@aiaiai-pt/martha-cli 0.61.2 → 0.63.0

package/dist/index.js

@@ -1,36 +1,44 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __toESM = (mod, isNodeMode, target) => {
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: () => mod[key],
-        enumerable: true
-      });
-  return to;
-};
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: (newValue) => all[name] = () => newValue
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+var __exportCjs = (target, getters, setters) => {
+  for (var name in getters)
+    __defProp(target, name, {
+      get: getters[name],
+      set: setters[name],
+      enumerable: true,
+      configurable: true
     });
 };
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/commander/lib/error.js
-var require_error = __commonJS((exports) => {
+var require_error = __commonJS(function(exports) {
   class CommanderError extends Error {
     constructor(exitCode, code, message) {
       super(message);
@@ -54,7 +62,7 @@ var require_error = __commonJS((exports) => {
 });
 
 // node_modules/commander/lib/argument.js
-var require_argument = __commonJS((exports) => {
+var require_argument = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Argument {
@@ -134,7 +142,7 @@ var require_argument = __commonJS((exports) => {
 });
 
 // node_modules/commander/lib/help.js
-var require_help = __commonJS((exports) => {
+var require_help = __commonJS(function(exports) {
   var { humanReadableArgName } = require_argument();
 
   class Help {
@@ -149,7 +157,7 @@ var require_help = __commonJS((exports) => {
       this.helpWidth = this.helpWidth ?? contextOptions.helpWidth ?? 80;
     }
     visibleCommands(cmd) {
-      const visibleCommands = cmd.commands.filter((cmd2) => !cmd2._hidden);
+      const visibleCommands = cmd.commands.filter((cmd) => !cmd._hidden);
       const helpCommand = cmd._getHelpCommand();
       if (helpCommand && !helpCommand._hidden) {
         visibleCommands.push(helpCommand);
@@ -491,7 +499,7 @@ ${itemIndentStr}`);
 });
 
 // node_modules/commander/lib/option.js
-var require_option = __commonJS((exports) => {
+var require_option = __commonJS(function(exports) {
   var { InvalidArgumentError } = require_error();
 
   class Option {
@@ -629,8 +637,8 @@ var require_option = __commonJS((exports) => {
     }
   }
   function camelcase(str) {
-    return str.split("-").reduce((str2, word) => {
-      return str2 + word[0].toUpperCase() + word.slice(1);
+    return str.split("-").reduce((str, word) => {
+      return str + word[0].toUpperCase() + word.slice(1);
     });
   }
   function splitOptionFlags(flags) {
@@ -675,7 +683,7 @@ var require_option = __commonJS((exports) => {
 });
 
 // node_modules/commander/lib/suggestSimilar.js
-var require_suggestSimilar = __commonJS((exports) => {
+var require_suggestSimilar = __commonJS(function(exports) {
   var maxDistance = 3;
   function editDistance(a, b) {
     if (Math.abs(a.length - b.length) > maxDistance)
@@ -748,7 +756,7 @@ var require_suggestSimilar = __commonJS((exports) => {
 });
 
 // node_modules/commander/lib/command.js
-var require_command = __commonJS((exports) => {
+var require_command = __commonJS(function(exports) {
   var EventEmitter = __require("node:events").EventEmitter;
   var childProcess = __require("node:child_process");
   var path = __require("node:path");
@@ -1001,7 +1009,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         this._exitCallback = (err) => {
           if (err.code !== "commander.executeSubCommandAsync") {
             throw err;
-          } else {}
+          }
         };
       }
       return this;
@@ -1201,44 +1209,44 @@ Expecting one of '${allowedValues.join("', '")}'`);
       });
       return source;
     }
-    _prepareUserArgs(argv, parseOptions) {
-      if (argv !== undefined && !Array.isArray(argv)) {
+    _prepareUserArgs(argv2, parseOptions) {
+      if (argv2 !== undefined && !Array.isArray(argv2)) {
         throw new Error("first parameter to parse must be array or undefined");
       }
       parseOptions = parseOptions || {};
-      if (argv === undefined && parseOptions.from === undefined) {
+      if (argv2 === undefined && parseOptions.from === undefined) {
         if (process2.versions?.electron) {
           parseOptions.from = "electron";
         }
-        const execArgv = process2.execArgv ?? [];
-        if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {
+        const execArgv2 = process2.execArgv ?? [];
+        if (execArgv2.includes("-e") || execArgv2.includes("--eval") || execArgv2.includes("-p") || execArgv2.includes("--print")) {
           parseOptions.from = "eval";
         }
       }
-      if (argv === undefined) {
-        argv = process2.argv;
+      if (argv2 === undefined) {
+        argv2 = process2.argv;
       }
-      this.rawArgs = argv.slice();
+      this.rawArgs = argv2.slice();
       let userArgs;
       switch (parseOptions.from) {
         case undefined:
         case "node":
-          this._scriptPath = argv[1];
-          userArgs = argv.slice(2);
+          this._scriptPath = argv2[1];
+          userArgs = argv2.slice(2);
           break;
         case "electron":
           if (process2.defaultApp) {
-            this._scriptPath = argv[1];
-            userArgs = argv.slice(2);
+            this._scriptPath = argv2[1];
+            userArgs = argv2.slice(2);
           } else {
-            userArgs = argv.slice(1);
+            userArgs = argv2.slice(1);
           }
           break;
         case "user":
-          userArgs = argv.slice(0);
+          userArgs = argv2.slice(0);
           break;
         case "eval":
-          userArgs = argv.slice(1);
+          userArgs = argv2.slice(1);
           break;
         default:
           throw new Error(`unexpected parse option { from: '${parseOptions.from}' }`);
@@ -1761,18 +1769,18 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this.error(message, { code: "commander.missingMandatoryOptionValue" });
     }
     _conflictingOption(option, conflictingOption) {
-      const findBestOptionFromValue = (option2) => {
-        const optionKey = option2.attributeName();
+      const findBestOptionFromValue = (option) => {
+        const optionKey = option.attributeName();
         const optionValue = this.getOptionValue(optionKey);
         const negativeOption = this.options.find((target) => target.negate && optionKey === target.attributeName());
         const positiveOption = this.options.find((target) => !target.negate && optionKey === target.attributeName());
         if (negativeOption && (negativeOption.presetArg === undefined && optionValue === false || negativeOption.presetArg !== undefined && optionValue === negativeOption.presetArg)) {
           return negativeOption;
         }
-        return positiveOption || option2;
+        return positiveOption || option;
       };
-      const getErrorMessage = (option2) => {
-        const bestOption = findBestOptionFromValue(option2);
+      const getErrorMessage = (option) => {
+        const bestOption = findBestOptionFromValue(option);
         const optionKey = bestOption.attributeName();
         const source = this.getOptionValueSource(optionKey);
         if (source === "env") {
@@ -1926,10 +1934,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
       this._name = path.basename(filename, path.extname(filename));
       return this;
     }
-    executableDir(path2) {
-      if (path2 === undefined)
+    executableDir(path) {
+      if (path === undefined)
         return this._executableDir;
-      this._executableDir = path2;
+      this._executableDir = path;
       return this;
     }
     helpInformation(contextOptions) {
@@ -2026,11 +2034,11 @@ Expecting one of '${allowedValues.join("', '")}'`);
     }
     help(contextOptions) {
       this.outputHelp(contextOptions);
-      let exitCode = Number(process2.exitCode ?? 0);
-      if (exitCode === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
-        exitCode = 1;
+      let exitCode2 = Number(process2.exitCode ?? 0);
+      if (exitCode2 === 0 && contextOptions && typeof contextOptions !== "function" && contextOptions.error) {
+        exitCode2 = 1;
       }
-      this._exit(exitCode, "commander.help", "(outputHelp)");
+      this._exit(exitCode2, "commander.help", "(outputHelp)");
     }
     addHelpText(position, text) {
       const allowedValues = ["beforeAll", "before", "after", "afterAll"];
@@ -2102,26 +2110,6 @@ Expecting one of '${allowedValues.join("', '")}'`);
   exports.useColor = useColor;
 });
 
-// node_modules/commander/index.js
-var require_commander = __commonJS((exports) => {
-  var { Argument } = require_argument();
-  var { Command } = require_command();
-  var { CommanderError, InvalidArgumentError } = require_error();
-  var { Help } = require_help();
-  var { Option } = require_option();
-  exports.program = new Command;
-  exports.createCommand = (name) => new Command(name);
-  exports.createOption = (flags, description) => new Option(flags, description);
-  exports.createArgument = (name, description) => new Argument(name, description);
-  exports.Command = Command;
-  exports.Option = Option;
-  exports.Argument = Argument;
-  exports.Help = Help;
-  exports.CommanderError = CommanderError;
-  exports.InvalidArgumentError = InvalidArgumentError;
-  exports.InvalidOptionArgumentError = InvalidArgumentError;
-});
-
 // src/lib/errors.ts
 function extractDetail(body) {
   if (typeof body === "string")
@@ -2197,7 +2185,7 @@ var init_errors = __esm(() => {
 });
 
 // node_modules/yaml/dist/nodes/identity.js
-var require_identity = __commonJS((exports) => {
+var require_identity = __commonJS(function(exports) {
   var ALIAS = Symbol.for("yaml.alias");
   var DOC = Symbol.for("yaml.document");
   var MAP = Symbol.for("yaml.map");
@@ -2251,7 +2239,7 @@ var require_identity = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/visit.js
-var require_visit = __commonJS((exports) => {
+var require_visit = __commonJS(function(exports) {
   var identity = require_identity();
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
@@ -2406,7 +2394,7 @@ var require_visit = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/directives.js
-var require_directives = __commonJS((exports) => {
+var require_directives = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
   var escapeChars = {
@@ -2558,7 +2546,7 @@ var require_directives = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/anchors.js
-var require_anchors = __commonJS((exports) => {
+var require_anchors = __commonJS(function(exports) {
   var identity = require_identity();
   var visit = require_visit();
   function anchorIsValid(anchor) {
@@ -2620,7 +2608,7 @@ var require_anchors = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/applyReviver.js
-var require_applyReviver = __commonJS((exports) => {
+var require_applyReviver = __commonJS(function(exports) {
   function applyReviver(reviver, obj, key, val) {
     if (val && typeof val === "object") {
       if (Array.isArray(val)) {
@@ -2667,7 +2655,7 @@ var require_applyReviver = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/toJS.js
-var require_toJS = __commonJS((exports) => {
+var require_toJS = __commonJS(function(exports) {
   var identity = require_identity();
   function toJS(value, arg, ctx) {
     if (Array.isArray(value))
@@ -2677,8 +2665,8 @@ var require_toJS = __commonJS((exports) => {
         return value.toJSON(arg, ctx);
       const data = { aliasCount: 0, count: 1, res: undefined };
       ctx.anchors.set(value, data);
-      ctx.onCreate = (res2) => {
-        data.res = res2;
+      ctx.onCreate = (res) => {
+        data.res = res;
         delete ctx.onCreate;
       };
       const res = value.toJSON(arg, ctx);
@@ -2694,7 +2682,7 @@ var require_toJS = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Node.js
-var require_Node = __commonJS((exports) => {
+var require_Node = __commonJS(function(exports) {
   var applyReviver = require_applyReviver();
   var identity = require_identity();
   var toJS = require_toJS();
@@ -2722,8 +2710,8 @@ var require_Node = __commonJS((exports) => {
       };
       const res = toJS.toJS(this, "", ctx);
       if (typeof onAnchor === "function")
-        for (const { count, res: res2 } of ctx.anchors.values())
-          onAnchor(res2, count);
+        for (const { count, res } of ctx.anchors.values())
+          onAnchor(res, count);
       return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
     }
   }
@@ -2731,7 +2719,7 @@ var require_Node = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Alias.js
-var require_Alias = __commonJS((exports) => {
+var require_Alias = __commonJS(function(exports) {
   var anchors = require_anchors();
   var visit = require_visit();
   var identity = require_identity();
@@ -2775,16 +2763,16 @@ var require_Alias = __commonJS((exports) => {
     toJSON(_arg, ctx) {
       if (!ctx)
         return { source: this.source };
-      const { anchors: anchors2, doc, maxAliasCount } = ctx;
+      const { anchors, doc, maxAliasCount } = ctx;
       const source = this.resolve(doc, ctx);
       if (!source) {
         const msg = `Unresolved alias (the anchor must be set before the alias): ${this.source}`;
         throw new ReferenceError(msg);
       }
-      let data = anchors2.get(source);
+      let data = anchors.get(source);
       if (!data) {
         toJS.toJS(source, null, ctx);
-        data = anchors2.get(source);
+        data = anchors.get(source);
       }
       if (data?.res === undefined) {
         const msg = "This should not happen: Alias anchor was not resolved?";
@@ -2793,7 +2781,7 @@ var require_Alias = __commonJS((exports) => {
       if (maxAliasCount >= 0) {
         data.count += 1;
         if (data.aliasCount === 0)
-          data.aliasCount = getAliasCount(doc, source, anchors2);
+          data.aliasCount = getAliasCount(doc, source, anchors);
         if (data.count * data.aliasCount > maxAliasCount) {
           const msg = "Excessive alias count indicates a resource exhaustion attack";
           throw new ReferenceError(msg);
@@ -2815,22 +2803,22 @@ var require_Alias = __commonJS((exports) => {
       return src;
     }
   }
-  function getAliasCount(doc, node, anchors2) {
+  function getAliasCount(doc, node, anchors) {
     if (identity.isAlias(node)) {
       const source = node.resolve(doc);
-      const anchor = anchors2 && source && anchors2.get(source);
+      const anchor = anchors && source && anchors.get(source);
       return anchor ? anchor.count * anchor.aliasCount : 0;
     } else if (identity.isCollection(node)) {
       let count = 0;
       for (const item of node.items) {
-        const c = getAliasCount(doc, item, anchors2);
+        const c = getAliasCount(doc, item, anchors);
         if (c > count)
           count = c;
       }
       return count;
     } else if (identity.isPair(node)) {
-      const kc = getAliasCount(doc, node.key, anchors2);
-      const vc = getAliasCount(doc, node.value, anchors2);
+      const kc = getAliasCount(doc, node.key, anchors);
+      const vc = getAliasCount(doc, node.value, anchors);
       return Math.max(kc, vc);
     }
     return 1;
@@ -2839,7 +2827,7 @@ var require_Alias = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Scalar.js
-var require_Scalar = __commonJS((exports) => {
+var require_Scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Node = require_Node();
   var toJS = require_toJS();
@@ -2867,7 +2855,7 @@ var require_Scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/createNode.js
-var require_createNode = __commonJS((exports) => {
+var require_createNode = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
   var Scalar = require_Scalar();
@@ -2915,10 +2903,10 @@ var require_createNode = __commonJS((exports) => {
         value = value.toJSON();
       }
       if (!value || typeof value !== "object") {
-        const node2 = new Scalar.Scalar(value);
+        const node = new Scalar.Scalar(value);
         if (ref)
-          ref.node = node2;
-        return node2;
+          ref.node = node;
+        return node;
       }
       tagObj = value instanceof Map ? schema[identity.MAP] : (Symbol.iterator in Object(value)) ? schema[identity.SEQ] : schema[identity.MAP];
     }
@@ -2939,7 +2927,7 @@ var require_createNode = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Collection.js
-var require_Collection = __commonJS((exports) => {
+var require_Collection = __commonJS(function(exports) {
   var createNode = require_createNode();
   var identity = require_identity();
   var Node = require_Node();
@@ -3054,7 +3042,7 @@ var require_Collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyComment.js
-var require_stringifyComment = __commonJS((exports) => {
+var require_stringifyComment = __commonJS(function(exports) {
   var stringifyComment = (str) => str.replace(/^(?!$)(?: $)?/gm, "#");
   function indentComment(comment, indent) {
     if (/^\n+$/.test(comment))
@@ -3071,7 +3059,7 @@ var require_stringifyComment = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/foldFlowLines.js
-var require_foldFlowLines = __commonJS((exports) => {
+var require_foldFlowLines = __commonJS(function(exports) {
   var FOLD_FLOW = "flow";
   var FOLD_BLOCK = "block";
   var FOLD_QUOTED = "quoted";
@@ -3167,17 +3155,17 @@ var require_foldFlowLines = __commonJS((exports) => {
     if (onFold)
       onFold();
     let res = text.slice(0, folds[0]);
-    for (let i2 = 0;i2 < folds.length; ++i2) {
-      const fold = folds[i2];
-      const end2 = folds[i2 + 1] || text.length;
+    for (let i = 0;i < folds.length; ++i) {
+      const fold = folds[i];
+      const end = folds[i + 1] || text.length;
       if (fold === 0)
         res = `
-${indent}${text.slice(0, end2)}`;
+${indent}${text.slice(0, end)}`;
       else {
         if (mode === FOLD_QUOTED && escapedFolds[fold])
           res += `${text[fold]}\\`;
         res += `
-${indent}${text.slice(fold + 1, end2)}`;
+${indent}${text.slice(fold + 1, end)}`;
       }
     }
     return res;
@@ -3208,7 +3196,7 @@ ${indent}${text.slice(fold + 1, end2)}`;
 });
 
 // node_modules/yaml/dist/stringify/stringifyString.js
-var require_stringifyString = __commonJS((exports) => {
+var require_stringifyString = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var foldFlowLines = require_foldFlowLines();
   var getFoldOptions = (ctx, isBlock) => ({
@@ -3506,7 +3494,7 @@ ${indent}`);
 });
 
 // node_modules/yaml/dist/stringify/stringify.js
-var require_stringify = __commonJS((exports) => {
+var require_stringify = __commonJS(function(exports) {
   var anchors = require_anchors();
   var identity = require_identity();
   var stringifyComment = require_stringifyComment();
@@ -3626,7 +3614,7 @@ ${ctx.indent}${str}`;
 });
 
 // node_modules/yaml/dist/stringify/stringifyPair.js
-var require_stringifyPair = __commonJS((exports) => {
+var require_stringifyPair = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var stringify = require_stringify();
@@ -3762,7 +3750,7 @@ ${ctx.indent}`;
 });
 
 // node_modules/yaml/dist/log.js
-var require_log = __commonJS((exports) => {
+var require_log = __commonJS(function(exports) {
   var node_process = __require("process");
   function debug(logLevel, ...messages) {
     if (logLevel === "debug")
@@ -3781,7 +3769,7 @@ var require_log = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/merge.js
-var require_merge = __commonJS((exports) => {
+var require_merge = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var MERGE_KEY = "<<";
@@ -3812,15 +3800,15 @@ var require_merge = __commonJS((exports) => {
     if (!identity.isMap(source))
       throw new Error("Merge sources must be maps or map aliases");
     const srcMap = source.toJSON(null, ctx, Map);
-    for (const [key, value2] of srcMap) {
+    for (const [key, value] of srcMap) {
       if (map instanceof Map) {
         if (!map.has(key))
-          map.set(key, value2);
+          map.set(key, value);
       } else if (map instanceof Set) {
         map.add(key);
       } else if (!Object.prototype.hasOwnProperty.call(map, key)) {
         Object.defineProperty(map, key, {
-          value: value2,
+          value,
           writable: true,
           enumerable: true,
           configurable: true
@@ -3835,7 +3823,7 @@ var require_merge = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/addPairToJSMap.js
-var require_addPairToJSMap = __commonJS((exports) => {
+var require_addPairToJSMap = __commonJS(function(exports) {
   var log = require_log();
   var merge = require_merge();
   var stringify = require_stringify();
@@ -3896,7 +3884,7 @@ var require_addPairToJSMap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/Pair.js
-var require_Pair = __commonJS((exports) => {
+var require_Pair = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyPair = require_stringifyPair();
   var addPairToJSMap = require_addPairToJSMap();
@@ -3934,14 +3922,14 @@ var require_Pair = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyCollection.js
-var require_stringifyCollection = __commonJS((exports) => {
+var require_stringifyCollection = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
   function stringifyCollection(collection, ctx, options) {
     const flow = ctx.inFlow ?? collection.flow;
-    const stringify2 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-    return stringify2(collection, ctx, options);
+    const stringify = flow ? stringifyFlowCollection : stringifyBlockCollection;
+    return stringify(collection, ctx, options);
   }
   function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
     const { indent, options: { commentString } } = ctx;
@@ -3950,13 +3938,13 @@ var require_stringifyCollection = __commonJS((exports) => {
     const lines = [];
     for (let i = 0;i < items.length; ++i) {
       const item = items[i];
-      let comment2 = null;
+      let comment = null;
       if (identity.isNode(item)) {
         if (!chompKeep && item.spaceBefore)
           lines.push("");
         addCommentBefore(ctx, lines, item.commentBefore, chompKeep);
         if (item.comment)
-          comment2 = item.comment;
+          comment = item.comment;
       } else if (identity.isPair(item)) {
         const ik = identity.isNode(item.key) ? item.key : null;
         if (ik) {
@@ -3966,12 +3954,12 @@ var require_stringifyCollection = __commonJS((exports) => {
         }
       }
       chompKeep = false;
-      let str2 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
-      if (comment2)
-        str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
-      if (chompKeep && comment2)
+      let str = stringify.stringify(item, itemCtx, () => comment = null, () => chompKeep = true);
+      if (comment)
+        str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
+      if (chompKeep && comment)
         chompKeep = false;
-      lines.push(blockItemPrefix + str2);
+      lines.push(blockItemPrefix + str);
     }
     let str;
     if (lines.length === 0) {
@@ -4079,7 +4067,7 @@ ${indent}${end}`;
 });
 
 // node_modules/yaml/dist/nodes/YAMLMap.js
-var require_YAMLMap = __commonJS((exports) => {
+var require_YAMLMap = __commonJS(function(exports) {
   var stringifyCollection = require_stringifyCollection();
   var addPairToJSMap = require_addPairToJSMap();
   var Collection = require_Collection();
@@ -4206,7 +4194,7 @@ var require_YAMLMap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/map.js
-var require_map = __commonJS((exports) => {
+var require_map = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLMap = require_YAMLMap();
   var map = {
@@ -4214,10 +4202,10 @@ var require_map = __commonJS((exports) => {
     default: true,
     nodeClass: YAMLMap.YAMLMap,
     tag: "tag:yaml.org,2002:map",
-    resolve(map2, onError) {
-      if (!identity.isMap(map2))
+    resolve(map, onError) {
+      if (!identity.isMap(map))
         onError("Expected a mapping for this tag");
-      return map2;
+      return map;
     },
     createNode: (schema, obj, ctx) => YAMLMap.YAMLMap.from(schema, obj, ctx)
   };
@@ -4225,7 +4213,7 @@ var require_map = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/nodes/YAMLSeq.js
-var require_YAMLSeq = __commonJS((exports) => {
+var require_YAMLSeq = __commonJS(function(exports) {
   var createNode = require_createNode();
   var stringifyCollection = require_stringifyCollection();
   var Collection = require_Collection();
@@ -4318,7 +4306,7 @@ var require_YAMLSeq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/seq.js
-var require_seq = __commonJS((exports) => {
+var require_seq = __commonJS(function(exports) {
   var identity = require_identity();
   var YAMLSeq = require_YAMLSeq();
   var seq = {
@@ -4326,10 +4314,10 @@ var require_seq = __commonJS((exports) => {
     default: true,
     nodeClass: YAMLSeq.YAMLSeq,
     tag: "tag:yaml.org,2002:seq",
-    resolve(seq2, onError) {
-      if (!identity.isSeq(seq2))
+    resolve(seq, onError) {
+      if (!identity.isSeq(seq))
         onError("Expected a sequence for this tag");
-      return seq2;
+      return seq;
     },
     createNode: (schema, obj, ctx) => YAMLSeq.YAMLSeq.from(schema, obj, ctx)
   };
@@ -4337,7 +4325,7 @@ var require_seq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/string.js
-var require_string = __commonJS((exports) => {
+var require_string = __commonJS(function(exports) {
   var stringifyString = require_stringifyString();
   var string = {
     identify: (value) => typeof value === "string",
@@ -4353,7 +4341,7 @@ var require_string = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/common/null.js
-var require_null = __commonJS((exports) => {
+var require_null = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var nullTag = {
     identify: (value) => value == null,
@@ -4368,7 +4356,7 @@ var require_null = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/bool.js
-var require_bool = __commonJS((exports) => {
+var require_bool = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var boolTag = {
     identify: (value) => typeof value === "boolean",
@@ -4389,7 +4377,7 @@ var require_bool = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyNumber.js
-var require_stringifyNumber = __commonJS((exports) => {
+var require_stringifyNumber = __commonJS(function(exports) {
   function stringifyNumber({ format, minFractionDigits, tag, value }) {
     if (typeof value === "bigint")
       return String(value);
@@ -4413,7 +4401,7 @@ var require_stringifyNumber = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/float.js
-var require_float = __commonJS((exports) => {
+var require_float = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
   var floatNaN = {
@@ -4456,7 +4444,7 @@ var require_float = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/int.js
-var require_int = __commonJS((exports) => {
+var require_int = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
   var intResolve = (str, offset, radix, { intAsBigInt }) => intAsBigInt ? BigInt(str) : parseInt(str.substring(offset), radix);
@@ -4498,7 +4486,7 @@ var require_int = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/core/schema.js
-var require_schema = __commonJS((exports) => {
+var require_schema = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -4523,7 +4511,7 @@ var require_schema = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/json/schema.js
-var require_schema2 = __commonJS((exports) => {
+var require_schema2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var map = require_map();
   var seq = require_seq();
@@ -4587,7 +4575,7 @@ var require_schema2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/binary.js
-var require_binary = __commonJS((exports) => {
+var require_binary = __commonJS(function(exports) {
   var node_buffer = __require("buffer");
   var Scalar = require_Scalar();
   var stringifyString = require_stringifyString();
@@ -4642,7 +4630,7 @@ var require_binary = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/pairs.js
-var require_pairs = __commonJS((exports) => {
+var require_pairs = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var Scalar = require_Scalar();
@@ -4675,8 +4663,8 @@ ${cn.comment}` : item.comment;
   }
   function createPairs(schema, iterable, ctx) {
     const { replacer } = ctx;
-    const pairs2 = new YAMLSeq.YAMLSeq(schema);
-    pairs2.tag = "tag:yaml.org,2002:pairs";
+    const pairs = new YAMLSeq.YAMLSeq(schema);
+    pairs.tag = "tag:yaml.org,2002:pairs";
     let i = 0;
     if (iterable && Symbol.iterator in Object(iterable))
       for (let it of iterable) {
@@ -4700,9 +4688,9 @@ ${cn.comment}` : item.comment;
         } else {
           key = it;
         }
-        pairs2.items.push(Pair.createPair(key, value, ctx));
+        pairs.items.push(Pair.createPair(key, value, ctx));
       }
-    return pairs2;
+    return pairs;
   }
   var pairs = {
     collection: "seq",
@@ -4717,7 +4705,7 @@ ${cn.comment}` : item.comment;
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/omap.js
-var require_omap = __commonJS((exports) => {
+var require_omap = __commonJS(function(exports) {
   var identity = require_identity();
   var toJS = require_toJS();
   var YAMLMap = require_YAMLMap();
@@ -4756,9 +4744,9 @@ var require_omap = __commonJS((exports) => {
     }
     static from(schema, iterable, ctx) {
       const pairs$1 = pairs.createPairs(schema, iterable, ctx);
-      const omap2 = new this;
-      omap2.items = pairs$1.items;
-      return omap2;
+      const omap = new this;
+      omap.items = pairs$1.items;
+      return omap;
     }
   }
   YAMLOMap.tag = "tag:yaml.org,2002:omap";
@@ -4789,7 +4777,7 @@ var require_omap = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/bool.js
-var require_bool2 = __commonJS((exports) => {
+var require_bool2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function boolStringify({ value, source }, ctx) {
     const boolObj = value ? trueTag : falseTag;
@@ -4818,7 +4806,7 @@ var require_bool2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/float.js
-var require_float2 = __commonJS((exports) => {
+var require_float2 = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var stringifyNumber = require_stringifyNumber();
   var floatNaN = {
@@ -4864,7 +4852,7 @@ var require_float2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/int.js
-var require_int2 = __commonJS((exports) => {
+var require_int2 = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   var intIdentify = (value) => typeof value === "bigint" || Number.isInteger(value);
   function intResolve(str, offset, radix, { intAsBigInt }) {
@@ -4884,8 +4872,8 @@ var require_int2 = __commonJS((exports) => {
           str = `0x${str}`;
           break;
       }
-      const n2 = BigInt(str);
-      return sign === "-" ? BigInt(-1) * n2 : n2;
+      const n = BigInt(str);
+      return sign === "-" ? BigInt(-1) * n : n;
     }
     const n = parseInt(str, radix);
     return sign === "-" ? -1 * n : n;
@@ -4940,7 +4928,7 @@ var require_int2 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/set.js
-var require_set = __commonJS((exports) => {
+var require_set = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -4989,14 +4977,14 @@ var require_set = __commonJS((exports) => {
     }
     static from(schema, iterable, ctx) {
       const { replacer } = ctx;
-      const set2 = new this(schema);
+      const set = new this(schema);
       if (iterable && Symbol.iterator in Object(iterable))
         for (let value of iterable) {
           if (typeof replacer === "function")
             value = replacer.call(iterable, value, value);
-          set2.items.push(Pair.createPair(value, null, ctx));
+          set.items.push(Pair.createPair(value, null, ctx));
         }
-      return set2;
+      return set;
     }
   }
   YAMLSet.tag = "tag:yaml.org,2002:set";
@@ -5023,13 +5011,13 @@ var require_set = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/timestamp.js
-var require_timestamp = __commonJS((exports) => {
+var require_timestamp = __commonJS(function(exports) {
   var stringifyNumber = require_stringifyNumber();
   function parseSexagesimal(str, asBigInt) {
     const sign = str[0];
     const parts = sign === "-" || sign === "+" ? str.substring(1) : str;
     const num = (n) => asBigInt ? BigInt(n) : Number(n);
-    const res = parts.replace(/_/g, "").split(":").reduce((res2, p) => res2 * num(60) + num(p), num(0));
+    const res = parts.replace(/_/g, "").split(":").reduce((res, p) => res * num(60) + num(p), num(0));
     return sign === "-" ? num(-1) * res : res;
   }
   function stringifySexagesimal(node) {
@@ -5105,7 +5093,7 @@ var require_timestamp = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/yaml-1.1/schema.js
-var require_schema3 = __commonJS((exports) => {
+var require_schema3 = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -5146,7 +5134,7 @@ var require_schema3 = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/tags.js
-var require_tags = __commonJS((exports) => {
+var require_tags = __commonJS(function(exports) {
   var map = require_map();
   var _null = require_null();
   var seq = require_seq();
@@ -5220,16 +5208,16 @@ var require_tags = __commonJS((exports) => {
     }
     if (addMergeTag)
       tags = tags.concat(merge.merge);
-    return tags.reduce((tags2, tag) => {
+    return tags.reduce((tags, tag) => {
       const tagObj = typeof tag === "string" ? tagsByName[tag] : tag;
       if (!tagObj) {
         const tagName = JSON.stringify(tag);
         const keys = Object.keys(tagsByName).map((key) => JSON.stringify(key)).join(", ");
         throw new Error(`Unknown custom tag ${tagName}; use one of ${keys}`);
       }
-      if (!tags2.includes(tagObj))
-        tags2.push(tagObj);
-      return tags2;
+      if (!tags.includes(tagObj))
+        tags.push(tagObj);
+      return tags;
     }, []);
   }
   exports.coreKnownTags = coreKnownTags;
@@ -5237,7 +5225,7 @@ var require_tags = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/schema/Schema.js
-var require_Schema = __commonJS((exports) => {
+var require_Schema = __commonJS(function(exports) {
   var identity = require_identity();
   var map = require_map();
   var seq = require_seq();
@@ -5267,7 +5255,7 @@ var require_Schema = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/stringify/stringifyDocument.js
-var require_stringifyDocument = __commonJS((exports) => {
+var require_stringifyDocument = __commonJS(function(exports) {
   var identity = require_identity();
   var stringify = require_stringify();
   var stringifyComment = require_stringifyComment();
@@ -5347,7 +5335,7 @@ var require_stringifyDocument = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/doc/Document.js
-var require_Document = __commonJS((exports) => {
+var require_Document = __commonJS(function(exports) {
   var Alias = require_Alias();
   var Collection = require_Collection();
   var identity = require_identity();
@@ -5556,8 +5544,8 @@ var require_Document = __commonJS((exports) => {
       };
       const res = toJS.toJS(this.contents, jsonArg ?? "", ctx);
       if (typeof onAnchor === "function")
-        for (const { count, res: res2 } of ctx.anchors.values())
-          onAnchor(res2, count);
+        for (const { count, res } of ctx.anchors.values())
+          onAnchor(res, count);
       return typeof reviver === "function" ? applyReviver.applyReviver(reviver, { "": res }, "", res) : res;
     }
     toJSON(jsonArg, onAnchor) {
@@ -5582,7 +5570,7 @@ var require_Document = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/errors.js
-var require_errors = __commonJS((exports) => {
+var require_errors = __commonJS(function(exports) {
   class YAMLError extends Error {
     constructor(name, pos, code, message) {
       super();
@@ -5647,7 +5635,7 @@ ${pointer}
 });
 
 // node_modules/yaml/dist/compose/resolve-props.js
-var require_resolve_props = __commonJS((exports) => {
+var require_resolve_props = __commonJS(function(exports) {
   function resolveProps(tokens, { flow, indicator, next, offset, onError, parentIndent, startOnNewline }) {
     let spaceBefore = false;
     let atNewline = startOnNewline;
@@ -5777,7 +5765,7 @@ var require_resolve_props = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-contains-newline.js
-var require_util_contains_newline = __commonJS((exports) => {
+var require_util_contains_newline = __commonJS(function(exports) {
   function containsNewline(key) {
     if (!key)
       return null;
@@ -5817,7 +5805,7 @@ var require_util_contains_newline = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-flow-indent-check.js
-var require_util_flow_indent_check = __commonJS((exports) => {
+var require_util_flow_indent_check = __commonJS(function(exports) {
   var utilContainsNewline = require_util_contains_newline();
   function flowIndentCheck(indent, fc, onError) {
     if (fc?.type === "flow-collection") {
@@ -5832,7 +5820,7 @@ var require_util_flow_indent_check = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-map-includes.js
-var require_util_map_includes = __commonJS((exports) => {
+var require_util_map_includes = __commonJS(function(exports) {
   var identity = require_identity();
   function mapIncludes(ctx, items, search) {
     const { uniqueKeys } = ctx.options;
@@ -5845,7 +5833,7 @@ var require_util_map_includes = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-map.js
-var require_resolve_block_map = __commonJS((exports) => {
+var require_resolve_block_map = __commonJS(function(exports) {
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
   var resolveProps = require_resolve_props();
@@ -5952,7 +5940,7 @@ var require_resolve_block_map = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-seq.js
-var require_resolve_block_seq = __commonJS((exports) => {
+var require_resolve_block_seq = __commonJS(function(exports) {
   var YAMLSeq = require_YAMLSeq();
   var resolveProps = require_resolve_props();
   var utilFlowIndentCheck = require_util_flow_indent_check();
@@ -6000,7 +5988,7 @@ var require_resolve_block_seq = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-end.js
-var require_resolve_end = __commonJS((exports) => {
+var require_resolve_end = __commonJS(function(exports) {
   function resolveEnd(end, offset, reqSpace, onError) {
     let comment = "";
     if (end) {
@@ -6040,7 +6028,7 @@ var require_resolve_end = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-flow-collection.js
-var require_resolve_flow_collection = __commonJS((exports) => {
+var require_resolve_flow_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Pair = require_Pair();
   var YAMLMap = require_YAMLMap();
@@ -6231,7 +6219,7 @@ var require_resolve_flow_collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-collection.js
-var require_compose_collection = __commonJS((exports) => {
+var require_compose_collection = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var YAMLMap = require_YAMLMap();
@@ -6293,7 +6281,7 @@ var require_compose_collection = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-block-scalar.js
-var require_resolve_block_scalar = __commonJS((exports) => {
+var require_resolve_block_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   function resolveBlockScalar(ctx, scalar, onError) {
     const start = scalar.offset;
@@ -6311,12 +6299,12 @@ var require_resolve_block_scalar = __commonJS((exports) => {
         break;
     }
     if (chompStart === 0) {
-      const value2 = header.chomp === "+" && lines.length > 0 ? `
+      const value = header.chomp === "+" && lines.length > 0 ? `
 `.repeat(Math.max(1, lines.length - 1)) : "";
-      let end2 = start + header.length;
+      let end = start + header.length;
       if (scalar.source)
-        end2 += scalar.source.length;
-      return { value: value2, type, comment: header.comment, range: [start, end2, end2] };
+        end += scalar.source.length;
+      return { value, type, comment: header.comment, range: [start, end, end] };
     }
     let trimIndent = scalar.indent + header.indent;
     let offset = scalar.offset + header.length;
@@ -6486,7 +6474,7 @@ var require_resolve_block_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/resolve-flow-scalar.js
-var require_resolve_flow_scalar = __commonJS((exports) => {
+var require_resolve_flow_scalar = __commonJS(function(exports) {
   var Scalar = require_Scalar();
   var resolveEnd = require_resolve_end();
   function resolveFlowScalar(scalar, strict, onError) {
@@ -6702,7 +6690,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-scalar.js
-var require_compose_scalar = __commonJS((exports) => {
+var require_compose_scalar = __commonJS(function(exports) {
   var identity = require_identity();
   var Scalar = require_Scalar();
   var resolveBlockScalar = require_resolve_block_scalar();
@@ -6764,9 +6752,9 @@ var require_compose_scalar = __commonJS((exports) => {
     return schema[identity.SCALAR];
   }
   function findScalarTagByTest({ atKey, directives, schema }, value, token, onError) {
-    const tag = schema.tags.find((tag2) => (tag2.default === true || atKey && tag2.default === "key") && tag2.test?.test(value)) || schema[identity.SCALAR];
+    const tag = schema.tags.find((tag) => (tag.default === true || atKey && tag.default === "key") && tag.test?.test(value)) || schema[identity.SCALAR];
     if (schema.compat) {
-      const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
+      const compat = schema.compat.find((tag) => tag.default && tag.test?.test(value)) ?? schema[identity.SCALAR];
       if (tag.tag !== compat.tag) {
         const ts = directives.tagString(tag.tag);
         const cs = directives.tagString(compat.tag);
@@ -6780,7 +6768,7 @@ var require_compose_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/util-empty-scalar-position.js
-var require_util_empty_scalar_position = __commonJS((exports) => {
+var require_util_empty_scalar_position = __commonJS(function(exports) {
   function emptyScalarPosition(offset, before, pos) {
     if (before) {
       pos ?? (pos = before.length);
@@ -6807,7 +6795,7 @@ var require_util_empty_scalar_position = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-node.js
-var require_compose_node = __commonJS((exports) => {
+var require_compose_node = __commonJS(function(exports) {
   var Alias = require_Alias();
   var identity = require_identity();
   var composeCollection = require_compose_collection();
@@ -6905,7 +6893,7 @@ var require_compose_node = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/compose-doc.js
-var require_compose_doc = __commonJS((exports) => {
+var require_compose_doc = __commonJS(function(exports) {
   var Document = require_Document();
   var composeNode = require_compose_node();
   var resolveEnd = require_resolve_end();
@@ -6945,7 +6933,7 @@ var require_compose_doc = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/compose/composer.js
-var require_composer = __commonJS((exports) => {
+var require_composer = __commonJS(function(exports) {
   var node_process = __require("process");
   var directives = require_directives();
   var Document = require_Document();
@@ -7134,7 +7122,7 @@ ${end.comment}` : end.comment;
 });
 
 // node_modules/yaml/dist/parse/cst-scalar.js
-var require_cst_scalar = __commonJS((exports) => {
+var require_cst_scalar = __commonJS(function(exports) {
   var resolveBlockScalar = require_resolve_block_scalar();
   var resolveFlowScalar = require_resolve_flow_scalar();
   var errors = require_errors();
@@ -7324,7 +7312,7 @@ var require_cst_scalar = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst-stringify.js
-var require_cst_stringify = __commonJS((exports) => {
+var require_cst_stringify = __commonJS(function(exports) {
   var stringify = (cst) => ("type" in cst) ? stringifyToken(cst) : stringifyItem(cst);
   function stringifyToken(token) {
     switch (token.type) {
@@ -7382,7 +7370,7 @@ var require_cst_stringify = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst-visit.js
-var require_cst_visit = __commonJS((exports) => {
+var require_cst_visit = __commonJS(function(exports) {
   var BREAK = Symbol("break visit");
   var SKIP = Symbol("skip children");
   var REMOVE = Symbol("remove item");
@@ -7441,7 +7429,7 @@ var require_cst_visit = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/cst.js
-var require_cst = __commonJS((exports) => {
+var require_cst = __commonJS(function(exports) {
   var cstScalar = require_cst_scalar();
   var cstStringify = require_cst_stringify();
   var cstVisit = require_cst_visit();
@@ -7542,7 +7530,7 @@ var require_cst = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/lexer.js
-var require_lexer = __commonJS((exports) => {
+var require_lexer = __commonJS(function(exports) {
   var cst = require_cst();
   function isEmpty(ch) {
     switch (ch) {
@@ -7915,18 +7903,18 @@ var require_lexer = __commonJS((exports) => {
       let indent = 0;
       let ch;
       loop:
-        for (let i2 = this.pos;ch = this.buffer[i2]; ++i2) {
+        for (let i = this.pos;ch = this.buffer[i]; ++i) {
           switch (ch) {
             case " ":
               indent += 1;
               break;
             case `
 `:
-              nl = i2;
+              nl = i;
               indent = 0;
               break;
             case "\r": {
-              const next = this.buffer[i2 + 1];
+              const next = this.buffer[i + 1];
               if (!next && !this.atEnd)
                 return this.setNext("block-scalar");
               if (next === `
@@ -7969,16 +7957,16 @@ var require_lexer = __commonJS((exports) => {
         nl = i - 1;
       } else if (!this.blockScalarKeep) {
         do {
-          let i2 = nl - 1;
-          let ch2 = this.buffer[i2];
-          if (ch2 === "\r")
-            ch2 = this.buffer[--i2];
-          const lastChar = i2;
-          while (ch2 === " ")
-            ch2 = this.buffer[--i2];
-          if (ch2 === `
-` && i2 >= this.pos && i2 + 1 + indent > lastChar)
-            nl = i2;
+          let i = nl - 1;
+          let ch = this.buffer[i];
+          if (ch === "\r")
+            ch = this.buffer[--i];
+          const lastChar = i;
+          while (ch === " ")
+            ch = this.buffer[--i];
+          if (ch === `
+` && i >= this.pos && i + 1 + indent > lastChar)
+            nl = i;
           else
             break;
         } while (true);
@@ -8128,7 +8116,7 @@ var require_lexer = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/line-counter.js
-var require_line_counter = __commonJS((exports) => {
+var require_line_counter = __commonJS(function(exports) {
   class LineCounter {
     constructor() {
       this.lineStarts = [];
@@ -8156,7 +8144,7 @@ var require_line_counter = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/parse/parser.js
-var require_parser = __commonJS((exports) => {
+var require_parser = __commonJS(function(exports) {
   var node_process = __require("process");
   var cst = require_cst();
   var lexer = require_lexer();
@@ -8647,12 +8635,12 @@ var require_parser = __commonJS((exports) => {
                 if (includesToken(it.start, "newline")) {
                   Object.assign(it, { key: null, sep: [this.sourceToken] });
                 } else {
-                  const start2 = getFirstKeyStartProps(it.start);
+                  const start = getFirstKeyStartProps(it.start);
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key: null, sep: [this.sourceToken] }]
+                    items: [{ start, key: null, sep: [this.sourceToken] }]
                   });
                 }
               } else if (it.value) {
@@ -8665,7 +8653,7 @@ var require_parser = __commonJS((exports) => {
                   items: [{ start, key: null, sep: [this.sourceToken] }]
                 });
               } else if (isFlowToken(it.key) && !includesToken(it.sep, "newline")) {
-                const start2 = getFirstKeyStartProps(it.start);
+                const start = getFirstKeyStartProps(it.start);
                 const key = it.key;
                 const sep = it.sep;
                 sep.push(this.sourceToken);
@@ -8675,7 +8663,7 @@ var require_parser = __commonJS((exports) => {
                   type: "block-map",
                   offset: this.offset,
                   indent: this.indent,
-                  items: [{ start: start2, key, sep }]
+                  items: [{ start, key, sep }]
                 });
               } else if (start.length > 0) {
                 it.sep = it.sep.concat(start, this.sourceToken);
@@ -9005,7 +8993,7 @@ var require_parser = __commonJS((exports) => {
 });
 
 // node_modules/yaml/dist/public-api.js
-var require_public_api = __commonJS((exports) => {
+var require_public_api = __commonJS(function(exports) {
   var composer = require_composer();
   var Document = require_Document();
   var errors = require_errors();
@@ -9019,22 +9007,22 @@ var require_public_api = __commonJS((exports) => {
     return { lineCounter: lineCounter$1, prettyErrors };
   }
   function parseAllDocuments(source, options = {}) {
-    const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
-    const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
+    const { lineCounter, prettyErrors } = parseOptions(options);
+    const parser$1 = new parser.Parser(lineCounter?.addNewLine);
     const composer$1 = new composer.Composer(options);
     const docs = Array.from(composer$1.compose(parser$1.parse(source)));
-    if (prettyErrors && lineCounter2)
+    if (prettyErrors && lineCounter)
       for (const doc of docs) {
-        doc.errors.forEach(errors.prettifyError(source, lineCounter2));
-        doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
+        doc.errors.forEach(errors.prettifyError(source, lineCounter));
+        doc.warnings.forEach(errors.prettifyError(source, lineCounter));
       }
     if (docs.length > 0)
       return docs;
     return Object.assign([], { empty: true }, composer$1.streamInfo());
   }
   function parseDocument(source, options = {}) {
-    const { lineCounter: lineCounter2, prettyErrors } = parseOptions(options);
-    const parser$1 = new parser.Parser(lineCounter2?.addNewLine);
+    const { lineCounter, prettyErrors } = parseOptions(options);
+    const parser$1 = new parser.Parser(lineCounter?.addNewLine);
     const composer$1 = new composer.Composer(options);
     let doc = null;
     for (const _doc of composer$1.compose(parser$1.parse(source), true, source.length)) {
@@ -9045,9 +9033,9 @@ var require_public_api = __commonJS((exports) => {
         break;
       }
     }
-    if (prettyErrors && lineCounter2) {
-      doc.errors.forEach(errors.prettifyError(source, lineCounter2));
-      doc.warnings.forEach(errors.prettifyError(source, lineCounter2));
+    if (prettyErrors && lineCounter) {
+      doc.errors.forEach(errors.prettifyError(source, lineCounter));
+      doc.warnings.forEach(errors.prettifyError(source, lineCounter));
     }
     return doc;
   }
@@ -9394,27 +9382,27 @@ async function* parseGenericSSE(body) {
       for (const rawLine of lines) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
         if (line === "") {
-          const evt2 = flush();
-          if (evt2)
-            yield evt2;
+          const evt = flush();
+          if (evt)
+            yield evt;
           continue;
         }
         if (line.startsWith(":"))
           continue;
         const colon = line.indexOf(":");
         const field = colon === -1 ? line : line.slice(0, colon);
-        let value2 = colon === -1 ? "" : line.slice(colon + 1);
-        if (value2.startsWith(" "))
-          value2 = value2.slice(1);
+        let value = colon === -1 ? "" : line.slice(colon + 1);
+        if (value.startsWith(" "))
+          value = value.slice(1);
         switch (field) {
           case "event":
-            event = value2;
+            event = value;
             break;
           case "data":
-            dataLines.push(value2);
+            dataLines.push(value);
             break;
           case "id":
-            id = value2;
+            id = value;
             break;
         }
       }
@@ -9488,7 +9476,6 @@ function parseDataLine(data) {
 // src/lib/api-client.ts
 var exports_api_client = {};
 __export(exports_api_client, {
-  sameHostRedirect: () => sameHostRedirect,
   MarthaAPIClient: () => MarthaAPIClient
 });
 import fs3 from "node:fs";
@@ -9530,11 +9517,22 @@ class MarthaAPIClient {
   getAccessToken;
   defaultTimeout;
   verbose;
+  tenantFor;
   constructor(config) {
     this.baseUrl = config.baseUrl.replace(/\/+$/, "");
     this.getAccessToken = config.getAccessToken;
     this.defaultTimeout = config.timeout ?? 30000;
     this.verbose = config.verbose ?? false;
+    this.tenantFor = config.tenantFor ?? (() => {
+      return;
+    });
+  }
+  authHeaders(token) {
+    const tenant = this.tenantFor(token);
+    return {
+      Authorization: `Bearer ${token}`,
+      ...tenant ? { "X-Martha-Tenant": tenant } : {}
+    };
   }
   log(msg) {
     if (this.verbose)
@@ -9562,24 +9560,24 @@ class MarthaAPIClient {
     }
     return res;
   }
-  async get(path3, opts) {
-    return this.request("GET", path3, opts);
+  async get(path, opts) {
+    return this.request("GET", path, opts);
   }
-  async post(path3, body, opts) {
-    return this.request("POST", path3, { ...opts, body });
+  async post(path, body, opts) {
+    return this.request("POST", path, { ...opts, body });
   }
-  async put(path3, body, opts) {
-    return this.request("PUT", path3, { ...opts, body });
+  async put(path, body, opts) {
+    return this.request("PUT", path, { ...opts, body });
   }
-  async patch(path3, body, opts) {
-    return this.request("PATCH", path3, { ...opts, body });
+  async patch(path, body, opts) {
+    return this.request("PATCH", path, { ...opts, body });
   }
-  async del(path3, opts) {
-    return this.request("DELETE", path3, opts);
+  async del(path, opts) {
+    return this.request("DELETE", path, opts);
   }
-  async upload(path3, filePath, opts) {
+  async upload(path, filePath, opts) {
     const token = await this.getAccessToken();
-    const url = this.buildUrl(path3, opts?.params);
+    const url = this.buildUrl(path, opts?.params);
     const timeout = opts?.timeout ?? 120000;
     const fileBuffer = fs3.readFileSync(filePath);
     const fileName = nodePath.basename(filePath);
@@ -9592,7 +9590,7 @@ class MarthaAPIClient {
       res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
-          Authorization: `Bearer ${token}`,
+          ...this.authHeaders(token),
           ...opts?.headers
         },
         body: formData,
@@ -9613,16 +9611,16 @@ class MarthaAPIClient {
     }
     return await res.json();
   }
-  async getRaw(path3, opts) {
+  async getRaw(path, opts) {
     const token = await this.getAccessToken();
-    const url = this.buildUrl(path3, opts?.params);
+    const url = this.buildUrl(path, opts?.params);
     const timeout = opts?.timeout ?? this.defaultTimeout;
     let res;
     try {
       res = await this.fetchSameHost(url, {
         method: "GET",
         headers: {
-          Authorization: `Bearer ${token}`,
+          ...this.authHeaders(token),
           ...opts?.headers
         },
         signal: opts?.signal ?? AbortSignal.timeout(timeout)
@@ -9642,16 +9640,16 @@ class MarthaAPIClient {
     }
     return res;
   }
-  async postRaw(path3, body, opts) {
+  async postRaw(path, body, opts) {
     const token = await this.getAccessToken();
-    const url = this.buildUrl(path3, opts?.params);
+    const url = this.buildUrl(path, opts?.params);
     const timeout = opts?.timeout ?? 120000;
     let res;
     try {
       res = await this.fetchSameHost(url, {
         method: "POST",
         headers: {
-          Authorization: `Bearer ${token}`,
+          ...this.authHeaders(token),
           "Content-Type": "application/json",
           ...opts?.headers
         },
@@ -9673,14 +9671,14 @@ class MarthaAPIClient {
     }
     return res;
   }
-  async* streamSSE(path3, body, opts) {
+  async* streamSSE(path, body, opts) {
     const token = await this.getAccessToken();
-    const url = this.buildUrl(path3, opts?.params);
+    const url = this.buildUrl(path, opts?.params);
     const timeout = opts?.timeout ?? 120000;
     const res = await this.fetchSameHost(url, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${token}`,
+        ...this.authHeaders(token),
         "Content-Type": "application/json",
         ...opts?.headers
       },
@@ -9696,12 +9694,12 @@ class MarthaAPIClient {
     }
     yield* parseSSEStream(res.body);
   }
-  async request(method, path3, opts) {
-    const url = this.buildUrl(path3, opts?.params);
+  async request(method, path, opts) {
+    const url = this.buildUrl(path, opts?.params);
     const timeout = opts?.timeout ?? this.defaultTimeout;
-    const attempt = async (token2) => {
+    const attempt = async (token) => {
       const headers = {
-        Authorization: `Bearer ${token2}`,
+        ...this.authHeaders(token),
         ...opts?.headers
       };
       if (opts?.body !== undefined) {
@@ -9746,11 +9744,11 @@ class MarthaAPIClient {
       return;
     return await res.json();
   }
-  buildUrl(path3, params) {
-    if (/^(https?:)?\/\//i.test(path3)) {
+  buildUrl(path, params) {
+    if (/^(https?:)?\/\//i.test(path)) {
       throw new CLIError("Absolute URL paths are not allowed", 1 /* Error */);
     }
-    const url = new URL(path3, this.baseUrl);
+    const url = new URL(path, this.baseUrl);
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         url.searchParams.set(key, value);
@@ -9783,21 +9781,64 @@ var init_api_client = __esm(() => {
   };
 });
 
+// node_modules/commander/index.js
+var exports_commander = {};
+__exportCjs(exports_commander, {
+  program: () => $program,
+  createCommand: () => $createCommand,
+  createOption: () => $createOption,
+  createArgument: () => $createArgument,
+  Command: () => $Command,
+  Option: () => $Option,
+  Argument: () => $Argument,
+  Help: () => $Help,
+  CommanderError: () => $CommanderError,
+  InvalidArgumentError: () => $InvalidArgumentError,
+  InvalidOptionArgumentError: () => $InvalidOptionArgumentError
+}, {
+  program: (value) => $program = value,
+  createCommand: (value) => $createCommand = value,
+  createOption: (value) => $createOption = value,
+  createArgument: (value) => $createArgument = value,
+  Command: (value) => $Command = value,
+  Option: (value) => $Option = value,
+  Argument: (value) => $Argument = value,
+  Help: (value) => $Help = value,
+  CommanderError: (value) => $CommanderError = value,
+  InvalidArgumentError: (value) => $InvalidArgumentError = value,
+  InvalidOptionArgumentError: (value) => $InvalidOptionArgumentError = value
+});
+var { Argument } = require_argument();
+var { Command } = require_command();
+var { CommanderError, InvalidArgumentError } = require_error();
+var { Help } = require_help();
+var { Option } = require_option();
+var $program = new Command;
+var $createCommand = (name) => new Command(name);
+var $createOption = (flags, description) => new Option(flags, description);
+var $createArgument = (name, description) => new Argument(name, description);
+var $Command = Command;
+var $Option = Option;
+var $Argument = Argument;
+var $Help = Help;
+var $CommanderError = CommanderError;
+var $InvalidArgumentError = InvalidArgumentError;
+var $InvalidOptionArgumentError = InvalidArgumentError;
+
 // node_modules/commander/esm.mjs
-var import__ = __toESM(require_commander(), 1);
 var {
   program,
   createCommand,
   createArgument,
   createOption,
-  CommanderError,
-  InvalidArgumentError,
+  CommanderError: CommanderError2,
+  InvalidArgumentError: InvalidArgumentError2,
   InvalidOptionArgumentError,
-  Command,
-  Argument,
-  Option,
-  Help
-} = import__.default;
+  Command: Command2,
+  Argument: Argument2,
+  Option: Option2,
+  Help: Help2
+} = exports_commander;
 
 // src/index.ts
 init_errors();
@@ -10346,9 +10387,9 @@ import { randomBytes, createHash } from "node:crypto";
 async function openBrowser(url) {
   const { execFile } = await import("node:child_process");
   const { platform } = await import("node:os");
-  const os3 = platform();
+  const os = platform();
   return new Promise((resolve, reject) => {
-    if (os3 === "win32") {
+    if (os === "win32") {
       execFile("cmd", ["/c", "start", "", url], (err) => {
         if (err)
           reject(err);
@@ -10356,7 +10397,7 @@ async function openBrowser(url) {
           resolve();
       });
     } else {
-      const cmd = os3 === "darwin" ? "open" : "xdg-open";
+      const cmd = os === "darwin" ? "open" : "xdg-open";
       execFile(cmd, [url], (err) => {
         if (err)
           reject(err);
@@ -10764,6 +10805,21 @@ function belongsToClient(tokens, clientId) {
   const azp = claims?.azp ?? claims?.client_id;
   return azp ? azp === clientId : true;
 }
+var selection = {};
+var clean = (v) => typeof v === "string" && v.trim() ? v.trim() : undefined;
+function registerOrgSelection(program) {
+  program.hook("preAction", (_root, action) => {
+    const opts = action.optsWithGlobals();
+    selection = { org: clean(opts.org), commandTenant: clean(opts.tenant) };
+  });
+}
+function organizationsFromClaims(payload) {
+  const orgs = payload.organizations;
+  if (orgs && typeof orgs === "object" && !Array.isArray(orgs)) {
+    return Object.keys(orgs);
+  }
+  return [];
+}
 function tenantFromClaims(payload) {
   const tid = payload.tenant_id;
   if (typeof tid === "string" && tid)
@@ -10798,43 +10854,59 @@ function createContext(opts) {
           return existing.access_token;
         }
       }
-      const { loginClientCredentials: loginClientCredentials2 } = await Promise.resolve().then(() => (init_client_credentials(), exports_client_credentials));
-      const tokens2 = await loginClientCredentials2({
+      await Promise.resolve().then(() => init_client_credentials());
+      const tokens = await loginClientCredentials({
         keycloakUrl: profile.keycloak_url,
         realm: profile.keycloak_realm,
         clientId,
         clientSecret
       });
-      tokenStore.saveTokens(profileName, tokens2);
-      return tokens2.access_token;
+      tokenStore.saveTokens(profileName, tokens);
+      return tokens.access_token;
     }
     if (!tokenStore.needsRefresh(profileName)) {
-      const tokens2 = tokenStore.getTokens(profileName);
-      if (tokens2)
-        return tokens2.access_token;
+      const tokens = tokenStore.getTokens(profileName);
+      if (tokens)
+        return tokens.access_token;
     }
     const tokens = tokenStore.getTokens(profileName);
     if (tokens?.refresh_token && !tokenStore.isRefreshExpired(profileName)) {
-      const clientId2 = tokens.auth_type === "client_credentials" ? profile.client_id : "martha-cli";
+      const clientId = tokens.auth_type === "client_credentials" ? profile.client_id : "martha-cli";
       const refreshed = await refreshAccessToken({
         keycloakUrl: profile.keycloak_url,
         realm: profile.keycloak_realm,
         refreshToken: tokens.refresh_token,
-        clientId: clientId2
+        clientId
       });
       tokenStore.saveTokens(profileName, refreshed);
       return refreshed.access_token;
     }
     throw new CLIError("Not authenticated.", 2 /* Auth */, "Run `martha auth login` to authenticate.");
   };
+  const explicitOrg = selection.org ?? clean(process.env.MARTHA_ORG);
+  const { commandTenant } = selection;
+  const tenantFor = (token) => {
+    if (explicitOrg)
+      return explicitOrg;
+    if (commandTenant) {
+      let orgs = [];
+      try {
+        orgs = organizationsFromClaims(decodeJwtPayload(token));
+      } catch {}
+      if (orgs.includes(commandTenant))
+        return commandTenant;
+    }
+    return profile.org?.trim() || undefined;
+  };
   const api = new MarthaAPIClient({
     baseUrl: profile.api_url,
     getAccessToken,
-    verbose: opts.verbose
+    verbose: opts.verbose,
+    tenantFor
   });
   const getTenantId = async () => {
     const token = await getAccessToken();
-    const tid = tenantFromClaims(decodeJwtPayload(token));
+    const tid = tenantFor(token) ?? tenantFromClaims(decodeJwtPayload(token));
     if (!tid) {
       throw new CLIError("No tenant_id or organizations claim in access token.", 2 /* Auth */);
     }
@@ -10848,7 +10920,8 @@ function createContext(opts) {
     api,
     configDir: opts.configDir,
     getTenantId,
-    getAccessToken
+    getAccessToken,
+    tenantFor
   };
 }
 
@@ -10941,20 +11014,20 @@ init_errors();
 function an(word) {
   return /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
 }
-function registerDefinitionCommands(program2, config) {
-  const cmd = program2.command(config.typeNamePlural).description(`Manage ${config.typeName} definitions`);
+function registerDefinitionCommands(program, config) {
+  const cmd = program.command(config.typeNamePlural).description(`Manage ${config.typeName} definitions`);
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   const listCmd = cmd.command("list").description(`List ${config.typeNamePlural}`).option("--inactive", "Include inactive items").option("--limit <n>", "Max results per page", "50").option("--search <term>", "Case-insensitive substring filter on name (server-side)").option("--all", "Auto-paginate until every matching item is fetched (server caps at 500/page)");
   if (config.extraListOptions) {
@@ -11171,7 +11244,7 @@ init_config();
 init_errors();
 
 // src/version.ts
-var CLI_VERSION = "0.61.2";
+var CLI_VERSION = "0.63.0";
 
 // src/commands/sessions.ts
 function relativeTime(iso) {
@@ -11246,20 +11319,20 @@ function printSessionTable(sessions) {
     }).join("  "));
   }
 }
-function registerSessionCommands(program2) {
-  const cmd = program2.command("sessions").description("Browse conversation history");
+function registerSessionCommands(program) {
+  const cmd = program.command("sessions").description("Browse conversation history");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List your conversation sessions").option("--search <text>", "Filter sessions by title").option("--limit <n>", "Max results (default: 20)", "20").option("--skip <n>", "Offset for pagination", "0").option("--type <type>", "Filter by session type (api, sms, whatsapp)").option("--include-archived", "Include archived sessions").action(async (opts) => {
     const ctx = getCtx();
@@ -11884,8 +11957,8 @@ Attach it as this agent's host executor:
     });
     parentCmd.command("revoke-runner <agent>").description("Revoke a host runner's live channel connection(s) without rotating the " + "key (#802). Drops the live stream within one heartbeat and flips the " + "agent offline. Default revokes ALL connections; --connection targets one.").option("--connection <id>", "Revoke only this connection_id (default: all of the agent's connections)").action(async (agent, opts) => {
       const ctx = getCtx();
-      const path4 = `${API_PATH}/${encodeURIComponent(agent)}/revoke-runner` + (opts.connection ? `?connection=${encodeURIComponent(opts.connection)}` : "");
-      const result = await ctx.api.post(path4, {});
+      const path = `${API_PATH}/${encodeURIComponent(agent)}/revoke-runner` + (opts.connection ? `?connection=${encodeURIComponent(opts.connection)}` : "");
+      const result = await ctx.api.post(path, {});
       if (isJson()) {
         console.log(JSON.stringify(result, null, 2));
         return;
@@ -12046,8 +12119,8 @@ Attach it as this agent's host executor:
     });
     parentCmd.command("self-grant <agent>").description("View or configure an agent's self-provisioning policy (request-then-approve). " + "With no flags, prints the current policy.").option("--enable", "Allow the agent to REQUEST capability grants").option("--disable", "Disallow self-provisioning").option("--scope <scope>", "Scope ceiling: none | read_only | read_write").option("--allow <ref...>", "Add allow-list refs (function:NAME or mcp:integration/name)").option("--remove <ref...>", "Remove allow-list refs").option("--collection-root <id...>", "Add collection-subtree roots the agent may self-grant collection-scoped functions into").option("--remove-collection-root <id...>", "Remove collection roots").option("--max-pending <n>", "Max concurrently-pending requests").action(async (agent, opts) => {
       const ctx = getCtx();
-      const path4 = `${API_PATH}/${encodeURIComponent(agent)}`;
-      const current = await ctx.api.get(path4);
+      const path = `${API_PATH}/${encodeURIComponent(agent)}`;
+      const current = await ctx.api.get(path);
       const mutating = opts.enable || opts.disable || opts.scope !== undefined || (opts.allow?.length ?? 0) > 0 || (opts.remove?.length ?? 0) > 0 || (opts.collectionRoot?.length ?? 0) > 0 || (opts.removeCollectionRoot?.length ?? 0) > 0 || opts.maxPending !== undefined;
       if (!mutating) {
         if (isJson()) {
@@ -12099,7 +12172,7 @@ Attach it as this agent's host executor:
           roots.delete(c);
         body.self_grant_collection_roots = [...roots];
       }
-      const updated = await ctx.api.put(path4, body);
+      const updated = await ctx.api.put(path, body);
       if (isJson()) {
         console.log(JSON.stringify(policyView(updated), null, 2));
         return;
@@ -12784,10 +12857,10 @@ class BrowserSession {
     let chromium;
     const candidates = [];
     try {
-      const { createRequire: createRequire2 } = await import("node:module");
+      const { createRequire } = await import("node:module");
       const { pathToFileURL } = await import("node:url");
-      const path5 = await import("node:path");
-      const req = createRequire2(pathToFileURL(path5.join(process.cwd(), "noop.js")));
+      const path = await import("node:path");
+      const req = createRequire(pathToFileURL(path.join(process.cwd(), "noop.js")));
       candidates.push(pathToFileURL(req.resolve(moduleName)).href);
     } catch {}
     candidates.push(moduleName);
@@ -13037,19 +13110,19 @@ async function dispatchBackgroundJob(command, jobId, journal, opts) {
   const sentinelPath = path6.join(dir, `${jobId}.exit`);
   await fs7.writeFile(logPath, "");
   const fd = openSync2(logPath, "a");
-  const env2 = { ...process.env, MARTHA_JOB_SENTINEL: sentinelPath };
+  const env = { ...process.env, MARTHA_JOB_SENTINEL: sentinelPath };
   const stdin = opts.stdinData != null ? "pipe" : "ignore";
   const child = opts.argv ? spawn2("/bin/sh", ["-c", `"$@"${SENTINEL_TAIL}`, "martha-job", ...opts.argv], {
     shell: false,
     cwd: opts.cwd,
     detached: true,
-    env: env2,
+    env,
     stdio: [stdin, fd, fd]
   }) : spawn2("/bin/sh", ["-c", `( ${command} )${SENTINEL_TAIL}`], {
     shell: false,
     cwd: opts.cwd,
     detached: true,
-    env: env2,
+    env,
     stdio: [stdin, fd, fd]
   });
   closeSync2(fd);
@@ -13827,11 +13900,11 @@ function formatToolStatus(data) {
   }
 }
 function promptPick(rl, count) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     rl.question(source_default.dim(`Pick 1-${count} (or Enter to cancel): `), (ans) => {
       const trimmed = ans.trim();
       if (!trimmed) {
-        resolve2(-1);
+        resolve(-1);
         return;
       }
       const n = parseInt(trimmed, 10);
@@ -13839,10 +13912,10 @@ function promptPick(rl, count) {
         process.stderr.write(source_default.yellow(`Invalid choice.
 
 `));
-        resolve2(-1);
+        resolve(-1);
         return;
       }
-      resolve2(n - 1);
+      resolve(n - 1);
     });
   });
 }
@@ -14224,16 +14297,16 @@ async function runOneShot(ctx, sessionId, message, isJson, clientId, agentName,
     console.log(stripApprovalWidgetTags(response));
   }
 }
-function registerChatCommand(program2) {
-  program2.command("chat").description("Chat with a Martha agent").option("--session <id>", "Resume an existing session").option("--client <nameOrId>", "Use a specific client (name or ID)").option("--agent <name>", "Drive the chat with a specific copilot agent (defaults to profile.default_agent)").option("--message <text>", "Send a single message (non-interactive)").option("--show-tools", "Show tool calls and results during chat").option("--local-exec", "Allow the agent to run host tools on THIS machine (#568). Requires the server to have LOCAL_EXEC_ENABLED=1.").option("--yes", "Auto-approve host tool execution (required with --local-exec for non-interactive runs).").option("--local-agent <name>", "Which local coding agent `local_agent` delegates to: a preset (claude | codex | cursor-agent) or a raw command. Overrides MARTHA_LOCAL_AGENT_CMD and `config local_agent` for this run.").option("--timeout <seconds>", "Per-message HTTP timeout in seconds (default: 600)").action(async (opts) => {
+function registerChatCommand(program) {
+  program.command("chat").description("Chat with a Martha agent").option("--session <id>", "Resume an existing session").option("--client <nameOrId>", "Use a specific client (name or ID)").option("--agent <name>", "Drive the chat with a specific copilot agent (defaults to profile.default_agent)").option("--message <text>", "Send a single message (non-interactive)").option("--show-tools", "Show tool calls and results during chat").option("--local-exec", "Allow the agent to run host tools on THIS machine (#568). Requires the server to have LOCAL_EXEC_ENABLED=1.").option("--yes", "Auto-approve host tool execution (required with --local-exec for non-interactive runs).").option("--local-agent <name>", "Which local coding agent `local_agent` delegates to: a preset (claude | codex | cursor-agent) or a raw command. Overrides MARTHA_LOCAL_AGENT_CMD and `config local_agent` for this run.").option("--timeout <seconds>", "Per-message HTTP timeout in seconds (default: 600)").action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
-    const isJson = !!program2.opts().json;
+    const isJson = !!program.opts().json;
     let clientId;
     if (opts.client) {
       const parsed = parseInt(opts.client, 10);
@@ -14355,9 +14428,9 @@ async function deliverToChannel(buzzBin, target, text) {
   const args = ["messages", "send", "--channel", target.channelId, "--content", text];
   if (target.threadRef)
     args.push("--reply-to", target.threadRef);
-  const send = () => new Promise((resolve2) => {
+  const send = () => new Promise((resolve) => {
     execFile(buzzBin, args, { timeout: 20000, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
-      resolve2({
+      resolve({
         ok: !err,
         out: stdout?.slice(0, 2000) ?? "",
         err: err ? `${err.message}
@@ -14389,9 +14462,9 @@ async function runAcpServer(ctx, input, output, opts) {
   const sessions = new Map;
   let writeChain = Promise.resolve();
   const writeLine = (msg) => {
-    writeChain = writeChain.then(() => new Promise((resolve2) => {
+    writeChain = writeChain.then(() => new Promise((resolve) => {
       output.write(JSON.stringify(msg) + `
-`, () => resolve2());
+`, () => resolve());
     }));
     return writeChain;
   };
@@ -14580,12 +14653,12 @@ async function probeStartup(ctx) {
     throw new CLIError(`ACP startup failed: cannot reach Martha API at ${ctx.profile.api_url}: ${message}`, 1 /* Error */, "Check the API URL (--api-url / profile) and that the Martha API is up.");
   }
 }
-function registerAcpServeCommand(program2) {
-  program2.command("acp-serve").description("Serve the Agent Client Protocol over stdio (newline-delimited JSON-RPC 2.0) so an ACP harness like Buzz's buzz-acp can drive a Martha agent").option("--client <nameOrId>", "Use a specific client id for the Martha session").option("--agent <name>", "Drive turns with a specific Martha agent (defaults to the credential/profile binding)").option("--post-reply", "After each completed turn, post the final answer back to the triggering Buzz channel via the `buzz` CLI (parsed from the prompt's [Context] section)").option("--buzz-bin <path>", "Path to the buzz CLI for --post-reply", "buzz").option("--timeout <seconds>", "Per-prompt HTTP timeout in seconds (default: 600)").action(async (opts) => {
+function registerAcpServeCommand(program) {
+  program.command("acp-serve").description("Serve the Agent Client Protocol over stdio (newline-delimited JSON-RPC 2.0) so an ACP harness like Buzz's buzz-acp can drive a Martha agent").option("--client <nameOrId>", "Use a specific client id for the Martha session").option("--agent <name>", "Drive turns with a specific Martha agent (defaults to the credential/profile binding)").option("--post-reply", "After each completed turn, post the final answer back to the triggering Buzz channel via the `buzz` CLI (parsed from the prompt's [Context] section)").option("--buzz-bin <path>", "Path to the buzz CLI for --post-reply", "buzz").option("--timeout <seconds>", "Per-prompt HTTP timeout in seconds (default: 600)").action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
     const timeoutMs = opts.timeout ? Math.max(1, Number(opts.timeout)) * 1000 : undefined;
     logJson("info", "martha acp-serve starting", {
@@ -14737,15 +14810,15 @@ function printAgentPrincipalReady(r, savedProfile) {
   Then: buzz channels add-member --channel <id> --pubkey <agent pubkey> --role member
 ` + "  and @mention the agent in the channel."));
 }
-function registerPrincipalCommands(program2) {
-  const principals = program2.command("principals").description("Provision principals — who may act, with what credential (mirrors the API's principals/bootstrap)");
+function registerPrincipalCommands(program) {
+  const principals = program.command("principals").description("Provision principals — who may act, with what credential (mirrors the API's principals/bootstrap)");
   principals.command("bootstrap").description("Provision a principal. --mode human: your run-as client (what `martha init` wraps). " + "--mode integration: headless service account. --mode agent: service account bound " + "to ONE Martha-hosted agent (chat takeover) so the credential acts as the agent — " + "the shape an external ACP driver (Buzz, Zed) needs.").requiredOption("--mode <mode>", "human | integration | agent").option("--agent <name>", "Agent to bind (agent mode)").option("--prompt <text>", "System prompt — creates the agent when it doesn't exist yet (agent mode)").option("--label <label>", "Label for the service-account client id (default: the agent name in agent mode)").option("--intents <list>", "Comma-separated tool intents to grant (rag, documents, workflows, tasks)").option("--collections <list>", "Comma-separated collections (name, slug or id) the agent may read. Intents grant the retrieval TOOLS; without this they return nothing").option("--save-profile <name>", "Save the minted credential as a Martha profile, so anything that runs as this agent needs only MARTHA_PROFILE=<name> — no secret to copy").action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
-    const isJson = !!program2.opts().json;
+    const isJson = !!program.opts().json;
     switch (opts.mode) {
       case "agent": {
         if (!opts.agent) {
@@ -14842,7 +14915,7 @@ function buzzHarnessDefinition(opts = {}) {
 function isValidHarnessId(id) {
   return /^[a-z0-9_][a-z0-9_-]*$/.test(id);
 }
-function buzzAppDataCandidates(platform, env2, home) {
+function buzzAppDataCandidates(platform, env, home) {
   const ids = [
     { build: "release", id: "xyz.block.buzz.app" },
     { build: "dev", id: "xyz.block.buzz.app.dev" }
@@ -14851,8 +14924,8 @@ function buzzAppDataCandidates(platform, env2, home) {
     if (platform === "darwin")
       return join4(home, "Library", "Application Support");
     if (platform === "win32")
-      return env2.APPDATA ?? join4(home, "AppData", "Roaming");
-    return env2.XDG_DATA_HOME ?? join4(home, ".local", "share");
+      return env.APPDATA ?? join4(home, "AppData", "Roaming");
+    return env.XDG_DATA_HOME ?? join4(home, ".local", "share");
   };
   const root = base();
   return ids.map(({ build, id }) => ({ build, dir: join4(root, id) }));
@@ -14860,12 +14933,12 @@ function buzzAppDataCandidates(platform, env2, home) {
 function chooseAppDataDir(candidates, exists) {
   return candidates.find((c) => exists(c.dir)) ?? null;
 }
-function buzzAppCandidates(platform, env2, home) {
+function buzzAppCandidates(platform, env, home) {
   if (platform === "darwin") {
     return ["/Applications/Buzz.app", join4(home, "Applications", "Buzz.app")];
   }
   if (platform === "win32") {
-    const base = env2.LOCALAPPDATA ?? join4(home, "AppData", "Local");
+    const base = env.LOCALAPPDATA ?? join4(home, "AppData", "Local");
     return [join4(base, "Programs", "Buzz")];
   }
   return [
@@ -14875,12 +14948,12 @@ function buzzAppCandidates(platform, env2, home) {
   ];
 }
 var BUZZ_RELEASES_URL = "https://github.com/block/buzz/releases/latest";
-function buzzSidecarDirs(platform, env2, home) {
+function buzzSidecarDirs(platform, env, home) {
   if (platform === "darwin") {
-    return buzzAppCandidates(platform, env2, home).map((app) => join4(app, "Contents", "MacOS"));
+    return buzzAppCandidates(platform, env, home).map((app) => join4(app, "Contents", "MacOS"));
   }
   if (platform === "win32") {
-    return buzzAppCandidates(platform, env2, home);
+    return buzzAppCandidates(platform, env, home);
   }
   return ["/opt/Buzz"];
 }
@@ -14918,7 +14991,7 @@ ${looked}
 }
 var DEFAULT_BUZZ_KINDS = "9,46010,40007,7";
 function buzzAcpEnv(opts) {
-  const env2 = {
+  const env = {
     BUZZ_RELAY_URL: opts.relayUrl,
     BUZZ_ACP_AGENT_COMMAND: opts.marthaBin,
     BUZZ_ACP_AGENT_ARGS: "acp-serve,--post-reply",
@@ -14928,16 +15001,16 @@ function buzzAcpEnv(opts) {
     ...opts.profile ? { MARTHA_PROFILE: opts.profile } : {}
   };
   if (opts.subscribe === "all")
-    env2.BUZZ_ACP_KINDS = opts.kinds;
-  return env2;
+    env.BUZZ_ACP_KINDS = opts.kinds;
+  return env;
 }
-function resolveOnPath(bin, env2, platform, isExecutable) {
+function resolveOnPath(bin, env, platform, isExecutable) {
   if (bin.includes("/") || bin.includes("\\")) {
     return isExecutable(bin) ? bin : null;
   }
-  const exts = platform === "win32" ? (env2.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const exts = platform === "win32" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
   const sep = platform === "win32" ? ";" : ":";
-  for (const dir of (env2.PATH ?? "").split(sep).filter(Boolean)) {
+  for (const dir of (env.PATH ?? "").split(sep).filter(Boolean)) {
     for (const ext of exts) {
       const candidate = join4(dir, bin + ext);
       if (isExecutable(candidate))
@@ -14965,11 +15038,11 @@ function whichBuzz(bin) {
     isExecutable: executableOnDisk
   });
 }
-function runBin(bin, args, env2) {
-  return new Promise((resolve2) => {
-    execFile2(bin, args, { env: env2, timeout: 15000, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
+function runBin(bin, args, env) {
+  return new Promise((resolve) => {
+    execFile2(bin, args, { env, timeout: 15000, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
       const code = err && typeof err.code === "number" ? err.code ?? 1 : err ? 1 : 0;
-      resolve2({
+      resolve({
         code,
         stdout: stdout ?? "",
         stderr: (stderr ?? "").slice(0, 2000)
@@ -15097,15 +15170,15 @@ async function preflightBuzz(ctx, opts) {
     detail: relayProbe.detail,
     fix: relayProbe.ok ? undefined : `start the relay, or correct --relay (${opts.relayUrl})`
   });
-  const identity2 = process.env.BUZZ_PRIVATE_KEY;
+  const identity = process.env.BUZZ_PRIVATE_KEY;
   checks.push({
-    ok: !!identity2,
+    ok: !!identity,
     label: "channel identity",
-    detail: identity2 ? "BUZZ_PRIVATE_KEY set (not shown)" : "BUZZ_PRIVATE_KEY not set",
-    fix: identity2 ? undefined : "export BUZZ_PRIVATE_KEY=<the agent's nsec> — Martha-issued identities land in #1119"
+    detail: identity ? "BUZZ_PRIVATE_KEY set (not shown)" : "BUZZ_PRIVATE_KEY not set",
+    fix: identity ? undefined : "export BUZZ_PRIVATE_KEY=<the agent's nsec> — Martha-issued identities land in #1119"
   });
-  if (identity2 && relayProbe.ok && buzzPath) {
-    checks.push(await checkMembership(buzzPath, opts.relayUrl, identity2, opts.channelId));
+  if (identity && relayProbe.ok && buzzPath) {
+    checks.push(await checkMembership(buzzPath, opts.relayUrl, identity, opts.channelId));
   } else {
     checks.push({
       ok: null,
@@ -15148,12 +15221,12 @@ async function checkAgentPrincipal(ctx, agent, def) {
     };
   }
 }
-async function checkMembership(buzzBin, relayUrl, identity2, channelId) {
+async function checkMembership(buzzBin, relayUrl, identity, channelId) {
   const label = "channel membership";
   const res = await runBin(buzzBin, ["--format", "compact", "channels", "list", "--member"], {
     ...process.env,
     BUZZ_RELAY_URL: relayUrl,
-    BUZZ_PRIVATE_KEY: identity2
+    BUZZ_PRIVATE_KEY: identity
   });
   if (res.code !== 0) {
     const why = res.code === 3 ? "the relay rejected this identity" : res.code === 2 ? "relay/network error" : `buzz exited ${res.code}`;
@@ -15190,13 +15263,13 @@ async function checkMembership(buzzBin, relayUrl, identity2, channelId) {
     fix: channels.length ? undefined : "buzz channels add-member --channel <id> --pubkey <the agent's pubkey> --role member"
   };
 }
-function emitManifest(kind, env2, opts) {
+function emitManifest(kind, env, opts) {
   const secretKeys = [
     "BUZZ_PRIVATE_KEY",
     "MARTHA_CLIENT_ID",
     "MARTHA_CLIENT_SECRET"
   ];
-  const entries = Object.entries(env2);
+  const entries = Object.entries(env);
   if (kind === "docker") {
     const lines = [
       "docker run --rm \\",
@@ -15253,8 +15326,8 @@ function assertSupportedChannel(kind) {
     throw new CLIError(`Channel type '${kind}' is not implemented.`, 4 /* Validation */, `Supported: ${SUPPORTED_CHANNELS.join(", ")}. Slack and others land as separate slices — the verb and the preflight generalize, the precondition list does not.`);
   }
 }
-function registerChannelCommands(program2) {
-  const channels = program2.command("channels").description("Put a Martha agent in an external conversation channel — from Buzz (install-harness) or from Martha (connect)");
+function registerChannelCommands(program) {
+  const channels = program.command("channels").description("Put a Martha agent in an external conversation channel — from Buzz (install-harness) or from Martha (connect)");
   channels.command("install-harness <type>").description("Register Martha as a runtime in Buzz Desktop (a tier-3 custom harness definition). " + "Desktop then owns the agent's keypair, attestation and lifecycle — we only declare how to start the adapter.").option("--app-data <dir>", "Buzz Desktop app-data dir (default: auto-detect)").option("--id <id>", "Harness id", BUZZ_HARNESS_ID).option("--label <label>", "Name shown in Buzz's runtime picker", "Martha").option("--command <bin>", "Executable Buzz should spawn", "martha").option("--use-profile <name>", "Bake MARTHA_PROFILE into the definition as the DEFAULT for every agent on this runtime, so Edit Agent needs nothing. A per-agent MARTHA_PROFILE in Edit Agent overrides it — that is how two Buzz agents become two different Martha agents. Named --use-profile because the global --profile picks which profile this COMMAND talks to.").option("--print", "Print the definition instead of writing it").option("--force", "Overwrite an existing definition").action(async (type, opts) => {
     assertSupportedChannel(type);
     const def = buzzHarnessDefinition({
@@ -15300,7 +15373,7 @@ function registerChannelCommands(program2) {
   });
   channels.command("preflight <type>").description("Check every precondition for an agent to answer in a channel, and name the one command that fixes each gap. Exits non-zero if any check fails.").requiredOption("--agent <name>", "The Martha agent that will answer").option("--relay <url>", "Relay URL", "ws://localhost:3030").option("--channel <uuid>", "Check membership of one specific channel").option("--buzz-acp-bin <path>", "buzz-acp binary", "buzz-acp").option("--buzz-bin <path>", "buzz CLI binary", "buzz").option("--martha-bin <path>", "martha binary buzz-acp will spawn", "martha").action(async (type, opts) => {
     assertSupportedChannel(type);
-    const ctx = contextFor(program2);
+    const ctx = contextFor(program);
     const checks = await preflightBuzz(ctx, {
       agent: opts.agent,
       relayUrl: opts.relay,
@@ -15318,7 +15391,7 @@ function registerChannelCommands(program2) {
     if (opts.subscribe !== "mentions" && opts.subscribe !== "all") {
       throw new CLIError(`--subscribe must be 'mentions' or 'all' (got '${opts.subscribe}').`, 4 /* Validation */);
     }
-    const ctx = contextFor(program2);
+    const ctx = contextFor(program);
     const checks = await preflightBuzz(ctx, {
       agent: opts.agent,
       relayUrl: opts.relay,
@@ -15328,20 +15401,20 @@ function registerChannelCommands(program2) {
       buzzBin: opts.buzzBin
     });
     reportPreflight(type, opts.agent, checks, opts.emit ? "stderr" : "stdout");
-    const env2 = buzzAcpEnv({
+    const env = buzzAcpEnv({
       relayUrl: opts.relay,
       subscribe: opts.subscribe,
       kinds: opts.kinds,
       multipleEventHandling: "queue",
       respondTo: opts.respondTo,
       marthaBin: opts.marthaBin,
-      profile: program2.opts().profile
+      profile: program.opts().profile
     });
     if (opts.emit) {
       if (!["docker", "compose", "k8s"].includes(opts.emit)) {
         throw new CLIError(`--emit must be docker, compose or k8s (got '${opts.emit}').`, 4 /* Validation */);
       }
-      console.log(emitManifest(opts.emit, env2, {
+      console.log(emitManifest(opts.emit, env, {
         agent: opts.agent,
         image: opts.image
       }));
@@ -15361,7 +15434,7 @@ function registerChannelCommands(program2) {
     if (opts.dryRun) {
       console.log(source_default.bold(`Would launch:
 `));
-      for (const [k, v] of Object.entries(env2))
+      for (const [k, v] of Object.entries(env))
         console.log(`  ${k}=${v}`);
       console.log(`  ${acp.path}
 `);
@@ -15371,10 +15444,10 @@ function registerChannelCommands(program2) {
 Connecting '${opts.agent}' to ${opts.relay} …
 `));
     const child = spawn3(acp.path, [], {
-      env: { ...process.env, PATH: childPath, ...env2 },
+      env: { ...process.env, PATH: childPath, ...env },
       stdio: "inherit"
     });
-    await new Promise((resolve2) => {
+    await new Promise((resolve) => {
       child.on("exit", (code, signal) => {
         if (signal) {
           console.log(source_default.dim(`
@@ -15383,21 +15456,21 @@ buzz-acp terminated by ${signal}`));
         } else if (code) {
           process.exitCode = code;
         }
-        resolve2();
+        resolve();
       });
       child.on("error", (err) => {
         console.error(source_default.red(`failed to start ${acp}: ${err.message}`));
         process.exitCode = 1 /* Error */;
-        resolve2();
+        resolve();
       });
     });
   });
 }
-function contextFor(program2) {
+function contextFor(program) {
   return createContext({
-    profileOverride: program2.opts().profile,
-    apiUrlOverride: program2.opts().apiUrl,
-    verbose: program2.opts().verbose
+    profileOverride: program.opts().profile,
+    apiUrlOverride: program.opts().apiUrl,
+    verbose: program.opts().verbose
   });
 }
 function reportPreflight(type, agent, checks, stream = "stdout") {
@@ -15458,9 +15531,9 @@ init_errors();
 import { createInterface as createInterface4 } from "node:readline";
 function prompt(rl, question, defaultValue) {
   const suffix = defaultValue ? ` [${defaultValue}]` : "";
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     rl.question(`${question}${suffix}: `, (answer) => {
-      resolve2(answer.trim() || defaultValue || "");
+      resolve(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -15704,22 +15777,22 @@ function configUse(profileName, configDir) {
   saveConfig(config, configDir);
   console.log(`Switched to profile ${source_default.cyan(profileName)}`);
 }
-function registerConfigCommand(program2) {
-  const configCmd = program2.command("config").description("Manage CLI configuration and profiles");
+function registerConfigCommand(program) {
+  const configCmd = program.command("config").description("Manage CLI configuration and profiles");
   configCmd.command("init").description("Interactive config setup").action(async () => {
     await configInit();
   });
   configCmd.command("show").description("Print current config").action(() => {
-    configShow(!!program2.opts().json, undefined, program2.opts().profile);
+    configShow(!!program.opts().json, undefined, program.opts().profile);
   });
   configCmd.command("get <key>").description("Get a config value").action((key) => {
-    configGet(key, !!program2.opts().json, undefined, program2.opts().profile);
+    configGet(key, !!program.opts().json, undefined, program.opts().profile);
   });
   configCmd.command("set <key> <value>").description("Set a config value").action((key, value) => {
-    configSet(key, value, !!program2.opts().json, undefined, program2.opts().profile);
+    configSet(key, value, !!program.opts().json, undefined, program.opts().profile);
   });
   configCmd.command("profiles").description("List all profiles").action(() => {
-    configProfiles(!!program2.opts().json);
+    configProfiles(!!program.opts().json);
   });
   configCmd.command("use <profile>").description("Switch active profile").action((profile) => {
     configUse(profile);
@@ -15743,7 +15816,7 @@ function registerConfigCommand(program2) {
       config.current_profile = name;
     }
     saveConfig(config);
-    if (program2.opts().json) {
+    if (program.opts().json) {
       console.log(JSON.stringify({
         name,
         profile,
@@ -15766,14 +15839,14 @@ function registerConfigCommand(program2) {
       if (!process.stdin.isTTY) {
         throw new CLIError("Cannot confirm in non-interactive mode.", 4 /* Validation */, "Use --yes to skip confirmation.");
       }
-      const ok = await new Promise((resolve2) => {
+      const ok = await new Promise((resolve) => {
         const rl = createInterface4({
           input: process.stdin,
           output: process.stderr
         });
         rl.question(`Delete profile '${name}'? (y/N) `, (answer) => {
           rl.close();
-          resolve2(answer.trim().toLowerCase() === "y");
+          resolve(answer.trim().toLowerCase() === "y");
         });
       });
       if (!ok) {
@@ -15787,7 +15860,7 @@ function registerConfigCommand(program2) {
       config.current_profile = remaining[0] ?? "default";
     }
     saveConfig(config);
-    if (program2.opts().json) {
+    if (program.opts().json) {
       console.log(JSON.stringify({ name, deleted: true }));
       return;
     }
@@ -16466,10 +16539,10 @@ function renderResults(results, isJson, warnings) {
 ${failed.length} failed.`));
   }
 }
-function registerDefinitionsApply(program2) {
-  let defCmd = program2.commands.find((c) => c.name() === "definitions");
+function registerDefinitionsApply(program) {
+  let defCmd = program.commands.find((c) => c.name() === "definitions");
   if (!defCmd) {
-    defCmd = program2.command("definitions").description("Cross-type definition operations");
+    defCmd = program.command("definitions").description("Cross-type definition operations");
   }
   defCmd.command("apply").description("Apply definitions from YAML/JSON files (create or update, never deletes)").requiredOption("-f, --file <path>", "Path to a YAML/JSON file or directory of definitions").option("--dry-run", "Preview changes without applying").option("--yes", "Skip confirmation prompt").addHelpText("after", `
 Examples:
@@ -16479,13 +16552,13 @@ Examples:
   $ martha definitions apply -f definitions/ --dry-run  Preview only
   $ martha definitions apply -f definitions/ --yes      Skip confirmation`).action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
-    const isJson = !!program2.opts().json;
+    const isJson = !!program.opts().json;
     const defs = loadDefinitions(opts.file);
     if (defs.length === 0) {
       if (isJson) {
@@ -16605,22 +16678,22 @@ function renderStats(stats) {
   const wf = stats.workflows;
   console.log(`Workflows: ${wf.total} total (${wf.active} active, ${wf.inactive} inactive)`);
 }
-function registerDefinitionsExport(program2) {
-  let defCmd = program2.commands.find((c) => c.name() === "definitions");
+function registerDefinitionsExport(program) {
+  let defCmd = program.commands.find((c) => c.name() === "definitions");
   if (!defCmd) {
-    defCmd = program2.command("definitions").description("Cross-type definition operations");
+    defCmd = program.command("definitions").description("Cross-type definition operations");
   }
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   defCmd.command("export").description("Export all definitions (functions and workflows)").option("--format <format>", "Output format: yaml or json (default: yaml)", "yaml").option("--output <file>", "Write to file instead of stdout").option("--inactive", "Include inactive definitions").option("--functions-only", "Export functions only").option("--workflows-only", "Export workflows only").action(async (opts) => {
     if (opts.functionsOnly && opts.workflowsOnly) {
@@ -16665,14 +16738,14 @@ function registerDefinitionsExport(program2) {
       renderPlan(ops);
     }
   });
-  const fnCmd = program2.commands.find((c) => c.name() === "functions");
+  const fnCmd = program.commands.find((c) => c.name() === "functions");
   if (fnCmd) {
     fnCmd.command("export").description("Export function definitions").option("--format <format>", "Output format: yaml or json (default: yaml)", "yaml").option("--output <file>", "Write to file instead of stdout").option("--inactive", "Include inactive definitions").action(async (opts) => {
       const ctx = getCtx();
       await exportDefinitions(ctx, { ...opts, functionsOnly: true }, isJson());
     });
   }
-  const wfCmd = program2.commands.find((c) => c.name() === "workflows");
+  const wfCmd = program.commands.find((c) => c.name() === "workflows");
   if (wfCmd) {
     wfCmd.command("export").description("Export workflow definitions").option("--format <format>", "Output format: yaml or json (default: yaml)", "yaml").option("--output <file>", "Write to file instead of stdout").option("--inactive", "Include inactive definitions").action(async (opts) => {
       const ctx = getCtx();
@@ -16891,7 +16964,7 @@ function colorStatus(status) {
   return fn(status);
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 async function pollUntilDone(ctx, executionId, intervalMs = 2000, timeoutMs = 300000) {
   const deadline = Date.now() + timeoutMs;
@@ -17301,8 +17374,8 @@ function registerProjectionCommands(parentCmd, getCtx, isJson) {
       } catch {}
     }
     if (opts.output) {
-      const fs10 = await import("node:fs/promises");
-      await fs10.writeFile(opts.output, toWrite, "utf-8");
+      const fs = await import("node:fs/promises");
+      await fs.writeFile(opts.output, toWrite, "utf-8");
       if (!isJson()) {
         console.error(source_default.dim(`Wrote ${format} projection of '${name}' to ${opts.output}`));
       }
@@ -17407,21 +17480,21 @@ var promptsConfig = {
       accessor: (item) => item.is_protected ? "yes" : "no"
     }
   ],
-  renderDetail: (prompt2) => {
-    console.log(source_default.bold(`Prompt: ${prompt2.name}
+  renderDetail: (prompt) => {
+    console.log(source_default.bold(`Prompt: ${prompt.name}
 `));
-    if (prompt2.description)
-      console.log(`  ${prompt2.description}
+    if (prompt.description)
+      console.log(`  ${prompt.description}
 `);
-    console.log(`  Scope:       ${prompt2.scope ?? "-"}`);
-    console.log(`  Protected:   ${prompt2.is_protected ? source_default.yellow("yes") : "no"}`);
-    const prod = prompt2.production;
-    const staging = prompt2.staging;
+    console.log(`  Scope:       ${prompt.scope ?? "-"}`);
+    console.log(`  Protected:   ${prompt.is_protected ? source_default.yellow("yes") : "no"}`);
+    const prod = prompt.production;
+    const staging = prompt.staging;
     console.log(`  Prod Ver:    ${prod?.version ?? "-"}`);
     console.log(`  Staging Ver: ${staging?.version ?? "-"}`);
-    if (prompt2.updated_at)
-      console.log(`  Updated:     ${prompt2.updated_at}`);
-    const content = prompt2.content;
+    if (prompt.updated_at)
+      console.log(`  Updated:     ${prompt.updated_at}`);
+    const content = prompt.content;
     if (content) {
       console.log(`
   ${source_default.bold("Content:")}`);
@@ -17656,7 +17729,7 @@ function nextSpinner() {
   return frame;
 }
 function sleep3(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function formatBytes(bytes) {
   if (bytes < 1024)
@@ -17811,19 +17884,19 @@ Detached. Check status with: martha documents status ${documentId}`));
     process.removeListener("SIGINT", sigintHandler);
   }
 }
-function registerDocumentCommands(program2) {
-  const cmd = program2.command("documents").description("Manage document collections and ingestion");
+function registerDocumentCommands(program) {
+  const cmd = program.command("documents").description("Manage document collections and ingestion");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   async function resolveCollection(ctx, ref) {
     const looksLikeUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(ref);
@@ -18423,19 +18496,19 @@ Ingestion status — source ${sourceId}`));
     }
   }
 }
-function registerDocumentSyncCommands(program2) {
-  const cmd = program2.command("document-sync").description("Manage durable document sync sources (Google Drive, etc.)");
+function registerDocumentSyncCommands(program) {
+  const cmd = program.command("document-sync").description("Manage durable document sync sources (Google Drive, etc.)");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   function printSummary(name, s) {
     const tag = s.dry_run ? source_default.yellow(" (dry-run)") : "";
@@ -18457,17 +18530,17 @@ ${name}${tag}`));
       throw new CLIError("--source and --all are mutually exclusive", 4 /* Validation */);
     }
     const params = { dry_run: String(dryRun) };
-    let sources2;
+    let sources;
     if (opts.all) {
       const all = await ctx.api.get("/api/admin/document-sync/sources", { params: { provider: "google_drive" } });
-      sources2 = all;
+      sources = all;
     } else {
-      sources2 = [
+      sources = [
         { id: opts.source, name: opts.source, provider: "google_drive" }
       ];
     }
     const results = [];
-    for (const src of sources2) {
+    for (const src of sources) {
       const summary = await ctx.api.post(`/api/admin/document-sync/sources/${encodeURIComponent(src.id)}/reconcile-tree`, undefined, { params });
       results.push(summary);
       if (!isJson())
@@ -18594,17 +18667,17 @@ No google_drive sources found.`));
 
 // src/commands/approvals.ts
 init_errors();
-function registerApprovalCommands(program2) {
-  const cmd = program2.command("approvals").description("Manage approval cases");
+function registerApprovalCommands(program) {
+  const cmd = program.command("approvals").description("Manage approval cases");
   function getCtx() {
     return createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List approval cases").option("--status <status>", "Filter by status").option("--assigned-to <user>", "Filter by assignee").option("--limit <n>", "Max results", "50").action(async (opts) => {
     const ctx = getCtx();
@@ -18690,19 +18763,19 @@ function renderAsk(a) {
   return lines.join(`
 `);
 }
-function registerAskCommands(program2) {
-  const cmd = program2.command("asks").description("Agent asks — questions/approval requests to the human queue (agent credentials)");
+function registerAskCommands(program) {
+  const cmd = program.command("asks").description("Agent asks — questions/approval requests to the human queue (agent credentials)");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("create").description("File an ask (the server attributes it to the token's agent)").requiredOption("--reason <text>", "The question / what approval is requested").option("--kind <kind>", `${KINDS.join(" | ")} (default agent_question)`, "agent_question").option("--context <text>", "Context summary for the reviewer").option("--questions <json>", "Structured questions JSON array (ask_user shape: question/header/options/multiSelect)").option("--expires-in <seconds>", "Auto-expire the ask after N seconds").option("--idempotency-key <key>", "Dedup key — retries with the same key do not double-file").action(async (opts) => {
     if (!KINDS.includes(opts.kind)) {
@@ -18824,18 +18897,18 @@ async function buildCreateTaskBody(ctx, opts) {
     body.sticky_assignment = true;
   return body;
 }
-var sleep4 = (ms, signal) => new Promise((resolve2) => {
+var sleep4 = (ms, signal) => new Promise((resolve) => {
   if (signal?.aborted) {
-    resolve2();
+    resolve();
     return;
   }
   const t = setTimeout(() => {
     signal?.removeEventListener("abort", onAbort);
-    resolve2();
+    resolve();
   }, ms);
   const onAbort = () => {
     clearTimeout(t);
-    resolve2();
+    resolve();
   };
   signal?.addEventListener("abort", onAbort, { once: true });
 });
@@ -18872,19 +18945,19 @@ var priorityColor = (priority) => {
       return priority;
   }
 };
-function registerTaskCommands(program2) {
-  const cmd = program2.command("tasks").description("Manage agent tasks");
+function registerTaskCommands(program) {
+  const cmd = program.command("tasks").description("Manage agent tasks");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List tasks").option("--status <status>", "Filter by status (open, running, completed, failed, cancelled)").option("--agent <id>", "Filter by agent definition ID").option("--priority <priority>", "Filter by priority (low, medium, high, urgent)").option("--search <query>", "Search in title and goal").option("--limit <n>", "Max results", "50").action(async (opts) => {
     const ctx = getCtx();
@@ -19298,9 +19371,9 @@ function sleepUnref(ms) {
 }
 var ACK_INTERVAL_MS = 5000;
 function startupEchoLine(who, opts) {
-  const identity2 = who ? who.kind === "agent" ? `agent ${who.agent_name ?? "?"} (${(who.agent_id ?? "").slice(0, 8)}…)` : `${who.kind} ${who.sub ?? ""}`.trim() : "identity unknown (whoami unavailable)";
+  const identity = who ? who.kind === "agent" ? `agent ${who.agent_name ?? "?"} (${(who.agent_id ?? "").slice(0, 8)}…)` : `${who.kind} ${who.sub ?? ""}`.trim() : "identity unknown (whoami unavailable)";
   const exec = opts.allowHostExec ? "host exec allowed" : "host exec refused (pass --allow-host-exec)";
-  return `[runner] attached as ${identity2} — this machine is the agent's hands (host executor; the agent reasons in Martha's cloud loop), cwd ${opts.cwd}, ${exec}`;
+  return `[runner] attached as ${identity} — this machine is the agent's hands (host executor; the agent reasons in Martha's cloud loop), cwd ${opts.cwd}, ${exec}`;
 }
 function rejectRemovedTaskModeFlags(opts) {
   const used = [
@@ -19438,13 +19511,13 @@ async function runChannelLoop(ctx, state, abort) {
     }
   }
 }
-function registerRunnerCommand(program2) {
-  program2.command("runner").description("Attach this machine as a cloud agent's hands (#714): hold the per-agent " + "channel open and execute host-tool calls the agent's Martha-hosted " + "reasoning loop parks on (chat gates and assigned-task parks). Identity " + "comes from the API token (the agent's runner key). The runner never " + "reasons and never runs tasks — self-hosted agents drive the task REST " + "(`martha tasks poll/claim/complete`) with their own code.").option("--tools", "Accepted no-op: hands mode is the only mode (kept so printed " + "setup-host-runner commands stay valid).").option("--cwd <dir>", "Scoped workspace for host execution", process.cwd()).option("--allow-host-exec", "Consent to run host commands (required to execute)").option("--yes", "Deprecated alias for --allow-host-exec").option("--local-agent <name>", "Local coding agent for local_agent delegation over the channel", DEFAULT_LOCAL_AGENT).option("--tasks", "REMOVED (#714): the runner no longer runs tasks").option("--channel", "REMOVED (#714): deprecated pre-#822 alias").option("--once", "REMOVED (#714): belonged to the task-executor mode").option("--team <name>", "REMOVED (#714): belonged to the task-executor mode").option("--agent <id>", "REMOVED (#714): identity comes from the API token").option("--poll-interval <ms>", "REMOVED (#714): the runner no longer polls").action(async (opts) => {
+function registerRunnerCommand(program) {
+  program.command("runner").description("Attach this machine as a cloud agent's hands (#714): hold the per-agent " + "channel open and execute host-tool calls the agent's Martha-hosted " + "reasoning loop parks on (chat gates and assigned-task parks). Identity " + "comes from the API token (the agent's runner key). The runner never " + "reasons and never runs tasks — self-hosted agents drive the task REST " + "(`martha tasks poll/claim/complete`) with their own code.").option("--tools", "Accepted no-op: hands mode is the only mode (kept so printed " + "setup-host-runner commands stay valid).").option("--cwd <dir>", "Scoped workspace for host execution", process.cwd()).option("--allow-host-exec", "Consent to run host commands (required to execute)").option("--yes", "Deprecated alias for --allow-host-exec").option("--local-agent <name>", "Local coding agent for local_agent delegation over the channel", DEFAULT_LOCAL_AGENT).option("--tasks", "REMOVED (#714): the runner no longer runs tasks").option("--channel", "REMOVED (#714): deprecated pre-#822 alias").option("--once", "REMOVED (#714): belonged to the task-executor mode").option("--team <name>", "REMOVED (#714): belonged to the task-executor mode").option("--agent <id>", "REMOVED (#714): identity comes from the API token").option("--poll-interval <ms>", "REMOVED (#714): the runner no longer polls").action(async (opts) => {
     rejectRemovedTaskModeFlags(opts);
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose,
-      apiUrlOverride: program2.opts().apiUrl
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose,
+      apiUrlOverride: program.opts().apiUrl
     });
     const allowHostExec = !!(opts.allowHostExec || opts.yes);
     let who;
@@ -19483,19 +19556,19 @@ function registerRunnerCommand(program2) {
 init_errors();
 var API_PATH3 = "/api/admin/teams";
 var fmtDate3 = (v) => typeof v === "string" ? new Date(v).toISOString().slice(0, 16).replace("T", " ") : "-";
-function registerTeamCommands(program2) {
-  const cmd = program2.command("teams").description("Manage agent teams");
+function registerTeamCommands(program) {
+  const cmd = program.command("teams").description("Manage agent teams");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("create").description("Create a new team").requiredOption("--name <name>", "Team name").option("--description <text>", "Team description").option("--routing <strategy>", "Routing strategy (manual or round_robin)", "manual").action(async (opts) => {
     const ctx = getCtx();
@@ -19660,19 +19733,19 @@ function healthColor(status) {
       return source_default.dim(status);
   }
 }
-function registerIntegrationCommands(program2) {
-  const cmd = program2.command("integrations").description("Manage integrations and OpenAPI specs");
+function registerIntegrationCommands(program) {
+  const cmd = program.command("integrations").description("Manage integrations and OpenAPI specs");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List all integrations").action(async () => {
     const ctx = getCtx();
@@ -19811,12 +19884,12 @@ ${data.length} spec(s)`));
     const created = result.created ?? [];
     const updated = result.updated ?? [];
     const skipped = result.skipped ?? [];
-    const errors2 = result.errors ?? [];
+    const errors = result.errors ?? [];
     console.log(`  Created: ${source_default.green(created.length)}  ` + `Updated: ${source_default.yellow(updated.length)}  ` + `Skipped: ${source_default.dim(skipped.length)}`);
-    if (errors2.length > 0) {
+    if (errors.length > 0) {
       console.log(source_default.red(`
-  Errors (${errors2.length}):`));
-      for (const err of errors2) {
+  Errors (${errors.length}):`));
+      for (const err of errors) {
         console.log(source_default.red(`    - ${err}`));
       }
     }
@@ -19885,11 +19958,11 @@ ${data.length} spec(s)`));
         console.log(source_default.yellow(`    - ${w}`));
       }
     }
-    const errors2 = result.errors ?? [];
-    if (errors2.length > 0) {
+    const errors = result.errors ?? [];
+    if (errors.length > 0) {
       console.log(source_default.red(`
-  Errors (${errors2.length}):`));
-      for (const e of errors2) {
+  Errors (${errors.length}):`));
+      for (const e of errors) {
         console.log(source_default.red(`    - ${e}`));
       }
     }
@@ -19971,8 +20044,8 @@ ${data.length} spec(s)`));
 Resources:
 `));
       for (const r of resources) {
-        const path9 = r.path || `/${r.name}`;
-        console.log(`  ${source_default.cyan(r.label || r.name)}` + source_default.dim(` → ${path9}`));
+        const path = r.path || `/${r.name}`;
+        console.log(`  ${source_default.cyan(r.label || r.name)}` + source_default.dim(` → ${path}`));
       }
     }
     try {
@@ -19992,14 +20065,14 @@ Functions:
     console.log(source_default.dim(`
 Proxy: martha integrations proxy ${name} GET /<path>`));
   });
-  cmd.command("proxy <name> <method> <path>").description("Send a request through the plugin proxy").option("--data <json>", "JSON request body").option("--query <params>", "Query params as key=val&key=val").action(async (name, method, path9, opts) => {
+  cmd.command("proxy <name> <method> <path>").description("Send a request through the plugin proxy").option("--data <json>", "JSON request body").option("--query <params>", "Query params as key=val&key=val").action(async (name, method, path, opts) => {
     const ctx = getCtx();
     const upperMethod = method.toUpperCase();
     const allowed = new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
     if (!allowed.has(upperMethod)) {
       throw new CLIError(`Invalid method: ${method}`, 4 /* Validation */, "Allowed: GET, POST, PUT, PATCH, DELETE");
     }
-    const cleanPath = path9.startsWith("/") ? path9.slice(1) : path9;
+    const cleanPath = path.startsWith("/") ? path.slice(1) : path;
     const proxyUrl = `/api/admin/plugins/${encodeURIComponent(name)}/${cleanPath}`;
     const params = {};
     if (opts.query) {
@@ -20059,17 +20132,17 @@ function renderTable(columns, items, opts) {
 
 // src/commands/connections.ts
 init_errors();
-function registerConnectionCommands(program2) {
-  const cmd = program2.command("connections").description("Manage Vault-backed integration connections (credentials live in Vault)");
+function registerConnectionCommands(program) {
+  const cmd = program.command("connections").description("Manage Vault-backed integration connections (credentials live in Vault)");
   function getCtx() {
     return createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List connections for the current tenant").option("--integration <name>", "Filter by integration name").option("--scope <scope>", "Filter by scope (tenant|client|system)").action(async (opts) => {
     const ctx = getCtx();
@@ -20210,8 +20283,8 @@ async function resolveCredentialValue(value) {
   if (value === "-")
     return readStdin();
   if (value.startsWith("@")) {
-    const fs11 = await import("node:fs/promises");
-    return (await fs11.readFile(value.slice(1), "utf-8")).trim();
+    const fs = await import("node:fs/promises");
+    return (await fs.readFile(value.slice(1), "utf-8")).trim();
   }
   return value;
 }
@@ -20246,19 +20319,19 @@ async function readStdin() {
 
 // src/commands/notifications.ts
 var CHANNEL_IDS = new Set(["resend", "slack_webhook", "webhook"]);
-function registerNotificationCommands(program2) {
-  const cmd = program2.command("notifications").description("Manage notification channels (email/Slack/webhook) — issue #116");
+function registerNotificationCommands(program) {
+  const cmd = program.command("notifications").description("Manage notification channels (email/Slack/webhook) — issue #116");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("channels").description("List available notification channel types").action(async () => {
     const ctx = getCtx();
@@ -20326,8 +20399,8 @@ Notification connections`));
     if (credentialValue === "-") {
       credentialValue = await readStdin2();
     } else if (credentialValue?.startsWith("@")) {
-      const fs11 = await import("node:fs/promises");
-      credentialValue = await fs11.readFile(credentialValue.slice(1), "utf-8");
+      const fs = await import("node:fs/promises");
+      credentialValue = await fs.readFile(credentialValue.slice(1), "utf-8");
     }
     if (!credentialValue) {
       throw new Error("--credential-value is required (use '-' for stdin or '@path' for file).");
@@ -20377,11 +20450,11 @@ async function readStdin2() {
 
 // src/commands/messaging.ts
 init_errors();
-async function messagingFetch(baseUrl, path9, opts) {
-  if (/^(https?:)?\/\//i.test(path9)) {
+async function messagingFetch(baseUrl, path, opts) {
+  if (/^(https?:)?\/\//i.test(path)) {
     throw new CLIError("Absolute URL paths are not allowed", 1 /* Error */);
   }
-  const url = new URL(path9, baseUrl);
+  const url = new URL(path, baseUrl);
   const headers = {
     "Content-Type": "application/json"
   };
@@ -20407,19 +20480,19 @@ async function messagingFetch(baseUrl, path9, opts) {
   }
   return res.json();
 }
-function registerMessagingCommands(program2) {
-  const cmd = program2.command("messaging").description("Messaging provider commands (SMS, WhatsApp)");
+function registerMessagingCommands(program) {
+  const cmd = program.command("messaging").description("Messaging provider commands (SMS, WhatsApp)");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("health").description("Check messaging provider health").action(async () => {
     const ctx = getCtx();
@@ -20679,7 +20752,7 @@ function renderSnippet(options) {
       return renderEsmSnippet(options);
   }
 }
-function parseKeyValueFlags(items, allowedKeys, label, parser2) {
+function parseKeyValueFlags(items, allowedKeys, label, parser) {
   const result = {};
   for (const item of items ?? []) {
     const idx = item.indexOf("=");
@@ -20694,7 +20767,7 @@ function parseKeyValueFlags(items, allowedKeys, label, parser2) {
     if (!allowedKeys.includes(key)) {
       throw new CLIError(`Unsupported ${label} key: ${key}`, 4 /* Validation */, `Allowed keys: ${allowedKeys.join(", ")}`);
     }
-    result[key] = parser2(value);
+    result[key] = parser(value);
   }
   return result;
 }
@@ -20907,12 +20980,12 @@ function formatDate(val) {
 function clientKey(c) {
   return String(c.client_key ?? c.keycloak_client_id ?? "-");
 }
-function setClientKeyPayload(body, clientKey2, keycloakClientId) {
-  if (clientKey2 && keycloakClientId && clientKey2 !== keycloakClientId) {
+function setClientKeyPayload(body, clientKey, keycloakClientId) {
+  if (clientKey && keycloakClientId && clientKey !== keycloakClientId) {
     throw new CLIError("--client-key and --keycloak-client-id must match when both are provided.", 4 /* Validation */, "Use --client-key for new commands; --keycloak-client-id is deprecated.");
   }
-  if (clientKey2)
-    body.client_key = clientKey2;
+  if (clientKey)
+    body.client_key = clientKey;
   if (keycloakClientId)
     body.keycloak_client_id = keycloakClientId;
 }
@@ -21021,17 +21094,17 @@ async function revokeEmbedCredentials(ctx, clientId) {
   return ctx.api.del(`${API}/${clientId}/embed-credentials`);
 }
 async function createEmbedCredentialApi(ctx, credentials) {
-  const [{ MarthaAPIClient: MarthaAPIClient2 }, { loginClientCredentials: loginClientCredentials2 }] = await Promise.all([
+  const [{ MarthaAPIClient }, { loginClientCredentials }] = await Promise.all([
     Promise.resolve().then(() => (init_api_client(), exports_api_client)),
     Promise.resolve().then(() => (init_client_credentials(), exports_client_credentials))
   ]);
-  const tokens = await loginClientCredentials2({
+  const tokens = await loginClientCredentials({
     keycloakUrl: ctx.profile.keycloak_url,
     realm: ctx.profile.keycloak_realm,
     clientId: credentials.service_account_client_id,
     clientSecret: credentials.client_secret
   });
-  return new MarthaAPIClient2({
+  return new MarthaAPIClient({
     baseUrl: ctx.profile.api_url,
     getAccessToken: async () => tokens.access_token
   });
@@ -21043,20 +21116,20 @@ async function grantAccess(ctx, clientId, type, defName) {
   const body = type === "function" ? { function_id: defId } : type === "workflow" ? { workflow_id: defId } : { agent_name: defId };
   await ctx.api.post(endpoint, body);
 }
-function registerClientCommands(program2) {
-  const cmd = program2.command("clients").description("Manage chat clients and access control");
+function registerClientCommands(program) {
+  const cmd = program.command("clients").description("Manage chat clients and access control");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List clients").option("--limit <n>", "Max results", "50").action(async (opts) => {
     const ctx = getCtx();
@@ -21475,10 +21548,10 @@ Embed-token mode needs backend credentials. Provision them with:
     let tempCredentials;
     try {
       if (opts.createTempClient) {
-        const key2 = `cli-smoke-${Date.now()}`;
+        const key = `cli-smoke-${Date.now()}`;
         client = await ctx.api.post(API, {
           name: `CLI Smoke ${Date.now()}`,
-          client_key: key2,
+          client_key: key,
           embed_enabled: true,
           embed_allowed_origins: [origin],
           embed_default_mode: "launcher",
@@ -21614,16 +21687,16 @@ ${rows.length} grant(s)`));
 }
 
 // src/commands/models.ts
-function registerModelsCommand(program2) {
-  program2.command("models").description("List available LLM models").option("--provider <name>", "Filter by provider (e.g. anthropic, openai)").action(async (opts) => {
+function registerModelsCommand(program) {
+  program.command("models").description("List available LLM models").option("--provider <name>", "Filter by provider (e.g. anthropic, openai)").action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
-    const isJson = !!program2.opts().json;
+    const isJson = !!program.opts().json;
     const params = new URLSearchParams;
     if (opts.provider)
       params.set("provider", opts.provider.toLowerCase());
@@ -21671,20 +21744,20 @@ ${models.length} models`));
 
 // src/commands/spend.ts
 init_errors();
-var GROUPINGS = ["day", "agent", "model", "surface", "billing_owner"];
+var GROUPINGS = ["day", "agent", "model", "surface", "billing_owner", "client"];
 function usd(value) {
   return value == null ? "-" : `$${Number(value).toFixed(4)}`;
 }
-function registerSpendCommand(program2) {
-  program2.command("spend").description("LLM spend for a tenant, from Martha's own ledger").option("--tenant <id>", "Tenant (defaults to your own; others need super-admin)").option("--group-by <dim>", `One of: ${GROUPINGS.join(", ")}`, "day").option("--since <YYYY-MM-DD>", "Inclusive UTC start day").option("--until <YYYY-MM-DD>", "Exclusive UTC end day").action(async (opts) => {
+function registerSpendCommand(program) {
+  program.command("spend").description("LLM spend for a tenant, from Martha's own ledger").option("--tenant <id>", "Tenant (defaults to your own; others need super-admin)").option("--group-by <dim>", `One of: ${GROUPINGS.join(", ")}`, "day").option("--since <YYYY-MM-DD>", "Inclusive UTC start day").option("--until <YYYY-MM-DD>", "Exclusive UTC end day").action(async (opts) => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
-    const isJson = !!program2.opts().json;
+    const isJson = !!program.opts().json;
     if (!GROUPINGS.includes(opts.groupBy)) {
       throw new CLIError(`--group-by must be one of: ${GROUPINGS.join(", ")}`, 4 /* Validation */);
     }
@@ -21730,27 +21803,34 @@ ${data.tenant_id}: ${t.calls} calls, ${usd(t.cost_usd)}` + (t.unpriced_calls ? `
 init_errors();
 var PERIODS = ["day", "month"];
 var ACTIONS = ["warn", "require_approval", "block"];
+function budgetScope(b) {
+  const agent = b.agent_id ? `agent ${b.agent_name ?? b.agent_id}` : null;
+  const client = b.client_id ? `client ${b.client_name ?? b.client_id}` : null;
+  if (agent && client)
+    return `${agent} via ${client}`;
+  return agent ?? client ?? "tenant";
+}
 function oneOf(value, allowed, flag) {
   if (!allowed.includes(value)) {
     throw new CLIError(`${flag} must be one of: ${allowed.join(", ")}`, 4 /* Validation */);
   }
 }
-function registerBudgetCommands(program2) {
-  const budget = program2.command("budget").description("LLM spend ceilings for a tenant");
+function registerBudgetCommands(program) {
+  const budget = program.command("budget").description("LLM spend ceilings for a tenant");
   const context = () => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   };
-  const path9 = async (ctx, tenant) => `/api/admin/tenants/${encodeURIComponent(tenant ?? await ctx.getTenantId())}/llm-budgets`;
+  const path = async (ctx, tenant) => `/api/admin/tenants/${encodeURIComponent(tenant ?? await ctx.getTenantId())}/llm-budgets`;
   budget.command("list").description("List the tenant's ceilings").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
     const ctx = context();
-    const data = await ctx.api.get(await path9(ctx, opts.tenant));
-    if (program2.opts().json) {
+    const data = await ctx.api.get(await path(ctx, opts.tenant));
+    if (program.opts().json) {
       console.log(JSON.stringify(data, null, 2));
       return;
     }
@@ -21759,33 +21839,36 @@ function registerBudgetCommands(program2) {
       return;
     }
     for (const b of data.budgets) {
-      const scope = b.agent_id ? `agent ${b.agent_id}` : "tenant";
-      console.log(`${b.id}  ${scope.padEnd(42)} ${b.period.padEnd(6)} $${b.limit_usd}  ${b.action}`);
+      console.log(`${b.id}  ${budgetScope(b).padEnd(42)} ${b.period.padEnd(6)} $${b.limit_usd}  ${b.action}`);
     }
   });
-  budget.command("set").description("Create or replace a ceiling (one per tenant-or-agent + period)").requiredOption("--period <p>", `One of: ${PERIODS.join(", ")}`).requiredOption("--limit <usd>", "Ceiling in USD (cache reads included)").requiredOption("--action <a>", `One of: ${ACTIONS.join(", ")}`).option("--agent <uuid>", "Scope to one AI Agent (default: whole tenant)").option("--note <text>", "Why this ceiling exists").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
+  budget.command("set").description("Create or replace a ceiling (one per scope + period)").requiredOption("--period <p>", `One of: ${PERIODS.join(", ")}`).requiredOption("--limit <usd>", "Ceiling in USD (cache reads included)").requiredOption("--action <a>", `One of: ${ACTIONS.join(", ")}`).option("--agent <uuid>", "Narrow to one AI Agent (default: whole tenant)").option("--client <id>", "Narrow to one API Client (with --agent: that agent within it)").option("--note <text>", "Why this ceiling exists").option("--tenant <id>", "Tenant (defaults to your own)").action(async (opts) => {
     oneOf(opts.period, PERIODS, "--period");
     oneOf(opts.action, ACTIONS, "--action");
     if (!/^\d+(\.\d{1,4})?$/.test(opts.limit)) {
       throw new CLIError("--limit must be a non-negative USD amount", 4 /* Validation */);
     }
+    if (opts.client !== undefined && !/^[1-9]\d*$/.test(opts.client)) {
+      throw new CLIError("--client must be an API Client id (a positive integer)", 4 /* Validation */);
+    }
     const ctx = context();
-    const saved = await ctx.api.put(await path9(ctx, opts.tenant), {
+    const saved = await ctx.api.put(await path(ctx, opts.tenant), {
       period: opts.period,
       limit_usd: opts.limit,
       action: opts.action,
       agent_id: opts.agent ?? null,
+      client_id: opts.client !== undefined ? Number(opts.client) : null,
       note: opts.note ?? null
     });
-    if (program2.opts().json)
+    if (program.opts().json)
       console.log(JSON.stringify(saved, null, 2));
     else
       console.log(`${saved.id}  ${saved.period} $${saved.limit_usd} -> ${saved.action}`);
   });
   budget.command("rm <budgetId>").description("Delete a ceiling").option("--tenant <id>", "Tenant (defaults to your own)").action(async (budgetId, opts) => {
     const ctx = context();
-    await ctx.api.del(`${await path9(ctx, opts.tenant)}/${encodeURIComponent(budgetId)}`);
-    if (program2.opts().json)
+    await ctx.api.del(`${await path(ctx, opts.tenant)}/${encodeURIComponent(budgetId)}`);
+    if (program.opts().json)
       console.log(JSON.stringify({ deleted: budgetId }));
     else
       console.log(`deleted ${budgetId}`);
@@ -21830,19 +21913,19 @@ function parseCollectionRefs(csv) {
     return [];
   return csv.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
-function registerWikiCommands(program2) {
-  const cmd = program2.command("wiki").description("Manage wikis: list/create/delete wikis, browse pages, search, schema, settings (#631)");
+function registerWikiCommands(program) {
+  const cmd = program.command("wiki").description("Manage wikis: list/create/delete wikis, browse pages, search, schema, settings (#631)");
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("list").description("List the tenant's wikis (only those you can see)").action(async () => {
     const ctx = getCtx();
@@ -21942,16 +22025,16 @@ ${wikis.length} wiki${wikis.length === 1 ? "" : "s"}`));
     console.log(source_default.dim(`
 ${pages.length} pages`));
   });
-  cmd.command("get <path>").description("Fetch the raw markdown body of a wiki page").option("--wiki <slug>", "Wiki slug (default: the tenant default wiki)").option("--out <file>", "Write body to file instead of stdout").action(async (path9, opts) => {
+  cmd.command("get <path>").description("Fetch the raw markdown body of a wiki page").option("--wiki <slug>", "Wiki slug (default: the tenant default wiki)").option("--out <file>", "Write body to file instead of stdout").action(async (path, opts) => {
     const ctx = getCtx();
-    const safe = path9.split("/").map(encodeURIComponent).join("/");
+    const safe = path.split("/").map(encodeURIComponent).join("/");
     const slug = encodeURIComponent(opts.wiki ?? DEFAULT_WIKI_SLUG);
     const endpoint = `/api/wiki/${slug}/pages/${safe}`;
     const resp = await ctx.api.getRaw(endpoint, {
       headers: { Accept: "text/markdown,*/*" }
     });
     if (resp.status === 404) {
-      throw new CLIError(`page not found: ${path9}`, 3 /* NotFound */);
+      throw new CLIError(`page not found: ${path}`, 3 /* NotFound */);
     }
     if (!resp.ok) {
       const detail = await resp.text();
@@ -21963,12 +22046,12 @@ ${pages.length} pages`));
       if (!isJson()) {
         console.log(source_default.dim(`wrote ${body.length} bytes to ${opts.out}`));
       } else {
-        console.log(JSON.stringify({ path: path9, bytes: body.length, file: opts.out }));
+        console.log(JSON.stringify({ path, bytes: body.length, file: opts.out }));
       }
       return;
     }
     if (isJson()) {
-      console.log(JSON.stringify({ path: path9, body, etag: resp.headers.get("ETag") }));
+      console.log(JSON.stringify({ path, body, etag: resp.headers.get("ETag") }));
     } else {
       process.stdout.write(body);
     }
@@ -22145,17 +22228,17 @@ ${pages.length} pages`));
 
 // src/commands/mcp.ts
 init_errors();
-function registerMCPCommands(program2) {
-  const cmd = program2.command("mcp").description("Discover and call MCP tools");
+function registerMCPCommands(program) {
+  const cmd = program.command("mcp").description("Discover and call MCP tools");
   function getCtx() {
     return createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
   }
   function isJson() {
-    return !!program2.opts().json;
+    return !!program.opts().json;
   }
   cmd.command("discover").description("Discover tools from an MCP server").option("--url <serverUrl>", "Direct MCP Streamable HTTP URL").option("--connection <connectionId>", "Martha connection UUID").option("--connection-ref <connectionRef>", "Martha connection reference").option("--force-refresh", "Bypass cached discovery").action(async (opts) => {
     const ctx = getCtx();
@@ -22449,7 +22532,7 @@ async function pollConnectionActive(ctx, connectionId) {
     });
     if (conn?.status === "active")
       return;
-    await new Promise((resolve2) => setTimeout(resolve2, intervalMs));
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
   }
   throw new CLIError(`Timed out waiting for OAuth authorization (${Math.round(timeoutMs / 1000)}s).`, 1 /* Error */, "The browser consent may not have completed. Re-run to try again, or check " + "the connection status in the admin UI.");
 }
@@ -22511,7 +22594,7 @@ async function pollExecution(ctx, executionId, timeoutMs) {
     if (["completed", "failed", "cancelled", "timeout"].includes(last.status)) {
       return last;
     }
-    await new Promise((resolve2) => setTimeout(resolve2, 1000));
+    await new Promise((resolve) => setTimeout(resolve, 1000));
   }
   throw new CLIError(`Timed out waiting for MCP workflow execution ${executionId}`, 1 /* Error */, last ? `Last status: ${last.status}` : undefined);
 }
@@ -22639,8 +22722,8 @@ async function resolveCredentialFlag(value) {
     return Buffer.concat(chunks).toString("utf-8").trim();
   }
   if (value.startsWith("@")) {
-    const fs12 = await import("node:fs/promises");
-    return (await fs12.readFile(value.slice(1), "utf-8")).trim();
+    const fs = await import("node:fs/promises");
+    return (await fs.readFile(value.slice(1), "utf-8")).trim();
   }
   return value;
 }
@@ -22656,16 +22739,16 @@ function assertOneOf(value, allowed, flag) {
     throw new CLIError(`${flag} must be one of: ${allowed.join(", ")}`, 4 /* Validation */);
   }
 }
-function registerPolicyCommands(program2) {
-  const cmd = program2.command("policy").description("Manage the tenant's invoke-time capability policy");
+function registerPolicyCommands(program) {
+  const cmd = program.command("policy").description("Manage the tenant's invoke-time capability policy");
   function getCtx() {
     return createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
   }
-  const isJson = () => !!program2.opts().json;
+  const isJson = () => !!program.opts().json;
   cmd.command("show").description("Show the current policy: settings + rules").action(async () => {
     const ctx = getCtx();
     const cfg = await ctx.api.get("/api/admin/policy");
@@ -22778,11 +22861,11 @@ var BASE = "/api/admin/agent-step/trust-roots";
 var FLEET_BASE = "/api/admin/agent-step/fleet";
 function resolveKeyMaterial(value) {
   if (value.startsWith("@")) {
-    const path9 = value.slice(1);
+    const path = value.slice(1);
     try {
-      return readFileSync3(path9, "utf8").trim();
+      return readFileSync3(path, "utf8").trim();
     } catch (e) {
-      throw new CLIError(`Could not read public key file '${path9}': ${e.message}`, 4 /* Validation */);
+      throw new CLIError(`Could not read public key file '${path}': ${e.message}`, 4 /* Validation */);
     }
   }
   return value;
@@ -22805,17 +22888,17 @@ function printOne(tr) {
   if (tr.updated_at)
     console.log(`  Updated:      ${tr.updated_at}`);
 }
-function registerAgentStepCommands(program2) {
-  const cmd = program2.command("agent-step").description("Author agent_step assets (execution_proof trust roots)");
+function registerAgentStepCommands(program) {
+  const cmd = program.command("agent-step").description("Author agent_step assets (execution_proof trust roots)");
   const roots = cmd.command("trust-roots").description("Manage per-tenant/per-runner attestation trust roots (#1083)");
   function getCtx() {
     return createContext({
-      profileOverride: program2.opts().profile,
-      apiUrlOverride: program2.opts().apiUrl,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      apiUrlOverride: program.opts().apiUrl,
+      verbose: program.opts().verbose
     });
   }
-  const isJson = () => !!program2.opts().json;
+  const isJson = () => !!program.opts().json;
   roots.command("list").description("List the tenant's trust roots").action(async () => {
     const ctx = getCtx();
     const rows = await ctx.api.get(BASE);
@@ -23134,21 +23217,21 @@ var DEFAULT_ENTITY = "document_collection";
 var DEFAULT_ACTION = "read";
 var APPROVAL_ENTITY = "approval";
 var RESOLVE_ACTION = "resolve";
-function registerAuthzCommands(program2) {
+function registerAuthzCommands(program) {
   function getCtx() {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl)
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl)
+      ctx.profile.api_url = program.opts().apiUrl;
     return ctx;
   }
-  const isJson = () => !!program2.opts().json;
-  registerCollections(program2, getCtx, isJson);
-  registerAccess(program2, getCtx, isJson);
-  registerGroups(program2, getCtx, isJson);
-  registerApprovers(program2, getCtx, isJson);
+  const isJson = () => !!program.opts().json;
+  registerCollections(program, getCtx, isJson);
+  registerAccess(program, getCtx, isJson);
+  registerGroups(program, getCtx, isJson);
+  registerApprovers(program, getCtx, isJson);
 }
 function renderGrantsTable(resp) {
   if (resp.grants.length === 0) {
@@ -23163,8 +23246,8 @@ function renderGrantsTable(resp) {
 ` + lines.join(`
 `);
 }
-function registerCollections(program2, getCtx, isJson) {
-  const cmd = program2.command("collections").description("Manage who can read a document collection (UMS authz)");
+function registerCollections(program, getCtx, isJson) {
+  const cmd = program.command("collections").description("Manage who can read a document collection (UMS authz)");
   cmd.command("grant <collection>").description("Grant read access on a collection to a principal").requiredOption("--to <type:id>", "user|client|agent|group:<id>").option("--action <action>", "Action to grant", DEFAULT_ACTION).option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (collection, opts) => {
     const ctx = getCtx();
     const json = isJson();
@@ -23234,8 +23317,8 @@ function registerCollections(program2, getCtx, isJson) {
     }
   });
 }
-function registerAccess(program2, getCtx, isJson) {
-  const cmd = program2.command("access").description("Generic two-axis grant management (any entity type)");
+function registerAccess(program, getCtx, isJson) {
+  const cmd = program.command("access").description("Generic two-axis grant management (any entity type)");
   cmd.command("grant").description("Grant access to a principal on an entity/object").requiredOption("--to <type:id>", "user|client|agent|group:<id>").option("--entity <entity_type>", "Entity type", DEFAULT_ENTITY).option("--object <id>", "Object id (omit for a tenant-root see-all grant)").option("--action <action>", "Action", DEFAULT_ACTION).option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (opts) => {
     const ctx = getCtx();
     const json = isJson();
@@ -23309,8 +23392,8 @@ function registerAccess(program2, getCtx, isJson) {
     }
   });
 }
-function registerGroups(program2, getCtx, isJson) {
-  const cmd = program2.command("groups").description("Manage UMS-native authz groups (#644)");
+function registerGroups(program, getCtx, isJson) {
+  const cmd = program.command("groups").description("Manage UMS-native authz groups (#644)");
   cmd.command("create <name>").description("Create a group").option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (name, opts) => {
     const ctx = getCtx();
     const json = isJson();
@@ -23406,8 +23489,8 @@ function registerGroups(program2, getCtx, isJson) {
     }
   });
 }
-function registerApprovers(program2, getCtx, isJson) {
-  const cmd = program2.command("approvers").description("Manage who may resolve approval cases in the tenant (UMS approval/resolve). " + "Noun-first sugar over `access` on the approval entity.");
+function registerApprovers(program, getCtx, isJson) {
+  const cmd = program.command("approvers").description("Manage who may resolve approval cases in the tenant (UMS approval/resolve). " + "Noun-first sugar over `access` on the approval entity.");
   cmd.command("add <group>").description("Make a group a tenant approver (its members can resolve approvals)").option("--tenant <tenant>", "Target tenant (super-admin only)").action(async (group, opts) => {
     const ctx = getCtx();
     const json = isJson();
@@ -23834,8 +23917,8 @@ async function askIntents() {
   });
   return parseIntents2(raw);
 }
-function registerInitCommand(program2) {
-  program2.command("init").description("Create or update a profile, and optionally bootstrap an access principal").option("--preset <name>", "Preset: cloud or local", "cloud").option("--name <name>", "Profile name (defaults to preset name)").option("--force", "Overwrite an existing profile").option("--api-url <url>", "Override the API URL").option("--keycloak-url <url>", "Override the Keycloak URL").option("--keycloak-realm <realm>", "Override the Keycloak realm").option("--no-interactive", "Skip prompts; use defaults / overrides only").option("--bootstrap", "Provision an intent-scoped principal + grants after saving the profile").option("--mode <mode>", "Bootstrap mode: 'human' (your own client) or 'integration' (service account)").option("--intent <intents...>", "Usage buckets to grant: rag, documents, workflows, custom").option("--workflow <names...>", "Workflow name(s) to grant (workflows/custom intent)").option("--function <names...>", "Extra function name(s) to grant (custom intent)").option("--label <name>", "Integration mode: label for the SA client id").option("--agent", "Also provision a personal chat copilot (human mode) and set it as the default").option("--agent-name <name>", "Copilot agent name (defaults to copilot-{user})").option("--model <id>", "Copilot LLM model id (defaults to the platform default)").option("--host-runner", "Also set the copilot up to run host tools on THIS machine (mints a runner key + prints the `martha runner` command)").option("--yes", "Acknowledge non-interactive bootstrap side effects").action(async (opts, command) => {
+function registerInitCommand(program) {
+  program.command("init").description("Create or update a profile, and optionally bootstrap an access principal").option("--preset <name>", "Preset: cloud or local", "cloud").option("--name <name>", "Profile name (defaults to preset name)").option("--force", "Overwrite an existing profile").option("--api-url <url>", "Override the API URL").option("--keycloak-url <url>", "Override the Keycloak URL").option("--keycloak-realm <realm>", "Override the Keycloak realm").option("--no-interactive", "Skip prompts; use defaults / overrides only").option("--bootstrap", "Provision an intent-scoped principal + grants after saving the profile").option("--mode <mode>", "Bootstrap mode: 'human' (your own client) or 'integration' (service account)").option("--intent <intents...>", "Usage buckets to grant: rag, documents, workflows, custom").option("--workflow <names...>", "Workflow name(s) to grant (workflows/custom intent)").option("--function <names...>", "Extra function name(s) to grant (custom intent)").option("--label <name>", "Integration mode: label for the SA client id").option("--agent", "Also provision a personal chat copilot (human mode) and set it as the default").option("--agent-name <name>", "Copilot agent name (defaults to copilot-{user})").option("--model <id>", "Copilot LLM model id (defaults to the platform default)").option("--host-runner", "Also set the copilot up to run host tools on THIS machine (mints a runner key + prints the `martha runner` command)").option("--yes", "Acknowledge non-interactive bootstrap side effects").action(async (opts, command) => {
     const globals = command.parent?.opts() ?? {};
     await initCommand({ ...opts, json: !!globals.json });
   });
@@ -23843,11 +23926,18 @@ function registerInitCommand(program2) {
 
 // src/commands/doctor.ts
 var FETCH_TIMEOUT_MS = 5000;
-function resolveApiUrl(base, path9) {
-  return new URL(path9, base).toString();
+function resolveApiUrl(base, path) {
+  return new URL(path, base).toString();
+}
+function authHeaders(ctx, token) {
+  const tenant = ctx.tenantFor(token);
+  return {
+    Authorization: `Bearer ${token}`,
+    ...tenant ? { "X-Martha-Tenant": tenant } : {}
+  };
 }
-function apiUrl(ctx, path9) {
-  return resolveApiUrl(ctx.profile.api_url, path9);
+function apiUrl(ctx, path) {
+  return resolveApiUrl(ctx.profile.api_url, path);
 }
 async function fetchJSON(url, init) {
   const res = await fetch(url, {
@@ -24002,7 +24092,7 @@ async function checkAuthenticatedRequest(ctx) {
   const url = apiUrl(ctx, "/api/admin/definitions/agents");
   try {
     const { ok, status } = await fetchJSON(url, {
-      headers: { Authorization: `Bearer ${tokens.access_token}` }
+      headers: authHeaders(ctx, tokens.access_token)
     });
     if (ok) {
       return { name: "API auth", status: "pass", detail: "token accepted" };
@@ -24047,7 +24137,7 @@ async function checkHostRunners(ctx) {
   const url = apiUrl(ctx, "/api/admin/definitions/agents/runner-presence");
   try {
     const { ok, status, json } = await fetchJSON(url, {
-      headers: { Authorization: `Bearer ${tokens.access_token}` }
+      headers: authHeaders(ctx, tokens.access_token)
     });
     if (!ok) {
       return {
@@ -24129,14 +24219,14 @@ async function doctorCommand(ctx) {
     console.log(source_default.green(`  All checks passed.`));
   }
 }
-function registerDoctorCommand(program2) {
-  program2.command("doctor").description("Run diagnostic checks against the active profile").action(async () => {
+function registerDoctorCommand(program) {
+  program.command("doctor").description("Run diagnostic checks against the active profile").action(async () => {
     const ctx = createContext({
-      profileOverride: program2.opts().profile,
-      verbose: program2.opts().verbose
+      profileOverride: program.opts().profile,
+      verbose: program.opts().verbose
     });
-    if (program2.opts().apiUrl) {
-      ctx.profile.api_url = program2.opts().apiUrl;
+    if (program.opts().apiUrl) {
+      ctx.profile.api_url = program.opts().apiUrl;
     }
     await doctorCommand(ctx);
   });
@@ -24169,8 +24259,8 @@ async function skillCommand() {
   const body = fs12.readFileSync(skillPath, "utf-8");
   process.stdout.write(body);
 }
-function registerSkillCommand(program2) {
-  program2.command("skill").description("Print the bundled agent skill reference (SKILL.md) to stdout").action(async () => {
+function registerSkillCommand(program) {
+  program.command("skill").description("Print the bundled agent skill reference (SKILL.md) to stdout").action(async () => {
     await skillCommand();
   });
 }
@@ -24240,9 +24330,9 @@ function resolveManager(explicit) {
     return fromInstall;
   return process.versions?.bun ? "bun" : "npm";
 }
-function registerUpdateCommand(program2) {
-  program2.command("update").description("Update the Martha CLI to the latest published version").option("--check", "Report whether a newer version is available; don't install").option("--yes", "Skip the confirmation prompt").option("--manager <pm>", "Package manager to use: npm | bun (default: auto)").action(async (opts) => {
-    const isJson = !!program2.opts().json;
+function registerUpdateCommand(program) {
+  program.command("update").description("Update the Martha CLI to the latest published version").option("--check", "Report whether a newer version is available; don't install").option("--yes", "Skip the confirmation prompt").option("--manager <pm>", "Package manager to use: npm | bun (default: auto)").action(async (opts) => {
+    const isJson = !!program.opts().json;
     const latest = await fetchLatest();
     if (!latest) {
       throw new CLIError(`Could not reach the npm registry to determine the latest version (${LATEST_URL}). Check your network.`, 1 /* Error */);
@@ -24305,8 +24395,9 @@ function registerUpdateCommand(program2) {
 }
 
 // src/index.ts
-var program2 = new Command;
-program2.name("martha").description("Terminal-first client for the Martha AI platform").version(CLI_VERSION).option("--profile <name>", "Use a named profile").option("--json", "Machine-readable JSON output").option("--quiet", "Suppress non-essential output").option("--verbose", "Verbose logging").option("--no-color", "Disable color output").option("--api-url <url>", "Override API base URL");
+var program2 = new Command2;
+program2.name("martha").description("Terminal-first client for the Martha AI platform").version(CLI_VERSION).option("--profile <name>", "Use a named profile").option("--json", "Machine-readable JSON output").option("--quiet", "Suppress non-essential output").option("--verbose", "Verbose logging").option("--no-color", "Disable color output").option("--api-url <url>", "Override API base URL").option("--org <tenant>", "Organization to act in (X-Martha-Tenant); needed when your token authorizes several");
+registerOrgSelection(program2);
 program2.command("status").description("Check connection and auth status").action(async () => {
   const ctx = createContext({
     profileOverride: program2.opts().profile,