oauth_config.rs b/src/oauth_config.rs
new file mode 100644
index 00000000..b6a510be
--- /dev/null
+++ b/src/oauth_config.rs
@@ -0,0 +1,202 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Helpers for the OAuth client configuration file.
+//!
+//! Uses the standard Google Cloud Console "installed application" JSON format:
+//! ```json
+//! {
+//!   "installed": {
+//!     "client_id": "...apps.googleusercontent.com",
+//!     "project_id": "my-project",
+//!     "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+//!     "token_uri": "https://oauth2.googleapis.com/token",
+//!     "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+//!     "client_secret": "GOCSPX-...",
+//!     "redirect_uris": ["http://localhost"]
+//!   }
+//! }
+//! ```
+
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+/// The "installed" application config from Google Cloud Console.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct InstalledConfig {
+    pub client_id: String,
+    pub client_secret: String,
+    pub project_id: String,
+    pub auth_uri: String,
+    pub token_uri: String,
+    #[serde(default)]
+    pub auth_provider_x509_cert_url: String,
+    #[serde(default)]
+    pub redirect_uris: Vec<String>,
+}
+
+/// Wrapper matching the Google Cloud Console download format.
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ClientSecretFile {
+    pub installed: InstalledConfig,
+}
+
+/// Returns the path for the client secret config file.
+pub fn client_config_path() -> PathBuf {
+    crate::auth_commands::config_dir().join("client_secret.json")
+}
+
+/// Saves OAuth client configuration in the standard Google Cloud Console format.
+pub fn save_client_config(
+    client_id: &str,
+    client_secret: &str,
+    project_id: &str,
+) -> anyhow::Result<PathBuf> {
+    let config = ClientSecretFile {
+        installed: InstalledConfig {
+            client_id: client_id.to_string(),
+            client_secret: client_secret.to_string(),
+            project_id: project_id.to_string(),
+            auth_uri: "https://accounts.google.com/o/oauth2/auth".to_string(),
+            token_uri: "https://oauth2.googleapis.com/token".to_string(),
+            auth_provider_x509_cert_url: "https://www.googleapis.com/oauth2/v1/certs".to_string(),
+            redirect_uris: vec!["http://localhost".to_string()],
+        },
+    };
+
+    let path = client_config_path();
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+
+    let json = serde_json::to_string_pretty(&config)?;
+    std::fs::write(&path, &json)?;
+
+    // Set file permissions to 600 on Unix (contains secrets)
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;
+    }
+
+    Ok(path)
+}
+
+/// Loads OAuth client configuration from the standard Google Cloud Console format.
+pub fn load_client_config() -> anyhow::Result<InstalledConfig> {
+    let path = client_config_path();
+    let data = std::fs::read_to_string(&path)
+        .map_err(|e| anyhow::anyhow!("Cannot read {}: {e}", path.display()))?;
+    let file: ClientSecretFile = serde_json::from_str(&data)
+        .map_err(|e| anyhow::anyhow!("Invalid client_secret.json format: {e}"))?;
+    Ok(file.installed)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_save_load_round_trip() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("client_secret.json");
+
+        let config = ClientSecretFile {
+            installed: InstalledConfig {
+                client_id: "test-id.apps.googleusercontent.com".to_string(),
+                client_secret: "GOCSPX-test".to_string(),
+                project_id: "my-project".to_string(),
+                auth_uri: "https://accounts.google.com/o/oauth2/auth".to_string(),
+                token_uri: "https://oauth2.googleapis.com/token".to_string(),
+                auth_provider_x509_cert_url: "https://www.googleapis.com/oauth2/v1/certs"
+                    .to_string(),
+                redirect_uris: vec!["http://localhost".to_string()],
+            },
+        };
+
+        let json = serde_json::to_string_pretty(&config).unwrap();
+        std::fs::write(&path, &json).unwrap();
+
+        let data = std::fs::read_to_string(&path).unwrap();
+        let loaded: ClientSecretFile = serde_json::from_str(&data).unwrap();
+
+        assert_eq!(
+            loaded.installed.client_id,
+            "test-id.apps.googleusercontent.com"
+        );
+        assert_eq!(loaded.installed.client_secret, "GOCSPX-test");
+        assert_eq!(loaded.installed.project_id, "my-project");
+    }
+
+    #[test]
+    fn test_parse_google_console_format() {
+        // Real format from Google Cloud Console download
+        let json = r#"{
+            "installed": {
+                "client_id": "test-client-id.apps.googleusercontent.com",
+                "project_id": "test-project-id",
+                "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+                "token_uri": "https://oauth2.googleapis.com/token",
+                "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+                "client_secret": "test-client-secret",
+                "redirect_uris": ["http://localhost"]
+            }
+        }"#;
+
+        let config: ClientSecretFile = serde_json::from_str(json).unwrap();
+        assert_eq!(config.installed.project_id, "test-project-id");
+        assert_eq!(config.installed.client_secret, "test-client-secret");
+        assert_eq!(config.installed.redirect_uris, vec!["http://localhost"]);
+    }
+
+    #[test]
+    fn test_parse_missing_optional_fields() {
+        // Minimal format — only required fields
+        let json = r#"{
+            "installed": {
+                "client_id": "test-id",
+                "project_id": "test-project",
+                "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+                "token_uri": "https://oauth2.googleapis.com/token",
+                "client_secret": "secret"
+            }
+        }"#;
+
+        let config: ClientSecretFile = serde_json::from_str(json).unwrap();
+        assert_eq!(config.installed.client_id, "test-id");
+        assert!(config.installed.redirect_uris.is_empty());
+        assert!(config.installed.auth_provider_x509_cert_url.is_empty());
+    }
+
+    #[test]
+    fn test_parse_invalid_json_fails() {
+        let json = r#"{ "wrong_key": {} }"#;
+        let result = serde_json::from_str::<ClientSecretFile>(json);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_parse_missing_client_id_fails() {
+        let json = r#"{
+            "installed": {
+                "project_id": "test",
+                "auth_uri": "https://example.com",
+                "token_uri": "https://example.com",
+                "client_secret": "secret"
+            }
+        }"#;
+        let result = serde_json::from_str::<ClientSecretFile>(json);
+        assert!(result.is_err());
+    }
+}
diff --git a/src/schema.rs b/src/schema.rs
new file mode 100644
index 00000000..9de6731b
--- /dev/null
+++ b/src/schema.rs
@@ -0,0 +1,449 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! JSON Schema Validation & Reference Resolution
+//!
+//! Provides utilities to validate JSON payloads against the Google API Discovery Document
+//! schemas before dispatching requests. This ensures immediate client-side feedback
+//! for invalid API payloads.
+
+use serde_json::{json, Value};
+
+use crate::discovery::{
+    fetch_discovery_document, JsonSchema, MethodParameter, RestDescription, RestMethod,
+    RestResource,
+};
+use crate::error::GwsError;
+use crate::services::resolve_service;
+
+/// Handles the `gws schema <dotted.path>` command.
+///
+/// Path format: `service.resource[.subresource].method`
+/// Example: `drive.files.list` or `drive.files.permissions.list`
+pub async fn handle_schema_command(path: &str, resolve_refs: bool) -> Result<(), GwsError> {
+    let parts: Vec<&str> = path.split('.').collect();
+    if parts.len() < 2 {
+        return Err(GwsError::Validation(format!(
+            "Schema path must be at least 'service.Message' or 'service.resource.method', got '{path}'"
+        )));
+    }
+
+    let service_name = parts[0];
+    let (api_name, version) = resolve_service(service_name)?;
+
+    let doc = fetch_discovery_document(&api_name, &version)
+        .await
+        .map_err(|e| GwsError::Discovery(format!("{e:#}")))?;
+
+    // Case 1: Schema lookup (e.g., "drive.File")
+    if parts.len() == 2 {
+        let schema_name = parts[1];
+        if let Some(schema) = doc.schemas.get(schema_name) {
+            let mut output = schema_to_json(schema);
+            if resolve_refs {
+                let mut seen = std::collections::HashSet::new();
+                // Add self to seen to prevent immediate recursion
+                seen.insert(schema_name.to_string());
+                resolve_schema_refs(&mut output, &doc, &mut seen);
+            }
+
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&output).unwrap_or_default()
+            );
+            return Ok(());
+        } else {
+            // It might be a resource path that is incomplete, but let's see if it's a schema typo first
+            // or perhaps the user meant "drive.files" (resource) which we don't support dumping yet.
+            // Let's check if it matches a resource name to give a better error.
+            if doc.resources.contains_key(schema_name) {
+                return Err(GwsError::Validation(format!(
+                    "'{schema_name}' is a resource. To see its methods, try 'gws schema {service_name}.{schema_name}.list' (or similar). To see a type definition, try 'gws schema {service_name}.<Type>'."
+                )));
+            }
+
+            let available: Vec<&String> = doc.schemas.keys().collect();
+            return Err(GwsError::Validation(format!(
+                "Schema or resource '{schema_name}' not found. Available schemas: {:?}",
+                available
+            )));
+        }
+    }
+
+    // Case 2: Method lookup (e.g., "drive.files.list")
+    let resource_path = &parts[1..parts.len() - 1];
+    let method_name = parts[parts.len() - 1];
+
+    let method = find_method(&doc, resource_path, method_name)?;
+
+    let mut output = build_schema_output(&doc, method);
+    if resolve_refs {
+        let mut seen = std::collections::HashSet::new();
+        resolve_schema_refs(&mut output, &doc, &mut seen);
+    }
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&output).unwrap_or_default()
+    );
+
+    Ok(())
+}
+
+/// Walks the resource tree to find a method.
+fn find_method<'a>(
+    doc: &'a RestDescription,
+    resource_path: &[&str],
+    method_name: &str,
+) -> Result<&'a RestMethod, GwsError> {
+    if resource_path.is_empty() {
+        return Err(GwsError::Validation(
+            "Resource path cannot be empty".to_string(),
+        ));
+    }
+
+    let first_resource_name = resource_path[0];
+    let resource = doc.resources.get(first_resource_name).ok_or_else(|| {
+        let available: Vec<&String> = doc.resources.keys().collect();
+        GwsError::Validation(format!(
+            "Resource '{}' not found. Available resources: {:?}",
+            first_resource_name, available
+        ))
+    })?;
+
+    // Walk deeper into sub-resources
+    let mut current_resource: &RestResource = resource;
+    for &sub_name in &resource_path[1..] {
+        current_resource = current_resource.resources.get(sub_name).ok_or_else(|| {
+            let available: Vec<&String> = current_resource.resources.keys().collect();
+            GwsError::Validation(format!(
+                "Sub-resource '{}' not found. Available: {:?}",
+                sub_name, available
+            ))
+        })?;
+    }
+
+    current_resource.methods.get(method_name).ok_or_else(|| {
+        let available: Vec<&String> = current_resource.methods.keys().collect();
+        GwsError::Validation(format!(
+            "Method '{}' not found. Available methods: {:?}",
+            method_name, available
+        ))
+    })
+}
+
+/// Builds the schema output JSON for a method.
+fn build_schema_output(doc: &RestDescription, method: &RestMethod) -> Value {
+    let mut params = json!({});
+    for (name, param) in &method.parameters {
+        params[name] = param_to_json(param);
+    }
+
+    let mut output = json!({
+        "httpMethod": method.http_method,
+        "path": method.path,
+        "description": method.description.as_deref().unwrap_or(""),
+        "parameters": params,
+        "scopes": method.scopes,
+    });
+
+    if !method.parameter_order.is_empty() {
+        output["parameterOrder"] = json!(method.parameter_order);
+    }
+
+    // Resolve request body schema
+    if let Some(ref req_ref) = method.request {
+        if let Some(ref schema_name) = req_ref.schema_ref {
+            output["requestBody"] = json!({
+                "schemaRef": schema_name,
+            });
+            if let Some(schema) = doc.schemas.get(schema_name) {
+                output["requestBody"]["schema"] = schema_to_json(schema);
+            }
+        }
+    }
+
+    // Response schema ref
+    if let Some(ref resp_ref) = method.response {
+        if let Some(ref schema_name) = resp_ref.schema_ref {
+            output["response"] = json!({
+                "schemaRef": schema_name,
+            });
+            // Also inline the response schema structure if available
+            if let Some(schema) = doc.schemas.get(schema_name) {
+                output["response"]["schema"] = schema_to_json(schema);
+            }
+        }
+    }
+
+    output
+}
+
+fn param_to_json(param: &MethodParameter) -> Value {
+    let mut p = json!({
+        "type": param.param_type.as_deref().unwrap_or("string"),
+        "required": param.required,
+    });
+
+    if let Some(ref loc) = param.location {
+        p["location"] = json!(loc);
+    }
+    if let Some(ref desc) = param.description {
+        p["description"] = json!(desc);
+    }
+    if let Some(ref fmt) = param.format {
+        p["format"] = json!(fmt);
+    }
+    if let Some(ref def) = param.default {
+        p["default"] = json!(def);
+    }
+    if let Some(ref vals) = param.enum_values {
+        p["enum"] = json!(vals);
+    }
+    if param.deprecated {
+        p["deprecated"] = json!(true);
+    }
+
+    p
+}
+
+fn schema_to_json(schema: &JsonSchema) -> Value {
+    let mut s = json!({});
+
+    if let Some(ref t) = schema.schema_type {
+        s["type"] = json!(t);
+    }
+    if let Some(ref desc) = schema.description {
+        s["description"] = json!(desc);
+    }
+
+    if !schema.properties.is_empty() {
+        let mut props = json!({});
+        for (name, prop) in &schema.properties {
+            let mut p = json!({});
+            if let Some(ref t) = prop.prop_type {
+                p["type"] = json!(t);
+            }
+            if let Some(ref r) = prop.schema_ref {
+                p["$ref"] = json!(r);
+            }
+            if let Some(ref desc) = prop.description {
+                p["description"] = json!(desc);
+            }
+            if prop.read_only {
+                p["readOnly"] = json!(true);
+            }
+            if let Some(ref fmt) = prop.format {
+                p["format"] = json!(fmt);
+            }
+
+            // Handle items for array types
+            if let Some(ref items) = prop.items {
+                let mut items_json = json!({});
+                if let Some(ref t) = items.prop_type {
+                    items_json["type"] = json!(t);
+                }
+                if let Some(ref r) = items.schema_ref {
+                    items_json["$ref"] = json!(r);
+                }
+                p["items"] = items_json;
+            }
+
+            props[name] = p;
+        }
+        s["properties"] = props;
+    }
+
+    s
+}
+
+/// Recursively resolves "$ref" fields in the JSON value.
+fn resolve_schema_refs(
+    val: &mut Value,
+    doc: &RestDescription,
+    seen: &mut std::collections::HashSet<String>,
+) {
+    match val {
+        Value::Object(map) => {
+            // Check if this object is a reference
+            if let Some(ref_name) = map
+                .get("$ref")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string())
+            {
+                // If we haven't seen this schema yet in this branch
+                if !seen.contains(&ref_name) {
+                    if let Some(schema) = doc.schemas.get(&ref_name) {
+                        seen.insert(ref_name.clone());
+                        let mut resolved = schema_to_json(schema);
+                        // Recursively resolve the resolved schema
+                        resolve_schema_refs(&mut resolved, doc, seen);
+                        seen.remove(&ref_name);
+
+                        // Merge resolved schema into current object, but preserve existing fields
+                        // (though usually $ref stands alone)
+                        if let Value::Object(resolved_map) = resolved {
+                            for (k, v) in resolved_map {
+                                map.entry(k).or_insert(v);
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Recurse into all fields
+            for (_, v) in map.iter_mut() {
+                resolve_schema_refs(v, doc, seen);
+            }
+        }
+        Value::Array(arr) => {
+            for v in arr {
+                resolve_schema_refs(v, doc, seen);
+            }
+        }
+        _ => {}
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_param_to_json() {
+        let param = MethodParameter {
+            param_type: Some("integer".to_string()),
+            description: Some("desc".to_string()),
+            location: Some("query".to_string()),
+            required: true,
+            format: Some("int32".to_string()),
+            default: Some("0".to_string()),
+            enum_values: Some(vec!["0".to_string(), "1".to_string()]),
+            enum_descriptions: None,
+            repeated: false,
+            minimum: None,
+            maximum: None,
+            deprecated: true,
+        };
+
+        let json = param_to_json(&param);
+        assert_eq!(json["type"], "integer");
+        assert_eq!(json["description"], "desc");
+        assert_eq!(json["location"], "query");
+        assert_eq!(json["required"], true);
+        assert_eq!(json["format"], "int32");
+        assert_eq!(json["default"], "0");
+        assert!(json["enum"].is_array());
+        assert_eq!(json["deprecated"], true);
+    }
+
+    #[test]
+    fn test_schema_to_json_basic() {
+        let mut properties = std::collections::HashMap::new();
+        properties.insert(
+            "name".to_string(),
+            crate::discovery::JsonSchemaProperty {
+                prop_type: Some("string".to_string()),
+                ..Default::default()
+            },
+        );
+
+        let schema = JsonSchema {
+            schema_type: Some("object".to_string()),
+            properties,
+            ..Default::default()
+        };
+
+        let json = schema_to_json(&schema);
+        assert_eq!(json["type"], "object");
+        assert!(json["properties"].is_object());
+        assert_eq!(json["properties"]["name"]["type"], "string");
+    }
+
+    #[test]
+    fn test_resolve_schema_refs_basic() {
+        let mut schemas = std::collections::HashMap::new();
+        let target_schema = JsonSchema {
+            schema_type: Some("string".to_string()),
+            description: Some("Resolved type".to_string()),
+            ..Default::default()
+        };
+        schemas.insert("Target".to_string(), target_schema);
+
+        let doc = RestDescription {
+            schemas,
+            ..Default::default()
+        };
+
+        let mut val = json!({
+            "$ref": "Target"
+        });
+
+        let mut seen = std::collections::HashSet::new();
+        resolve_schema_refs(&mut val, &doc, &mut seen);
+
+        assert_eq!(val["type"], "string");
+        assert_eq!(val["description"], "Resolved type");
+        // $ref might remain or effectively be merged, checking properties is key
+    }
+
+    #[test]
+    fn test_resolve_schema_refs_nested() {
+        let mut schemas = std::collections::HashMap::new();
+        let child = JsonSchema {
+            schema_type: Some("integer".to_string()),
+            ..Default::default()
+        };
+        schemas.insert("Child".to_string(), child);
+
+        let parent = JsonSchema {
+            schema_type: Some("object".to_string()),
+            properties: {
+                let mut map = std::collections::HashMap::new();
+                map.insert(
+                    "f".to_string(),
+                    crate::discovery::JsonSchemaProperty {
+                        schema_ref: Some("Child".to_string()),
+                        ..Default::default()
+                    },
+                );
+                map
+            },
+            ..Default::default()
+        };
+        schemas.insert("Parent".to_string(), parent);
+
+        let doc = RestDescription {
+            schemas,
+            ..Default::default()
+        };
+
+        let mut val = json!({
+            "$ref": "Parent"
+        });
+
+        let mut seen = std::collections::HashSet::new();
+        resolve_schema_refs(&mut val, &doc, &mut seen);
+
+        // Check Parent resolved
+        assert_eq!(val["type"], "object");
+        // Check Child resolved inside Parent
+        // note: schema_to_json converts ref to $ref property, then resolve_schema_refs follows it
+        // The implementation matches on "$ref" keys in objects.
+        // schema_to_json for Parent produces { properties: { f: { $ref: "Child" } } }
+        // The recursion should resolve f.$ref to Child content.
+
+        let f_node = &val["properties"]["f"];
+        assert_eq!(f_node["type"], "integer");
+    }
+}
diff --git a/src/services.rs b/src/services.rs
new file mode 100644
index 00000000..fc5b1aa7
--- /dev/null
+++ b/src/services.rs
@@ -0,0 +1,220 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::error::GwsError;
+
+/// A known service with its alias, API name, version, and description.
+pub struct ServiceEntry {
+    pub aliases: &'static [&'static str],
+    pub api_name: &'static str,
+    pub version: &'static str,
+    pub description: &'static str,
+}
+
+/// All known services with metadata.
+pub const SERVICES: &[ServiceEntry] = &[
+    ServiceEntry {
+        aliases: &["drive"],
+        api_name: "drive",
+        version: "v3",
+        description: "Manage files, folders, and shared drives",
+    },
+    ServiceEntry {
+        aliases: &["sheets"],
+        api_name: "sheets",
+        version: "v4",
+        description: "Read and write spreadsheets",
+    },
+    ServiceEntry {
+        aliases: &["gmail"],
+        api_name: "gmail",
+        version: "v1",
+        description: "Send, read, and manage email",
+    },
+    ServiceEntry {
+        aliases: &["calendar"],
+        api_name: "calendar",
+        version: "v3",
+        description: "Manage calendars and events",
+    },
+    ServiceEntry {
+        aliases: &["admin", "directory"],
+        api_name: "admin",
+        version: "directory_v1",
+        description: "Manage users, groups, and devices",
+    },
+    ServiceEntry {
+        aliases: &["admin-reports", "reports"],
+        api_name: "admin",
+        version: "reports_v1",
+        description: "Audit logs and usage reports",
+    },
+    ServiceEntry {
+        aliases: &["docs"],
+        api_name: "docs",
+        version: "v1",
+        description: "Read and write Google Docs",
+    },
+    ServiceEntry {
+        aliases: &["slides"],
+        api_name: "slides",
+        version: "v1",
+        description: "Read and write presentations",
+    },
+    ServiceEntry {
+        aliases: &["tasks"],
+        api_name: "tasks",
+        version: "v1",
+        description: "Manage task lists and tasks",
+    },
+    ServiceEntry {
+        aliases: &["people"],
+        api_name: "people",
+        version: "v1",
+        description: "Manage contacts and profiles",
+    },
+    ServiceEntry {
+        aliases: &["chat"],
+        api_name: "chat",
+        version: "v1",
+        description: "Manage Chat spaces and messages",
+    },
+    ServiceEntry {
+        aliases: &["vault"],
+        api_name: "vault",
+        version: "v1",
+        description: "Manage eDiscovery holds and exports",
+    },
+    ServiceEntry {
+        aliases: &["groupssettings"],
+        api_name: "groupssettings",
+        version: "v1",
+        description: "Manage Google Groups settings",
+    },
+    ServiceEntry {
+        aliases: &["reseller"],
+        api_name: "reseller",
+        version: "v1",
+        description: "Manage Workspace subscriptions",
+    },
+    ServiceEntry {
+        aliases: &["licensing"],
+        api_name: "licensing",
+        version: "v1",
+        description: "Manage product licenses",
+    },
+    ServiceEntry {
+        aliases: &["apps-script", "script"],
+        api_name: "script",
+        version: "v1",
+        description: "Manage and execute Apps Script projects",
+    },
+    ServiceEntry {
+        aliases: &["classroom"],
+        api_name: "classroom",
+        version: "v1",
+        description: "Manage classes, rosters, and coursework",
+    },
+    ServiceEntry {
+        aliases: &["cloudidentity"],
+        api_name: "cloudidentity",
+        version: "v1",
+        description: "Manage identity groups and memberships",
+    },
+    ServiceEntry {
+        aliases: &["alertcenter"],
+        api_name: "alertcenter",
+        version: "v1beta1",
+        description: "Manage Workspace security alerts",
+    },
+    ServiceEntry {
+        aliases: &["forms"],
+        api_name: "forms",
+        version: "v1",
+        description: "Read and write Google Forms",
+    },
+    ServiceEntry {
+        aliases: &["keep"],
+        api_name: "keep",
+        version: "v1",
+        description: "Manage Google Keep notes",
+    },
+    ServiceEntry {
+        aliases: &["meet"],
+        api_name: "meet",
+        version: "v2",
+        description: "Manage Google Meet conferences",
+    },
+    ServiceEntry {
+        aliases: &["events"],
+        api_name: "workspaceevents",
+        version: "v1",
+        description: "Subscribe to Google Workspace events",
+    },
+    ServiceEntry {
+        aliases: &["modelarmor"],
+        api_name: "modelarmor",
+        version: "v1",
+        description: "Filter user-generated content for safety",
+    },
+];
+
+/// Resolves a service alias to (api_name, version).
+pub fn resolve_service(name: &str) -> Result<(String, String), GwsError> {
+    for entry in SERVICES {
+        if entry.aliases.contains(&name) {
+            return Ok((entry.api_name.to_string(), entry.version.to_string()));
+        }
+    }
+    let all_names: Vec<&str> = SERVICES
+        .iter()
+        .flat_map(|e| e.aliases.iter().copied())
+        .collect();
+    Err(GwsError::Validation(format!(
+        "Unknown service '{}'. Known services: {}. Use '<api>:<version>' syntax for unlisted APIs.",
+        name,
+        all_names.join(", ")
+    )))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_resolve_service_known() {
+        assert_eq!(
+            resolve_service("drive").unwrap(),
+            ("drive".to_string(), "v3".to_string())
+        );
+        assert_eq!(
+            resolve_service("admin").unwrap(),
+            ("admin".to_string(), "directory_v1".to_string())
+        );
+        assert_eq!(
+            resolve_service("directory").unwrap(),
+            ("admin".to_string(), "directory_v1".to_string())
+        );
+    }
+
+    #[test]
+    fn test_resolve_service_unknown() {
+        let err = resolve_service("unknown_service");
+        assert!(err.is_err());
+        match err.unwrap_err() {
+            GwsError::Validation(msg) => assert!(msg.contains("Unknown service")),
+            _ => panic!("Expected Validation error"),
+        }
+    }
+}
diff --git a/src/setup.rs b/src/setup.rs
new file mode 100644
index 00000000..ea78f9f7
--- /dev/null
+++ b/src/setup.rs
@@ -0,0 +1,1786 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! GCP project setup and OAuth credential bootstrap.
+//!
+//! Automates the manual GCP setup steps: gcloud auth, project selection,
+//! API enabling, consent screen configuration, and OAuth client creation.
+//! Uses `gcloud` CLI for project ops and the OAuth2 REST API for credential creation.
+
+use std::process::Command;
+
+use serde_json::json;
+
+use crate::error::GwsError;
+
+use crate::setup_tui::{PickerResult, SelectItem, SetupWizard, StepStatus};
+
+/// A Workspace API with its service ID, human-readable name, and discovery doc coordinates.
+struct ApiEntry {
+    id: &'static str,
+    name: &'static str,
+    /// Discovery API name (e.g. "gmail", "drive").
+    discovery: &'static str,
+    /// Discovery API version (e.g. "v1", "v3").
+    version: &'static str,
+}
+
+/// All Google Workspace API service IDs that can be enabled.
+const WORKSPACE_APIS: &[ApiEntry] = &[
+    ApiEntry {
+        id: "drive.googleapis.com",
+        name: "Google Drive",
+        discovery: "drive",
+        version: "v3",
+    },
+    ApiEntry {
+        id: "sheets.googleapis.com",
+        name: "Google Sheets",
+        discovery: "sheets",
+        version: "v4",
+    },
+    ApiEntry {
+        id: "gmail.googleapis.com",
+        name: "Gmail",
+        discovery: "gmail",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "calendar-json.googleapis.com",
+        name: "Google Calendar",
+        discovery: "calendar",
+        version: "v3",
+    },
+    ApiEntry {
+        id: "docs.googleapis.com",
+        name: "Google Docs",
+        discovery: "docs",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "slides.googleapis.com",
+        name: "Google Slides",
+        discovery: "slides",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "tasks.googleapis.com",
+        name: "Google Tasks",
+        discovery: "tasks",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "people.googleapis.com",
+        name: "People (Contacts)",
+        discovery: "people",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "chat.googleapis.com",
+        name: "Google Chat",
+        discovery: "chat",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "vault.googleapis.com",
+        name: "Google Vault",
+        discovery: "vault",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "groupssettings.googleapis.com",
+        name: "Groups Settings",
+        discovery: "groupssettings",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "reseller.googleapis.com",
+        name: "Reseller",
+        discovery: "reseller",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "licensing.googleapis.com",
+        name: "Licensing",
+        discovery: "licensing",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "script.googleapis.com",
+        name: "Apps Script",
+        discovery: "script",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "admin.googleapis.com",
+        name: "Admin SDK",
+        discovery: "admin",
+        version: "directory_v1",
+    },
+    ApiEntry {
+        id: "classroom.googleapis.com",
+        name: "Classroom",
+        discovery: "classroom",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "cloudidentity.googleapis.com",
+        name: "Cloud Identity",
+        discovery: "cloudidentity",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "alertcenter.googleapis.com",
+        name: "Alert Center",
+        discovery: "alertcenter",
+        version: "v1beta1",
+    },
+    ApiEntry {
+        id: "forms.googleapis.com",
+        name: "Google Forms",
+        discovery: "forms",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "keep.googleapis.com",
+        name: "Google Keep",
+        discovery: "keep",
+        version: "v1",
+    },
+    ApiEntry {
+        id: "meet.googleapis.com",
+        name: "Google Meet",
+        discovery: "meet",
+        version: "v2",
+    },
+    ApiEntry {
+        id: "pubsub.googleapis.com",
+        name: "Cloud Pub/Sub",
+        discovery: "pubsub",
+        version: "v1",
+    },
+];
+
+const RESTRICTED_SCOPES: &[&str] = &[
+    "https://www.googleapis.com/auth/chat.admin.delete",
+    "https://www.googleapis.com/auth/chat.delete",
+    "https://www.googleapis.com/auth/chat.messages",
+    "https://www.googleapis.com/auth/chat.messages.readonly",
+    "https://www.googleapis.com/auth/drive",
+    "https://www.googleapis.com/auth/drive.activity",
+    "https://www.googleapis.com/auth/drive.activity.readonly",
+    "https://www.googleapis.com/auth/drive.meet.readonly",
+    "https://www.googleapis.com/auth/drive.metadata",
+    "https://www.googleapis.com/auth/drive.metadata.readonly",
+    "https://www.googleapis.com/auth/drive.readonly",
+    "https://www.googleapis.com/auth/drive.scripts",
+    "https://www.googleapis.com/auth/gmail.compose",
+    "https://www.googleapis.com/auth/gmail.insert",
+    "https://www.googleapis.com/auth/gmail.metadata",
+    "https://www.googleapis.com/auth/gmail.modify",
+    "https://www.googleapis.com/auth/gmail.readonly",
+    "https://www.googleapis.com/auth/gmail.settings.basic",
+    "https://www.googleapis.com/auth/gmail.settings.sharing",
+];
+
+const SENSITIVE_SCOPES: &[&str] = &[
+    "https://www.googleapis.com/auth/chat.admin.memberships",
+    "https://www.googleapis.com/auth/chat.admin.memberships.readonly",
+    "https://www.googleapis.com/auth/chat.admin.spaces",
+    "https://www.googleapis.com/auth/chat.admin.spaces.readonly",
+    "https://www.googleapis.com/auth/chat.customemojis",
+    "https://www.googleapis.com/auth/chat.customemojis.readonly",
+    "https://www.googleapis.com/auth/documents",
+    "https://www.googleapis.com/auth/documents.readonly",
+    "https://www.googleapis.com/auth/chat.memberships",
+    "https://www.googleapis.com/auth/chat.memberships.app",
+    "https://www.googleapis.com/auth/chat.memberships.readonly",
+    "https://www.googleapis.com/auth/chat.messages.create",
+    "https://www.googleapis.com/auth/chat.messages.reactions",
+    "https://www.googleapis.com/auth/chat.messages.reactions.create",
+    "https://www.googleapis.com/auth/chat.messages.reactions.readonly",
+    "https://www.googleapis.com/auth/chat.spaces",
+    "https://www.googleapis.com/auth/chat.spaces.create",
+    "https://www.googleapis.com/auth/chat.spaces.readonly",
+    "https://www.googleapis.com/auth/chat.users.readstate",
+    "https://www.googleapis.com/auth/chat.users.readstate.readonly",
+    "https://www.googleapis.com/auth/chat.users.spacesettings",
+    "https://www.googleapis.com/auth/drive.apps.readonly",
+    "https://www.googleapis.com/auth/gmail.addons.current.message.metadata",
+    "https://www.googleapis.com/auth/gmail.addons.current.message.readonly",
+    "https://www.googleapis.com/auth/gmail.send",
+];
+
+/// Helper to get just the API IDs (for tests and non-interactive mode).
+fn all_api_ids() -> Vec<&'static str> {
+    WORKSPACE_APIS.iter().map(|a| a.id).collect()
+}
+
+#[derive(Clone, PartialEq, Eq, PartialOrd, Ord)]
+pub enum ScopeClassification {
+    NonSensitive,
+    Sensitive,
+    Restricted,
+}
+
+pub const PLATFORM_SCOPE: &str = "https://www.googleapis.com/auth/cloud-platform";
+
+/// A scope discovered from a Discovery Document.
+#[derive(Clone)]
+pub struct DiscoveredScope {
+    /// Full scope URL, e.g. "https://www.googleapis.com/auth/drive"
+    pub url: String,
+    /// Short label, e.g. "drive"
+    pub short: String,
+    /// Human-readable description from the Discovery Document.
+    pub description: String,
+    /// Which API this scope came from, e.g. "Google Drive"
+    #[allow(dead_code)]
+    pub api_name: String,
+    /// Whether this is a ".readonly" variant.
+    pub is_readonly: bool,
+    /// Sensitivity classification.
+    pub classification: ScopeClassification,
+}
+
+/// Fetch scopes from discovery docs for the given enabled API IDs.
+pub async fn fetch_scopes_for_apis(enabled_api_ids: &[String]) -> Vec<DiscoveredScope> {
+    let mut all_scopes: Vec<DiscoveredScope> = Vec::new();
+
+    for api_entry in WORKSPACE_APIS {
+        if !enabled_api_ids.iter().any(|id| id == api_entry.id) {
+            continue;
+        }
+        let doc = match crate::discovery::fetch_discovery_document(
+            api_entry.discovery,
+            api_entry.version,
+        )
+        .await
+        {
+            Ok(d) => d,
+            Err(_) => continue, // skip APIs we can't find a discovery doc for
+        };
+
+        if let Some(auth) = &doc.auth {
+            if let Some(oauth2) = &auth.oauth2 {
+                if let Some(scopes) = &oauth2.scopes {
+                    for (url, desc) in scopes {
+                        // Deduplicate (some APIs share scopes)
+                        if all_scopes.iter().any(|s| s.url == *url) {
+                            continue;
+                        }
+
+                        // Filter out legacy endpoints like m8/feeds or calendar/feeds
+                        if !url.starts_with("https://www.googleapis.com/auth/") {
+                            continue;
+                        }
+                        // Filter out app-only scopes that can't be used with user OAuth consent
+                        // (they require a Chat app / service account)
+                        if url.contains("/auth/chat.app.")
+                            || url.contains("/auth/chat.bot")
+                            || url.contains("/auth/chat.import")
+                            || url.contains("/auth/keep")
+                        {
+                            continue;
+                        }
+                        let short = url
+                            .strip_prefix("https://www.googleapis.com/auth/")
+                            .unwrap_or(url)
+                            .to_string();
+                        let is_readonly = short.contains("readonly");
+
+                        let classification = if RESTRICTED_SCOPES.contains(&url.as_str()) {
+                            ScopeClassification::Restricted
+                        } else if SENSITIVE_SCOPES.contains(&url.as_str()) {
+                            ScopeClassification::Sensitive
+                        } else {
+                            ScopeClassification::NonSensitive
+                        };
+
+                        let description = if let Some(desc) = &desc.description {
+                            if !desc.is_empty() {
+                                desc.clone()
+                            } else {
+                                // Generate a friendly name from the short URL
+                                short
+                                    .split('.')
+                                    .map(|s| {
+                                        let mut c = s.chars();
+                                        match c.next() {
+                                            None => String::new(),
+                                            Some(f) => {
+                                                f.to_uppercase().collect::<String>() + c.as_str()
+                                            }
+                                        }
+                                    })
+                                    .collect::<Vec<String>>()
+                                    .join(" ")
+                            }
+                        } else {
+                            // Generate a friendly name from the short URL
+                            short
+                                .split('.')
+                                .map(|s| {
+                                    let mut c = s.chars();
+                                    match c.next() {
+                                        None => String::new(),
+                                        Some(f) => {
+                                            f.to_uppercase().collect::<String>() + c.as_str()
+                                        }
+                                    }
+                                })
+                                .collect::<Vec<String>>()
+                                .join(" ")
+                        };
+
+                        all_scopes.push(DiscoveredScope {
+                            url: url.clone(),
+                            description,
+                            short,
+                            is_readonly,
+                            api_name: api_entry.name.to_string(),
+                            classification,
+                        });
+                    }
+                }
+            }
+        }
+    }
+
+    // Sort: restricted first, then sensitive, then non-sensitive, then alphabetically
+    all_scopes.sort_by(|a, b| {
+        b.classification
+            .cmp(&a.classification)
+            .then_with(|| a.short.cmp(&b.short))
+    });
+
+    all_scopes
+}
+
+/// Options for the setup command.
+pub struct SetupOptions {
+    pub project: Option<String>,
+    pub dry_run: bool,
+}
+
+/// Parse setup flags from args.
+pub fn parse_setup_args(args: &[String]) -> SetupOptions {
+    let mut project = None;
+    let mut dry_run = false;
+    let mut i = 0;
+    while i < args.len() {
+        if args[i] == "--project" && i + 1 < args.len() {
+            project = Some(args[i + 1].clone());
+            i += 2;
+        } else if args[i].starts_with("--project=") {
+            project = Some(args[i].split_once('=').unwrap().1.to_string());
+            i += 1;
+        } else if args[i] == "--dry-run" {
+            dry_run = true;
+            i += 1;
+        } else {
+            i += 1;
+        }
+    }
+    SetupOptions { project, dry_run }
+}
+
+// ── gcloud helpers ──────────────────────────────────────────────
+
+/// Create a gcloud Command with interactive prompts disabled.
+/// This prevents CBA proxy install prompts from blocking subprocess calls.
+fn gcloud_cmd() -> Command {
+    let mut cmd = Command::new("gcloud");
+    cmd.env("CLOUDSDK_CORE_DISABLE_PROMPTS", "1");
+    cmd
+}
+
+/// Check if gcloud CLI is installed.
+pub fn is_gcloud_installed() -> bool {
+    Command::new("gcloud")
+        .arg("version")
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+/// Run `gcloud auth login` interactively.
+fn gcloud_auth_login() -> Result<(), GwsError> {
+    let status = gcloud_cmd()
+        .args(["auth", "login"])
+        .status()
+        .map_err(|e| GwsError::Auth(format!("Failed to run gcloud auth login: {e}")))?;
+
+    if !status.success() {
+        return Err(GwsError::Auth("gcloud auth login failed".to_string()));
+    }
+    Ok(())
+}
+
+/// Get the active gcloud account email.
+fn get_gcloud_account() -> Result<Option<String>, GwsError> {
+    let output = gcloud_cmd()
+        .args(["config", "get-value", "account"])
+        .output()
+        .map_err(|e| GwsError::Auth(format!("Failed to run gcloud: {e}")))?;
+
+    if !output.status.success() {
+        return Ok(None);
+    }
+
+    let val = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if val.is_empty() || val == "(unset)" {
+        return Ok(None);
+    }
+    Ok(Some(val))
+}
+
+/// List all authenticated gcloud accounts.
+/// Returns (account_email, is_active) pairs.
+fn list_gcloud_accounts() -> Vec<(String, bool)> {
+    let output = gcloud_cmd()
+        .args(["auth", "list", "--format=value(account,status)"])
+        .output();
+
+    match output {
+        Ok(out) if out.status.success() => String::from_utf8_lossy(&out.stdout)
+            .lines()
+            .filter_map(|line| {
+                let parts: Vec<&str> = line.splitn(2, '\t').collect();
+                if parts.is_empty() || parts[0].is_empty() {
+                    None
+                } else {
+                    let account = parts[0].to_string();
+                    let active = parts.get(1).is_some_and(|s| s.contains("ACTIVE"));
+                    Some((account, active))
+                }
+            })
+            .collect(),
+        _ => Vec::new(),
+    }
+}
+
+/// Set the active gcloud account.
+fn set_gcloud_account(account: &str) -> Result<(), GwsError> {
+    let status = gcloud_cmd()
+        .args(["config", "set", "account", account])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .map_err(|e| GwsError::Auth(format!("Failed to set account: {e}")))?;
+    if !status.success() {
+        return Err(GwsError::Auth(format!(
+            "Failed to set account to '{account}'"
+        )));
+    }
+    Ok(())
+}
+
+/// Get the current gcloud project ID.
+fn get_gcloud_project() -> Result<Option<String>, GwsError> {
+    let output = gcloud_cmd()
+        .args(["config", "get-value", "project"])
+        .output()
+        .map_err(|e| GwsError::Auth(format!("Failed to run gcloud: {e}")))?;
+
+    if !output.status.success() {
+        return Ok(None);
+    }
+
+    let val = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if val.is_empty() || val == "(unset)" {
+        return Ok(None);
+    }
+    Ok(Some(val))
+}
+
+/// Set the active gcloud project.
+fn set_gcloud_project(project_id: &str) -> Result<(), GwsError> {
+    let status = gcloud_cmd()
+        .args(["config", "set", "project", project_id])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .map_err(|e| GwsError::Validation(format!("Failed to set gcloud project: {e}")))?;
+
+    if !status.success() {
+        return Err(GwsError::Validation(format!(
+            "Failed to set project to '{project_id}'"
+        )));
+    }
+    Ok(())
+}
+
+/// List all GCP projects accessible to the current user.
+/// Returns a list of (project_id, project_name) tuples, and an optional error message.
+/// Times out after 10 seconds to avoid hanging on CBA-enrolled devices.
+/// gcloud stderr flows through to the terminal so users see progress/error messages.
+fn list_gcloud_projects() -> (Vec<(String, String)>, Option<String>) {
+    let child = gcloud_cmd()
+        .args([
+            "projects",
+            "list",
+            "--format=value(projectId,name)",
+            "--sort-by=projectId",
+        ])
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::inherit()) // let user see gcloud messages
+        .spawn();
+
+    let mut child = match child {
+        Ok(c) => c,
+        Err(e) => return (Vec::new(), Some(format!("Failed to run gcloud: {e}"))),
+    };
+
+    // Wait with timeout
+    let timeout = std::time::Duration::from_secs(10);
+    let start = std::time::Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                if status.success() {
+                    let stdout = child
+                        .stdout
+                        .take()
+                        .map(|mut s| {
+                            let mut buf = String::new();
+                            std::io::Read::read_to_string(&mut s, &mut buf).ok();
+                            buf
+                        })
+                        .unwrap_or_default();
+                    let projects = stdout
+                        .lines()
+                        .filter_map(|line| {
+                            let parts: Vec<&str> = line.splitn(2, '\t').collect();
+                            if parts.is_empty() || parts[0].is_empty() {
+                                None
+                            } else {
+                                let id = parts[0].to_string();
+                                let name = parts.get(1).unwrap_or(&"").to_string();
+                                Some((id, name))
+                            }
+                        })
+                        .collect();
+                    return (projects, None);
+                } else {
+                    return (
+                        Vec::new(),
+                        Some("gcloud projects list failed (see above)".to_string()),
+                    );
+                }
+            }
+            Ok(None) => {
+                if start.elapsed() > timeout {
+                    let _ = child.kill();
+                    return (
+                        Vec::new(),
+                        Some("Timed out listing projects (10s)".to_string()),
+                    );
+                }
+                std::thread::sleep(std::time::Duration::from_millis(100));
+            }
+            Err(e) => return (Vec::new(), Some(format!("Error waiting for gcloud: {e}"))),
+        }
+    }
+}
+
+/// Get a gcloud access token for REST API calls.
+fn get_access_token() -> Result<String, GwsError> {
+    let output = gcloud_cmd()
+        .args(["auth", "print-access-token"])
+        .output()
+        .map_err(|e| GwsError::Auth(format!("Failed to get access token: {e}")))?;
+
+    if !output.status.success() {
+        return Err(GwsError::Auth(
+            "Failed to get gcloud access token. Run `gcloud auth login` first.".to_string(),
+        ));
+    }
+
+    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+}
+
+// ── API enabling ────────────────────────────────────────────────
+
+/// Enable selected Workspace APIs for a project. Returns (enabled, skipped, failed).
+async fn enable_apis(
+    project_id: &str,
+    api_ids: &[String],
+) -> (Vec<String>, Vec<String>, Vec<String>) {
+    // First, get already-enabled APIs
+    let already_enabled = get_enabled_apis(project_id);
+
+    let mut to_enable = Vec::new();
+    let mut skipped = Vec::new();
+
+    for api_id in api_ids {
+        if already_enabled.contains(api_id) {
+            skipped.push(api_id.clone());
+        } else {
+            to_enable.push(api_id.clone());
+        }
+    }
+
+    if to_enable.is_empty() {
+        return (Vec::new(), skipped, Vec::new());
+    }
+
+    // Batch enable all APIs in a single gcloud call
+    let mut args = vec!["services".to_string(), "enable".to_string()];
+    args.extend(to_enable.clone());
+    args.push("--project".to_string());
+    args.push(project_id.to_string());
+
+    let result = gcloud_cmd()
+        .args(&args)
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .output();
+
+    match result {
+        Ok(output) if output.status.success() => (to_enable, skipped, Vec::new()),
+        Ok(_) => (Vec::new(), skipped, to_enable),
+        Err(_) => (Vec::new(), skipped, to_enable),
+    }
+}
+
+/// Get the list of already-enabled API service names for a project.
+pub fn get_enabled_apis(project_id: &str) -> Vec<String> {
+    let output = gcloud_cmd()
+        .args([
+            "services",
+            "list",
+            "--enabled",
+            "--project",
+            project_id,
+            "--format=json",
+        ])
+        .output();
+
+    match output {
+        Ok(out) if out.status.success() => {
+            let json_str = String::from_utf8_lossy(&out.stdout);
+            if let Ok(services) = serde_json::from_str::<Vec<serde_json::Value>>(&json_str) {
+                return services
+                    .iter()
+                    .filter_map(|s| {
+                        s.get("config")
+                            .and_then(|c| c.get("name"))
+                            .and_then(|n| n.as_str())
+                            .map(|s| s.to_string())
+                    })
+                    .collect();
+            }
+            Vec::new()
+        }
+        _ => Vec::new(),
+    }
+}
+
+// ── OAuth REST API ──────────────────────────────────────────────
+
+/// Configure the OAuth consent screen via REST API.
+async fn configure_consent_screen(
+    project_id: &str,
+    access_token: &str,
+    app_name: &str,
+    support_email: &str,
+) -> Result<(), GwsError> {
+    let client = crate::client::build_client()?;
+
+    // Check if consent screen already exists
+    let check_url = format!(
+        "https://oauth2.googleapis.com/v1/projects/{}/brands",
+        project_id
+    );
+
+    let check_res = client
+        .get(&check_url)
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| GwsError::Auth(format!("Failed to check consent screen: {e}")))?;
+
+    if check_res.status().is_success() {
+        let data: serde_json::Value = check_res.json().await.unwrap_or_else(|_| json!({}));
+        if let Some(brands) = data.get("brands").and_then(|b| b.as_array()) {
+            if !brands.is_empty() {
+                return Ok(());
+            }
+        }
+    }
+
+    // Create the consent screen
+    let create_res = client
+        .post(&check_url)
+        .bearer_auth(access_token)
+        .json(&json!({
+            "applicationTitle": app_name,
+            "supportEmail": support_email,
+        }))
+        .send()
+        .await
+        .map_err(|e| GwsError::Auth(format!("Failed to create consent screen: {e}")))?;
+
+    if create_res.status().is_success() {
+        return Ok(());
+    }
+
+    let body = create_res.text().await.unwrap_or_default();
+    if body.contains("already exists") || body.contains("ALREADY_EXISTS") {
+        return Ok(());
+    }
+
+    // Fallback to manual instructions.
+    // We don't print anything here because the TUI / CLI orchestrator
+    // will guide the user to check/configure the consent screen.
+    Ok(())
+}
+
+// (create_oauth_client removed due to IAP Admin APIs deprecation)
+
+// ── Main setup orchestrator ─────────────────────────────────────
+
+const STEP_LABELS: [&str; 5] = [
+    "gcloud CLI",
+    "Authentication",
+    "GCP project",
+    "Workspace APIs",
+    "OAuth credentials",
+];
+
+enum SetupStage {
+    CheckGcloud,
+    Account,
+    Project,
+    EnableApis,
+    ConfigureOauth,
+    Finish,
+}
+
+/// Shared mutable state threaded through each setup stage.
+struct SetupContext {
+    wizard: Option<SetupWizard>,
+    interactive: bool,
+    dry_run: bool,
+    opts: SetupOptions,
+    account: String,
+    project_id: String,
+    api_ids: Vec<String>,
+    client_id: String,
+    client_secret: String,
+    enabled: Vec<String>,
+    skipped: Vec<String>,
+    failed: Vec<String>,
+}
+
+impl SetupContext {
+    /// Helper to update wizard step if present.
+    fn wiz(&mut self, idx: usize, status: StepStatus) {
+        if let Some(ref mut w) = self.wizard {
+            let _ = w.update_step(idx, status);
+        }
+    }
+
+    /// Finish and consume the wizard.
+    fn finish_wizard(&mut self) {
+        if let Some(w) = self.wizard.take() {
+            let _ = w.finish();
+        }
+    }
+}
+
+/// Stage 1: Verify that gcloud CLI is installed.
+fn stage_check_gcloud(ctx: &mut SetupContext) -> Result<SetupStage, GwsError> {
+    ctx.wiz(0, StepStatus::InProgress("Checking...".into()));
+    if !ctx.dry_run {
+        std::thread::sleep(std::time::Duration::from_millis(200));
+    }
+    if !is_gcloud_installed() {
+        ctx.wiz(0, StepStatus::Failed("not found".into()));
+        ctx.finish_wizard();
+        return Err(GwsError::Validation(
+            "gcloud CLI not found. Install it from https://cloud.google.com/sdk/docs/install"
+                .to_string(),
+        ));
+    }
+    ctx.wiz(0, StepStatus::Done("found".into()));
+    if !ctx.interactive {
+        eprintln!("Step 1/6: Checking for gcloud CLI...\n  ✓ gcloud CLI found");
+    }
+    Ok(SetupStage::Account)
+}
+
+/// Stage 2: Select or authenticate a Google account.
+fn stage_account(ctx: &mut SetupContext) -> Result<SetupStage, GwsError> {
+    ctx.wiz(1, StepStatus::InProgress(String::new()));
+    if ctx.interactive {
+        let accounts = list_gcloud_accounts();
+        let current = get_gcloud_account()?.unwrap_or_default();
+
+        let mut items: Vec<SelectItem> = vec![SelectItem {
+            label: "➕ Login with new account".to_string(),
+            description: "Opens browser for gcloud auth login".to_string(),
+            selected: false,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        }];
+        items.extend(accounts.iter().map(|(acct, active)| SelectItem {
+            label: acct.clone(),
+            description: if *active {
+                "(active)".to_string()
+            } else {
+                String::new()
+            },
+            selected: *acct == current,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        }));
+
+        let result = ctx
+            .wizard
+            .as_mut()
+            .unwrap()
+            .show_picker(
+                "Select a Google account",
+                "Space to select, Enter to confirm",
+                items,
+                false,
+            )
+            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+
+        match result {
+            PickerResult::Confirmed(items) => {
+                let chosen = items.iter().find(|i| i.selected);
+                match chosen {
+                    Some(item) if item.label.starts_with('➕') => {
+                        ctx.wizard
+                            .as_mut()
+                            .unwrap()
+                            .suspend()
+                            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+                        eprintln!("  → Opening browser for login...");
+                        gcloud_auth_login()?;
+                        let acct = get_gcloud_account()?.ok_or_else(|| {
+                            GwsError::Auth("Authentication failed — no active account".to_string())
+                        })?;
+                        ctx.wizard
+                            .as_mut()
+                            .unwrap()
+                            .resume()
+                            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+                        ctx.wiz(1, StepStatus::Done(acct.clone()));
+                        ctx.account = acct;
+                        Ok(SetupStage::Project)
+                    }
+                    Some(item) => {
+                        set_gcloud_account(&item.label)?;
+                        ctx.wiz(1, StepStatus::Done(item.label.clone()));
+                        ctx.account = item.label.clone();
+                        Ok(SetupStage::Project)
+                    }
+                    None => {
+                        ctx.finish_wizard();
+                        Err(GwsError::Validation("No account selected".to_string()))
+                    }
+                }
+            }
+            PickerResult::GoBack => Ok(SetupStage::CheckGcloud),
+            PickerResult::Cancelled => {
+                ctx.finish_wizard();
+                Err(GwsError::Validation("Setup cancelled".to_string()))
+            }
+        }
+    } else {
+        ctx.account = match get_gcloud_account()? {
+            Some(acct) => {
+                eprintln!(
+                    "Step 2/6: Checking authentication...\n  ✓ Authenticated as {}",
+                    acct
+                );
+                acct
+            }
+            None => {
+                eprintln!(
+                    "Step 2/6: Checking authentication...\n  → Not logged in. Running gcloud auth login..."
+                );
+                gcloud_auth_login()?;
+                get_gcloud_account()?.ok_or_else(|| {
+                    GwsError::Auth("Authentication failed — no active account".to_string())
+                })?
+            }
+        };
+        Ok(SetupStage::Project)
+    }
+}
+
+/// Stage 3: Select or create a GCP project.
+fn stage_project(ctx: &mut SetupContext) -> Result<SetupStage, GwsError> {
+    ctx.wiz(2, StepStatus::InProgress(String::new()));
+    if let Some(p) = ctx.opts.project.clone() {
+        if !ctx.dry_run {
+            set_gcloud_project(&p)?;
+        }
+        ctx.wiz(2, StepStatus::Done(p.clone()));
+        if !ctx.interactive {
+            eprintln!("Step 3/6: Project set to {}", p);
+        }
+        ctx.project_id = p;
+        return Ok(SetupStage::EnableApis);
+    }
+
+    if ctx.interactive {
+        if let Some(ref mut w) = ctx.wizard {
+            let _ = w.show_message("Loading projects...");
+        }
+        let (projects, list_err) = list_gcloud_projects();
+        if let Some(err) = &list_err {
+            if let Some(ref mut w) = ctx.wizard {
+                let _ = w.show_message(&format!("⚠ Could not list projects: {err}"));
+            }
+        }
+        let current = get_gcloud_project()?.unwrap_or_default();
+
+        let mut items: Vec<SelectItem> = vec![SelectItem {
+            label: "➕ Create new project".to_string(),
+            description: "Create a new GCP project for gws".to_string(),
+            selected: false,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        }];
+        items.extend(projects.iter().map(|(id, name)| SelectItem {
+            label: id.clone(),
+            description: name.clone(),
+            selected: *id == current,
+            is_fixed: false,
+            is_template: false,
+            template_selects: vec![],
+        }));
+
+        let result = ctx
+            .wizard
+            .as_mut()
+            .unwrap()
+            .show_picker(
+                "Select a GCP project",
+                "Space to select, Enter to confirm",
+                items,
+                false,
+            )
+            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+
+        match result {
+            PickerResult::Confirmed(items) => {
+                let chosen = items.iter().find(|i| i.selected);
+                match chosen {
+                    Some(item) if item.label.starts_with('➕') => {
+                        let project_name = match ctx
+                            .wizard
+                            .as_mut()
+                            .unwrap()
+                            .show_input("Create new GCP project", "Enter a unique project ID", None)
+                            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?
+                        {
+                            crate::setup_tui::InputResult::Confirmed(v) if !v.is_empty() => v,
+                            _ => {
+                                return Err(GwsError::Validation(
+                                    "Project creation cancelled by user".to_string(),
+                                ))
+                            }
+                        };
+
+                        ctx.wizard
+                            .as_mut()
+                            .unwrap()
+                            .show_message(&format!("Creating project '{}'...", project_name))
+                            .ok();
+
+                        let status = gcloud_cmd()
+                            .args(["projects", "create", &project_name])
+                            .status()
+                            .map_err(|e| {
+                                GwsError::Validation(format!("Failed to create project: {e}"))
+                            })?;
+                        if !status.success() {
+                            return Err(GwsError::Validation(format!(
+                                "Failed to create project '{}'. Check the ID is valid and unique.",
+                                project_name
+                            )));
+                        }
+                        set_gcloud_project(&project_name)?;
+                        ctx.wiz(2, StepStatus::Done(project_name.clone()));
+                        ctx.project_id = project_name;
+                        Ok(SetupStage::EnableApis)
+                    }
+                    Some(item) => {
+                        set_gcloud_project(&item.label)?;
+                        ctx.wiz(2, StepStatus::Done(item.label.clone()));
+                        ctx.project_id = item.label.clone();
+                        Ok(SetupStage::EnableApis)
+                    }
+                    None => {
+                        ctx.finish_wizard();
+                        Err(GwsError::Validation(
+                            "No project selected. Use --project <id> to specify one.".to_string(),
+                        ))
+                    }
+                }
+            }
+            PickerResult::GoBack => Ok(SetupStage::Account),
+            PickerResult::Cancelled => {
+                ctx.finish_wizard();
+                Err(GwsError::Validation("Setup cancelled".to_string()))
+            }
+        }
+    } else {
+        ctx.project_id = match get_gcloud_project()? {
+            Some(p) => {
+                eprintln!("Step 3/6: Using current project: {}", p);
+                p
+            }
+            None => {
+                return Err(GwsError::Validation(
+                    "No GCP project configured. Use --project <id> or run `gcloud config set project <id>`"
+                        .to_string(),
+                ));
+            }
+        };
+        Ok(SetupStage::EnableApis)
+    }
+}
+
+/// Stage 4: Select and enable Workspace APIs.
+async fn stage_enable_apis(ctx: &mut SetupContext) -> Result<SetupStage, GwsError> {
+    ctx.wiz(3, StepStatus::InProgress(String::new()));
+    if ctx.interactive {
+        let already_enabled = get_enabled_apis(&ctx.project_id);
+        let items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|api| {
+                let already = already_enabled.contains(&api.id.to_string());
+                SelectItem {
+                    label: api.name.to_string(),
+                    description: if already {
+                        format!("{} (already enabled)", api.id)
+                    } else {
+                        api.id.to_string()
+                    },
+                    selected: already,
+                    is_fixed: already,
+                    is_template: false,
+                    template_selects: vec![],
+                }
+            })
+            .collect();
+
+        let result = ctx
+            .wizard
+            .as_mut()
+            .unwrap()
+            .show_picker(
+                "Select APIs to enable",
+                "Space to toggle, 'a' to select all, Enter to confirm",
+                items,
+                true,
+            )
+            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+
+        match result {
+            PickerResult::Confirmed(items) => {
+                ctx.api_ids = items
+                    .iter()
+                    .enumerate()
+                    .filter(|(_, item)| item.selected)
+                    .map(|(i, _)| WORKSPACE_APIS[i].id.to_string())
+                    .collect::<Vec<_>>();
+            }
+            PickerResult::GoBack => {
+                return Ok(SetupStage::Project);
+            }
+            PickerResult::Cancelled => {
+                ctx.finish_wizard();
+                return Err(GwsError::Validation("Setup cancelled".to_string()));
+            }
+        }
+    } else {
+        ctx.api_ids = all_api_ids().iter().map(|s| s.to_string()).collect();
+    }
+
+    if ctx.dry_run {
+        eprintln!("Step 4/5: Would enable {} APIs:", ctx.api_ids.len());
+        for id in &ctx.api_ids {
+            eprintln!("  - {}", id);
+        }
+        eprintln!("Step 5/5: Would configure OAuth credentials (Consent + Client)");
+        eprintln!();
+        let output = json!({
+            "status": "dry_run",
+            "message": "No changes were made. Run `gws auth login` to authenticate.",
+            "account": ctx.account,
+            "project": ctx.project_id,
+            "apis_would_enable": ctx.api_ids,
+        });
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&output).unwrap_or_default()
+        );
+        return Ok(SetupStage::Finish);
+    }
+
+    ctx.wiz(
+        3,
+        StepStatus::InProgress(format!("Enabling {} APIs...", ctx.api_ids.len())),
+    );
+    let (enabled_apis, skipped_apis, failed_apis) =
+        enable_apis(&ctx.project_id, &ctx.api_ids).await;
+    ctx.enabled = enabled_apis;
+    ctx.skipped = skipped_apis;
+    ctx.failed = failed_apis;
+    ctx.wiz(
+        3,
+        StepStatus::Done(format!(
+            "{} enabled, {} skipped",
+            ctx.enabled.len(),
+            ctx.skipped.len()
+        )),
+    );
+    Ok(SetupStage::ConfigureOauth)
+}
+
+/// Stage 5: Configure OAuth consent screen and collect client credentials.
+async fn stage_configure_oauth(ctx: &mut SetupContext) -> Result<SetupStage, GwsError> {
+    ctx.wiz(4, StepStatus::InProgress("Configuring...".into()));
+    let access_token = get_access_token()?;
+    let app_name = "gws CLI";
+    configure_consent_screen(&ctx.project_id, &access_token, app_name, &ctx.account).await?;
+
+    ctx.wiz(
+        4,
+        StepStatus::InProgress("Waiting for manual input...".into()),
+    );
+    if !ctx.interactive {
+        return Err(GwsError::Validation(
+            "Cannot automate OAuth client creation. Please run setup interactively.".to_string(),
+        ));
+    }
+
+    let (cid_result, csecret_result) = if let Some(ref mut w) = ctx.wizard {
+        let current_creds: Option<serde_json::Value> = crate::credential_store::load_encrypted()
+            .ok()
+            .and_then(|s| serde_json::from_str(&s).ok());
+
+        w.show_message(&format!(
+            "Go to: https://console.cloud.google.com/apis/credentials/consent?project={}\n\
+             Ensure 'External' consent screen is configured. Then,\n\
+             Go to: https://console.cloud.google.com/apis/credentials?project={}\n\
+             Click 'Create Credentials' -> 'OAuth client ID' -> 'Desktop app'",
+            ctx.project_id, ctx.project_id
+        ))
+        .ok();
+
+        let cid_res = w
+            .show_input(
+                "Enter OAuth Client ID",
+                "Paste the Client ID from Google Cloud Console",
+                current_creds.as_ref().and_then(|c| c["client_id"].as_str()),
+            )
+            .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?;
+
+        let csec_res = match &cid_res {
+            crate::setup_tui::InputResult::Confirmed(v) if !v.is_empty() => w
+                .show_input(
+                    "Enter OAuth Client Secret",
+                    "Paste the Client Secret from Google Cloud Console",
+                    current_creds
+                        .as_ref()
+                        .and_then(|c| c["client_secret"].as_str()),
+                )
+                .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?,
+            _ => crate::setup_tui::InputResult::Cancelled,
+        };
+        (cid_res, csec_res)
+    } else {
+        return Err(GwsError::Validation(
+            "Interactive mode required for OAuth client input".to_string(),
+        ));
+    };
+
+    ctx.client_id = match cid_result {
+        crate::setup_tui::InputResult::Confirmed(v) => {
+            if v.is_empty() {
+                ctx.finish_wizard();
+                return Err(GwsError::Validation("Client ID cannot be empty".into()));
+            }
+            v
+        }
+        crate::setup_tui::InputResult::GoBack => {
+            return Ok(SetupStage::EnableApis);
+        }
+        crate::setup_tui::InputResult::Cancelled => {
+            ctx.finish_wizard();
+            return Err(GwsError::Validation("Setup cancelled".into()));
+        }
+    };
+
+    ctx.client_secret = match csecret_result {
+        crate::setup_tui::InputResult::Confirmed(v) => {
+            if v.is_empty() {
+                ctx.finish_wizard();
+                return Err(GwsError::Validation("Client Secret cannot be empty".into()));
+            }
+            v
+        }
+        crate::setup_tui::InputResult::GoBack => {
+            return Ok(SetupStage::EnableApis);
+        }
+        crate::setup_tui::InputResult::Cancelled => {
+            ctx.finish_wizard();
+            return Err(GwsError::Validation("Setup cancelled".into()));
+        }
+    };
+
+    let _config_path = crate::oauth_config::save_client_config(
+        &ctx.client_id,
+        &ctx.client_secret,
+        &ctx.project_id,
+    )
+    .map_err(|e| GwsError::Validation(format!("Failed to save client config: {e}")))?;
+
+    ctx.wiz(4, StepStatus::Done("configured".into()));
+    Ok(SetupStage::Finish)
+}
+
+/// Run the full setup flow. Orchestrates all steps and outputs JSON summary.
+pub async fn run_setup(args: &[String]) -> Result<(), GwsError> {
+    let opts = parse_setup_args(args);
+    let dry_run = opts.dry_run;
+    let interactive = std::io::IsTerminal::is_terminal(&std::io::stdin()) && !dry_run;
+
+    if dry_run {
+        eprintln!("🏃 DRY RUN — no changes will be made\n");
+    }
+
+    let wizard = if interactive {
+        Some(
+            SetupWizard::start(&STEP_LABELS)
+                .map_err(|e| GwsError::Validation(format!("TUI error: {e}")))?,
+        )
+    } else {
+        None
+    };
+
+    let mut ctx = SetupContext {
+        wizard,
+        interactive,
+        dry_run,
+        opts,
+        account: String::new(),
+        project_id: String::new(),
+        api_ids: Vec::new(),
+        client_id: String::new(),
+        client_secret: String::new(),
+        enabled: Vec::new(),
+        skipped: Vec::new(),
+        failed: Vec::new(),
+    };
+
+    let mut stage = SetupStage::CheckGcloud;
+
+    loop {
+        stage = match stage {
+            SetupStage::CheckGcloud => stage_check_gcloud(&mut ctx)?,
+            SetupStage::Account => stage_account(&mut ctx)?,
+            SetupStage::Project => stage_project(&mut ctx)?,
+            SetupStage::EnableApis => stage_enable_apis(&mut ctx).await?,
+            SetupStage::ConfigureOauth => stage_configure_oauth(&mut ctx).await?,
+            SetupStage::Finish => break,
+        };
+    }
+
+    ctx.finish_wizard();
+
+    let output = json!({
+        "status": "success",
+        "message": "Setup complete! Run `gws auth login` to authenticate.",
+        "account": ctx.account,
+        "project": ctx.project_id,
+        "apis_enabled": ctx.enabled.len(),
+        "apis_skipped": ctx.skipped.len(),
+        "apis_failed": ctx.failed.len(),
+        "client_config": crate::oauth_config::client_config_path().display().to_string(),
+    });
+    println!(
+        "{}",
+        serde_json::to_string_pretty(&output).unwrap_or_default()
+    );
+
+    eprintln!("\n✅ Setup complete! Run `gws auth login` to authenticate.");
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::services;
+    use crate::setup_tui::{PickerResult, SelectItem};
+    use crossterm::event::KeyCode;
+
+    // ── Action resolution (test-only) ───────────────────────────
+
+    #[derive(Debug, PartialEq)]
+    enum SetupAction {
+        SetAccount(String),
+        LoginNewAccount,
+        SetProject(String),
+        CreateProject(String),
+        EnableApis(Vec<String>),
+        NoSelection,
+    }
+
+    fn resolve_account_selection(items: &[SelectItem]) -> SetupAction {
+        match items.iter().find(|i| i.selected) {
+            Some(item) if item.label.starts_with('➕') => SetupAction::LoginNewAccount,
+            Some(item) => SetupAction::SetAccount(item.label.clone()),
+            None => SetupAction::NoSelection,
+        }
+    }
+
+    fn resolve_project_selection(items: &[SelectItem]) -> SetupAction {
+        match items.iter().find(|i| i.selected) {
+            Some(item) if item.label.starts_with('➕') => {
+                SetupAction::CreateProject(String::new())
+            }
+            Some(item) => SetupAction::SetProject(item.label.clone()),
+            None => SetupAction::NoSelection,
+        }
+    }
+
+    fn resolve_api_selection(items: &[SelectItem]) -> SetupAction {
+        let api_ids: Vec<String> = items
+            .iter()
+            .enumerate()
+            .filter(|(_, item)| item.selected)
+            .filter_map(|(i, _)| WORKSPACE_APIS.get(i).map(|a| a.id.to_string()))
+            .collect();
+        SetupAction::EnableApis(api_ids)
+    }
+
+    // ── Helpers ─────────────────────────────────────────────────
+
+    fn make_items(labels: &[&str]) -> Vec<SelectItem> {
+        labels
+            .iter()
+            .map(|l| SelectItem {
+                label: l.to_string(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect()
+    }
+
+    fn simulate_picker(
+        items: Vec<SelectItem>,
+        keys: &[KeyCode],
+        multiselect: bool,
+    ) -> Vec<SelectItem> {
+        let mut state = crate::setup_tui::PickerState::new("Test", "", items, multiselect);
+        for key in keys {
+            if let Some(PickerResult::Confirmed(result)) = state.handle_key(*key) {
+                return result;
+            }
+        }
+        panic!("Key sequence did not produce a Confirmed result");
+    }
+
+    // ── API / data tests ────────────────────────────────────────
+
+    #[test]
+    fn test_workspace_api_ids_not_empty() {
+        assert!(!WORKSPACE_APIS.is_empty());
+    }
+
+    #[test]
+    fn test_workspace_api_ids_all_have_googleapis_suffix() {
+        for api in WORKSPACE_APIS {
+            assert!(
+                api.id.ends_with(".googleapis.com"),
+                "API ID '{}' should end with .googleapis.com",
+                api.id
+            );
+        }
+    }
+
+    #[test]
+    fn test_workspace_api_ids_no_duplicates() {
+        let mut seen = std::collections::HashSet::new();
+        for api in WORKSPACE_APIS {
+            assert!(seen.insert(api.id), "Duplicate API ID: {}", api.id);
+        }
+    }
+
+    #[test]
+    fn test_workspace_api_ids_covers_services() {
+        let api_ids = all_api_ids();
+        for entry in services::SERVICES {
+            if entry.api_name == "modelarmor" || entry.api_name == "workspaceevents" {
+                continue;
+            }
+            let expected_suffix = if entry.api_name == "calendar" {
+                "calendar-json.googleapis.com"
+            } else {
+                &format!("{}.googleapis.com", entry.api_name)
+            };
+            if entry.api_name == "admin" {
+                assert!(api_ids.contains(&"admin.googleapis.com"));
+                continue;
+            }
+            assert!(
+                api_ids.iter().any(|id| *id == expected_suffix),
+                "Missing API ID for service '{}' (expected {})",
+                entry.api_name,
+                expected_suffix
+            );
+        }
+    }
+
+    // ── parse_setup_args tests ──────────────────────────────────
+
+    #[test]
+    fn test_parse_setup_args_empty() {
+        let opts = parse_setup_args(&[]);
+        assert!(opts.project.is_none());
+        assert!(!opts.dry_run);
+    }
+
+    #[test]
+    fn test_parse_setup_args_with_project() {
+        let args = vec!["--project".into(), "my-project".into()];
+        let opts = parse_setup_args(&args);
+        assert_eq!(opts.project.as_deref(), Some("my-project"));
+    }
+
+    #[test]
+    fn test_parse_setup_args_with_project_equals() {
+        let args = vec!["--project=my-project".into()];
+        let opts = parse_setup_args(&args);
+        assert_eq!(opts.project.as_deref(), Some("my-project"));
+    }
+
+    #[test]
+    fn test_parse_setup_args_ignores_unknown() {
+        let args = vec!["--verbose".into(), "--unknown".into()];
+        let opts = parse_setup_args(&args);
+        assert!(opts.project.is_none());
+    }
+
+    #[test]
+    fn test_parse_setup_args_dry_run() {
+        let args = vec!["--dry-run".into()];
+        let opts = parse_setup_args(&args);
+        assert!(opts.dry_run);
+    }
+
+    #[test]
+    fn test_parse_setup_args_dry_run_with_project() {
+        let args: Vec<String> = vec!["--dry-run".into(), "--project".into(), "p".into()];
+        let opts = parse_setup_args(&args);
+        assert!(opts.dry_run);
+        assert_eq!(opts.project.as_deref(), Some("p"));
+    }
+
+    // ── Account selection → gcloud action ───────────────────────
+
+    #[test]
+    fn test_account_select_existing_triggers_set_account() {
+        let mut items = make_items(&["➕ Login with new account", "user@gmail.com"]);
+        items[1].selected = true;
+        assert_eq!(
+            resolve_account_selection(&items),
+            SetupAction::SetAccount("user@gmail.com".into())
+        );
+    }
+
+    #[test]
+    fn test_account_select_login_new_triggers_login() {
+        let mut items = make_items(&["➕ Login with new account", "user@gmail.com"]);
+        items[0].selected = true;
+        assert_eq!(
+            resolve_account_selection(&items),
+            SetupAction::LoginNewAccount
+        );
+    }
+
+    #[test]
+    fn test_account_select_none_returns_no_selection() {
+        let items = make_items(&["➕ Login", "user@gmail.com"]);
+        assert_eq!(resolve_account_selection(&items), SetupAction::NoSelection);
+    }
+
+    // ── Project selection → gcloud action ───────────────────────
+
+    #[test]
+    fn test_project_select_existing() {
+        let mut items = make_items(&["➕ Create new project", "my-project-123"]);
+        items[1].selected = true;
+        assert_eq!(
+            resolve_project_selection(&items),
+            SetupAction::SetProject("my-project-123".into())
+        );
+    }
+
+    #[test]
+    fn test_project_select_create_new() {
+        let mut items = make_items(&["➕ Create new project", "existing"]);
+        items[0].selected = true;
+        assert_eq!(
+            resolve_project_selection(&items),
+            SetupAction::CreateProject(String::new())
+        );
+    }
+
+    #[test]
+    fn test_project_select_none() {
+        let items = make_items(&["➕ Create new project", "proj-a"]);
+        assert_eq!(resolve_project_selection(&items), SetupAction::NoSelection);
+    }
+
+    // ── API selection → enable action ───────────────────────────
+
+    #[test]
+    fn test_api_select_none_enables_nothing() {
+        let items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|a| SelectItem {
+                label: a.name.to_string(),
+                description: a.id.to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect();
+        assert_eq!(
+            resolve_api_selection(&items),
+            SetupAction::EnableApis(vec![])
+        );
+    }
+
+    #[test]
+    fn test_api_select_first_enables_one() {
+        let mut items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|a| SelectItem {
+                label: a.name.to_string(),
+                description: a.id.to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect();
+        items[0].selected = true;
+        assert_eq!(
+            resolve_api_selection(&items),
+            SetupAction::EnableApis(vec![WORKSPACE_APIS[0].id.to_string()])
+        );
+    }
+
+    #[test]
+    fn test_api_select_all_enables_all() {
+        let items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|a| SelectItem {
+                label: a.name.to_string(),
+                description: a.id.to_string(),
+                selected: true,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect();
+        match resolve_api_selection(&items) {
+            SetupAction::EnableApis(ids) => assert_eq!(ids.len(), WORKSPACE_APIS.len()),
+            _ => panic!("Expected EnableApis"),
+        }
+    }
+
+    // ── Full pipeline: keys → picker → gcloud action ────────────
+
+    #[test]
+    fn test_pipeline_select_account_via_keys() {
+        let items = vec![
+            SelectItem {
+                label: "➕ Login with new account".into(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "user@gmail.com".into(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+        ];
+        let result = simulate_picker(
+            items,
+            &[KeyCode::Down, KeyCode::Char(' '), KeyCode::Enter],
+            false,
+        );
+        assert_eq!(
+            resolve_account_selection(&result),
+            SetupAction::SetAccount("user@gmail.com".into())
+        );
+    }
+
+    #[test]
+    fn test_pipeline_login_new_via_keys() {
+        let items = vec![
+            SelectItem {
+                label: "➕ Login with new account".into(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "user@gmail.com".into(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+        ];
+        let result = simulate_picker(items, &[KeyCode::Char(' '), KeyCode::Enter], false);
+        assert_eq!(
+            resolve_account_selection(&result),
+            SetupAction::LoginNewAccount
+        );
+    }
+
+    #[test]
+    fn test_pipeline_select_project_via_keys() {
+        let items = vec![
+            SelectItem {
+                label: "➕ Create new project".into(),
+                description: String::new(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "my-project".into(),
+                description: "My Project".into(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "other-project".into(),
+                description: "Other".into(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+        ];
+        let result = simulate_picker(
+            items,
+            &[
+                KeyCode::Down,
+                KeyCode::Down,
+                KeyCode::Char(' '),
+                KeyCode::Enter,
+            ],
+            false,
+        );
+        assert_eq!(
+            resolve_project_selection(&result),
+            SetupAction::SetProject("other-project".into())
+        );
+    }
+
+    #[test]
+    fn test_pipeline_select_all_apis_via_keys() {
+        let items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|a| SelectItem {
+                label: a.name.to_string(),
+                description: a.id.to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect();
+        let result = simulate_picker(items, &[KeyCode::Char('a'), KeyCode::Enter], true);
+        match resolve_api_selection(&result) {
+            SetupAction::EnableApis(ids) => {
+                assert_eq!(ids.len(), WORKSPACE_APIS.len());
+                assert_eq!(ids[0], WORKSPACE_APIS[0].id);
+            }
+            _ => panic!("Expected EnableApis"),
+        }
+    }
+
+    #[test]
+    fn test_pipeline_select_two_apis_via_keys() {
+        let items: Vec<SelectItem> = WORKSPACE_APIS
+            .iter()
+            .map(|a| SelectItem {
+                label: a.name.to_string(),
+                description: a.id.to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect();
+        let result = simulate_picker(
+            items,
+            &[
+                KeyCode::Char(' '),
+                KeyCode::Down,
+                KeyCode::Char(' '),
+                KeyCode::Enter,
+            ],
+            true,
+        );
+        match resolve_api_selection(&result) {
+            SetupAction::EnableApis(ids) => {
+                assert_eq!(ids.len(), 2);
+                assert_eq!(ids[0], WORKSPACE_APIS[0].id);
+                assert_eq!(ids[1], WORKSPACE_APIS[1].id);
+            }
+            _ => panic!("Expected EnableApis"),
+        }
+    }
+}
diff --git a/src/setup_tui.rs b/src/setup_tui.rs
new file mode 100644
index 00000000..39adbacc
--- /dev/null
+++ b/src/setup_tui.rs
@@ -0,0 +1,1732 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Interactive multi-select TUI for the setup flow.
+//!
+//! Provides a ratatui-based fullscreen multi-select picker
+//! that the user can navigate with arrow keys, toggle with space,
+//! select all with 'a', and confirm with Enter.
+
+use crossterm::{
+    event::{self, Event, KeyCode, KeyEventKind},
+    terminal::{disable_raw_mode, enable_raw_mode, EnterAlternateScreen, LeaveAlternateScreen},
+    ExecutableCommand,
+};
+use ratatui::{
+    layout::{Constraint, Layout},
+    style::{Color, Modifier, Style},
+    text::{Line, Span},
+    widgets::{Block, Borders, List, ListItem, ListState, Paragraph},
+    DefaultTerminal,
+};
+use std::io::stdout;
+
+/// An item in the multi-select list.
+#[derive(Clone)]
+pub struct SelectItem {
+    pub label: String,
+    pub description: String,
+    pub selected: bool,
+    pub is_fixed: bool,
+    pub is_template: bool,
+    pub template_selects: Vec<String>,
+}
+
+/// Result of running the multi-select picker.
+pub enum PickerResult {
+    /// User confirmed selection.
+    Confirmed(Vec<SelectItem>),
+    /// User wanted to go back
+    GoBack,
+    /// User cancelled (q).
+    Cancelled,
+}
+
+/// Result of running the input dialog.
+pub enum InputResult {
+    /// User confirmed input.
+    Confirmed(String),
+    /// User wanted to go back
+    GoBack,
+    /// User cancelled
+    Cancelled,
+}
+
+/// Helper to wrap text to a particular max width.
+pub fn wrap_text(text: &str, max_width: u16) -> Vec<String> {
+    if max_width == 0 {
+        return vec![text.to_string()];
+    }
+    let mut result = Vec::new();
+    for paragraph in text.split('\n') {
+        let mut current_line = String::new();
+        for word in paragraph.split_whitespace() {
+            if current_line.is_empty() {
+                current_line.push_str(word);
+            } else if current_line.chars().count() + 1 + word.chars().count() <= max_width as usize
+            {
+                current_line.push(' ');
+                current_line.push_str(word);
+            } else {
+                result.push(current_line);
+                current_line = word.to_string();
+            }
+        }
+        if !current_line.is_empty() {
+            result.push(current_line);
+        } else if paragraph.is_empty() {
+            result.push(String::new());
+        }
+    }
+    result
+}
+
+/// State for the multi-select picker.
+pub struct PickerState {
+    pub items: Vec<SelectItem>,
+    pub list_state: ListState,
+    pub title: String,
+    pub help_text: String,
+    pub multiselect: bool,
+}
+
+/// State for the text input.
+pub struct InputState {
+    pub value: String,
+    title: String,
+}
+
+impl InputState {
+    pub fn new(title: &str, _help_text: &str, initial: Option<&str>) -> Self {
+        Self {
+            value: initial.unwrap_or("").to_string(),
+            title: title.to_string(),
+        }
+    }
+
+    pub fn handle_key(&mut self, code: KeyCode) -> Option<InputResult> {
+        match code {
+            KeyCode::Esc => Some(InputResult::Cancelled),
+            KeyCode::Up | KeyCode::BackTab => Some(InputResult::GoBack),
+            KeyCode::Enter => Some(InputResult::Confirmed(self.value.clone())),
+            KeyCode::Backspace => {
+                self.value.pop();
+                None
+            }
+            KeyCode::Char(c) => {
+                self.value.push(c);
+                None
+            }
+            _ => None,
+        }
+    }
+}
+
+impl PickerState {
+    pub fn new(title: &str, help_text: &str, items: Vec<SelectItem>, multiselect: bool) -> Self {
+        let selected_idx = items.iter().position(|i| i.selected).unwrap_or(0);
+        let mut list_state = ListState::default();
+        list_state.select(Some(selected_idx));
+        Self {
+            items,
+            list_state,
+            title: title.to_string(),
+            help_text: help_text.to_string(),
+            multiselect,
+        }
+    }
+
+    fn toggle_current(&mut self) {
+        if let Some(i) = self.list_state.selected() {
+            if !self.items[i].is_fixed {
+                let current_label = self.items[i].label.clone();
+                let current_selected = !self.items[i].selected;
+                let is_template = self.items[i].is_template;
+                let template_selects = self.items[i].template_selects.clone();
+
+                self.items[i].selected = current_selected;
+
+                if is_template {
+                    // Turn off other templates
+                    if current_selected {
+                        for item in &mut self.items {
+                            if item.is_template && item.label != current_label {
+                                item.selected = false;
+                            }
+                        }
+                        // Apply template selection to normal items
+                        for item in &mut self.items {
+                            if !item.is_template && !item.is_fixed {
+                                item.selected = template_selects.contains(&item.label);
+                            }
+                        }
+                    }
+                } else {
+                    // If a normal item is toggled, turn OFF all templates since the user is customizing
+                    for item in &mut self.items {
+                        if item.is_template {
+                            item.selected = false;
+                        }
+                    }
+
+                    // Handle readonly/superset interdependency
+                    // Only deselect the counterpart when we are SELECTING an item
+                    if current_selected {
+                        let counterpart_to_deselect = if current_label.ends_with(".readonly") {
+                            current_label.strip_suffix(".readonly").unwrap().to_string()
+                        } else {
+                            format!("{}.readonly", current_label)
+                        };
+
+                        self.items.iter_mut().for_each(|item| {
+                            if item.label == counterpart_to_deselect && !item.is_fixed {
+                                item.selected = false;
+                            }
+                        });
+                    }
+                }
+            }
+        }
+    }
+
+    fn toggle_all(&mut self) {
+        let all_non_fixed_selected = self
+            .items
+            .iter()
+            .filter(|i| !i.is_fixed)
+            .all(|item| item.selected);
+        for item in &mut self.items {
+            if !item.is_fixed {
+                item.selected = !all_non_fixed_selected;
+            }
+        }
+    }
+
+    fn next(&mut self) {
+        let i = match self.list_state.selected() {
+            Some(i) => (i + 1) % self.items.len(),
+            None => 0,
+        };
+        self.list_state.select(Some(i));
+    }
+
+    fn previous(&mut self) {
+        let i = match self.list_state.selected() {
+            Some(i) => {
+                if i == 0 {
+                    self.items.len() - 1
+                } else {
+                    i - 1
+                }
+            }
+            None => 0,
+        };
+        self.list_state.select(Some(i));
+    }
+
+    fn selected_count(&self) -> usize {
+        self.items.iter().filter(|i| i.selected).count()
+    }
+
+    /// Handle a key press. Returns Some(result) if the picker should exit.
+    pub fn handle_key(&mut self, code: KeyCode) -> Option<PickerResult> {
+        match code {
+            KeyCode::Char('q') | KeyCode::Esc => Some(PickerResult::Cancelled),
+            KeyCode::Left | KeyCode::Char('h') | KeyCode::Backspace => Some(PickerResult::GoBack),
+            KeyCode::Enter => {
+                if !self.multiselect {
+                    if let Some(idx) = self.list_state.selected() {
+                        for (i, item) in self.items.iter_mut().enumerate() {
+                            if !item.is_fixed {
+                                item.selected = i == idx;
+                            }
+                        }
+                    }
+                }
+                Some(PickerResult::Confirmed(self.items.clone()))
+            }
+            KeyCode::Char(' ') => {
+                if self.multiselect {
+                    self.toggle_current();
+                } else if let Some(idx) = self.list_state.selected() {
+                    for (i, item) in self.items.iter_mut().enumerate() {
+                        if !item.is_fixed {
+                            item.selected = i == idx;
+                        }
+                    }
+                }
+                None
+            }
+            KeyCode::Char('a') => {
+                if self.multiselect {
+                    self.toggle_all();
+                }
+                None
+            }
+            KeyCode::Up | KeyCode::Char('k') => {
+                self.previous();
+                if !self.multiselect {
+                    if let Some(idx) = self.list_state.selected() {
+                        for (i, item) in self.items.iter_mut().enumerate() {
+                            if !item.is_fixed {
+                                item.selected = i == idx;
+                            }
+                        }
+                    }
+                }
+                None
+            }
+            KeyCode::Down | KeyCode::Char('j') => {
+                self.next();
+                if !self.multiselect {
+                    if let Some(idx) = self.list_state.selected() {
+                        for (i, item) in self.items.iter_mut().enumerate() {
+                            if !item.is_fixed {
+                                item.selected = i == idx;
+                            }
+                        }
+                    }
+                }
+                None
+            }
+            _ => None,
+        }
+    }
+}
+
+/// Run an interactive multi-select picker.
+///
+/// Returns `PickerResult::Confirmed` with the final item states,
+/// or `PickerResult::Cancelled` if the user pressed Esc/q.
+pub fn run_picker(
+    title: &str,
+    help_text: &str,
+    items: Vec<SelectItem>,
+    multiselect: bool,
+) -> std::io::Result<PickerResult> {
+    // Enter TUI mode
+    stdout().execute(EnterAlternateScreen)?;
+    enable_raw_mode()?;
+
+    let mut terminal = ratatui::init();
+    let mut state = PickerState::new(title, help_text, items, multiselect);
+
+    let result = run_picker_loop(&mut terminal, &mut state);
+
+    // Restore terminal
+    ratatui::restore();
+    disable_raw_mode()?;
+    stdout().execute(LeaveAlternateScreen)?;
+
+    result
+}
+
+fn run_picker_loop(
+    terminal: &mut DefaultTerminal,
+    state: &mut PickerState,
+) -> std::io::Result<PickerResult> {
+    loop {
+        terminal.draw(|frame| {
+            let area = frame.area();
+
+            // Layout: title (2) | list (stretch) | help bar (3)
+            let chunks = Layout::vertical([
+                Constraint::Length(3),
+                Constraint::Min(5),
+                Constraint::Length(3),
+            ])
+            .split(area);
+
+            // Title
+            let mut title_spans = vec![
+                Span::styled(&state.title, Style::default().fg(Color::Cyan).bold()),
+                Span::raw("  "),
+            ];
+            if state.multiselect {
+                title_spans.push(Span::styled(
+                    format!("{}/{} selected", state.selected_count(), state.items.len()),
+                    Style::default().fg(Color::DarkGray),
+                ));
+            }
+            let title = Paragraph::new(Line::from(title_spans))
+                .block(Block::default().borders(Borders::BOTTOM));
+            frame.render_widget(title, chunks[0]);
+
+            // List items
+            let items: Vec<ListItem> = state
+                .items
+                .iter()
+                .map(|item| {
+                    let checkbox = if state.multiselect {
+                        if item.selected {
+                            "[x] "
+                        } else {
+                            "[ ] "
+                        }
+                    } else if item.selected {
+                        "◉ "
+                    } else {
+                        "○ "
+                    };
+                    let checkbox_style = if item.is_fixed {
+                        Style::default().fg(Color::DarkGray)
+                    } else if item.selected {
+                        Style::default().fg(Color::Green)
+                    } else {
+                        Style::default().fg(Color::DarkGray)
+                    };
+                    let label_style = if item.is_fixed {
+                        Style::default().fg(Color::DarkGray)
+                    } else if item.selected {
+                        Style::default().fg(Color::White)
+                    } else {
+                        Style::default().fg(Color::Gray)
+                    };
+                    let desc_style = Style::default().fg(Color::DarkGray);
+
+                    ListItem::new(Line::from(vec![
+                        Span::styled(checkbox, checkbox_style),
+                        Span::styled(&item.label, label_style),
+                        Span::raw("  "),
+                        Span::styled(&item.description, desc_style),
+                    ]))
+                })
+                .collect();
+
+            let list = List::new(items)
+                .highlight_style(
+                    Style::default()
+                        .bg(Color::DarkGray)
+                        .add_modifier(Modifier::BOLD),
+                )
+                .highlight_symbol("▸ ");
+
+            frame.render_stateful_widget(list, chunks[1], &mut state.list_state);
+
+            // Help bar
+            let mut help_spans = vec![
+                Span::styled(" ↑↓ ", Style::default().fg(Color::Yellow)),
+                Span::raw("Navigate  "),
+            ];
+            if state.multiselect {
+                help_spans.push(Span::styled(" Space ", Style::default().fg(Color::Yellow)));
+                help_spans.push(Span::raw("Toggle  "));
+                help_spans.push(Span::styled(" a ", Style::default().fg(Color::Yellow)));
+                help_spans.push(Span::raw("All  "));
+            }
+            help_spans.push(Span::styled(" Enter ", Style::default().fg(Color::Green)));
+            help_spans.push(Span::raw("Confirm  "));
+            help_spans.push(Span::styled(" Esc ", Style::default().fg(Color::Red)));
+            help_spans.push(Span::raw("Cancel"));
+
+            let help = Paragraph::new(Line::from(help_spans))
+                .block(Block::default().borders(Borders::TOP));
+            frame.render_widget(help, chunks[2]);
+
+            // Additional help text at the bottom of the list area if provided
+            if !state.help_text.is_empty() {
+                // Rendered as part of the title block already
+            }
+        })?;
+
+        // Handle input
+        if let Event::Key(key) = event::read()? {
+            if key.kind != KeyEventKind::Press {
+                continue;
+            }
+            if let Some(result) = state.handle_key(key.code) {
+                return Ok(result);
+            }
+        }
+    }
+}
+
+// ── Setup Wizard (unified TUI session) ──────────────────────────
+
+/// Status of a single setup step.
+#[derive(Clone)]
+pub enum StepStatus {
+    Pending,
+    InProgress(String),
+    Done(String),
+    Failed(String),
+}
+
+/// A step in the setup wizard.
+#[derive(Clone)]
+struct WizardStep {
+    label: String,
+    status: StepStatus,
+}
+
+/// Unified TUI session for the entire setup flow.
+/// Renders step progress + inline picker in one ratatui session.
+pub struct SetupWizard {
+    steps: Vec<WizardStep>,
+    terminal: DefaultTerminal,
+    message: Option<String>,
+}
+
+impl SetupWizard {
+    /// Enter ratatui and start the wizard with the given step labels.
+    pub fn start(step_labels: &[&str]) -> std::io::Result<Self> {
+        stdout().execute(EnterAlternateScreen)?;
+        enable_raw_mode()?;
+        let terminal = ratatui::init();
+        let steps = step_labels
+            .iter()
+            .map(|label| WizardStep {
+                label: label.to_string(),
+                status: StepStatus::Pending,
+            })
+            .collect();
+        let mut wizard = Self {
+            steps,
+            terminal,
+            message: None,
+        };
+        wizard.draw_progress()?;
+        Ok(wizard)
+    }
+
+    /// Update a step's status and redraw.
+    pub fn update_step(&mut self, idx: usize, status: StepStatus) -> std::io::Result<()> {
+        if idx < self.steps.len() {
+            self.steps[idx].status = status;
+        }
+        self.message = None;
+        self.draw_progress()
+    }
+
+    /// Show a message below the steps (e.g. "Loading projects...").
+    pub fn show_message(&mut self, msg: &str) -> std::io::Result<()> {
+        self.message = Some(msg.to_string());
+        self.draw_progress()
+    }
+
+    /// Temporarily exit ratatui (e.g. for browser-based auth).
+    pub fn suspend(&mut self) -> std::io::Result<()> {
+        ratatui::restore();
+        disable_raw_mode()?;
+        stdout().execute(LeaveAlternateScreen)?;
+        Ok(())
+    }
+
+    /// Re-enter ratatui after a suspend.
+    pub fn resume(&mut self) -> std::io::Result<()> {
+        stdout().execute(EnterAlternateScreen)?;
+        enable_raw_mode()?;
+        self.terminal = ratatui::init();
+        self.draw_progress()
+    }
+
+    /// Show an inline picker and wait for user selection.
+    pub fn show_picker(
+        &mut self,
+        title: &str,
+        help_text: &str,
+        items: Vec<SelectItem>,
+        multiselect: bool,
+    ) -> std::io::Result<PickerResult> {
+        let mut picker = PickerState::new(title, help_text, items, multiselect);
+        loop {
+            let steps_snapshot = self.steps.clone();
+            let msg = self.message.clone();
+            self.terminal.draw(|frame| {
+                let area = frame.area();
+                let mut step_height = steps_snapshot.len() as u16 + 2;
+                let msg_lines = if let Some(m) = &msg {
+                    let wrapped = crate::setup_tui::wrap_text(m, area.width.saturating_sub(4));
+                    step_height += wrapped.len() as u16 + 1;
+                    wrapped
+                } else {
+                    vec![]
+                };
+                let chunks = Layout::vertical([
+                    Constraint::Length(step_height),
+                    Constraint::Min(5),
+                    Constraint::Length(3),
+                ])
+                .split(area);
+
+                Self::render_steps(frame, chunks[0], &steps_snapshot, &msg_lines);
+                Self::render_picker(frame, chunks[1], &mut picker);
+
+                let mut help_spans = vec![
+                    Span::styled(" ↑↓ ", Style::default().fg(Color::Yellow)),
+                    Span::raw("Navigate  "),
+                ];
+                if picker.multiselect {
+                    help_spans.push(Span::styled(" Space ", Style::default().fg(Color::Yellow)));
+                    help_spans.push(Span::raw("Toggle  "));
+                    help_spans.push(Span::styled(" a ", Style::default().fg(Color::Yellow)));
+                    help_spans.push(Span::raw("All  "));
+                }
+                help_spans.push(Span::styled(" Enter ", Style::default().fg(Color::Green)));
+                help_spans.push(Span::raw("Confirm  "));
+                help_spans.push(Span::styled(" Esc ", Style::default().fg(Color::Red)));
+                help_spans.push(Span::raw("Cancel"));
+
+                let help = Paragraph::new(Line::from(help_spans))
+                    .block(Block::default().borders(Borders::TOP));
+                frame.render_widget(help, chunks[2]);
+            })?;
+
+            if let Event::Key(key) = event::read()? {
+                if key.kind != KeyEventKind::Press {
+                    continue;
+                }
+                if let Some(result) = picker.handle_key(key.code) {
+                    return Ok(result);
+                }
+            }
+        }
+    }
+
+    /// Show an inline text input and wait for user submission.
+    pub fn show_input(
+        &mut self,
+        title: &str,
+        help_text: &str,
+        initial: Option<&str>,
+    ) -> std::io::Result<InputResult> {
+        let mut input = InputState::new(title, help_text, initial);
+        loop {
+            let steps_snapshot = self.steps.clone();
+            let msg = self.message.clone();
+            self.terminal.draw(|frame| {
+                let area = frame.area();
+                let mut step_height = steps_snapshot.len() as u16 + 2;
+                let msg_lines = if let Some(m) = &msg {
+                    let wrapped = crate::setup_tui::wrap_text(m, area.width.saturating_sub(4));
+                    step_height += wrapped.len() as u16 + 1;
+                    wrapped
+                } else {
+                    vec![]
+                };
+                let chunks = Layout::vertical([
+                    Constraint::Length(step_height),
+                    Constraint::Min(5),
+                    Constraint::Length(3),
+                ])
+                .split(area);
+
+                Self::render_steps(frame, chunks[0], &steps_snapshot, &msg_lines);
+                Self::render_input(frame, chunks[1], &mut input);
+
+                let help = Paragraph::new(Line::from(vec![
+                    Span::styled(" Type ", Style::default().fg(Color::Yellow)),
+                    Span::raw("Input text  "),
+                    Span::styled(" Enter ", Style::default().fg(Color::Green)),
+                    Span::raw("Confirm  "),
+                    Span::styled(" Esc ", Style::default().fg(Color::Red)),
+                    Span::raw("Cancel"),
+                ]))
+                .block(Block::default().borders(Borders::TOP));
+                frame.render_widget(help, chunks[2]);
+            })?;
+
+            if let Event::Key(key) = event::read()? {
+                if key.kind != KeyEventKind::Press {
+                    continue;
+                }
+                if let Some(result) = input.handle_key(key.code) {
+                    return Ok(result);
+                }
+            }
+        }
+    }
+
+    /// Exit ratatui cleanly.
+    pub fn finish(self) -> std::io::Result<()> {
+        ratatui::restore();
+        disable_raw_mode()?;
+        stdout().execute(LeaveAlternateScreen)?;
+        Ok(())
+    }
+
+    fn draw_progress(&mut self) -> std::io::Result<()> {
+        let steps_snapshot = self.steps.clone();
+        let msg = self.message.clone();
+        self.terminal.draw(|frame| {
+            let area = frame.area();
+            let mut step_height = steps_snapshot.len() as u16 + 2;
+            let msg_lines = if let Some(m) = &msg {
+                let wrapped = crate::setup_tui::wrap_text(m, area.width.saturating_sub(4));
+                step_height += wrapped.len() as u16 + 1;
+                wrapped
+            } else {
+                vec![]
+            };
+            let chunks =
+                Layout::vertical([Constraint::Length(step_height), Constraint::Min(0)]).split(area);
+            Self::render_steps(frame, chunks[0], &steps_snapshot, &msg_lines);
+        })?;
+        Ok(())
+    }
+
+    fn render_steps(
+        frame: &mut ratatui::Frame,
+        area: ratatui::layout::Rect,
+        steps: &[WizardStep],
+        msg_lines: &[String],
+    ) {
+        let mut items: Vec<ListItem> = steps
+            .iter()
+            .enumerate()
+            .map(|(i, step)| {
+                let num = format!("Step {}/{}:", i + 1, steps.len());
+                match &step.status {
+                    StepStatus::Pending => ListItem::new(Line::from(vec![
+                        Span::styled("  ○ ", Style::default().fg(Color::DarkGray)),
+                        Span::styled(num, Style::default().fg(Color::DarkGray)),
+                        Span::raw(" "),
+                        Span::styled(&step.label, Style::default().fg(Color::DarkGray)),
+                    ])),
+                    StepStatus::InProgress(detail) => {
+                        let mut spans = vec![
+                            Span::styled("  ▸ ", Style::default().fg(Color::Yellow).bold()),
+                            Span::styled(num, Style::default().fg(Color::Yellow)),
+                            Span::raw(" "),
+                            Span::styled(&step.label, Style::default().fg(Color::White).bold()),
+                        ];
+                        if !detail.is_empty() {
+                            spans.push(Span::styled(
+                                format!(" — {detail}"),
+                                Style::default().fg(Color::DarkGray),
+                            ));
+                        }
+                        ListItem::new(Line::from(spans))
+                    }
+                    StepStatus::Done(detail) => {
+                        let mut spans = vec![
+                            Span::styled("  ✓ ", Style::default().fg(Color::Green)),
+                            Span::styled(num, Style::default().fg(Color::Green)),
+                            Span::raw(" "),
+                            Span::styled(&step.label, Style::default().fg(Color::Green)),
+                        ];
+                        if !detail.is_empty() {
+                            spans.push(Span::styled(
+                                format!(" — {detail}"),
+                                Style::default().fg(Color::DarkGray),
+                            ));
+                        }
+                        ListItem::new(Line::from(spans))
+                    }
+                    StepStatus::Failed(detail) => ListItem::new(Line::from(vec![
+                        Span::styled("  ✗ ", Style::default().fg(Color::Red)),
+                        Span::styled(num, Style::default().fg(Color::Red)),
+                        Span::raw(" "),
+                        Span::styled(&step.label, Style::default().fg(Color::Red)),
+                        Span::styled(format!(" — {detail}"), Style::default().fg(Color::Red)),
+                    ])),
+                }
+            })
+            .collect();
+
+        if !msg_lines.is_empty() {
+            items.push(ListItem::new(Line::from(vec![Span::raw("")])));
+            for line in msg_lines {
+                items.push(ListItem::new(Line::from(vec![Span::styled(
+                    format!("  {line}"),
+                    Style::default().fg(Color::Cyan),
+                )])));
+            }
+        }
+
+        let list = List::new(items).block(
+            Block::default()
+                .title(Span::styled(
+                    " gws auth setup ",
+                    Style::default().fg(Color::Cyan).bold(),
+                ))
+                .borders(Borders::ALL)
+                .border_style(Style::default().fg(Color::DarkGray)),
+        );
+        frame.render_widget(list, area);
+    }
+
+    fn render_picker(
+        frame: &mut ratatui::Frame,
+        area: ratatui::layout::Rect,
+        picker: &mut PickerState,
+    ) {
+        let items: Vec<ListItem> = picker
+            .items
+            .iter()
+            .map(|item| {
+                let checkbox = if item.selected { "◉ " } else { "○ " };
+                let checkbox_style = if item.selected {
+                    Style::default().fg(Color::Green)
+                } else {
+                    Style::default().fg(Color::DarkGray)
+                };
+                let label_style = if item.selected {
+                    Style::default().fg(Color::White)
+                } else {
+                    Style::default().fg(Color::Gray)
+                };
+                ListItem::new(Line::from(vec![
+                    Span::styled(checkbox, checkbox_style),
+                    Span::styled(&item.label, label_style),
+                    Span::raw("  "),
+                    Span::styled(&item.description, Style::default().fg(Color::DarkGray)),
+                ]))
+            })
+            .collect();
+
+        let title_line = Line::from(vec![
+            Span::styled(&picker.title, Style::default().fg(Color::Cyan).bold()),
+            Span::raw("  "),
+            Span::styled(
+                format!(
+                    "{}/{} selected",
+                    picker.selected_count(),
+                    picker.items.len()
+                ),
+                Style::default().fg(Color::DarkGray),
+            ),
+        ]);
+
+        let list = List::new(items)
+            .block(
+                Block::default()
+                    .title(title_line)
+                    .borders(Borders::ALL)
+                    .border_style(Style::default().fg(Color::DarkGray)),
+            )
+            .highlight_style(
+                Style::default()
+                    .bg(Color::DarkGray)
+                    .add_modifier(Modifier::BOLD),
+            )
+            .highlight_symbol("▸ ");
+
+        frame.render_stateful_widget(list, area, &mut picker.list_state);
+    }
+
+    fn render_input(
+        frame: &mut ratatui::Frame,
+        area: ratatui::layout::Rect,
+        input: &mut InputState,
+    ) {
+        let title_line = Line::from(vec![Span::styled(
+            &input.title,
+            Style::default().fg(Color::Cyan).bold(),
+        )]);
+
+        let p = Paragraph::new(Line::from(vec![
+            Span::raw("> "),
+            Span::styled(&input.value, Style::default().fg(Color::White)),
+            Span::styled(
+                "█",
+                Style::default()
+                    .fg(Color::Gray)
+                    .add_modifier(Modifier::RAPID_BLINK),
+            ),
+        ]))
+        .block(
+            Block::default()
+                .title(title_line)
+                .borders(Borders::ALL)
+                .border_style(Style::default().fg(Color::DarkGray)),
+        );
+
+        frame.render_widget(p, area);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_items(labels: &[&str]) -> Vec<SelectItem> {
+        labels
+            .iter()
+            .map(|&s| SelectItem {
+                label: s.to_string(),
+                description: format!("Desc {s}"),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            })
+            .collect()
+    }
+
+    /// Helper: feed a sequence of key presses into a PickerState,
+    /// returning the final result (Confirmed/Cancelled).
+    fn run_keys(state: &mut PickerState, keys: &[KeyCode]) -> Option<PickerResult> {
+        for key in keys {
+            if let Some(result) = state.handle_key(*key) {
+                return Some(result);
+            }
+        }
+        None
+    }
+
+    // ── PickerState unit tests ──────────────────────────────────
+
+    #[test]
+    fn test_picker_state_toggle() {
+        let mut items = make_items(&["A", "B"]);
+        items[1].selected = true;
+        let mut state = PickerState::new("Test", "", items, true);
+        state.list_state.select(Some(0)); // cursor starts at preselected (1), move to 0 for test
+        assert_eq!(state.selected_count(), 1);
+
+        state.toggle_current(); // toggle A -> selected
+        assert_eq!(state.selected_count(), 2);
+
+        state.next();
+        state.toggle_current(); // toggle B -> unselected
+        assert_eq!(state.selected_count(), 1);
+    }
+
+    #[test]
+    fn test_picker_state_toggle_all() {
+        let items = make_items(&["A", "B"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        state.toggle_all();
+        assert!(state.items.iter().all(|i| i.selected));
+
+        state.toggle_all();
+        assert!(state.items.iter().all(|i| !i.selected));
+    }
+
+    #[test]
+    fn test_picker_state_navigation() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        assert_eq!(state.list_state.selected(), Some(0));
+        state.next();
+        assert_eq!(state.list_state.selected(), Some(1));
+        state.next();
+        assert_eq!(state.list_state.selected(), Some(2));
+        state.next(); // wraps
+        assert_eq!(state.list_state.selected(), Some(0));
+        state.previous(); // wraps back
+        assert_eq!(state.list_state.selected(), Some(2));
+    }
+
+    // ── handle_key / key-sequence tests ─────────────────────────
+
+    #[test]
+    fn test_enter_confirms_with_current_state() {
+        let items = make_items(&["A", "B"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Enter);
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert_eq!(items.len(), 2);
+                assert!(items.iter().all(|i| !i.selected));
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_esc_cancels() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Esc);
+        assert!(matches!(result, Some(PickerResult::Cancelled)));
+    }
+
+    #[test]
+    fn test_q_cancels() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Char('q'));
+        assert!(matches!(result, Some(PickerResult::Cancelled)));
+    }
+
+    #[test]
+    fn test_space_toggle_then_enter() {
+        let items = make_items(&["Gmail", "Drive", "Calendar"]);
+        let mut state = PickerState::new("APIs", "", items, true);
+
+        // Toggle first item, move down, toggle second, confirm
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Char(' '), // select Gmail
+                KeyCode::Down,      // move to Drive
+                KeyCode::Char(' '), // select Drive
+                KeyCode::Enter,     // confirm
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(items[0].selected, "Gmail should be selected");
+                assert!(items[1].selected, "Drive should be selected");
+                assert!(!items[2].selected, "Calendar should not be selected");
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_select_all_then_deselect_one() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Char('a'), // select all
+                KeyCode::Down,      // move to B
+                KeyCode::Char(' '), // deselect B
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(items[0].selected);
+                assert!(!items[1].selected);
+                assert!(items[2].selected);
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_vim_navigation_j_k() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        // j = down, k = up
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Char('j'), // -> B
+                KeyCode::Char('j'), // -> C
+                KeyCode::Char(' '), // select C
+                KeyCode::Char('k'), // -> B
+                KeyCode::Char(' '), // select B
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(!items[0].selected, "A not selected");
+                assert!(items[1].selected, "B selected");
+                assert!(items[2].selected, "C selected");
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_wrap_around_navigation() {
+        let items = make_items(&["A", "B"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        // From A (0), go up -> wraps to B (1)
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Up,        // wrap to B
+                KeyCode::Char(' '), // select B
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(!items[0].selected);
+                assert!(items[1].selected);
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_unknown_key_ignored() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        // Random keys should not exit
+        assert!(state.handle_key(KeyCode::Char('x')).is_none());
+        assert!(state.handle_key(KeyCode::Char('z')).is_none());
+        assert!(state.handle_key(KeyCode::Tab).is_none());
+    }
+
+    #[test]
+    fn test_double_toggle_returns_to_original() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Char(' '), // select A
+                KeyCode::Char(' '), // deselect A
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(!items[0].selected, "double toggle => back to unselected");
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_toggle_all_twice_resets() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, true);
+
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Char('a'), // all on
+                KeyCode::Char('a'), // all off
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(items.iter().all(|i| !i.selected));
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_preselected_items_preserved() {
+        let mut items = make_items(&["A", "B", "C"]);
+        items[1].selected = true; // B pre-selected
+        let mut state = PickerState::new("Test", "", items, true);
+
+        // Just confirm without changing anything
+        let result = state.handle_key(KeyCode::Enter);
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(!items[0].selected);
+                assert!(items[1].selected, "pre-selected B preserved");
+                assert!(!items[2].selected);
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    // ── InputState tests ───────────────────────────────────────
+
+    #[test]
+    fn test_input_state_new_empty() {
+        let state = InputState::new("Title", "Help", None);
+        assert_eq!(state.value, "");
+    }
+
+    #[test]
+    fn test_input_state_new_with_initial() {
+        let state = InputState::new("Title", "Help", Some("initial"));
+        assert_eq!(state.value, "initial");
+    }
+
+    #[test]
+    fn test_input_state_typing() {
+        let mut state = InputState::new("Title", "Help", None);
+        assert!(state.handle_key(KeyCode::Char('h')).is_none());
+        assert!(state.handle_key(KeyCode::Char('i')).is_none());
+        assert_eq!(state.value, "hi");
+    }
+
+    #[test]
+    fn test_input_state_backspace() {
+        let mut state = InputState::new("Title", "Help", Some("abc"));
+        assert!(state.handle_key(KeyCode::Backspace).is_none());
+        assert_eq!(state.value, "ab");
+        assert!(state.handle_key(KeyCode::Backspace).is_none());
+        assert_eq!(state.value, "a");
+    }
+
+    #[test]
+    fn test_input_state_backspace_empty() {
+        let mut state = InputState::new("Title", "Help", None);
+        // Backspace on empty string should be a no-op
+        assert!(state.handle_key(KeyCode::Backspace).is_none());
+        assert_eq!(state.value, "");
+    }
+
+    #[test]
+    fn test_input_state_enter_confirms() {
+        let mut state = InputState::new("Title", "Help", Some("test_value"));
+        let result = state.handle_key(KeyCode::Enter);
+        match result {
+            Some(InputResult::Confirmed(v)) => assert_eq!(v, "test_value"),
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_input_state_esc_cancels() {
+        let mut state = InputState::new("Title", "Help", None);
+        let result = state.handle_key(KeyCode::Esc);
+        assert!(matches!(result, Some(InputResult::Cancelled)));
+    }
+
+    #[test]
+    fn test_input_state_up_goes_back() {
+        let mut state = InputState::new("Title", "Help", None);
+        let result = state.handle_key(KeyCode::Up);
+        assert!(matches!(result, Some(InputResult::GoBack)));
+    }
+
+    #[test]
+    fn test_input_state_backtab_goes_back() {
+        let mut state = InputState::new("Title", "Help", None);
+        let result = state.handle_key(KeyCode::BackTab);
+        assert!(matches!(result, Some(InputResult::GoBack)));
+    }
+
+    #[test]
+    fn test_input_state_unknown_key_ignored() {
+        let mut state = InputState::new("Title", "Help", None);
+        assert!(state.handle_key(KeyCode::Down).is_none());
+        assert!(state.handle_key(KeyCode::Tab).is_none());
+        assert!(state.handle_key(KeyCode::Left).is_none());
+    }
+
+    #[test]
+    fn test_input_state_type_backspace_confirm() {
+        let mut state = InputState::new("Title", "Help", None);
+        state.handle_key(KeyCode::Char('a'));
+        state.handle_key(KeyCode::Char('b'));
+        state.handle_key(KeyCode::Char('c'));
+        state.handle_key(KeyCode::Backspace); // remove 'c'
+        state.handle_key(KeyCode::Char('d'));
+        let result = state.handle_key(KeyCode::Enter);
+        match result {
+            Some(InputResult::Confirmed(v)) => assert_eq!(v, "abd"),
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    // ── GoBack key tests ───────────────────────────────────────
+
+    #[test]
+    fn test_backspace_goes_back() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Backspace);
+        assert!(matches!(result, Some(PickerResult::GoBack)));
+    }
+
+    #[test]
+    fn test_left_goes_back() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Left);
+        assert!(matches!(result, Some(PickerResult::GoBack)));
+    }
+
+    #[test]
+    fn test_h_goes_back() {
+        let items = make_items(&["A"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        let result = state.handle_key(KeyCode::Char('h'));
+        assert!(matches!(result, Some(PickerResult::GoBack)));
+    }
+
+    // ── selected_count tests ───────────────────────────────────
+
+    #[test]
+    fn test_selected_count_none() {
+        let items = make_items(&["A", "B", "C"]);
+        let state = PickerState::new("Test", "", items, true);
+        assert_eq!(state.selected_count(), 0);
+    }
+
+    #[test]
+    fn test_selected_count_some() {
+        let mut items = make_items(&["A", "B", "C"]);
+        items[0].selected = true;
+        items[2].selected = true;
+        let state = PickerState::new("Test", "", items, true);
+        assert_eq!(state.selected_count(), 2);
+    }
+
+    #[test]
+    fn test_selected_count_after_toggle() {
+        let items = make_items(&["A", "B"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        assert_eq!(state.selected_count(), 0);
+        state.handle_key(KeyCode::Char(' ')); // toggle A
+        assert_eq!(state.selected_count(), 1);
+        state.handle_key(KeyCode::Down);
+        state.handle_key(KeyCode::Char(' ')); // toggle B
+        assert_eq!(state.selected_count(), 2);
+    }
+
+    // ── is_fixed item tests ────────────────────────────────────
+
+    #[test]
+    fn test_fixed_item_cannot_be_toggled() {
+        let mut items = make_items(&["Fixed", "Normal"]);
+        items[0].is_fixed = true;
+        items[0].selected = true;
+        let mut state = PickerState::new("Test", "", items, true);
+
+        // Cursor on "Fixed", try to toggle
+        state.handle_key(KeyCode::Char(' '));
+        assert!(state.items[0].selected, "Fixed item should remain selected");
+    }
+
+    #[test]
+    fn test_fixed_item_preserved_during_toggle_all() {
+        let mut items = make_items(&["Fixed", "A", "B"]);
+        items[0].is_fixed = true;
+        items[0].selected = true;
+        let mut state = PickerState::new("Test", "", items, true);
+
+        // Toggle all on
+        state.handle_key(KeyCode::Char('a'));
+        assert!(state.items[0].selected, "Fixed remains selected");
+        assert!(state.items[1].selected, "A selected");
+        assert!(state.items[2].selected, "B selected");
+
+        // Toggle all off
+        state.handle_key(KeyCode::Char('a'));
+        assert!(
+            state.items[0].selected,
+            "Fixed still selected even after toggle-all-off"
+        );
+        assert!(!state.items[1].selected, "A deselected");
+        assert!(!state.items[2].selected, "B deselected");
+    }
+
+    // ── Single-select picker tests ─────────────────────────────
+
+    #[test]
+    fn test_single_select_enter_selects_highlighted() {
+        let mut items = make_items(&["A", "B", "C"]);
+        items[0].selected = true; // pre-select A
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // Navigate to C (index 2) and press Enter
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Down, // -> B
+                KeyCode::Down, // -> C
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(!items[0].selected, "A should be deselected");
+                assert!(!items[1].selected, "B should be deselected");
+                assert!(items[2].selected, "C should be selected");
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+
+    #[test]
+    fn test_single_select_navigation_auto_selects() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // In single-select, navigating down should auto-select the new item
+        state.handle_key(KeyCode::Down); // -> B
+        assert!(state.items[1].selected, "B auto-selected on nav");
+        assert!(!state.items[0].selected, "A deselected on nav");
+
+        state.handle_key(KeyCode::Down); // -> C
+        assert!(state.items[2].selected, "C auto-selected on nav");
+        assert!(!state.items[1].selected, "B deselected on nav");
+    }
+
+    #[test]
+    fn test_single_select_space_selects_current() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        state.handle_key(KeyCode::Down); // -> B
+        state.handle_key(KeyCode::Char(' ')); // space on B
+
+        assert!(!state.items[0].selected);
+        assert!(state.items[1].selected, "B selected via space");
+        assert!(!state.items[2].selected);
+    }
+
+    #[test]
+    fn test_single_select_a_does_not_toggle_all() {
+        let items = make_items(&["A", "B"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // 'a' should be a no-op in single select mode
+        state.handle_key(KeyCode::Char('a'));
+        // Neither should be selected (they started unselected)
+        assert!(!state.items[0].selected);
+        assert!(!state.items[1].selected);
+    }
+
+    #[test]
+    fn test_single_select_up_navigation_auto_selects() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // Go up from A wraps to C
+        state.handle_key(KeyCode::Up);
+        assert!(state.items[2].selected, "C auto-selected on up wrap");
+        assert!(!state.items[0].selected, "A deselected");
+    }
+
+    #[test]
+    fn test_single_select_k_navigation_auto_selects() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // Go up from A wraps to C using k
+        state.handle_key(KeyCode::Char('k'));
+        assert!(state.items[2].selected, "C auto-selected with k key");
+    }
+
+    #[test]
+    fn test_single_select_j_navigation_auto_selects() {
+        let items = make_items(&["A", "B", "C"]);
+        let mut state = PickerState::new("Test", "", items, false);
+
+        state.handle_key(KeyCode::Char('j'));
+        assert!(state.items[1].selected, "B auto-selected with j key");
+    }
+
+    // ── Template toggling tests ────────────────────────────────
+
+    fn make_template_items() -> Vec<SelectItem> {
+        vec![
+            SelectItem {
+                label: "✨ Recommended".to_string(),
+                description: "Template".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: true,
+                template_selects: vec!["gmail".to_string(), "drive".to_string()],
+            },
+            SelectItem {
+                label: "🔒 Read Only".to_string(),
+                description: "Template".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: true,
+                template_selects: vec!["gmail.readonly".to_string(), "drive.readonly".to_string()],
+            },
+            SelectItem {
+                label: "gmail".to_string(),
+                description: "Gmail access".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "gmail.readonly".to_string(),
+                description: "Gmail readonly".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "drive".to_string(),
+                description: "Drive access".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+            SelectItem {
+                label: "drive.readonly".to_string(),
+                description: "Drive readonly".to_string(),
+                selected: false,
+                is_fixed: false,
+                is_template: false,
+                template_selects: vec![],
+            },
+        ]
+    }
+
+    #[test]
+    fn test_template_select_applies_scopes() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Toggle "Recommended" template (at index 0)
+        state.handle_key(KeyCode::Char(' '));
+
+        assert!(state.items[0].selected, "Recommended template selected");
+        assert!(state.items[2].selected, "gmail selected by template");
+        assert!(
+            !state.items[3].selected,
+            "gmail.readonly NOT in recommended"
+        );
+        assert!(state.items[4].selected, "drive selected by template");
+        assert!(
+            !state.items[5].selected,
+            "drive.readonly NOT in recommended"
+        );
+    }
+
+    #[test]
+    fn test_template_deselects_other_templates() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Select "Recommended"
+        state.handle_key(KeyCode::Char(' '));
+        assert!(state.items[0].selected, "Recommended selected");
+
+        // Navigate to "Read Only" and select it
+        state.handle_key(KeyCode::Down);
+        state.handle_key(KeyCode::Char(' '));
+
+        assert!(!state.items[0].selected, "Recommended deselected");
+        assert!(state.items[1].selected, "Read Only selected");
+        // Read Only template scopes applied
+        assert!(!state.items[2].selected, "gmail NOT in readonly");
+        assert!(state.items[3].selected, "gmail.readonly selected");
+        assert!(!state.items[4].selected, "drive NOT in readonly");
+        assert!(state.items[5].selected, "drive.readonly selected");
+    }
+
+    #[test]
+    fn test_toggling_individual_deselects_templates() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Select "Recommended"
+        state.handle_key(KeyCode::Char(' '));
+        assert!(state.items[0].selected);
+
+        // Navigate to "gmail" (index 2) and toggle it off
+        state.handle_key(KeyCode::Down); // -> Read Only
+        state.handle_key(KeyCode::Down); // -> gmail
+        state.handle_key(KeyCode::Char(' ')); // toggle gmail off
+
+        assert!(!state.items[0].selected, "Recommended template deselected");
+        assert!(!state.items[1].selected, "Read Only template deselected");
+        assert!(!state.items[2].selected, "gmail toggled off");
+    }
+
+    #[test]
+    fn test_deselect_template_does_not_change_individual_items() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Select "Recommended" template
+        state.handle_key(KeyCode::Char(' '));
+        assert!(state.items[2].selected, "gmail selected");
+
+        // Deselect "Recommended" template (toggle off)
+        state.handle_key(KeyCode::Char(' '));
+        assert!(!state.items[0].selected, "Recommended deselected");
+        // Individual items should NOT change when deselecting a template
+        // (only selecting a template applies its selections)
+        assert!(
+            state.items[2].selected,
+            "gmail still selected after template deselect"
+        );
+    }
+
+    // ── Readonly/superset scope interaction tests ──────────────
+
+    #[test]
+    fn test_selecting_scope_deselects_readonly_counterpart() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Navigate to gmail.readonly (index 3) and select it
+        state.handle_key(KeyCode::Down); // -> Read Only
+        state.handle_key(KeyCode::Down); // -> gmail
+        state.handle_key(KeyCode::Down); // -> gmail.readonly
+        state.handle_key(KeyCode::Char(' ')); // select gmail.readonly
+
+        assert!(state.items[3].selected, "gmail.readonly selected");
+
+        // Now navigate to gmail (index 2) and select it
+        state.handle_key(KeyCode::Up); // -> gmail
+        state.handle_key(KeyCode::Char(' ')); // select gmail
+
+        assert!(state.items[2].selected, "gmail selected");
+        assert!(
+            !state.items[3].selected,
+            "gmail.readonly deselected (superset wins)"
+        );
+    }
+
+    #[test]
+    fn test_selecting_readonly_deselects_write_counterpart() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Navigate to gmail (index 2) and select it
+        state.handle_key(KeyCode::Down); // -> Read Only
+        state.handle_key(KeyCode::Down); // -> gmail
+        state.handle_key(KeyCode::Char(' ')); // select gmail
+
+        assert!(state.items[2].selected, "gmail selected");
+
+        // Now navigate to gmail.readonly (index 3) and select it
+        state.handle_key(KeyCode::Down); // -> gmail.readonly
+        state.handle_key(KeyCode::Char(' ')); // select gmail.readonly
+
+        assert!(state.items[3].selected, "gmail.readonly selected");
+        assert!(
+            !state.items[2].selected,
+            "gmail deselected (readonly overrides)"
+        );
+    }
+
+    #[test]
+    fn test_deselecting_scope_does_not_affect_counterpart() {
+        let items = make_template_items();
+        let mut state = PickerState::new("Scopes", "", items, true);
+
+        // Select both gmail and drive
+        state.handle_key(KeyCode::Down); // -> Read Only
+        state.handle_key(KeyCode::Down); // -> gmail
+        state.handle_key(KeyCode::Char(' ')); // select gmail
+        state.handle_key(KeyCode::Down); // -> gmail.readonly
+        state.handle_key(KeyCode::Down); // -> drive
+        state.handle_key(KeyCode::Char(' ')); // select drive
+
+        assert!(state.items[2].selected, "gmail selected");
+        assert!(state.items[4].selected, "drive selected");
+
+        // Now deselect gmail - should NOT affect gmail.readonly
+        state.handle_key(KeyCode::Up); // -> gmail.readonly
+        state.handle_key(KeyCode::Up); // -> gmail
+        state.handle_key(KeyCode::Char(' ')); // deselect gmail
+
+        assert!(!state.items[2].selected, "gmail deselected");
+        assert!(
+            !state.items[3].selected,
+            "gmail.readonly was never selected"
+        );
+    }
+
+    // ── wrap_text tests ────────────────────────────────────────
+
+    #[test]
+    fn test_wrap_text_no_wrapping_needed() {
+        let result = wrap_text("short text", 80);
+        assert_eq!(result, vec!["short text"]);
+    }
+
+    #[test]
+    fn test_wrap_text_wraps_long_line() {
+        let result = wrap_text("hello world foo bar", 11);
+        assert_eq!(result, vec!["hello world", "foo bar"]);
+    }
+
+    #[test]
+    fn test_wrap_text_preserves_newlines() {
+        let result = wrap_text("line one\nline two", 80);
+        assert_eq!(result, vec!["line one", "line two"]);
+    }
+
+    #[test]
+    fn test_wrap_text_empty_lines() {
+        let result = wrap_text("before\n\nafter", 80);
+        assert_eq!(result, vec!["before", "", "after"]);
+    }
+
+    #[test]
+    fn test_wrap_text_zero_width() {
+        let result = wrap_text("any text", 0);
+        assert_eq!(result, vec!["any text"]);
+    }
+
+    #[test]
+    fn test_wrap_text_single_long_word() {
+        let result = wrap_text("superlongword", 5);
+        // A single word longer than max_width can't be split, so it stays as-is
+        assert_eq!(result, vec!["superlongword"]);
+    }
+
+    #[test]
+    fn test_wrap_text_multiple_paragraphs_with_wrapping() {
+        let result = wrap_text("aaa bbb ccc\nddd eee", 7);
+        assert_eq!(result, vec!["aaa bbb", "ccc", "ddd eee"]);
+    }
+
+    // ── PickerState::new initial selection tests ───────────────
+
+    #[test]
+    fn test_picker_starts_at_first_selected_item() {
+        let mut items = make_items(&["A", "B", "C"]);
+        items[2].selected = true;
+        let state = PickerState::new("Test", "", items, true);
+        assert_eq!(state.list_state.selected(), Some(2));
+    }
+
+    #[test]
+    fn test_picker_starts_at_zero_when_none_selected() {
+        let items = make_items(&["A", "B", "C"]);
+        let state = PickerState::new("Test", "", items, true);
+        assert_eq!(state.list_state.selected(), Some(0));
+    }
+
+    // ── Edge case tests ────────────────────────────────────────
+
+    #[test]
+    fn test_single_item_toggle() {
+        let items = make_items(&["Only"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        state.handle_key(KeyCode::Char(' ')); // toggle on
+        assert!(state.items[0].selected);
+        state.handle_key(KeyCode::Char(' ')); // toggle off
+        assert!(!state.items[0].selected);
+    }
+
+    #[test]
+    fn test_single_item_navigation_wraps() {
+        let items = make_items(&["Only"]);
+        let mut state = PickerState::new("Test", "", items, true);
+        state.handle_key(KeyCode::Down); // wraps to 0
+        assert_eq!(state.list_state.selected(), Some(0));
+        state.handle_key(KeyCode::Up); // wraps to 0
+        assert_eq!(state.list_state.selected(), Some(0));
+    }
+
+    #[test]
+    fn test_fixed_item_in_single_select_preserved() {
+        let mut items = make_items(&["Fixed", "A", "B"]);
+        items[0].is_fixed = true;
+        items[0].selected = true;
+        let mut state = PickerState::new("Test", "", items, false);
+
+        // Navigate to B and press Enter
+        let result = run_keys(
+            &mut state,
+            &[
+                KeyCode::Down, // -> A
+                KeyCode::Down, // -> B
+                KeyCode::Enter,
+            ],
+        );
+        match result {
+            Some(PickerResult::Confirmed(items)) => {
+                assert!(items[0].selected, "Fixed item preserved");
+                assert!(!items[1].selected, "A not selected");
+                assert!(items[2].selected, "B selected");
+            }
+            _ => panic!("Expected Confirmed"),
+        }
+    }
+}
diff --git a/src/token_storage.rs b/src/token_storage.rs
new file mode 100644
index 00000000..9786ed62
--- /dev/null
+++ b/src/token_storage.rs
@@ -0,0 +1,134 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use yup_oauth2::storage::{TokenInfo, TokenStorage, TokenStorageError};
+
+/// A custom token storage implementation for `yup-oauth2` that encrypts
+/// the cached tokens at rest using the AES key derived from the OS keyring.
+pub struct EncryptedTokenStorage {
+    file_path: PathBuf,
+    // Add memory cache since TokenStorage getters can be called frequently
+    cache: Arc<Mutex<Option<HashMap<String, TokenInfo>>>>,
+}
+
+impl EncryptedTokenStorage {
+    pub fn new(path: PathBuf) -> Self {
+        Self {
+            file_path: path,
+            cache: Arc::new(Mutex::new(None)),
+        }
+    }
+
+    async fn load_from_disk(&self) -> HashMap<String, TokenInfo> {
+        if let Ok(data) = tokio::fs::read(&self.file_path).await {
+            if let Ok(decrypted) = crate::credential_store::decrypt(&data) {
+                if let Ok(json) = String::from_utf8(decrypted) {
+                    if let Ok(map) = serde_json::from_str(&json) {
+                        return map;
+                    }
+                }
+            }
+        }
+        HashMap::new()
+    }
+
+    async fn save_to_disk(&self, map: &HashMap<String, TokenInfo>) -> anyhow::Result<()> {
+        let json = serde_json::to_string(map)?;
+        let encrypted = crate::credential_store::encrypt(json.as_bytes())?;
+
+        if let Some(parent) = self.file_path.parent() {
+            let _ = tokio::fs::create_dir_all(parent).await;
+            #[cfg(unix)]
+            {
+                use std::os::unix::fs::PermissionsExt;
+                let _ = std::fs::set_permissions(parent, std::fs::Permissions::from_mode(0o700));
+            }
+        }
+
+        #[cfg(unix)]
+        {
+            let mut options = tokio::fs::OpenOptions::new();
+            options.write(true).create(true).truncate(true).mode(0o600);
+            if let Ok(mut file) = options.open(&self.file_path).await {
+                use tokio::io::AsyncWriteExt;
+                let _ = file.write_all(encrypted.as_slice()).await;
+            }
+        }
+        #[cfg(not(unix))]
+        {
+            tokio::fs::write(&self.file_path, encrypted).await?;
+        }
+
+        Ok(())
+    }
+
+    // Helper to join scopes consistently for cache keys
+    fn cache_key(scopes: &[&str]) -> String {
+        let mut s: Vec<&str> = scopes.to_vec();
+        s.sort_unstable();
+        s.dedup();
+        s.join(" ")
+    }
+}
+
+#[async_trait::async_trait]
+impl TokenStorage for EncryptedTokenStorage {
+    async fn set(&self, scopes: &[&str], token: TokenInfo) -> Result<(), TokenStorageError> {
+        let mut map_lock = self.cache.lock().await;
+
+        // Initialize cache if this is the first write
+        if map_lock.is_none() {
+            *map_lock = Some(self.load_from_disk().await);
+        }
+
+        if let Some(map) = map_lock.as_mut() {
+            map.insert(Self::cache_key(scopes), token);
+            self.save_to_disk(map)
+                .await
+                .map_err(|e| TokenStorageError::Other(std::borrow::Cow::Owned(e.to_string())))?;
+        }
+
+        Ok(())
+    }
+
+    async fn get(&self, scopes: &[&str]) -> Option<TokenInfo> {
+        let mut map_lock = self.cache.lock().await;
+
+        if map_lock.is_none() {
+            *map_lock = Some(self.load_from_disk().await);
+        }
+
+        if let Some(map) = map_lock.as_ref() {
+            // First look for exact match
+            let key = Self::cache_key(scopes);
+            if let Some(token) = map.get(&key) {
+                return Some(token.clone());
+            }
+
+            // Fallback: check if we have a superset of the scopes (simplistic check compared to yup-oauth2 internal, but functional for this CLI)
+            for (cached_key, token) in map.iter() {
+                let cached_scopes: Vec<&str> = cached_key.split(' ').collect();
+                if scopes.iter().all(|s| cached_scopes.contains(s)) {
+                    return Some(token.clone());
+                }
+            }
+        }
+
+        None
+    }
+}
diff --git a/templates/modelarmor/jailbreak.json b/templates/modelarmor/jailbreak.json
new file mode 100644
index 00000000..43f039d2
--- /dev/null
+++ b/templates/modelarmor/jailbreak.json
@@ -0,0 +1,8 @@
+{
+  "filterConfig": {
+    "piAndJailbreakFilterSettings": {
+      "filterEnforcement": "ENABLED",
+      "confidenceLevel": "LOW_AND_ABOVE"
+    }
+  }
+}