@codai/axiom-mcp 2.0.0 → 2.1.0

package/dist/cli-main.js

@@ -1,15 +1,16 @@
 import { createRequire } from "node:module";
 import * as fs$1 from "node:fs/promises";
-import fs, { access, constants, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import fs, { access, chmod, constants, lstat, mkdir, open, opendir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import * as path from "node:path";
 import { dirname, join, relative, sep } from "node:path";
 import { parseArgs, promisify } from "node:util";
-import { createHash, randomBytes } from "node:crypto";
-import { realpath } from "node:fs";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, timingSafeEqual, verify } from "node:crypto";
+import { createReadStream, realpath as realpath$1 } from "node:fs";
 import childProcess, { spawn } from "node:child_process";
 import { cpus, hostname } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { performance } from "node:perf_hooks";
+import { performance as performance$1 } from "node:perf_hooks";
+import { fileURLToPath } from "node:url";
 import process$1 from "node:process";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -80,13 +81,13 @@ function canonicalize$1(value) {
 	}
 	return `{${parts.join(",")}}`;
 }
-const HEX64 = /^[0-9a-f]{64}$/;
+const HEX64$1 = /^[0-9a-f]{64}$/;
 const REF = /^sha256:([0-9a-f]{64})$/;
 function sha256Hex(data) {
 	return createHash("sha256").update(data).digest("hex");
 }
 function digestRef(hex) {
-	if (!HEX64.test(hex)) throw new TypeError(`invalid sha256 hex: ${hex}`);
+	if (!HEX64$1.test(hex)) throw new TypeError(`invalid sha256 hex: ${hex}`);
 	return `sha256:${hex}`;
 }
 function parseDigestRef(ref) {
@@ -100,7 +101,200 @@ function canonicalHash(value) {
 function canonicalDigestRef(value) {
 	return digestRef(canonicalHash(value));
 }
-new TextEncoder();
+const utf8 = new TextEncoder();
+function pae(payloadType, payload) {
+	const typeBytes = utf8.encode(payloadType);
+	const head = utf8.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${payload.length} `);
+	const out = new Uint8Array(head.length + payload.length);
+	out.set(head, 0);
+	out.set(payload, head.length);
+	return out;
+}
+const AXIOM_MANIFEST_PAYLOAD_TYPE$1 = "application/vnd.axiom.manifest+json";
+const SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+const PKCS8_PREFIX = Buffer.from("302e020100300506032b657004220420", "hex");
+function toBuffer(u8) {
+	return Buffer.from(u8.buffer, u8.byteOffset, u8.byteLength);
+}
+function rawPublicKeyOf(key) {
+	const spki = key.export({
+		type: "spki",
+		format: "der"
+	});
+	return Buffer.from(spki.subarray(spki.length - 32));
+}
+function keyidFor(key) {
+	let raw;
+	if (typeof key === "string") raw = Buffer.from(key, "base64");
+	else if (key instanceof Uint8Array) raw = toBuffer(key);
+	else raw = rawPublicKeyOf(key.type === "private" ? createPublicKey(key) : key);
+	if (raw.length !== 32) throw new Error(`ed25519 public key must be 32 raw bytes`);
+	return createHash("sha256").update(raw).digest("hex");
+}
+function publicKeyBase64(key) {
+	return rawPublicKeyOf(key.type === "private" ? createPublicKey(key) : key).toString("base64");
+}
+function privateKeyFrom(material) {
+	const text = material.trim();
+	if (text.includes("-----BEGIN")) {
+		const key = createPrivateKey(text);
+		assertEd25519(key);
+		return key;
+	}
+	let der;
+	try {
+		der = Buffer.from(text, "base64");
+	} catch {
+		throw new Error("signing key is not valid base64");
+	}
+	if (der.length === 0) throw new Error("signing key is empty");
+	if (der.length === 32) return createPrivateKey({
+		key: Buffer.concat([PKCS8_PREFIX, der]),
+		format: "der",
+		type: "pkcs8"
+	});
+	const key = createPrivateKey({
+		key: der,
+		format: "der",
+		type: "pkcs8"
+	});
+	assertEd25519(key);
+	return key;
+}
+function publicKeyFrom(material) {
+	const text = material.trim();
+	if (text.includes("-----BEGIN")) {
+		const key = createPublicKey(text);
+		assertEd25519(key);
+		return key;
+	}
+	const der = Buffer.from(text, "base64");
+	if (der.length === 32) return createPublicKey({
+		key: Buffer.concat([SPKI_PREFIX, der]),
+		format: "der",
+		type: "spki"
+	});
+	const key = createPublicKey({
+		key: der,
+		format: "der",
+		type: "spki"
+	});
+	assertEd25519(key);
+	return key;
+}
+function assertEd25519(key) {
+	if (key.asymmetricKeyType !== "ed25519") throw new Error(`expected an ed25519 key, got ${String(key.asymmetricKeyType)}`);
+}
+function generateKeyPair() {
+	const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+	return {
+		keyid: keyidFor(publicKey),
+		privateKey,
+		publicKey,
+		privateKeyBase64: Buffer.from(privateKey.export({
+			type: "pkcs8",
+			format: "der"
+		})).toString("base64"),
+		publicKeyBase64: publicKeyBase64(publicKey)
+	};
+}
+function signEnvelope(body, privateKey, keyid, payloadType = AXIOM_MANIFEST_PAYLOAD_TYPE$1) {
+	assertEd25519(privateKey);
+	const payloadBytes = new TextEncoder().encode(canonicalize$1(body));
+	const message = toBuffer(pae(payloadType, payloadBytes));
+	const sig = sign(null, message, privateKey);
+	return {
+		payloadType,
+		payload: toBuffer(payloadBytes).toString("base64"),
+		signatures: [{
+			keyid: keyid ?? keyidFor(privateKey),
+			sig: sig.toString("base64")
+		}]
+	};
+}
+function eqKeyid(a, b) {
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(Buffer.from(a, "utf8"), Buffer.from(b, "utf8"));
+}
+function verifyEnvelope(env, trustedKeys, payloadType = AXIOM_MANIFEST_PAYLOAD_TYPE$1) {
+	if (env.payloadType !== payloadType) return {
+		ok: false,
+		keyids: [],
+		reason: "BAD_PAYLOAD_TYPE"
+	};
+	if (!Array.isArray(env.signatures) || env.signatures.length === 0) return {
+		ok: false,
+		keyids: [],
+		reason: "NO_SIGNATURES"
+	};
+	const payloadBytes = Buffer.from(env.payload, "base64");
+	const text = payloadBytes.toString("utf8");
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return {
+			ok: false,
+			keyids: [],
+			reason: "BAD_PAYLOAD"
+		};
+	}
+	let canon;
+	try {
+		canon = canonicalize$1(parsed);
+	} catch {
+		return {
+			ok: false,
+			keyids: [],
+			reason: "NOT_CANONICAL"
+		};
+	}
+	if (canon !== text) return {
+		ok: false,
+		keyids: [],
+		reason: "NOT_CANONICAL"
+	};
+	const message = toBuffer(pae(env.payloadType, payloadBytes));
+	const keys = [];
+	for (const t of trustedKeys) {
+		if (t.alg !== "ed25519") continue;
+		try {
+			keys.push({
+				keyid: t.keyid,
+				key: publicKeyFrom(t.publicKey)
+			});
+		} catch {}
+	}
+	if (keys.length === 0) return {
+		ok: false,
+		keyids: [],
+		reason: "UNKNOWN_KEY"
+	};
+	const verified = /* @__PURE__ */ new Set();
+	let sawKnownKeyid = false;
+	for (const s of env.signatures) {
+		if (s.keyid !== void 0 && keys.some((k) => eqKeyid(k.keyid, s.keyid))) sawKnownKeyid = true;
+		let sig;
+		try {
+			sig = Buffer.from(s.sig, "base64");
+		} catch {
+			continue;
+		}
+		for (const k of keys) try {
+			if (verify(null, message, k.key, sig)) verified.add(k.keyid);
+		} catch {}
+	}
+	if (verified.size === 0) return {
+		ok: false,
+		keyids: [],
+		reason: sawKnownKeyid ? "BAD_SIGNATURE" : "UNKNOWN_KEY"
+	};
+	return {
+		ok: true,
+		keyids: [...verified].sort(),
+		payload: text
+	};
+}
 const IN_TOTO_STATEMENT_V1 = "https://in-toto.io/Statement/v1";
 const SLSA_PROVENANCE_V1 = "https://slsa.dev/provenance/v1";
 const AXIOM_BUILD_TYPE = "https://axiom.dev/build/plan@v2";
@@ -6025,6 +6219,12 @@ const ERROR_CODES = [
 	"ERR_PROVIDER_FAILED",
 	"ERR_GUARD_TIMEOUT",
 	"ERR_GUARD_OUTPUT",
+	"ERR_SIGNATURE_MISSING",
+	"ERR_SIGNATURE_INVALID",
+	"ERR_ROLLBACK",
+	"ERR_EMITTER_UNKNOWN",
+	"ERR_TEMPLATE_UNKNOWN",
+	"ERR_TEMPLATE_PARAMS",
 	"ERR_GIT_NOT_FOUND",
 	"ERR_GIT_NOT_REPO",
 	"ERR_GIT_DIRTY",
@@ -6032,6 +6232,9 @@ const ERROR_CODES = [
 	"ERR_GIT_BRANCH_INVALID",
 	"ERR_GIT_FAILED",
 	"ERR_REF_OFFLINE",
+	"ERR_NET_DISABLED",
+	"ERR_NET_DENIED",
+	"ERR_NET_FAILED",
 	"ERR_NOT_CANONICAL",
 	"ERR_UNSUPPORTED_OP",
 	"ERR_INTERNAL"
@@ -6208,6 +6411,7 @@ const PlanSchema = object$1({
 	capabilities: array(CapabilitySchema).default([]),
 	artifacts: array(PlanArtifactSchema).min(1).max(2e3),
 	checks: array(CheckRefSchema).default([]),
+	counter: int().nonnegative().optional(),
 	metadata: record(string(), json$1()).default({})
 }).strict();
 const ErrorCodeSchema = _enum(ERROR_CODES);
@@ -6335,7 +6539,8 @@ const ManifestBodySchema = object$1({
 	planDigest: DigestRefSchema,
 	artifacts: array(ManifestArtifactSchema).min(1).max(2e3),
 	checks: array(CheckRefSchema),
-	toolchain: ToolchainSchema
+	toolchain: ToolchainSchema,
+	counter: int().nonnegative().optional()
 }).strict().superRefine((m, ctx) => {
 	if (!isSortedUnique(m.artifacts.map((a) => a.path))) ctx.addIssue({
 		code: "custom",
@@ -6376,11 +6581,37 @@ const DsseEnvelopeSchema = object$1({
 		sig: base64()
 	}).strict())
 }).strict();
+const ManifestSignatureSchema = object$1({
+	payloadType: literal("application/vnd.axiom.manifest+json"),
+	payload: base64(),
+	signatures: array(object$1({
+		keyid: string().optional(),
+		sig: base64()
+	}).strict()).min(1)
+}).strict();
+const TrustedKeySchema = object$1({
+	keyid: string().regex(/^[0-9a-f]{64}$/),
+	alg: literal("ed25519"),
+	publicKey: base64(),
+	name: string().min(1).max(200).optional(),
+	notBefore: int().nonnegative().optional()
+}).strict();
+const TrustStoreSchema = object$1({
+	version: literal(1),
+	keys: array(TrustedKeySchema),
+	minCounter: int().nonnegative().optional()
+}).strict();
+const TrustStateSchema = object$1({
+	version: literal(1),
+	lastCounter: int().nonnegative(),
+	manifestDigest: DigestRefSchema.optional()
+}).strict();
 const ManifestBundleSchema = object$1({
 	manifest: ManifestBodySchema,
 	manifestDigest: DigestRefSchema,
 	attestation: InTotoStatementLooseSchema.optional(),
 	envelope: DsseEnvelopeSchema.optional(),
+	signatures: array(ManifestSignatureSchema).optional(),
 	blobs: record(DigestRefSchema, BlobSchema).default({})
 }).strict().superRefine((b, ctx) => {
 	let total = 0;
@@ -6415,6 +6646,28 @@ const ProfileSchema = object$1({
 	limits: ProfileLimitsSchema.default({}),
 	facts: ProfileFactsSchema.prefault({})
 }).strict();
+const RepoSnapshotEntryKindSchema = _enum(["file", "symlink"]);
+const RepoSnapshotBodySchema = object$1({
+	files: array(object$1({
+		path: RelPathSchema,
+		bytes: int().nonnegative(),
+		sha256: Sha256HexSchema.optional(),
+		mode: ArtifactModeSchema,
+		kind: RepoSnapshotEntryKindSchema
+	}).strict()),
+	truncated: boolean(),
+	counts: object$1({
+		files: int().nonnegative(),
+		bytes: int().nonnegative()
+	}).strict()
+}).strict();
+const RepoSnapshotSchema = object$1({
+	apiVersion: ApiVersionSchema,
+	kind: literal("RepoSnapshot"),
+	root: object$1({ kind: literal("relative") }).strict(),
+	snapshotDigest: DigestRefSchema,
+	body: RepoSnapshotBodySchema
+}).strict();
 var Diff = class {
 	diff(oldStr, newStr, options = {}) {
 		let callback;
@@ -7198,7 +7451,7 @@ async function resolveContent(bundle, artifact, casDir) {
 	});
 	return bytes;
 }
-const realpathNative$2 = promisify(realpath.native);
+const realpathNative$2 = promisify(realpath$1.native);
 function validateArtifactPaths(artifacts) {
 	const seen = /* @__PURE__ */ new Map();
 	for (const a of artifacts) {
@@ -9990,7 +10243,7 @@ function deriveManifestFacts(bundle) {
 		const ext = extOf(a.path);
 		byExt[ext] = (byExt[ext] ?? 0) + 1;
 	}
-	const signed = bundle.envelope !== void 0 && bundle.envelope.signatures.length > 0;
+	const signed = bundle.signatures !== void 0 && bundle.signatures.length > 0 || bundle.envelope !== void 0 && bundle.envelope.signatures.length > 0;
 	return {
 		artifactCount: bundle.manifest.artifacts.length,
 		totalBytes,
@@ -10164,6 +10417,292 @@ function parseJsonObject(bytes) {
 		return;
 	}
 }
+const EXPRESSION_MAX_CHARS = 4096;
+const CEL_LIMITS = {
+	maxDepth: 24,
+	maxAstNodes: 2e3,
+	maxListElements: 256,
+	maxMapEntries: 256,
+	maxCallArguments: 8
+};
+const CEL_ALLOWED_FUNCTIONS = /* @__PURE__ */ new Set([
+	"has",
+	"all",
+	"exists",
+	"exists_one",
+	"map",
+	"filter",
+	"size",
+	"contains",
+	"startsWith",
+	"endsWith",
+	"matches",
+	"lowerAscii",
+	"upperAscii",
+	"trim",
+	"split",
+	"join",
+	"indexOf",
+	"lastIndexOf",
+	"substring",
+	"string",
+	"int",
+	"uint",
+	"double",
+	"bool",
+	"bytes",
+	"dyn",
+	"type"
+]);
+const CelParams = object$1({
+	expression: string().min(1).max(EXPRESSION_MAX_CHARS),
+	message: string().max(2e3).optional(),
+	severity: _enum([
+		"error",
+		"warn",
+		"info"
+	]).optional()
+}).strict();
+const PREDICATE$1 = "expr.cel";
+const UNSAFE_REGEX = /\(\?<?[=!]|\\[1-9]|\\k</;
+let envPromise;
+function celEnvironment() {
+	if (envPromise === void 0) envPromise = import("./lib-CqHwM4m_.js").then((m) => {
+		let env = new m.Environment({
+			limits: CEL_LIMITS,
+			unlistedVariablesAreDyn: false
+		});
+		env = env.registerVariable("manifest", "map");
+		env = env.registerVariable("artifacts", "list");
+		env = env.registerVariable("content", "map");
+		env = env.registerVariable("repo", "map");
+		return env;
+	});
+	return envPromise;
+}
+function isNode(v) {
+	return typeof v === "object" && v !== null && "op" in v && "args" in v;
+}
+function children(n) {
+	const a = n.args;
+	switch (n.op) {
+		case "value":
+		case "id": return [];
+		case ".":
+		case ".?": return Array.isArray(a) && isNode(a[0]) ? [a[0]] : [];
+		case "call": return Array.isArray(a) && Array.isArray(a[1]) ? a[1].filter(isNode) : [];
+		case "rcall": {
+			if (!Array.isArray(a)) return [];
+			const out = [];
+			if (isNode(a[1])) out.push(a[1]);
+			if (Array.isArray(a[2])) out.push(...a[2].filter(isNode));
+			return out;
+		}
+		case "map": return Array.isArray(a) ? a.flatMap((e) => Array.isArray(e) ? e.filter(isNode) : isNode(e) ? [e] : []) : [];
+		default:
+			if (isNode(a)) return [a];
+			return Array.isArray(a) ? a.filter(isNode) : [];
+	}
+}
+function analyzeAst(root) {
+	const out = {
+		deniedCalls: [],
+		unsafeRegex: [],
+		variables: /* @__PURE__ */ new Set()
+	};
+	const stack = [root];
+	while (stack.length > 0) {
+		const n = stack.pop();
+		if (n === void 0) break;
+		if (n.op === "id" && typeof n.args === "string") out.variables.add(n.args);
+		if (n.op === "call" || n.op === "rcall") {
+			const args = n.args;
+			const name = typeof args[0] === "string" ? args[0] : "";
+			if (!CEL_ALLOWED_FUNCTIONS.has(name)) out.deniedCalls.push(name);
+			if (name === "matches") {
+				const params = n.op === "rcall" ? args[2] : args[1].slice(1);
+				const pat = Array.isArray(params) ? params[0] : void 0;
+				if (!isNode(pat) || pat.op !== "value" || typeof pat.args !== "string") out.unsafeRegex.push("<non-literal pattern>");
+				else if (UNSAFE_REGEX.test(pat.args)) out.unsafeRegex.push(pat.args);
+			}
+		}
+		const kids = children(n);
+		for (let i = kids.length - 1; i >= 0; i--) {
+			const k = kids[i];
+			if (k !== void 0) stack.push(k);
+		}
+	}
+	return out;
+}
+function toCelValue(v) {
+	if (typeof v === "number") return Number.isInteger(v) ? BigInt(v) : v;
+	if (Array.isArray(v)) return v.map(toCelValue);
+	if (v instanceof Uint8Array) return v;
+	if (typeof v === "object" && v !== null) {
+		const out = {};
+		for (const [k, val] of Object.entries(v)) out[k] = toCelValue(val);
+		return out;
+	}
+	return v;
+}
+async function buildContentMap(ctx) {
+	const out = {};
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	for (const a of ctx.manifest.artifacts) {
+		if (a.op === "delete" || a.digest === void 0) continue;
+		const bytes = await ctx.facts.content(a.path);
+		if (bytes === void 0) continue;
+		const entry = {
+			bytes: BigInt(bytes.length),
+			sha256: a.digest.sha256
+		};
+		if (bytes.length <= 262144 && isUtf8(bytes)) entry.text = decoder.decode(bytes);
+		out[a.path] = entry;
+	}
+	return out;
+}
+async function buildRepoMap(ctx) {
+	const repo = ctx.facts.repo;
+	if (repo === void 0) return void 0;
+	const exists = {};
+	for (const a of ctx.manifest.artifacts) exists[a.path] = await repo.exists(a.path);
+	const out = { exists };
+	if (repo.packageJson !== void 0) out.packageJson = toCelValue(repo.packageJson);
+	if (repo.gitHead !== void 0) out.gitHead = repo.gitHead;
+	if (repo.gitDirty !== void 0) out.gitDirty = repo.gitDirty;
+	return out;
+}
+function manifestActivation(manifest) {
+	const m = toCelValue(manifest);
+	return {
+		manifest: m,
+		artifacts: m.artifacts
+	};
+}
+function errorMessage$1(e) {
+	if (e instanceof Error) {
+		const code = e.code;
+		const first = e.message.split("\n")[0] ?? e.message;
+		return typeof code === "string" ? `${code}: ${first}` : first;
+	}
+	return String(e);
+}
+async function evaluateCel(expression, activation, budgetMs = 100) {
+	if (expression.length > 4096) return {
+		kind: "error",
+		code: "ERR_PREDICATE_PARAMS",
+		message: `expression exceeds ${EXPRESSION_MAX_CHARS} characters`
+	};
+	const env = await celEnvironment();
+	let compiled;
+	try {
+		compiled = env.parse(expression);
+	} catch (e) {
+		return {
+			kind: "error",
+			code: "ERR_PREDICATE_PARAMS",
+			message: `parse: ${errorMessage$1(e)}`
+		};
+	}
+	const analysis = analyzeAst(compiled.ast);
+	if (analysis.deniedCalls.length > 0) return {
+		kind: "error",
+		code: "ERR_PREDICATE_PARAMS",
+		message: `function not allowed: ${[...new Set(analysis.deniedCalls)].join(", ")}`
+	};
+	if (analysis.unsafeRegex.length > 0) return {
+		kind: "error",
+		code: "ERR_PREDICATE_PARAMS",
+		message: `matches() pattern must be a literal RE2-safe regex: ${analysis.unsafeRegex.join(", ")}`
+	};
+	if (analysis.variables.has("repo") && activation.repo === void 0) return {
+		kind: "error",
+		code: "ERR_PROVIDER_FAILED",
+		message: "expression references `repo` but repo facts are unavailable (no authorised root)"
+	};
+	const context = {
+		manifest: activation.manifest,
+		artifacts: activation.artifacts,
+		content: activation.content
+	};
+	if (activation.repo !== void 0) context.repo = activation.repo;
+	const t0 = performance.now();
+	let value;
+	try {
+		value = compiled(context);
+	} catch (e) {
+		return {
+			kind: "error",
+			code: "ERR_PROVIDER_FAILED",
+			message: `eval: ${errorMessage$1(e)}`
+		};
+	}
+	const ms = performance.now() - t0;
+	if (ms > budgetMs) return {
+		kind: "error",
+		code: "ERR_PROVIDER_FAILED",
+		message: `evaluation took ${Math.round(ms)} ms (budget ${budgetMs} ms)`
+	};
+	if (typeof value !== "boolean") return {
+		kind: "error",
+		code: "ERR_PROVIDER_FAILED",
+		message: `expression must evaluate to bool, got ${celTypeName(value)}`
+	};
+	return {
+		kind: "value",
+		value,
+		ms
+	};
+}
+function celTypeName(v) {
+	if (v === null) return "null";
+	if (typeof v === "bigint") return "int";
+	if (typeof v === "number") return "double";
+	if (Array.isArray(v)) return "list";
+	if (v instanceof Uint8Array) return "bytes";
+	return typeof v;
+}
+function providerError$2(code, message, expression) {
+	return finding({
+		id: PREDICATE$1,
+		predicate: PREDICATE$1,
+		message,
+		facts: {
+			code,
+			__provider: true,
+			expression
+		}
+	});
+}
+const exprCel = definePredicate({
+	id: PREDICATE$1,
+	params: CelParams,
+	requires: ["manifest", "content"],
+	async run(ctx, { expression, message, severity }) {
+		const { manifest, artifacts } = manifestActivation(ctx.manifest);
+		const mentions = (name) => new RegExp(`\\b${name}\\b`).test(expression);
+		const activation = {
+			manifest,
+			artifacts,
+			content: mentions("content") ? await buildContentMap(ctx) : {}
+		};
+		if (mentions("repo")) {
+			const repo = await buildRepoMap(ctx);
+			if (repo !== void 0) activation.repo = repo;
+		}
+		const r = await evaluateCel(expression, activation);
+		if (r.kind === "error") return [providerError$2(r.code, r.message, expression)];
+		if (r.value) return [];
+		const f = finding({
+			id: PREDICATE$1,
+			predicate: PREDICATE$1,
+			message: message ?? `expression evaluated to false: ${expression}`,
+			facts: { expression }
+		});
+		if (severity !== void 0) f.severity = severity;
+		return [f];
+	}
+});
 const SECRET_PATTERNS = [
 	{
 		name: "cnp",
@@ -10390,7 +10929,7 @@ const GuardOutputSchema = object$1({
 const PREDICATE = "guard.external";
 const OUTPUT_MAX = 8388608;
 const IS_WIN32$1 = process.platform === "win32";
-const realpathNative$1 = promisify(realpath.native);
+const realpathNative$1 = promisify(realpath$1.native);
 const ENV_WHITELIST = [
 	"PATH",
 	"HOME",
@@ -10423,7 +10962,7 @@ function isInside(parent, child) {
 	const c = norm$1(child);
 	return c !== p && c.startsWith(p + path.sep);
 }
-function providerError(code, message, extra = {}) {
+function providerError$1(code, message, extra = {}) {
 	return finding({
 		id: PREDICATE,
 		predicate: PREDICATE,
@@ -10449,22 +10988,22 @@ function guardEnv(extra, digest, root, base = process.env) {
 }
 async function resolveGuardCommand(command, args, root, allowlist) {
 	const segments = command.split(/[\\/]+/);
-	if (segments.includes("..")) return providerError("ERR_PREDICATE_PARAMS", `guard command must not contain "..": ${command}`, { command });
+	if (segments.includes("..")) return providerError$1("ERR_PREDICATE_PARAMS", `guard command must not contain "..": ${command}`, { command });
 	let real;
 	if (path.isAbsolute(command)) {
 		real = await realpathSafe(command);
-		if (real === void 0) return providerError("ERR_PREDICATE_PARAMS", `guard command not found: ${command}`, { command });
+		if (real === void 0) return providerError$1("ERR_PREDICATE_PARAMS", `guard command not found: ${command}`, { command });
 		const allowed = /* @__PURE__ */ new Set();
 		for (const a of allowlist) {
 			const r = await realpathSafe(a);
 			if (r !== void 0) allowed.add(norm$1(r));
 		}
-		if (!allowed.has(norm$1(real))) return providerError("ERR_PREDICATE_PARAMS", `absolute guard command is not in --guard-allowlist: ${command}`, { command });
+		if (!allowed.has(norm$1(real))) return providerError$1("ERR_PREDICATE_PARAMS", `absolute guard command is not in --guard-allowlist: ${command}`, { command });
 	} else {
 		const scriptsDir = path.join(root, "scripts");
 		real = await realpathSafe(segments[0] === "scripts" ? path.resolve(root, command) : path.resolve(scriptsDir, command));
 		const scriptsReal = await realpathSafe(scriptsDir);
-		if (real === void 0 || scriptsReal === void 0 || !isInside(scriptsReal, real)) return providerError("ERR_PREDICATE_PARAMS", `relative guard command must resolve inside <root>/scripts/: ${command}`, { command });
+		if (real === void 0 || scriptsReal === void 0 || !isInside(scriptsReal, real)) return providerError$1("ERR_PREDICATE_PARAMS", `relative guard command must resolve inside <root>/scripts/: ${command}`, { command });
 	}
 	const ext = path.extname(real).toLowerCase();
 	if (ext === ".mjs" || ext === ".js" || ext === ".cjs") return {
@@ -10482,7 +11021,7 @@ async function resolveGuardCommand(command, args, root, allowlist) {
 			...args
 		]
 	};
-	if (!path.isAbsolute(command)) return providerError("ERR_PREDICATE_PARAMS", `relative guard command must be .mjs/.js/.cjs/.ps1: ${command}`, { command });
+	if (!path.isAbsolute(command)) return providerError$1("ERR_PREDICATE_PARAMS", `relative guard command must be .mjs/.js/.cjs/.ps1: ${command}`, { command });
 	return {
 		file: real,
 		argv: [...args]
@@ -10620,25 +11159,25 @@ function mapOutput(out, command) {
 }
 async function runGuard(ctx, params) {
 	const guard = ctx.facts.guard;
-	if (guard === void 0 || !guard.enabled || !ctx.facts.profile.allowGuards) return [providerError("ERR_UNSUPPORTED_OP", "external guards disabled (needs profile facts.allowGuards and --allow-guards)", { command: params.command })];
+	if (guard === void 0 || !guard.enabled || !ctx.facts.profile.allowGuards) return [providerError$1("ERR_UNSUPPORTED_OP", "external guards disabled (needs profile facts.allowGuards and --allow-guards)", { command: params.command })];
 	const resolved = await resolveGuardCommand(params.command, params.args, guard.root, guard.allowlist);
 	if ("id" in resolved) return [resolved];
 	let cwd = guard.root;
 	if (params.cwd === "staging") {
-		if (guard.stagingDir === void 0) return [providerError("ERR_PREDICATE_PARAMS", "cwd \"staging\" requested but no staging dir", { command: params.command })];
+		if (guard.stagingDir === void 0) return [providerError$1("ERR_PREDICATE_PARAMS", "cwd \"staging\" requested but no staging dir", { command: params.command })];
 		cwd = guard.stagingDir;
 	}
 	const input = params.stdin === "none" ? void 0 : canonicalize$1(params.stdin === "bundle" ? ctx.bundle : ctx.manifest);
 	const env = guardEnv(params.env, ctx.bundle.manifestDigest, guard.root);
 	const r = await runChild(resolved, cwd, env, input, params.timeoutMs);
-	if (r.timedOut) return [providerError("ERR_GUARD_TIMEOUT", `guard timed out after ${params.timeoutMs} ms`, {
+	if (r.timedOut) return [providerError$1("ERR_GUARD_TIMEOUT", `guard timed out after ${params.timeoutMs} ms`, {
 		command: params.command,
 		timeoutMs: params.timeoutMs,
 		stderr: r.stderr
 	})];
-	if (r.spawnError !== void 0) return [providerError("ERR_GUARD_OUTPUT", `guard could not be spawned: ${r.spawnError}`, { command: params.command })];
+	if (r.spawnError !== void 0) return [providerError$1("ERR_GUARD_OUTPUT", `guard could not be spawned: ${r.spawnError}`, { command: params.command })];
 	const out = parseJsonOutput(r.stdout) ?? (params.legacyText ? parseLegacyText(r.stdout) : void 0);
-	if (out === void 0) return [providerError("ERR_GUARD_OUTPUT", `guard stdout is not a GuardOutput JSON object (exit ${r.code ?? "null"})`, {
+	if (out === void 0) return [providerError$1("ERR_GUARD_OUTPUT", `guard stdout is not a GuardOutput JSON object (exit ${r.code ?? "null"})`, {
 		command: params.command,
 		exitCode: r.code,
 		stdout: r.stdout.slice(-4096),
@@ -10690,20 +11229,6 @@ const manifestMaxTotalBytes = definePredicate({
 		})];
 	}
 });
-const manifestRequireSigned = definePredicate({
-	id: "manifest.requireSigned",
-	params: Empty,
-	requires: ["manifest"],
-	async run(ctx) {
-		if (ctx.facts.manifest.signed) return [];
-		return [finding({
-			id: "manifest.requireSigned",
-			predicate: "manifest.requireSigned",
-			message: "bundle has no DSSE signature",
-			facts: { signed: false }
-		})];
-	}
-});
 const manifestNoDeletes = definePredicate({
 	id: "manifest.noDeletes",
 	params: Empty,
@@ -10718,59 +11243,283 @@ const manifestNoDeletes = definePredicate({
 	}
 });
 const Globs = object$1({ globs: array(string().min(1)).min(1) }).strict();
-const BUILTIN_PREDICATES = [
-	definePredicate({
-		id: "path.allow",
-		params: Globs,
-		requires: ["manifest"],
-		async run(ctx, { globs }) {
-			const allowed = globMatcher(globs, false);
-			return ctx.facts.manifest.paths.filter((p) => !allowed(p)).map((p) => finding({
-				id: "path.allow",
-				predicate: "path.allow",
-				path: p,
-				message: `path is outside the allowed globs`,
-				facts: { globs }
+const pathAllow = definePredicate({
+	id: "path.allow",
+	params: Globs,
+	requires: ["manifest"],
+	async run(ctx, { globs }) {
+		const allowed = globMatcher(globs, false);
+		return ctx.facts.manifest.paths.filter((p) => !allowed(p)).map((p) => finding({
+			id: "path.allow",
+			predicate: "path.allow",
+			path: p,
+			message: `path is outside the allowed globs`,
+			facts: { globs }
+		}));
+	}
+});
+const pathDeny = definePredicate({
+	id: "path.deny",
+	params: Globs,
+	requires: ["manifest"],
+	async run(ctx, { globs }) {
+		const denied = globMatcher(globs, false);
+		return ctx.facts.manifest.paths.filter(denied).map((p) => finding({
+			id: "path.deny",
+			predicate: "path.deny",
+			path: p,
+			message: `path matches a denied glob`,
+			facts: { globs }
+		}));
+	}
+});
+const pathReservedNames = definePredicate({
+	id: "path.reservedNames",
+	params: object$1({}).strict(),
+	requires: ["manifest"],
+	async run(ctx) {
+		const out = [];
+		for (const p of ctx.facts.manifest.paths) {
+			const issues = relPathIssues(p);
+			if (issues.length === 0) continue;
+			out.push(finding({
+				id: "path.reservedNames",
+				predicate: "path.reservedNames",
+				message: `path violates relative-POSIX rules: ${issues.join(", ")}`,
+				facts: {
+					path: p,
+					issues
+				}
 			}));
 		}
-	}),
-	definePredicate({
-		id: "path.deny",
-		params: Globs,
-		requires: ["manifest"],
-		async run(ctx, { globs }) {
-			const denied = globMatcher(globs, false);
-			return ctx.facts.manifest.paths.filter(denied).map((p) => finding({
-				id: "path.deny",
-				predicate: "path.deny",
-				path: p,
-				message: `path matches a denied glob`,
-				facts: { globs }
+		return out;
+	}
+});
+const repoNoOverwriteOf = definePredicate({
+	id: "repo.noOverwriteOf",
+	params: object$1({ globs: array(string().min(1)).min(1) }).strict(),
+	requires: ["manifest", "repo"],
+	async run(ctx, { globs }) {
+		const repo = ctx.facts.repo;
+		if (repo === void 0) return [];
+		const protectedPath = globMatcher(globs, false);
+		const out = [];
+		for (const a of ctx.manifest.artifacts) {
+			if (a.op === "create" || !protectedPath(a.path)) continue;
+			if (!await repo.exists(a.path)) continue;
+			out.push(finding({
+				id: "repo.noOverwriteOf",
+				predicate: "repo.noOverwriteOf",
+				path: a.path,
+				message: `${a.op} of protected existing file`,
+				facts: {
+					op: a.op,
+					globs
+				}
 			}));
 		}
-	}),
-	definePredicate({
-		id: "path.reservedNames",
-		params: object$1({}).strict(),
-		requires: ["manifest"],
-		async run(ctx) {
-			const out = [];
-			for (const p of ctx.facts.manifest.paths) {
-				const issues = relPathIssues(p);
-				if (issues.length === 0) continue;
+		return out;
+	}
+});
+const repoRequireCompanion = definePredicate({
+	id: "repo.requireCompanion",
+	params: object$1({ rules: array(object$1({
+		when: string().min(1),
+		expect: array(object$1({
+			name: string().min(1),
+			match: string().min(1)
+		}).strict()).min(1)
+	}).strict()).min(1) }).strict(),
+	requires: ["manifest", "repo"],
+	async run(ctx, { rules }) {
+		const paths = ctx.facts.manifest.paths;
+		const out = [];
+		for (const rule of rules) {
+			const when = globMatcher([rule.when], false);
+			const triggers = paths.filter(when);
+			if (triggers.length === 0) continue;
+			for (const exp of rule.expect) {
+				const match = globMatcher([exp.match], false);
+				if (paths.some(match)) continue;
+				if ((ctx.facts.repo ? await ctx.facts.repo.glob(exp.match) : []).length > 0) continue;
 				out.push(finding({
-					id: "path.reservedNames",
-					predicate: "path.reservedNames",
-					message: `path violates relative-POSIX rules: ${issues.join(", ")}`,
+					id: `repo.requireCompanion.${exp.name}`,
+					predicate: "repo.requireCompanion",
+					message: `"${rule.when}" changed but no companion matches "${exp.match}" (${exp.name})`,
 					facts: {
-						path: p,
-						issues
+						when: rule.when,
+						expect: exp.match,
+						name: exp.name,
+						triggers
 					}
 				}));
 			}
-			return out;
 		}
-	}),
+		return out;
+	}
+});
+const PREDICATE_ID = "manifest.requireSigned";
+const TRUST_FILE_DEFAULT = ".axiom/trust/keys.json";
+const TRUST_STATE_FILE = ".axiom/trust/state.json";
+const TRUST_FILE_MAX = 262144;
+const RequireSignedParams = object$1({
+	minSignatures: int().min(1).max(16).default(1),
+	antiRollback: boolean().default(false),
+	trustFile: string().min(1).default(TRUST_FILE_DEFAULT)
+}).strict();
+function providerError(code, message, extra = {}) {
+	return finding({
+		id: PREDICATE_ID,
+		predicate: PREDICATE_ID,
+		message,
+		facts: {
+			code,
+			__provider: true,
+			...extra
+		}
+	});
+}
+function fail(id, message, facts = {}) {
+	return finding({
+		id,
+		predicate: PREDICATE_ID,
+		message,
+		facts
+	});
+}
+async function readJsonFile(ctx, rel) {
+	const repo = ctx.facts.repo;
+	if (repo === void 0) return { error: "no root" };
+	let bytes;
+	try {
+		bytes = await repo.read(rel, TRUST_FILE_MAX);
+	} catch (e) {
+		return { error: e instanceof Error ? e.message : String(e) };
+	}
+	if (bytes === void 0) return { missing: true };
+	try {
+		return { value: JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)) };
+	} catch (e) {
+		return { error: e instanceof Error ? e.message : String(e) };
+	}
+}
+async function loadTrustStore$1(ctx, trustFile) {
+	if (ctx.facts.repo === void 0) return { finding: providerError("ERR_PROVIDER_FAILED", "manifest.requireSigned needs a repo root to read the trust store") };
+	const r = await readJsonFile(ctx, trustFile);
+	if ("missing" in r) return { finding: providerError("ERR_NOT_FOUND", `trust store ${trustFile} not found`, { trustFile }) };
+	if ("error" in r) return { finding: providerError("ERR_PROVIDER_FAILED", `trust store ${trustFile}: ${r.error}`, { trustFile }) };
+	const parsed = TrustStoreSchema.safeParse(r.value);
+	if (!parsed.success) return { finding: providerError("ERR_PROVIDER_FAILED", `trust store ${trustFile} is invalid`, {
+		trustFile,
+		issues: parsed.error.issues.slice(0, 5).map((i) => `${i.path.join(".")}: ${i.message}`)
+	}) };
+	return { store: parsed.data };
+}
+async function loadTrustState$1(ctx) {
+	const r = await readJsonFile(ctx, TRUST_STATE_FILE);
+	if ("missing" in r) return { state: void 0 };
+	if ("error" in r) return { finding: providerError("ERR_PROVIDER_FAILED", `trust state ${TRUST_STATE_FILE}: ${r.error}`) };
+	const parsed = TrustStateSchema.safeParse(r.value);
+	if (!parsed.success) return { finding: providerError("ERR_JOURNAL_CORRUPT", `trust state ${TRUST_STATE_FILE} is invalid`) };
+	return { state: parsed.data };
+}
+function verifyBundleSignatures(bundle, store, counter) {
+	const findings = [];
+	const envs = bundle.signatures ?? [];
+	if (envs.length === 0) return {
+		keyids: [],
+		findings: [fail("signature.missing", "bundle carries no signatures")]
+	};
+	const keyids = /* @__PURE__ */ new Set();
+	const eligible = store.keys.filter((k) => k.notBefore === void 0 || counter !== void 0 && counter >= k.notBefore);
+	for (const [i, env] of envs.entries()) {
+		const payloadDigest = `sha256:${sha256Hex(Buffer.from(env.payload, "base64"))}`;
+		if (payloadDigest !== bundle.manifestDigest) {
+			findings.push(fail("signature.bad", `signatures[${i}] signs a different manifest`, {
+				reason: "PAYLOAD_MISMATCH",
+				payloadDigest
+			}));
+			continue;
+		}
+		const r = verifyEnvelope(env, eligible);
+		if (r.ok) {
+			for (const k of r.keyids) keyids.add(k);
+			continue;
+		}
+		const detail = {
+			reason: r.reason,
+			index: i
+		};
+		switch (r.reason) {
+			case "NOT_CANONICAL":
+				findings.push(fail("signature.notCanonical", `signatures[${i}] payload is not JCS-canonical`, detail));
+				break;
+			case "UNKNOWN_KEY":
+				findings.push(fail("signature.unknownKey", `signatures[${i}] is not from a trusted key`, {
+					...detail,
+					hinted: env.signatures.map((s) => s.keyid ?? null)
+				}));
+				break;
+			default: findings.push(fail("signature.bad", `signatures[${i}] failed verification`, detail));
+		}
+	}
+	return {
+		keyids: [...keyids].sort(),
+		findings
+	};
+}
+const manifestRequireSigned = definePredicate({
+	id: PREDICATE_ID,
+	params: RequireSignedParams,
+	requires: ["manifest"],
+	async run(ctx, params) {
+		const loaded = await loadTrustStore$1(ctx, params.trustFile);
+		if ("finding" in loaded) return [loaded.finding];
+		const store = loaded.store;
+		const counter = ctx.manifest.counter;
+		const { keyids, findings } = verifyBundleSignatures(ctx.bundle, store, counter);
+		const out = [];
+		if (keyids.length < params.minSignatures) {
+			out.push(...findings);
+			if (findings.length === 0 || keyids.length > 0) out.push(fail("signature.missing", `need ${params.minSignatures} trusted signature(s), have ${keyids.length}`, {
+				have: keyids,
+				need: params.minSignatures
+			}));
+			return dedupe(out);
+		}
+		if (params.antiRollback) {
+			if (counter === void 0) return [fail("signature.rollback", "antiRollback requires manifest.counter", { reason: "NO_COUNTER" })];
+			const st = await loadTrustState$1(ctx);
+			if ("finding" in st) return [st.finding];
+			const last = st.state?.lastCounter;
+			const floor = store.minCounter;
+			if (last !== void 0 && counter <= last) return [fail("signature.rollback", `counter ${counter} is not greater than last ${last}`, {
+				reason: "ROLLBACK",
+				counter,
+				lastCounter: last
+			})];
+			if (floor !== void 0 && counter < floor) return [fail("signature.rollback", `counter ${counter} is below trust minCounter ${floor}`, {
+				reason: "BELOW_MIN",
+				counter,
+				minCounter: floor
+			})];
+		}
+		return [];
+	}
+});
+function dedupe(findings) {
+	const seen = /* @__PURE__ */ new Set();
+	return findings.filter((f) => {
+		const k = `${f.id}|${f.message}`;
+		if (seen.has(k)) return false;
+		seen.add(k);
+		return true;
+	});
+}
+const BUILTIN_PREDICATES = [
+	pathAllow,
+	pathDeny,
+	pathReservedNames,
 	contentNoSecrets,
 	contentMaxBytes,
 	contentEncodingUtf8,
@@ -10780,70 +11529,10 @@ const BUILTIN_PREDICATES = [
 	manifestNoDeletes,
 	depsMax,
 	depsDeny,
-	definePredicate({
-		id: "repo.noOverwriteOf",
-		params: object$1({ globs: array(string().min(1)).min(1) }).strict(),
-		requires: ["manifest", "repo"],
-		async run(ctx, { globs }) {
-			const repo = ctx.facts.repo;
-			if (repo === void 0) return [];
-			const protectedPath = globMatcher(globs, false);
-			const out = [];
-			for (const a of ctx.manifest.artifacts) {
-				if (a.op === "create" || !protectedPath(a.path)) continue;
-				if (!await repo.exists(a.path)) continue;
-				out.push(finding({
-					id: "repo.noOverwriteOf",
-					predicate: "repo.noOverwriteOf",
-					path: a.path,
-					message: `${a.op} of protected existing file`,
-					facts: {
-						op: a.op,
-						globs
-					}
-				}));
-			}
-			return out;
-		}
-	}),
-	definePredicate({
-		id: "repo.requireCompanion",
-		params: object$1({ rules: array(object$1({
-			when: string().min(1),
-			expect: array(object$1({
-				name: string().min(1),
-				match: string().min(1)
-			}).strict()).min(1)
-		}).strict()).min(1) }).strict(),
-		requires: ["manifest", "repo"],
-		async run(ctx, { rules }) {
-			const paths = ctx.facts.manifest.paths;
-			const out = [];
-			for (const rule of rules) {
-				const when = globMatcher([rule.when], false);
-				const triggers = paths.filter(when);
-				if (triggers.length === 0) continue;
-				for (const exp of rule.expect) {
-					const match = globMatcher([exp.match], false);
-					if (paths.some(match)) continue;
-					if ((ctx.facts.repo ? await ctx.facts.repo.glob(exp.match) : []).length > 0) continue;
-					out.push(finding({
-						id: `repo.requireCompanion.${exp.name}`,
-						predicate: "repo.requireCompanion",
-						message: `"${rule.when}" changed but no companion matches "${exp.match}" (${exp.name})`,
-						facts: {
-							when: rule.when,
-							expect: exp.match,
-							name: exp.name,
-							triggers
-						}
-					}));
-				}
-			}
-			return out;
-		}
-	}),
-	guardExternal
+	repoNoOverwriteOf,
+	repoRequireCompanion,
+	guardExternal,
+	exprCel
 ];
 const MiB = 1048576;
 const BUILTIN_PROFILE_INPUTS = {
@@ -11091,7 +11780,7 @@ function errorMessage(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 function ms(start) {
-	return Math.max(0, Math.round(performance.now() - start));
+	return Math.max(0, Math.round(performance$1.now() - start));
 }
 const GUARD_POOL_SIZE = Math.max(1, Math.min(4, cpus().length));
 async function runPool(items, size, fn) {
@@ -11101,21 +11790,21 @@ async function runPool(items, size, fn) {
 	}));
 }
 async function runChecks(opts) {
-	const t0 = performance.now();
+	const t0 = performance$1.now();
 	const { bundle, profile } = opts;
 	const registry = opts.registry ?? builtinRegistry();
 	const checks = mergeChecks(profile.checks, opts.checks ?? []);
 	const providers = [];
 	const findings = [];
 	let providerFailed = false;
-	const tm = performance.now();
+	const tm = performance$1.now();
 	const manifestFacts = deriveManifestFacts(bundle);
 	providers.push({
 		name: "manifest",
 		status: "ok",
 		ms: ms(tm)
 	});
-	const tc = performance.now();
+	const tc = performance$1.now();
 	const content = contentReader(bundle, opts.casDir);
 	providers.push({
 		name: "content",
@@ -11131,7 +11820,7 @@ async function runChecks(opts) {
 			profile: profile.facts
 		}
 	};
-	const tr = performance.now();
+	const tr = performance$1.now();
 	if (opts.root !== void 0 && profile.facts.allowRepo) try {
 		ctx.facts.repo = await createRepoFacts(opts.root);
 		providers.push({
@@ -11233,7 +11922,7 @@ async function runChecks(opts) {
 		}
 		await execute(check, predicate, params.params);
 	}
-	const tg = performance.now();
+	const tg = performance$1.now();
 	if (guardChecks.length > 0 || guardFailed) {
 		await runPool(guardChecks, GUARD_POOL_SIZE, (g) => execute(g.check, g.predicate, g.params));
 		providers.push({
@@ -11341,11 +12030,222 @@ async function casGet(root, hex) {
 		throw err;
 	}
 }
+function redactUri(uri) {
+	try {
+		const u = new URL(uri);
+		return u.protocol === "file:" ? `file://${u.pathname}` : `${u.origin}${u.pathname}`;
+	} catch {
+		return "<invalid uri>";
+	}
+}
+function hostAllowed(host, allowlist) {
+	if (allowlist === void 0) return true;
+	const h = host.toLowerCase();
+	for (const raw of allowlist) {
+		const p = raw.trim().toLowerCase();
+		if (p === "") continue;
+		if (p.startsWith("*.")) {
+			if (h.endsWith(p.slice(1)) && h.length > p.length - 1) return true;
+		} else if (h === p) return true;
+	}
+	return false;
+}
+function netError(code, message, src, opts, extra = {}) {
+	let host;
+	try {
+		host = new URL(src.uri).host;
+	} catch {
+		host = void 0;
+	}
+	const details = {
+		uri: redactUri(src.uri),
+		digest: src.digest,
+		...extra
+	};
+	if (host !== void 0) details.host = host;
+	const o = { details };
+	if (opts.path !== void 0) o.path = opts.path;
+	return new AxiomError(code, message, o);
+}
+async function openSink(root, hex) {
+	const target = casPath(root, hex);
+	await mkdir(dirname(target), { recursive: true });
+	const tmp = `${target}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+	return {
+		tmp,
+		fh: await open(tmp, "wx"),
+		hash: createHash("sha256"),
+		bytes: 0
+	};
+}
+async function readFileStream(uri, sink, maxBytes, src, opts) {
+	const p = fileURLToPath(uri);
+	const st = await stat(p).catch(() => void 0);
+	if (st === void 0 || !st.isFile()) throw netError("ERR_NET_FAILED", "file ref does not exist or is not a file", src, opts);
+	if (st.size > maxBytes) throw new AxiomError("ERR_BLOB_TOO_LARGE", `ref is ${st.size} bytes`, { details: {
+		bytes: st.size,
+		max: maxBytes,
+		uri: redactUri(src.uri)
+	} });
+	for await (const chunk of createReadStream(p)) {
+		const c = chunk;
+		sink.bytes += c.length;
+		if (sink.bytes > maxBytes) throw new AxiomError("ERR_BLOB_TOO_LARGE", "ref exceeds maxBytes", { details: {
+			max: maxBytes,
+			uri: redactUri(src.uri)
+		} });
+		sink.hash.update(c);
+		await sink.fh.write(c);
+	}
+}
+async function readHttpsStream(uri, sink, maxBytes, timeoutMs, src, opts) {
+	const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+	const ac = new AbortController();
+	const timer = setTimeout(() => ac.abort(/* @__PURE__ */ new Error("timeout")), timeoutMs);
+	try {
+		let res;
+		try {
+			res = await fetchImpl(uri, {
+				method: "GET",
+				redirect: "error",
+				signal: ac.signal,
+				headers: { accept: "*/*" }
+			});
+		} catch (err) {
+			const timedOut = ac.signal.aborted;
+			throw netError("ERR_NET_FAILED", timedOut ? `ref fetch timed out after ${timeoutMs} ms` : "ref fetch failed", src, opts, { reason: timedOut ? "timeout" : err.message });
+		}
+		if (!res.ok) throw netError("ERR_NET_FAILED", `ref fetch returned HTTP ${res.status}`, src, opts, { status: res.status });
+		const declared = Number(res.headers.get("content-length") ?? "");
+		if (Number.isFinite(declared) && declared > maxBytes) throw new AxiomError("ERR_BLOB_TOO_LARGE", `ref declares ${declared} bytes`, { details: {
+			bytes: declared,
+			max: maxBytes,
+			uri: redactUri(src.uri)
+		} });
+		if (res.body === null) return;
+		const reader = res.body.getReader();
+		for (;;) {
+			let step;
+			try {
+				step = await reader.read();
+			} catch (err) {
+				throw netError("ERR_NET_FAILED", ac.signal.aborted ? `ref fetch timed out after ${timeoutMs} ms` : "ref body read failed", src, opts, { reason: ac.signal.aborted ? "timeout" : err.message });
+			}
+			if (step.done) break;
+			sink.bytes += step.value.length;
+			if (sink.bytes > maxBytes) {
+				ac.abort(/* @__PURE__ */ new Error("maxBytes"));
+				await reader.cancel().catch(() => void 0);
+				throw new AxiomError("ERR_BLOB_TOO_LARGE", "ref exceeds maxBytes", { details: {
+					max: maxBytes,
+					uri: redactUri(src.uri)
+				} });
+			}
+			sink.hash.update(step.value);
+			await sink.fh.write(step.value);
+		}
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function resolveRef(src, opts) {
+	const hex = parseDigestRef(src.digest);
+	const cached = await casGet(opts.root, hex);
+	if (cached !== void 0) return cached;
+	if (!opts.allowNet) throw netError("ERR_NET_DISABLED", "ref is not in the CAS and network access is disabled (pass --allow-net)", src, opts);
+	let uri;
+	try {
+		uri = new URL(src.uri);
+	} catch {
+		throw netError("ERR_NET_DENIED", "ref uri is not a valid URL", src, opts);
+	}
+	if (uri.protocol === "file:") {
+		if (opts.allowFile !== true) throw netError("ERR_NET_DENIED", "file: refs need allowFile", src, opts, { protocol: "file:" });
+	} else if (uri.protocol !== "https:") throw netError("ERR_NET_DENIED", "only https: refs are fetched", src, opts, { protocol: uri.protocol });
+	else if (uri.username !== "" || uri.password !== "") throw netError("ERR_NET_DENIED", "credentials in a ref uri are not allowed", src, opts);
+	else if (!hostAllowed(uri.hostname, opts.allowlist)) throw netError("ERR_NET_DENIED", "ref host is not in the allowlist", src, opts, { allowlist: opts.allowlist ?? [] });
+	const maxBytes = opts.maxBytes ?? 33554432;
+	const timeoutMs = opts.timeoutMs ?? 3e4;
+	const sink = await openSink(opts.root, hex);
+	let ok = false;
+	try {
+		if (uri.protocol === "file:") await readFileStream(uri, sink, maxBytes, src, opts);
+		else await readHttpsStream(uri, sink, maxBytes, timeoutMs, src, opts);
+		const actual = sink.hash.digest("hex");
+		if (actual !== hex) throw new AxiomError("ERR_DIGEST_MISMATCH", "fetched ref does not match its pinned digest", { details: {
+			expected: src.digest,
+			actual: `sha256:${actual}`,
+			bytes: sink.bytes,
+			uri: redactUri(src.uri)
+		} });
+		await sink.fh.sync();
+		await sink.fh.close();
+		ok = true;
+		try {
+			await rename(sink.tmp, casPath(opts.root, hex));
+		} catch (err) {
+			await rm(sink.tmp, { force: true });
+			if (!await casHas(opts.root, hex)) throw err;
+		}
+	} finally {
+		if (!ok) {
+			await sink.fh.close().catch(() => void 0);
+			await rm(sink.tmp, { force: true });
+		}
+	}
+	const bytes = await casGet(opts.root, hex);
+	if (bytes === void 0) throw new AxiomError("ERR_BLOB_MISSING", "ref was stored but cannot be read back", { details: { digest: src.digest } });
+	return bytes;
+}
 const INLINE_BASE64_DECODED_MAX = 196608;
 const AXIOM_VERSION = "2.0.0";
 function invalidPlan(err) {
 	return new AxiomError("ERR_INVALID_PLAN", "plan does not match PlanSchema", { details: { issues: err.issues } });
 }
+function renderTemplate(a, src, opts) {
+	const emitter = opts.emitters?.get(src.emitter);
+	if (emitter === void 0) throw new AxiomError("ERR_EMITTER_UNKNOWN", `no emitter registered as "${src.emitter}"`, {
+		path: a.path,
+		details: {
+			emitter: src.emitter,
+			available: opts.emitters?.list() ?? []
+		}
+	});
+	const def = Object.hasOwn(emitter.templates, src.template) ? emitter.templates[src.template] : void 0;
+	if (def === void 0) throw new AxiomError("ERR_TEMPLATE_UNKNOWN", `emitter "${src.emitter}" has no template "${src.template}"`, {
+		path: a.path,
+		details: {
+			emitter: src.emitter,
+			template: src.template,
+			available: Object.keys(emitter.templates).sort()
+		}
+	});
+	const parsed = def.params.safeParse(src.params);
+	if (!parsed.success) throw new AxiomError("ERR_TEMPLATE_PARAMS", "template params fail the template schema", {
+		path: a.path,
+		details: {
+			emitter: src.emitter,
+			template: src.template,
+			issues: parsed.error.issues
+		}
+	});
+	const rendered = def.render(parsed.data);
+	const bytes = typeof rendered === "string" ? utf8Bytes(rendered) : rendered;
+	if (bytes.length > 262144) throw new AxiomError("ERR_BLOB_TOO_LARGE", `template rendered ${bytes.length} bytes`, {
+		path: a.path,
+		details: {
+			bytes: bytes.length,
+			max: INLINE_CONTENT_MAX
+		}
+	});
+	return {
+		bytes,
+		emitter: {
+			id: emitter.id,
+			version: emitter.version
+		}
+	};
+}
 async function resolveSource(a, opts) {
 	const src = a.source;
 	if (src === void 0) throw new AxiomError("ERR_INVALID_PLAN", "source is required unless op is delete", { path: a.path });
@@ -11360,7 +12260,7 @@ async function resolveSource(a, opts) {
 						max: INLINE_CONTENT_MAX
 					}
 				});
-				return bytes;
+				return { bytes };
 			}
 			if (!isBase64(src.content)) throw new AxiomError("ERR_INVALID_PLAN", "inline content is not valid base64", { path: a.path });
 			const bytes = decodeBlob({
@@ -11374,7 +12274,7 @@ async function resolveSource(a, opts) {
 					max: INLINE_BASE64_DECODED_MAX
 				}
 			});
-			return bytes;
+			return { bytes };
 		}
 		case "cas": {
 			const hex = parseDigestRef(src.digest);
@@ -11395,22 +12295,19 @@ async function resolveSource(a, opts) {
 					actual: `sha256:${actual}`
 				}
 			});
-			return bytes;
+			return { bytes };
 		}
-		case "ref": throw new AxiomError("ERR_REF_OFFLINE", "ref sources are not fetched in v2.0", {
-			path: a.path,
-			details: {
-				uri: src.uri,
-				digest: src.digest
-			}
-		});
-		case "template": throw new AxiomError("ERR_UNSUPPORTED_OP", "template sources ship in v2.1", {
-			path: a.path,
-			details: {
-				emitter: src.emitter,
-				template: src.template
-			}
-		});
+		case "ref":
+			if (opts.root === void 0) throw new AxiomError("ERR_REF_OFFLINE", "ref source needs a root (its CAS)", {
+				path: a.path,
+				details: { digest: src.digest }
+			});
+			return { bytes: await resolveRef(src, {
+				...opts.net ?? { allowNet: false },
+				root: opts.root,
+				path: a.path
+			}) };
+		case "template": return renderTemplate(a, src, opts);
 	}
 }
 async function resolveArtifact(a, opts) {
@@ -11422,9 +12319,9 @@ async function resolveArtifact(a, opts) {
 		},
 		bytes: void 0
 	};
-	const bytes = await resolveSource(a, opts);
+	const { bytes, emitter } = await resolveSource(a, opts);
 	const origin = a.source?.type ?? "inline";
-	return {
+	const out = {
 		artifact: {
 			path: a.path,
 			op: a.op,
@@ -11435,6 +12332,8 @@ async function resolveArtifact(a, opts) {
 		},
 		bytes
 	};
+	if (emitter !== void 0) out.emitter = emitter;
+	return out;
 }
 function digestOnlyPlan(plan, digests) {
 	const artifacts = [...plan.artifacts].sort((x, y) => compareUtf8(x.path, y.path)).map((a) => {
@@ -11443,10 +12342,19 @@ function digestOnlyPlan(plan, digests) {
 			mode: a.mode,
 			op: a.op
 		};
-		if (a.source !== void 0) out.source = {
-			type: a.source.type,
-			digest: `sha256:${digests.get(a.path) ?? ""}`
-		};
+		if (a.source !== void 0) {
+			const digest = `sha256:${digests.get(a.path) ?? ""}`;
+			out.source = a.source.type === "template" ? {
+				type: "template",
+				emitter: a.source.emitter,
+				template: a.source.template,
+				params: a.source.params,
+				digest
+			} : {
+				type: a.source.type,
+				digest
+			};
+		}
 		return out;
 	});
 	return {
@@ -11454,7 +12362,7 @@ function digestOnlyPlan(plan, digests) {
 		artifacts
 	};
 }
-function splitToolchain(input) {
+function splitToolchain(input, used) {
 	const emitters = {};
 	let axiom = AXIOM_VERSION;
 	for (const key of Object.keys(input ?? {}).sort()) {
@@ -11463,6 +12371,7 @@ function splitToolchain(input) {
 		if (key === "axiom") axiom = v;
 		else emitters[key] = v;
 	}
+	for (const id of [...used.keys()].sort()) emitters[id] = used.get(id);
 	return {
 		axiom,
 		emitters
@@ -11492,9 +12401,13 @@ async function compilePlan(planInput, opts = {}) {
 	for (const a of plan.artifacts) resolved.push(await resolveArtifact(a, opts));
 	resolved.sort((x, y) => compareUtf8(x.artifact.path, y.artifact.path));
 	const digests = /* @__PURE__ */ new Map();
-	for (const r of resolved) if (r.artifact.digest !== void 0) digests.set(r.artifact.path, r.artifact.digest.sha256);
+	const usedEmitters = /* @__PURE__ */ new Map();
+	for (const r of resolved) {
+		if (r.artifact.digest !== void 0) digests.set(r.artifact.path, r.artifact.digest.sha256);
+		if (r.emitter !== void 0) usedEmitters.set(r.emitter.id, r.emitter.version);
+	}
 	const planDigest = canonicalDigestRef(digestOnlyPlan(plan, digests));
-	const toolchain = splitToolchain(opts.toolchain);
+	const toolchain = splitToolchain(opts.toolchain, usedEmitters);
 	const body = {
 		apiVersion: plan.apiVersion,
 		kind: "Manifest",
@@ -11505,12 +12418,14 @@ async function compilePlan(planInput, opts = {}) {
 		checks: [...plan.checks].sort((x, y) => compareUtf8(x.id, y.id)),
 		toolchain
 	};
+	if (plan.counter !== void 0) body.counter = plan.counter;
 	const manifestDigest = canonicalDigestRef(body);
 	const blobs = {};
 	const useCas = opts.store === "cas" && opts.root !== void 0;
 	let total = 0;
 	for (const r of resolved) {
 		if (r.bytes === void 0 || r.artifact.digest === void 0) continue;
+		if (r.artifact.origin === "ref") continue;
 		if (useCas) {
 			await casPut(opts.root, r.bytes);
 			continue;
@@ -11587,6 +12502,17 @@ function diffManifests(a, b) {
 		changed
 	};
 }
+function createEmitterRegistry(emitters) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const e of emitters) {
+		if (byId.has(e.id)) throw new Error(`duplicate emitter id: ${e.id}`);
+		byId.set(e.id, e);
+	}
+	return {
+		get: (id) => byId.get(id),
+		list: () => [...byId.keys()].sort()
+	};
+}
 function issueCode(params) {
 	const code = params?.code;
 	return isErrorCode(code) ? code : "ERR_INVALID_MANIFEST";
@@ -12523,6 +13449,476 @@ var StdioServerTransport = class {
 		});
 	}
 };
+function defineTemplate(description, params, render) {
+	return {
+		description,
+		params,
+		render
+	};
+}
+function lines(...parts) {
+	const flat = [];
+	for (const p of parts) if (typeof p === "string") flat.push(p);
+	else flat.push(...p);
+	return `${flat.join("\n").replace(/\s+$/, "")}\n`;
+}
+const Ident = string().regex(/^[A-Za-z_$][A-Za-z0-9_$]*$/, "must be a JavaScript identifier").max(64);
+const HttpMethod = _enum([
+	"GET",
+	"POST",
+	"PUT",
+	"DELETE"
+]);
+const Segment = string().regex(/^[a-z0-9][a-z0-9-]*(\/(\[[a-z][a-zA-Z0-9]*\]|[a-z0-9][a-z0-9-]*))*$/, "invalid segment").max(128);
+const SORT_METHODS = (ms) => {
+	const order = [
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE"
+	];
+	return [...new Set(ms)].sort((a, b) => order.indexOf(a) - order.indexOf(b));
+};
+const routeHandler = defineTemplate("Next.js 16 App Router route handler (`app/api/<segment>/route.ts`) — one exported async function per method, `NextRequest` in, `Response.json` out; optional Zod body validation on the non-GET methods.", object$1({
+	segment: Segment,
+	methods: array(HttpMethod).min(1).max(4),
+	zodSchemaName: Ident.optional()
+}).strict(), ({ segment, methods, zodSchemaName }) => {
+	const schema = zodSchemaName;
+	return lines([
+		"import type { NextRequest } from \"next/server\";",
+		...schema === void 0 ? [] : [`import { ${schema} } from "./schema";`],
+		"",
+		`// ${segment} — generated by @codai/axiom-emitters-web (web@2.0.0).`,
+		""
+	], SORT_METHODS(methods).map((m) => {
+		if (m === "GET") return lines([
+			"export async function GET(request: NextRequest): Promise<Response> {",
+			"  const { searchParams } = new URL(request.url);",
+			"  return Response.json({ ok: true, query: Object.fromEntries(searchParams) });",
+			"}"
+		]).trimEnd();
+		if (m === "DELETE") return lines([
+			"export async function DELETE(_request: NextRequest): Promise<Response> {",
+			"  return new Response(null, { status: 204 });",
+			"}"
+		]).trimEnd();
+		const validate = schema === void 0 ? ["  const data = (await request.json()) as unknown;"] : [
+			"  const parsed = " + schema + ".safeParse(await request.json());",
+			"  if (!parsed.success) {",
+			"    return Response.json({ error: parsed.error.issues }, { status: 400 });",
+			"  }",
+			"  const data = parsed.data;"
+		];
+		return lines([
+			`export async function ${m}(request: NextRequest): Promise<Response> {`,
+			...validate,
+			`  return Response.json({ ok: true, data }, { status: ${m === "POST" ? 201 : 200} });`,
+			"}"
+		]).trimEnd();
+	}).join("\n\n"));
+});
+const ZOD_FIELD = {
+	string: "z.string().min(1)",
+	number: "z.coerce.number()",
+	boolean: "z.coerce.boolean()",
+	email: "z.email()"
+};
+const serverAction = defineTemplate("Next.js 16 Server Action (\"use server\") validating FormData with Zod v4 and returning a `useActionState`-compatible `{ ok, errors, values }` state.", object$1({
+	name: Ident,
+	fields: array(object$1({
+		name: Ident,
+		zod: _enum([
+			"string",
+			"number",
+			"boolean",
+			"email"
+		])
+	}).strict()).min(1).max(50)
+}).strict(), ({ name, fields }) => {
+	const State = `${name.charAt(0).toUpperCase()}${name.slice(1)}State`;
+	return lines([
+		"\"use server\";",
+		"",
+		"import { z } from \"zod\";",
+		"",
+		`// ${name} — generated by @codai/axiom-emitters-web (web@2.0.0).`,
+		"",
+		`const ${name}Schema = z.object({`,
+		...fields.map((f) => `  ${f.name}: ${ZOD_FIELD[f.zod]},`),
+		"});",
+		"",
+		`export interface ${State} {`,
+		"  ok: boolean;",
+		"  errors: Record<string, string[]>;",
+		`  values: Partial<z.output<typeof ${name}Schema>>;`,
+		"}",
+		"",
+		`export const initial${State}: ${State} = { ok: false, errors: {}, values: {} };`,
+		"",
+		`export async function ${name}(`,
+		`  _prev: ${State},`,
+		"  formData: FormData,",
+		`): Promise<${State}> {`,
+		`  const parsed = ${name}Schema.safeParse({`,
+		...fields.map((f) => `    ${f.name}: formData.get("${f.name}"),`),
+		"  });",
+		"  if (!parsed.success) {",
+		"    const flat = z.flattenError(parsed.error);",
+		"    return { ok: false, errors: flat.fieldErrors as Record<string, string[]>, values: {} };",
+		"  }",
+		"  return { ok: true, errors: {}, values: parsed.data };",
+		"}"
+	]);
+});
+const honoRoute = defineTemplate("Hono 4 route module exporting a `Hono` instance with one handler per method; mount it with `app.route(\"/\", <name>)`.", object$1({
+	name: Ident,
+	path: string().regex(/^\/[A-Za-z0-9/:_-]*$/, "path must start with /").max(128),
+	methods: array(HttpMethod).min(1).max(4)
+}).strict(), ({ name, path, methods }) => lines([
+	"import { Hono } from \"hono\";",
+	"",
+	`// ${name} — generated by @codai/axiom-emitters-web (web@2.0.0).`,
+	"",
+	`export const ${name} = new Hono();`,
+	"",
+	...SORT_METHODS(methods).flatMap((m) => [
+		`${name}.${m.toLowerCase()}("${path}", (c) => {`,
+		m === "DELETE" ? "  return c.body(null, 204);" : `  return c.json({ ok: true, method: "${m}" }${m === "POST" ? ", 201" : ""});`,
+		"});",
+		""
+	]),
+	`export default ${name};`
+]));
+const DRIZZLE_COLUMN = {
+	text: (n) => `text("${n}")`,
+	integer: (n) => `integer("${n}")`,
+	boolean: (n) => `boolean("${n}")`,
+	timestamp: (n) => `timestamp("${n}", { withTimezone: true })`,
+	uuid: (n) => `uuid("${n}")`
+};
+const drizzleTable = defineTemplate("Drizzle `pgTable` with the repo conventions: `id` identity column always generated, `withTimezone: true` on every timestamp, and inferred insert/select types.", object$1({
+	name: string().regex(/^[a-z][a-z0-9_]*$/, "snake_case table name").max(63),
+	columns: array(object$1({
+		name: string().regex(/^[a-z][a-z0-9_]*$/, "snake_case column name").max(63),
+		type: _enum([
+			"text",
+			"integer",
+			"boolean",
+			"timestamp",
+			"uuid"
+		]),
+		primaryKey: boolean().default(false),
+		notNull: boolean().default(false)
+	}).strict()).min(1).max(100)
+}).strict(), ({ name, columns }) => {
+	const kinds = [...new Set(columns.map((c) => c.type))].sort();
+	const toCamel = (s) => s.replace(/_([a-z0-9])/g, (_m, c) => c.toUpperCase());
+	const camel = toCamel(name);
+	const Type = `${camel.charAt(0).toUpperCase()}${camel.slice(1)}`;
+	const hasExplicitPk = columns.some((c) => c.primaryKey);
+	return lines([
+		`import { ${["pgTable", ...kinds].sort().join(", ")} } from "drizzle-orm/pg-core";`,
+		"",
+		`// ${name} — generated by @codai/axiom-emitters-web (web@2.0.0).`,
+		"",
+		`export const ${camel} = pgTable("${name}", {`,
+		...hasExplicitPk ? [] : ["  id: integer(\"id\").generatedAlwaysAsIdentity().primaryKey(),"],
+		...columns.map((c) => {
+			const suffix = [c.primaryKey ? ".primaryKey()" : "", c.notNull && !c.primaryKey ? ".notNull()" : ""].join("");
+			return `  ${toCamel(c.name)}: ${DRIZZLE_COLUMN[c.type](c.name)}${suffix},`;
+		}),
+		"});",
+		"",
+		`export type ${Type} = typeof ${camel}.$inferSelect;`,
+		`export type New${Type} = typeof ${camel}.$inferInsert;`
+	]);
+});
+const biomeConfig = defineTemplate("Biome 2.5 config matching this repo's own style (2-space, width 100, double quotes, LF, `noExplicitAny` / `noConsole` / `noNonNullAssertion` as errors).", object$1({}).strict(), () => lines([
+	"{",
+	"  \"$schema\": \"https://biomejs.dev/schemas/2.5.14/schema.json\",",
+	"  \"vcs\": { \"enabled\": true, \"clientKind\": \"git\", \"useIgnoreFile\": true },",
+	"  \"files\": { \"includes\": [\"**\", \"!**/dist\", \"!**/.next\"] },",
+	"  \"formatter\": {",
+	"    \"enabled\": true,",
+	"    \"indentStyle\": \"space\",",
+	"    \"indentWidth\": 2,",
+	"    \"lineWidth\": 100,",
+	"    \"lineEnding\": \"lf\"",
+	"  },",
+	"  \"javascript\": {",
+	"    \"formatter\": { \"quoteStyle\": \"double\", \"semicolons\": \"always\", \"trailingCommas\": \"all\" }",
+	"  },",
+	"  \"linter\": {",
+	"    \"enabled\": true,",
+	"    \"rules\": {",
+	"      \"preset\": \"recommended\",",
+	"      \"style\": {",
+	"        \"noNonNullAssertion\": \"error\",",
+	"        \"useImportType\": \"error\",",
+	"        \"useNodejsImportProtocol\": \"error\"",
+	"      },",
+	"      \"suspicious\": {",
+	"        \"noExplicitAny\": \"error\",",
+	"        \"noConsole\": { \"level\": \"error\", \"options\": { \"allow\": [\"error\", \"warn\"] } }",
+	"      },",
+	"      \"correctness\": { \"noUnusedImports\": \"error\", \"noUnusedVariables\": \"error\" }",
+	"    }",
+	"  }",
+	"}"
+]));
+const tailwindGlobals = defineTemplate("Tailwind v4 CSS-first entry (`@import \"tailwindcss\"` + an empty `@theme` block and light/dark tokens). No `tailwind.config.js`.", object$1({}).strict(), () => lines([
+	"@import \"tailwindcss\";",
+	"",
+	"@theme {",
+	"  --color-background: oklch(1 0 0);",
+	"  --color-foreground: oklch(0.145 0 0);",
+	"  --radius: 0.625rem;",
+	"}",
+	"",
+	"@layer base {",
+	"  :root {",
+	"    color-scheme: light dark;",
+	"  }",
+	"",
+	"  body {",
+	"    background-color: var(--color-background);",
+	"    color: var(--color-foreground);",
+	"  }",
+	"}"
+]));
+const EMITTERS = createEmitterRegistry([{
+	id: "web",
+	version: "2.0.0",
+	templates: {
+		"biome.config": biomeConfig,
+		"drizzle.table": drizzleTable,
+		"hono.route": honoRoute,
+		"next.route-handler": routeHandler,
+		"next.server-action": serverAction,
+		"readme.section": defineTemplate("A single `## <title>` markdown section with the given body — the smallest useful template, meant for composing docs from a plan.", object$1({
+			title: string().min(1).max(120),
+			body: string().max(8e3)
+		}).strict(), ({ title, body }) => lines([
+			`## ${title}`,
+			"",
+			body.replace(/\r\n/g, "\n").trimEnd()
+		])),
+		"tailwind.globals": tailwindGlobals
+	}
+}]);
+function emitterCatalogue(registry = EMITTERS) {
+	const rows = [];
+	for (const id of registry.list()) {
+		const e = registry.get(id);
+		if (e === void 0) continue;
+		for (const template of Object.keys(e.templates).sort()) rows.push({
+			emitter: e.id,
+			version: e.version,
+			template,
+			description: e.templates[template]?.description ?? ""
+		});
+	}
+	return rows;
+}
+function manifestsDir(root) {
+	return path.join(root, ".axiom", "manifests");
+}
+function reportsDir(root) {
+	return path.join(root, ".axiom", "reports");
+}
+function hexOf(ref) {
+	return ref.slice(7);
+}
+function toDigestRef(shaOrRef) {
+	const ref = shaOrRef.startsWith("sha256:") ? shaOrRef : `sha256:${shaOrRef}`;
+	const parsed = DigestRefSchema.safeParse(ref);
+	if (!parsed.success) throw new AxiomError("ERR_NOT_FOUND", `not a sha256 digest: ${shaOrRef}`);
+	return parsed.data;
+}
+async function writeJsonAtomic$1(file, value) {
+	await mkdir(path.dirname(file), { recursive: true });
+	const tmp = `${file}.tmp-${process.pid}`;
+	await writeFile(tmp, JSON.stringify(value), "utf8");
+	await rename(tmp, file);
+}
+async function readJsonOrUndefined$1(file) {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return void 0;
+		throw err;
+	}
+}
+async function saveManifest(root, bundle) {
+	const file = path.join(manifestsDir(root), `${hexOf(bundle.manifestDigest)}.json`);
+	await writeJsonAtomic$1(file, bundle);
+	return file;
+}
+async function saveReport(root, report) {
+	const file = path.join(reportsDir(root), `${hexOf(report.manifestDigest)}.json`);
+	await writeJsonAtomic$1(file, report);
+	return file;
+}
+async function loadManifest(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(path.join(manifestsDir(root), `${hexOf(ref)}.json`));
+		if (raw !== void 0) return ManifestBundleSchema.parse(raw);
+	}
+}
+async function loadReport(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(path.join(reportsDir(root), `${hexOf(ref)}.json`));
+		if (raw !== void 0) return CheckReportSchema.parse(raw);
+	}
+}
+async function loadApplied(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(appliedPath(root, ref));
+		if (raw !== void 0) return ApplyResultSchema.parse(raw);
+	}
+}
+async function listStored(roots, sub) {
+	const out = [];
+	for (const root of roots) {
+		let names;
+		try {
+			names = await readdir(path.join(root, ".axiom", sub));
+		} catch {
+			continue;
+		}
+		for (const n of names) {
+			const m = /^([0-9a-f]{64})\.json$/.exec(n);
+			if (m?.[1] !== void 0) out.push({
+				root,
+				sha: m[1]
+			});
+		}
+	}
+	return out;
+}
+const HEX64 = /^[0-9a-f]{64}$/;
+function casRootDir(root) {
+	return path.join(root, ".axiom", "cas", "sha256");
+}
+async function readdirOrEmpty(dir) {
+	try {
+		return await readdir(dir);
+	} catch (err) {
+		if (err.code === "ENOENT") return [];
+		throw err;
+	}
+}
+async function loadManifestArtifactDigests(root, hex) {
+	const file = path.join(manifestsDir(root), `${hex}.json`);
+	let raw;
+	try {
+		raw = await readFile(file, "utf8");
+	} catch (err) {
+		if (err.code === "ENOENT") throw new AxiomError("ERR_BLOB_MISSING", "a journal names a manifest that is not stored", { details: {
+			manifestDigest: `sha256:${hex}`,
+			file
+		} });
+		throw err;
+	}
+	const parsed = ManifestBundleSchema.safeParse(JSON.parse(raw));
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_MANIFEST", "stored manifest fails ManifestBundleSchema", { details: { file } });
+	const out = /* @__PURE__ */ new Set();
+	for (const a of parsed.data.manifest.artifacts) if (a.digest !== void 0) out.add(a.digest.sha256);
+	return out;
+}
+async function liveManifestHexes(root, keep) {
+	const hexes = /* @__PURE__ */ new Set();
+	const { journals } = await listJournals(root);
+	for (const j of journals) hexes.add(j.manifestDigest.slice(7));
+	if (keep === "journal") {
+		for (const n of await readdirOrEmpty(path.join(root, ".axiom", "applied"))) {
+			const m = /^([0-9a-f]{64})\.json$/.exec(n);
+			if (m?.[1] !== void 0) hexes.add(m[1]);
+		}
+		return hexes;
+	}
+	for (const n of await readdirOrEmpty(manifestsDir(root))) {
+		const m = /^([0-9a-f]{64})\.json$/.exec(n);
+		if (m?.[1] !== void 0) hexes.add(m[1]);
+	}
+	return hexes;
+}
+async function collectGarbage(root, opts = {}) {
+	const keep = opts.keep ?? "all-manifests";
+	const dryRun = opts.dryRun === true;
+	const now = opts.now ?? Date.now;
+	const lock = await acquireLock(root, "gc", opts.lockTimeoutMs ?? 1e3);
+	try {
+		const live = /* @__PURE__ */ new Set();
+		for (const hex of await liveManifestHexes(root, keep)) for (const d of await loadManifestArtifactDigests(root, hex)) live.add(d);
+		const casDir = casRootDir(root);
+		const removed = [];
+		const present = /* @__PURE__ */ new Set();
+		let scanned = 0;
+		let skippedYoung = 0;
+		let freedBytes = 0;
+		const cutoff = opts.olderThanMs === void 0 ? void 0 : now() - opts.olderThanMs;
+		for (const shard of (await readdirOrEmpty(casDir)).sort()) {
+			const shardDir = path.join(casDir, shard);
+			for (const name of (await readdirOrEmpty(shardDir)).sort()) {
+				const file = path.join(shardDir, name);
+				const st = await stat(file).catch(() => void 0);
+				if (st === void 0 || !st.isFile()) continue;
+				if (!HEX64.test(name)) {
+					if (name.endsWith(".tmp") && (cutoff === void 0 || st.mtimeMs < cutoff)) {
+						if (!dryRun) await rm(file, { force: true });
+						removed.push({
+							sha: name,
+							bytes: st.size
+						});
+						freedBytes += st.size;
+					}
+					continue;
+				}
+				scanned++;
+				present.add(name);
+				if (live.has(name)) continue;
+				if (cutoff !== void 0 && st.mtimeMs >= cutoff) {
+					skippedYoung++;
+					continue;
+				}
+				if (!dryRun) await rm(file, { force: true });
+				removed.push({
+					sha: name,
+					bytes: st.size
+				});
+				freedBytes += st.size;
+			}
+		}
+		let missing = 0;
+		for (const d of live) if (!present.has(d)) missing++;
+		return {
+			root,
+			keep,
+			dryRun,
+			scanned,
+			live: live.size,
+			missing,
+			removed,
+			skippedYoung,
+			freedBytes
+		};
+	} finally {
+		await lock.release();
+	}
+}
+function parseDuration(text) {
+	const m = /^(\d+)(ms|s|m|h|d)?$/.exec(text.trim());
+	if (m === null || m[1] === void 0) return void 0;
+	return Number(m[1]) * ({
+		ms: 1,
+		s: 1e3,
+		m: 6e4,
+		h: 36e5,
+		d: 864e5
+	}[m[2] ?? "ms"] ?? 1);
+}
 const SCHEMA_KINDS = [
 	"Plan",
 	"Manifest",
@@ -12530,7 +13926,8 @@ const SCHEMA_KINDS = [
 	"CheckReport",
 	"ApplyResult",
 	"Profile",
-	"Journal"
+	"Journal",
+	"RepoSnapshot"
 ];
 const BY_KIND = {
 	Plan: PlanSchema,
@@ -12539,22 +13936,180 @@ const BY_KIND = {
 	CheckReport: CheckReportSchema,
 	ApplyResult: ApplyResultSchema,
 	Profile: ProfileSchema,
-	Journal: JournalSchema
+	Journal: JournalSchema,
+	RepoSnapshot: RepoSnapshotSchema
 };
 function isSchemaKind(v) {
 	return typeof v === "string" && SCHEMA_KINDS.includes(v);
 }
-function jsonSchemaFor(kind) {
-	const json = toJSONSchema(BY_KIND[kind], {
-		target: "draft-2020-12",
-		io: "input",
-		unrepresentable: "any"
-	});
+function jsonSchemaFor(kind) {
+	const json = toJSONSchema(BY_KIND[kind], {
+		target: "draft-2020-12",
+		io: "input",
+		unrepresentable: "any"
+	});
+	return {
+		$id: `https://axiom.dev/schemas/v2/${kind}.schema.json`,
+		title: kind,
+		...json
+	};
+}
+const SIGNING_KEY_ENV = "AXIOM_SIGNING_KEY";
+function trustFilePath(root, rel = TRUST_FILE_DEFAULT) {
+	return path.join(root, ...rel.split("/"));
+}
+function trustStatePath(root) {
+	return path.join(root, ...TRUST_STATE_FILE.split("/"));
+}
+async function writeJsonAtomic(file, value, mode) {
+	await mkdir(path.dirname(file), { recursive: true });
+	const tmp = `${file}.tmp-${process.pid}`;
+	await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, {
+		encoding: "utf8",
+		mode
+	});
+	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
+	await rename(tmp, file);
+}
+async function readJsonOrUndefined(file) {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return void 0;
+		throw err;
+	}
+}
+async function keygen(outDir, name) {
+	const kp = generateKeyPair();
+	const file = path.join(outDir, `axiom-signing-${kp.keyid.slice(0, 16)}.key`);
+	await mkdir(outDir, { recursive: true });
+	try {
+		await writeFile(file, `${kp.privateKeyBase64}\n`, {
+			encoding: "utf8",
+			mode: 384,
+			flag: "wx"
+		});
+	} catch (err) {
+		if (err.code === "EEXIST") throw new AxiomError("ERR_EXISTS", `refusing to overwrite ${file}`, { path: file });
+		throw err;
+	}
+	await chmod(file, 384).catch(() => void 0);
+	const publicEntry = {
+		keyid: kp.keyid,
+		alg: "ed25519",
+		publicKey: kp.publicKeyBase64
+	};
+	if (name !== void 0) publicEntry.name = name;
+	return {
+		publicEntry,
+		privateKeyFile: file
+	};
+}
+async function loadSigningKey(src) {
+	let material;
+	if (src.keyFile !== void 0) material = await readFile(path.resolve(src.keyFile), "utf8");
+	else material = (src.env ?? process.env)[SIGNING_KEY_ENV];
+	if (material === void 0 || material.trim().length === 0) throw new AxiomError("ERR_NOT_FOUND", `no signing key: set ${SIGNING_KEY_ENV} (base64 PKCS#8 or raw seed) or pass --key-file`);
+	try {
+		return privateKeyFrom(material);
+	} catch (err) {
+		throw new AxiomError("ERR_SIGNATURE_INVALID", "signing key material is not a usable ed25519 key", { cause: err });
+	}
+}
+async function signBundle(bundle, src) {
+	const key = await loadSigningKey(src);
+	const keyid = keyidFor(key);
+	const env = signEnvelope(bundle.manifest, key, keyid);
+	const others = (bundle.signatures ?? []).filter((s) => !s.signatures.some((x) => x.keyid === keyid));
+	return {
+		bundle: {
+			...bundle,
+			signatures: [...others, env]
+		},
+		keyid
+	};
+}
+async function verifyBundleAgainstRoot(root, bundle, rel = TRUST_FILE_DEFAULT) {
+	const store = await loadTrustStore(root, rel);
+	if (store === void 0) return void 0;
+	const v = verifyBundleSignatures(bundle, store, bundle.manifest.counter);
 	return {
-		$id: `https://axiom.dev/schemas/v2/${kind}.schema.json`,
-		title: kind,
-		...json
+		trustFile: rel,
+		keyids: v.keyids,
+		findings: v.findings.map((f) => ({
+			id: f.id,
+			message: f.message
+		})),
+		ok: v.keyids.length > 0 && v.findings.length === 0
+	};
+}
+async function loadTrustStore(root, rel = TRUST_FILE_DEFAULT) {
+	const raw = await readJsonOrUndefined(trustFilePath(root, rel));
+	if (raw === void 0) return void 0;
+	const parsed = TrustStoreSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_PROFILE", `trust store ${rel} is invalid`, { details: { issues: parsed.error.issues.slice(0, 10).map((i) => i.message) } });
+	return parsed.data;
+}
+function parsePublicEntry(raw) {
+	const candidate = typeof raw === "object" && raw !== null && "publicEntry" in raw ? raw.publicEntry : raw;
+	const parsed = TrustedKeySchema.safeParse(candidate);
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_PROFILE", "not a trusted-key entry", { details: { issues: parsed.error.issues.slice(0, 10).map((i) => i.message) } });
+	const derived = keyidFor(publicKeyBase64(publicKeyFrom(parsed.data.publicKey)));
+	if (derived !== parsed.data.keyid) throw new AxiomError("ERR_SIGNATURE_INVALID", "keyid does not match publicKey", { details: {
+		keyid: parsed.data.keyid,
+		derived
+	} });
+	return parsed.data;
+}
+async function trustAdd(root, entry, rel = TRUST_FILE_DEFAULT) {
+	const store = await loadTrustStore(root, rel) ?? {
+		version: 1,
+		keys: []
+	};
+	const keys = store.keys.filter((k) => k.keyid !== entry.keyid);
+	keys.push(entry);
+	keys.sort((a, b) => a.keyid < b.keyid ? -1 : a.keyid > b.keyid ? 1 : 0);
+	const next = {
+		...store,
+		keys
+	};
+	await writeJsonAtomic(trustFilePath(root, rel), next);
+	return next;
+}
+async function trustRemove(root, keyid, rel = TRUST_FILE_DEFAULT) {
+	const store = await loadTrustStore(root, rel);
+	if (store === void 0) throw new AxiomError("ERR_NOT_FOUND", `trust store ${rel} not found`);
+	const keys = store.keys.filter((k) => k.keyid !== keyid);
+	if (keys.length === store.keys.length) throw new AxiomError("ERR_NOT_FOUND", `keyid ${keyid} not in trust store`);
+	const next = {
+		...store,
+		keys
 	};
+	await writeJsonAtomic(trustFilePath(root, rel), next);
+	return next;
+}
+async function loadTrustState(root) {
+	const raw = await readJsonOrUndefined(trustStatePath(root));
+	if (raw === void 0) return void 0;
+	const parsed = TrustStateSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_JOURNAL_CORRUPT", `${TRUST_STATE_FILE} is invalid`);
+	return parsed.data;
+}
+async function advanceTrustState(root, bundle) {
+	const counter = bundle.manifest.counter;
+	if (counter === void 0) return void 0;
+	const cur = await loadTrustState(root);
+	if (cur !== void 0 && cur.lastCounter >= counter) return cur;
+	const next = {
+		version: 1,
+		lastCounter: counter,
+		manifestDigest: bundle.manifestDigest
+	};
+	await writeJsonAtomic(trustStatePath(root), next);
+	return next;
+}
+function profileWantsAntiRollback(checks) {
+	return checks.some((c) => c.predicate === "manifest.requireSigned" && typeof c.params === "object" && c.params !== null && c.params.antiRollback === true);
 }
 const LOG_LEVELS = [
 	"error",
@@ -12593,7 +14148,7 @@ function createLogger(opts = {}) {
 	};
 }
 const silentLogger = createLogger({ write: () => {} });
-const realpathNative = promisify(realpath.native);
+const realpathNative = promisify(realpath$1.native);
 const IS_WIN32 = process.platform === "win32";
 async function realDir(p, code) {
 	let real;
@@ -25387,80 +26942,205 @@ const EMPTY_COMPLETION_RESULT = { completion: {
 	values: [],
 	hasMore: false
 } };
-function manifestsDir(root) {
-	return path.join(root, ".axiom", "manifests");
-}
-function reportsDir(root) {
-	return path.join(root, ".axiom", "reports");
-}
-function hexOf(ref) {
-	return ref.slice(7);
+const SNAPSHOT_MAX_FILES_DEFAULT = 2e4;
+const SNAPSHOT_MAX_FILES_CAP = 5e4;
+const SNAPSHOT_MAX_BYTES_DEFAULT = 67108864;
+const ALWAYS_SKIP = /* @__PURE__ */ new Set([".git", ".axiom"]);
+function globToRegExp(glob) {
+	let re = "^";
+	for (let i = 0; i < glob.length; i++) {
+		const c = glob[i];
+		if (c === "*") {
+			if (glob[i + 1] === "*") {
+				i++;
+				if (glob[i + 1] === "/") {
+					i++;
+					re += "(?:.*/)?";
+				} else re += ".*";
+			} else re += "[^/]*";
+		} else if (c === "?") re += "[^/]";
+		else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+	}
+	return new RegExp(`${re}$`);
 }
-function toDigestRef(shaOrRef) {
-	const ref = shaOrRef.startsWith("sha256:") ? shaOrRef : `sha256:${shaOrRef}`;
-	const parsed = DigestRefSchema.safeParse(ref);
-	if (!parsed.success) throw new AxiomError("ERR_NOT_FOUND", `not a sha256 digest: ${shaOrRef}`);
-	return parsed.data;
+function matcherOf(globs, whenEmpty) {
+	if (globs === void 0 || globs.length === 0) return () => whenEmpty;
+	const res = globs.map(globToRegExp);
+	return (rel) => res.some((r) => r.test(rel));
 }
-async function writeJsonAtomic(file, value) {
-	await mkdir(path.dirname(file), { recursive: true });
-	const tmp = `${file}.tmp-${process.pid}`;
-	await writeFile(tmp, JSON.stringify(value), "utf8");
-	await rename(tmp, file);
+function validateGlob(g, label) {
+	const probe = g.replace(/\*+/g, "x").replace(/\?/g, "x").replace(/\/+$/, "");
+	if (probe.length === 0 || !isValidRelPath(probe)) throw new AxiomError("ERR_CONTAINMENT", `${label} glob must be a contained relative path: ${g}`, { details: { glob: g } });
 }
-async function readJsonOrUndefined(file) {
+async function gitignoreMatcher(root) {
+	let text;
 	try {
-		return JSON.parse(await readFile(file, "utf8"));
-	} catch (err) {
-		if (err.code === "ENOENT") return void 0;
-		throw err;
+		text = await readFile(path.join(root, ".gitignore"), "utf8");
+	} catch {
+		return () => false;
 	}
+	const globs = [];
+	for (const raw of text.split(/\r?\n/)) {
+		const l = raw.trim();
+		if (l.length === 0 || l.startsWith("#") || l.startsWith("!")) continue;
+		let pat = l.startsWith("/") ? l.slice(1) : l.includes("/") ? l : `**/${l}`;
+		if (pat.endsWith("/")) pat = pat.slice(0, -1);
+		globs.push(pat, `${pat}/**`);
+	}
+	return matcherOf(globs, false);
 }
-async function saveManifest(root, bundle) {
-	const file = path.join(manifestsDir(root), `${hexOf(bundle.manifestDigest)}.json`);
-	await writeJsonAtomic(file, bundle);
-	return file;
+function sha256File(abs) {
+	return new Promise((resolve, reject) => {
+		const h = createHash("sha256");
+		createReadStream(abs).on("data", (chunk) => h.update(chunk)).on("error", reject).on("end", () => resolve(h.digest("hex")));
+	});
 }
-async function saveReport(root, report) {
-	const file = path.join(reportsDir(root), `${hexOf(report.manifestDigest)}.json`);
-	await writeJsonAtomic(file, report);
-	return file;
+function modeOf(mode) {
+	return process.platform !== "win32" && (mode & 64) !== 0 ? "0755" : "0644";
+}
+async function snapshotRoot(root, opts = {}) {
+	if (opts.followSymlinks === true) throw new AxiomError("ERR_UNSUPPORTED_OP", "followSymlinks is not supported (symlinks are recorded, never followed)");
+	const rootReal = await realpath(root);
+	const maxFiles = Math.min(opts.maxFiles ?? 2e4, SNAPSHOT_MAX_FILES_CAP);
+	const maxBytes = opts.maxBytes ?? 67108864;
+	if (maxFiles < 1 || maxBytes < 0) throw new AxiomError("ERR_INVALID_PLAN", "maxFiles must be ≥ 1 and maxBytes ≥ 0", { details: {
+		maxFiles,
+		maxBytes
+	} });
+	for (const g of opts.include ?? []) validateGlob(g, "include");
+	for (const g of opts.exclude ?? []) validateGlob(g, "exclude");
+	const include = matcherOf(opts.include, true);
+	const exclude = matcherOf(opts.exclude, false);
+	const ignored = opts.respectGitignore === false ? () => false : await gitignoreMatcher(rootReal);
+	const withDigest = opts.withContentDigest !== false;
+	const files = [];
+	let bytes = 0;
+	let truncated = false;
+	const visit = async (dirAbs, dirRel) => {
+		let entries;
+		try {
+			const dir = await opendir(dirAbs);
+			entries = [];
+			for await (const e of dir) entries.push(e);
+		} catch {
+			return;
+		}
+		const sortKey = (d) => d.isDirectory() ? `${d.name}/` : d.name;
+		entries.sort((a, b) => compareUtf8(sortKey(a), sortKey(b)));
+		for (const e of entries) {
+			if (truncated) return;
+			const rel = dirRel === "" ? e.name : `${dirRel}/${e.name}`;
+			if (!isValidRelPath(rel)) continue;
+			if (e.isDirectory()) {
+				if (ALWAYS_SKIP.has(e.name) || ignored(rel) || exclude(rel)) continue;
+				await visit(path.join(dirAbs, e.name), rel);
+				continue;
+			}
+			if (ignored(rel) || !include(rel) || exclude(rel)) continue;
+			const abs = path.join(dirAbs, e.name);
+			let entry;
+			if (e.isSymbolicLink()) entry = await symlinkEntry(rootReal, abs, rel, withDigest);
+			else if (e.isFile()) entry = await fileEntry(abs, rel, withDigest);
+			if (entry === void 0) continue;
+			if (files.length >= maxFiles || bytes + entry.bytes > maxBytes) {
+				truncated = true;
+				return;
+			}
+			files.push(entry);
+			bytes += entry.bytes;
+		}
+	};
+	await visit(rootReal, "");
+	files.sort((a, b) => compareUtf8(a.path, b.path));
+	const body = {
+		files,
+		truncated,
+		counts: {
+			files: files.length,
+			bytes
+		}
+	};
+	return {
+		apiVersion: "axiom.dev/v2",
+		kind: "RepoSnapshot",
+		root: { kind: "relative" },
+		snapshotDigest: canonicalDigestRef(body),
+		body
+	};
 }
-async function loadManifest(roots, ref) {
-	for (const root of roots) {
-		const raw = await readJsonOrUndefined(path.join(manifestsDir(root), `${hexOf(ref)}.json`));
-		if (raw !== void 0) return ManifestBundleSchema.parse(raw);
+async function fileEntry(abs, rel, withDigest) {
+	let st;
+	try {
+		st = await lstat(abs);
+	} catch {
+		return;
 	}
-}
-async function loadReport(roots, ref) {
-	for (const root of roots) {
-		const raw = await readJsonOrUndefined(path.join(reportsDir(root), `${hexOf(ref)}.json`));
-		if (raw !== void 0) return CheckReportSchema.parse(raw);
+	if (!st.isFile()) return void 0;
+	const entry = {
+		path: rel,
+		bytes: st.size,
+		mode: modeOf(st.mode),
+		kind: "file"
+	};
+	if (withDigest) try {
+		entry.sha256 = await sha256File(abs);
+	} catch {
+		return;
 	}
+	return entry;
 }
-async function loadApplied(roots, ref) {
-	for (const root of roots) {
-		const raw = await readJsonOrUndefined(appliedPath(root, ref));
-		if (raw !== void 0) return ApplyResultSchema.parse(raw);
+async function symlinkEntry(rootReal, abs, rel, withDigest) {
+	const entry = {
+		path: rel,
+		bytes: 0,
+		mode: "0644",
+		kind: "symlink"
+	};
+	let target;
+	try {
+		target = await realpath(abs);
+	} catch {
+		return entry;
+	}
+	if (!isSameOrInside(rootReal, target)) return entry;
+	let st;
+	try {
+		st = await lstat(target);
+	} catch {
+		return entry;
+	}
+	if (!st.isFile()) return entry;
+	entry.bytes = st.size;
+	entry.mode = modeOf(st.mode);
+	if (withDigest) try {
+		entry.sha256 = await sha256File(target);
+	} catch {
+		entry.bytes = 0;
 	}
+	return entry;
 }
-async function listStored(roots, sub) {
-	const out = [];
-	for (const root of roots) {
-		let names;
-		try {
-			names = await readdir(path.join(root, ".axiom", sub));
-		} catch {
-			continue;
-		}
-		for (const n of names) {
-			const m = /^([0-9a-f]{64})\.json$/.exec(n);
-			if (m?.[1] !== void 0) out.push({
-				root,
-				sha: m[1]
-			});
-		}
+function diffSnapshots(a, b) {
+	const key = (e) => e.sha256 ?? `bytes:${e.bytes}:${e.kind}`;
+	const ma = new Map(a.body.files.map((e) => [e.path, e]));
+	const mb = new Map(b.body.files.map((e) => [e.path, e]));
+	const out = {
+		added: [],
+		removed: [],
+		changed: []
+	};
+	for (const [p, eb] of mb) {
+		const ea = ma.get(p);
+		if (ea === void 0) out.added.push(p);
+		else if (key(ea) !== key(eb) || ea.mode !== eb.mode || ea.kind !== eb.kind) out.changed.push({
+			path: p,
+			from: ea.sha256 ?? null,
+			to: eb.sha256 ?? null
+		});
 	}
+	for (const p of ma.keys()) if (!mb.has(p)) out.removed.push(p);
+	out.added.sort(compareUtf8);
+	out.removed.sort(compareUtf8);
+	out.changed.sort((x, y) => compareUtf8(x.path, y.path));
 	return out;
 }
 const BUNDLE_BYTES_MAX = 4194304;
@@ -25567,7 +27247,16 @@ const ManifestVerifyOutput = object$1({
 		code: ErrorCodeSchema,
 		message: string(),
 		path: string().optional()
-	}))
+	})),
+	signatures: object$1({
+		trustFile: string(),
+		keyids: array(string()),
+		findings: array(object$1({
+			id: string(),
+			message: string()
+		})),
+		ok: boolean()
+	}).optional()
 });
 const RollbackOutput = object$1({
 	manifestDigest: DigestRefSchema,
@@ -25631,7 +27320,10 @@ const TOOL_DEFS = [
 				})
 			};
 			try {
-				const { bundle } = await compilePlan(parsed.data, { store: "inline" });
+				const { bundle } = await compilePlan(parsed.data, {
+					store: "inline",
+					emitters: EMITTERS
+				});
 				return {
 					ok: true,
 					planDigest: bundle.manifest.planDigest,
@@ -25654,7 +27346,7 @@ const TOOL_DEFS = [
 	defineTool({
 		name: "axiom_plan_compile",
 		title: "Compile a Plan into a ManifestBundle",
-		description: "Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). `store: cas` writes blobs under <root>/.axiom/cas instead of inlining them. When a root is given the bundle is stored under <root>/.axiom/manifests/<hex>.json so later tools can reference it by digest.",
+		description: "Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). `store: cas` writes blobs under <root>/.axiom/cas instead of inlining them. When a root is given the bundle is stored under <root>/.axiom/manifests/<hex>.json so later tools can reference it by digest. `template` sources are rendered by the built-in `web` emitter (see `axiom emitters`); its version is recorded in toolchain.emitters.",
 		inputSchema: {
 			plan: LooseObject.describe("Plan document"),
 			store: _enum(["inline", "cas"]).optional().describe("Blob transport; default inline"),
@@ -25665,7 +27357,10 @@ const TOOL_DEFS = [
 		async handler(ctx, { plan, store, root }) {
 			guardPayloadSize("plan", plan);
 			const rootReal = root !== void 0 || store === "cas" ? (await resolveRoot(ctx.policy, root)).rootReal : void 0;
-			const opts = { store: store ?? "inline" };
+			const opts = {
+				store: store ?? "inline",
+				emitters: EMITTERS
+			};
 			if (rootReal !== void 0) opts.root = rootReal;
 			const { bundle } = await compilePlan(plan, opts);
 			if (rootReal !== void 0) {
@@ -25690,11 +27385,14 @@ const TOOL_DEFS = [
 	defineTool({
 		name: "axiom_manifest_verify",
 		title: "Verify a ManifestBundle",
-		description: "Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. Never writes.",
-		inputSchema: { bundle: LooseObject.describe("ManifestBundle") },
+		description: "Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. When a root with .axiom/trust/keys.json is available, detached DSSE signatures are verified and the trusted keyids are reported under `signatures`. Never writes.",
+		inputSchema: {
+			bundle: LooseObject.describe("ManifestBundle"),
+			root: RootArg
+		},
 		outputSchema: ManifestVerifyOutput,
 		annotations: READ,
-		async handler(_ctx, { bundle }) {
+		async handler(ctx, { bundle, root }) {
 			guardPayloadSize("bundle", bundle);
 			const r = verifyBundle(bundle);
 			const out = {
@@ -25705,12 +27403,25 @@ const TOOL_DEFS = [
 				errors: r.errors
 			};
 			if (r.manifestDigest !== void 0) out.manifestDigest = r.manifestDigest;
+			if (r.ok) {
+				const rootReal = await optionalRoot(ctx, root);
+				if (rootReal !== void 0) {
+					const sig = await verifyBundleAgainstRoot(rootReal, parseBundle(bundle));
+					if (sig !== void 0) {
+						out.signatures = sig;
+						out.signed = sig.keyids.length > 0;
+						if (!sig.ok) out.ok = false;
+					}
+				}
+			}
 			return out;
 		},
 		summarize: (o) => ({
 			ok: o.ok,
 			manifestDigest: o.manifestDigest,
 			canonical: o.canonical,
+			signed: o.signed,
+			keyids: o.signatures?.keyids,
 			missing: o.missing.length,
 			errors: o.errors.slice(0, 20)
 		})
@@ -25776,6 +27487,7 @@ const TOOL_DEFS = [
 				manifestDigest: parsed.manifestDigest
 			} });
 			const { rootReal } = await resolveRoot(ctx.policy, root);
+			const profileDoc = await profileFor(ctx, parsed, profile, rootReal);
 			const result = await apply({
 				bundle: parsed,
 				root: rootReal,
@@ -25789,6 +27501,7 @@ const TOOL_DEFS = [
 				await saveManifest(rootReal, parsed);
 				ctx.seenRoots.add(rootReal);
 			}
+			if (result.status === "applied" && profileWantsAntiRollback([...profileDoc.checks, ...parsed.manifest.checks])) await advanceTrustState(rootReal, parsed);
 			ctx.log.info("apply", {
 				manifestDigest: parsed.manifestDigest,
 				status: result.status,
@@ -25891,6 +27604,46 @@ const TOOL_DEFS = [
 			return { roots };
 		},
 		summarize: (o) => o
+	}),
+	defineTool({
+		name: "axiom_repo_snapshot",
+		title: "Snapshot a root",
+		description: "Deterministic, content-addressed inventory of a root: every regular file (and symlink) as { path, bytes, sha256, mode, kind }, sorted by code point, with snapshotDigest = sha256(JCS(body)). No timestamps, no absolute paths — the same tree gives the same digest on every machine. Honours the root .gitignore, always skips .git/ and .axiom/, never follows symlinks, never leaves the root. Use it to build Plans against real pre-image digests, or diff two snapshots with `axiom snapshot-diff`.",
+		inputSchema: {
+			root: RootArg,
+			include: array(string().min(1)).optional().describe("Relative globs (*, **, ?) to keep; default everything"),
+			exclude: array(string().min(1)).optional().describe("Relative globs to drop"),
+			maxFiles: int().min(1).max(SNAPSHOT_MAX_FILES_CAP).default(SNAPSHOT_MAX_FILES_DEFAULT).describe(`Stop after this many files (cap ${SNAPSHOT_MAX_FILES_CAP}); sets truncated`),
+			maxBytes: int().nonnegative().default(SNAPSHOT_MAX_BYTES_DEFAULT).describe("Stop once the summed size would exceed this; sets truncated"),
+			followSymlinks: literal(false).default(false).describe("Always false; symlinks are recorded, never followed"),
+			respectGitignore: boolean().default(true),
+			withContentDigest: boolean().default(true).describe("false → sizes only, no sha256")
+		},
+		outputSchema: RepoSnapshotSchema,
+		annotations: READ,
+		async handler(ctx, input) {
+			const { rootReal } = await resolveRoot(ctx.policy, input.root);
+			const opts = {
+				maxFiles: input.maxFiles,
+				maxBytes: input.maxBytes,
+				respectGitignore: input.respectGitignore,
+				withContentDigest: input.withContentDigest
+			};
+			if (input.include !== void 0) opts.include = input.include;
+			if (input.exclude !== void 0) opts.exclude = input.exclude;
+			const snap = await snapshotRoot(rootReal, opts);
+			ctx.log.debug("snapshot", {
+				root: rootReal,
+				files: snap.body.counts.files
+			});
+			return snap;
+		},
+		summarize: (o) => ({
+			snapshotDigest: o.snapshotDigest,
+			counts: o.body.counts,
+			truncated: o.body.truncated,
+			paths: o.body.files.slice(0, 20).map((f) => f.path)
+		})
 	})
 ];
 async function resolveBundleOrRef(ctx, v, label) {
@@ -26083,6 +27836,10 @@ function createServer(policy, opts = {}) {
 			text: JSON.stringify(jsonSchemaFor(k), null, 2)
 		}] };
 	});
+	server.registerResource("emitters", "axiom://emitters", {
+		title: "Template emitters available to axiom_plan_compile",
+		mimeType: "application/json"
+	}, async (uri) => json(uri.href, emitterCatalogue()));
 	log.info("server created", {
 		name: SERVER_NAME,
 		version: SERVER_VERSION,
@@ -26097,20 +27854,34 @@ const help = (version) => `axiom ${version} — transactional write gate for AI
 
 Usage:
   axiom mcp [--root <abs>]... [--allow-guards] [--guard-allowlist <abs>]... [--log-level ${LOG_LEVELS.join("|")}]
+            [--http <host:port>] [--http-token-env <NAME>]
   axiom compile <plan.json|plan.axm> [-o <out.json>] [--store inline|cas] [--root <dir>]
-	axiom verify <bundle.json>
+                                     [--allow-net [--net-allow <host>[,host]]] [--allow-file]   (ref sources; offline by default)
+  axiom verify <bundle.json> [--root <dir>]      (with --root: also verify signatures against .axiom/trust/keys.json)
   axiom check <bundle.json> --root <dir> [--profile <name>] [--json] [--allow-guards] [--guard-allowlist <abs>]...
   axiom apply <bundle.json> --root <dir> [--dry-run] [--profile <name>] [--confirm <digest>]
                                          [--pr [--branch <name>] [--message <text>]]
                                          [--allow-guards] [--guard-allowlist <abs>]...
 	axiom rollback <digest> --root <dir>
+  axiom gc --root <dir> [--dry-run] [--older-than <n>(ms|s|m|h|d)] [--keep all-manifests|journal]   (CAS garbage collection; CLI only)
 	axiom diff <a.json> <b.json>
 	axiom schema <${SCHEMA_KINDS.join("|")}>
+  axiom emitters [--json]                  (template emitters available to \`compile\`)
+  axiom keygen [--out <dir>] [--name <label>]   (ed25519; private key → file 0600, public entry → stdout)
+  axiom sign <bundle.json> [--key-file <path>] [-o <out.json>]   (private key from --key-file or $${SIGNING_KEY_ENV})
+  axiom trust add <pubkey.json> --root <dir> | trust remove <keyid> --root <dir> | trust list --root <dir>
   axiom gate --stdin [--root <dir>] [--profile <file>] [--strict] [--log-level ...]   (PreToolUse hook; exit 0 allow / 2 deny)
+    axiom migrate v1 <manifest.json> [-o <plan.json>] [--profile <name>] [--cas <root>] [--content <dir>] [--overwrite]
+                                           (v1 manifest → v2 Plan; exit 1 = migrated with warnings)
+  axiom snapshot --root <dir> [-o <out.json>] [--include <glob>]... [--exclude <glob>]... [--max-files <n>] [--no-gitignore] [--no-digest]
+  axiom snapshot-diff <a.json> <b.json>       (RepoSnapshot files → { added, removed, changed })
 	axiom --version | --help
 
 Exit codes: 0 ok · 1 verdict fail / apply failed · 2 usage or error.
 The \`mcp\` verb speaks JSON-RPC on stdout and logs JSON lines on stderr; every other verb prints JSON to stdout.
+With --http it serves Streamable HTTP at http://<host:port>/mcp instead (port 0 = random; the URL is logged at
+info level). A non-loopback host requires a bearer token in the env var named by --http-token-env
+(default AXIOM_HTTP_TOKEN); loopback binds accept an optional token.
 A \`.axm\` plan with errors prints its diagnostics as JSON and exits 2.
 \`guard.external\` checks run only with --allow-guards AND a profile that sets facts.allowGuards; absolute
 commands must additionally appear in --guard-allowlist (relative ones must live under <root>/scripts/).
@@ -26179,6 +27950,8 @@ async function cmdMcp(argv) {
 			multiple: true
 		},
 		"log-level": { type: "string" },
+		http: { type: "string" },
+		"http-token-env": { type: "string" },
 		...GUARD_FLAGS
 	});
 	const level = values["log-level"] ?? "warn";
@@ -26188,6 +27961,32 @@ async function cmdMcp(argv) {
 	if (policy.roots.size === 0) log.warn("no --root given; every root-taking tool will fail with ERR_ROOT_REQUIRED");
 	const guards = guardOptions(values);
 	if (guards.allowGuards) log.warn("external guards ENABLED (--allow-guards)", { allowlist: guards.guardAllowlist });
+	if (values.http !== void 0) {
+		const { parseHostPort, startHttp, HTTP_TOKEN_ENV_DEFAULT } = await import("./http-lazy.js");
+		const { host, port } = parseHostPort(values.http);
+		const tokenEnv = values["http-token-env"] ?? HTTP_TOKEN_ENV_DEFAULT;
+		const token = process.env[tokenEnv];
+		const httpOpts = {
+			host,
+			port,
+			log
+		};
+		if (token !== void 0 && token.length > 0) httpOpts.token = token;
+		const handle = await startHttp(() => createServer(policy, {
+			log,
+			guards
+		}), httpOpts);
+		await new Promise((resolve) => {
+			const stop = () => {
+				handle.close().then(resolve);
+			};
+			process.once("SIGINT", stop);
+			process.once("SIGTERM", stop);
+			process.stdin.on("end", stop);
+			process.stdin.resume();
+		});
+		return EXIT_OK;
+	}
 	const server = createServer(policy, {
 		log,
 		guards
@@ -26208,15 +28007,31 @@ async function cmdCompile(argv) {
 			short: "o"
 		},
 		store: { type: "string" },
-		root: { type: "string" }
+		root: { type: "string" },
+		"allow-net": { type: "boolean" },
+		"net-allow": {
+			type: "string",
+			multiple: true
+		},
+		"allow-file": { type: "boolean" }
 	});
 	const file = positionals[0];
 	if (file === void 0) throw new UsageError("compile: <plan.json|plan.axm> is required");
 	const store = values.store ?? "inline";
 	if (store !== "inline" && store !== "cas") throw new UsageError("--store must be inline|cas");
-	const compileOpts = { store };
+	const allowNet = values["allow-net"] === true;
+	const allowlist = (values["net-allow"] ?? []).flatMap((s) => s.split(",")).filter((s) => s !== "");
+	if (!allowNet && allowlist.length > 0) throw new UsageError("--net-allow requires --allow-net");
+	const net = { allowNet };
+	if (allowlist.length > 0) net.allowlist = allowlist;
+	if (values["allow-file"] === true) net.allowFile = true;
+	const compileOpts = {
+		store,
+		emitters: EMITTERS,
+		net
+	};
 	let rootReal;
-	if (values.root !== void 0 || store === "cas") {
+	if (values.root !== void 0 || store === "cas" || allowNet || net.allowFile === true) {
 		rootReal = await realRootArg(values.root ?? ".");
 		compileOpts.root = rootReal;
 	}
@@ -26233,12 +28048,30 @@ async function cmdCompile(argv) {
 	return EXIT_OK;
 }
 async function cmdVerify(argv) {
-	const { positionals } = opts(argv, {});
+	const { values, positionals } = opts(argv, { root: { type: "string" } });
 	const file = positionals[0];
 	if (file === void 0) throw new UsageError("verify: <bundle.json> is required");
-	const r = verifyBundle(await readJson(file));
-	out(r);
-	return r.ok ? EXIT_OK : EXIT_FAIL;
+	const raw = await readJson(file);
+	const r = verifyBundle(raw);
+	if (values.root === void 0 || !r.ok) {
+		out(r);
+		return r.ok ? EXIT_OK : EXIT_FAIL;
+	}
+	const sig = await verifyBundleAgainstRoot(await realRootArg(values.root), parseBundleFile(raw));
+	if (sig === void 0) {
+		out({
+			...r,
+			signatures: null,
+			note: "no .axiom/trust/keys.json under root"
+		});
+		return EXIT_OK;
+	}
+	out({
+		...r,
+		signed: sig.keyids.length > 0,
+		signatures: sig
+	});
+	return sig.ok ? EXIT_OK : EXIT_FAIL;
 }
 async function loadProfileFor(rootReal, name) {
 	return loadProfile(name, { searchDirs: [path.join(rootReal, ".axiom", "profiles")] });
@@ -26314,6 +28147,7 @@ async function cmdApply(argv) {
 	if (values.message !== void 0) applyOpts.commitMessage = values.message;
 	const result = await apply(applyOpts);
 	if (result.status === "applied" || result.status === "noop") await saveManifest(rootReal, bundle);
+	if (result.status === "applied" && !dryRun && profileWantsAntiRollback([...profile.checks, ...bundle.manifest.checks])) await advanceTrustState(rootReal, bundle);
 	out(result);
 	return result.status === "failed" || result.status === "rolled-back" ? EXIT_FAIL : EXIT_OK;
 }
@@ -26324,6 +28158,28 @@ async function cmdRollback(argv) {
 	out(await rollback(await realRootArg(values.root), toDigestRef(digest)));
 	return EXIT_OK;
 }
+async function cmdGc(argv) {
+	const { values } = opts(argv, {
+		root: { type: "string" },
+		"dry-run": { type: "boolean" },
+		"older-than": { type: "string" },
+		keep: { type: "string" }
+	});
+	const rootReal = await realRootArg(values.root);
+	const keep = values.keep ?? "all-manifests";
+	if (keep !== "all-manifests" && keep !== "journal") throw new UsageError("--keep must be all-manifests|journal");
+	const gcOpts = {
+		keep,
+		dryRun: values["dry-run"] === true
+	};
+	if (values["older-than"] !== void 0) {
+		const ms = parseDuration(values["older-than"]);
+		if (ms === void 0) throw new UsageError("--older-than must be <n>(ms|s|m|h|d)");
+		gcOpts.olderThanMs = ms;
+	}
+	out(await collectGarbage(rootReal, gcOpts));
+	return EXIT_OK;
+}
 async function cmdDiff(argv) {
 	const { positionals } = opts(argv, {});
 	const [a, b] = positionals;
@@ -26339,6 +28195,86 @@ async function cmdSchema(argv) {
 	out(jsonSchemaFor(kind));
 	return EXIT_OK;
 }
+async function cmdEmitters(argv) {
+	const { values } = opts(argv, { json: { type: "boolean" } });
+	const rows = emitterCatalogue();
+	if (values.json) {
+		out(rows);
+		return EXIT_OK;
+	}
+	for (const r of rows) console.log(`${r.emitter}@${r.version}: ${r.template} — ${r.description}`);
+	return EXIT_OK;
+}
+async function cmdKeygen(argv) {
+	const { values } = opts(argv, {
+		out: { type: "string" },
+		name: { type: "string" }
+	});
+	const r = await keygen(path.resolve(values.out ?? "."), values.name);
+	out({
+		publicEntry: r.publicEntry,
+		privateKeyFile: r.privateKeyFile
+	});
+	return EXIT_OK;
+}
+async function cmdSign(argv) {
+	const { values, positionals } = opts(argv, {
+		"key-file": { type: "string" },
+		out: {
+			type: "string",
+			short: "o"
+		}
+	});
+	const file = positionals[0];
+	if (file === void 0) throw new UsageError("sign: <bundle.json> is required");
+	const bundle = parseBundleFile(await readJson(file));
+	const src = {};
+	if (values["key-file"] !== void 0) src.keyFile = values["key-file"];
+	const { bundle: signed, keyid } = await signBundle(bundle, src);
+	const target = values.out ?? file;
+	await writeFile(path.resolve(target), `${JSON.stringify(signed, null, 2)}\n`, "utf8");
+	out({
+		manifestDigest: signed.manifestDigest,
+		keyid,
+		signatures: signed.signatures?.length ?? 0,
+		out: target
+	});
+	return EXIT_OK;
+}
+async function cmdTrust(argv) {
+	const [sub, ...rest] = argv;
+	const { values, positionals } = opts(rest, { root: { type: "string" } });
+	const rootReal = await realRootArg(values.root);
+	switch (sub) {
+		case "list":
+			out(await loadTrustStore(rootReal) ?? {
+				version: 1,
+				keys: []
+			});
+			return EXIT_OK;
+		case "add": {
+			const file = positionals[0];
+			if (file === void 0) throw new UsageError("trust add: <pubkey.json> is required");
+			const entry = parsePublicEntry(await readJson(file));
+			const store = await trustAdd(rootReal, entry);
+			out({
+				added: entry.keyid,
+				keys: store.keys.length
+			});
+			return EXIT_OK;
+		}
+		case "remove": {
+			const keyid = positionals[0];
+			if (keyid === void 0) throw new UsageError("trust remove: <keyid> is required");
+			out({
+				removed: keyid,
+				keys: (await trustRemove(rootReal, keyid)).keys.length
+			});
+			return EXIT_OK;
+		}
+		default: throw new UsageError("trust: subcommand must be add|remove|list");
+	}
+}
 async function cmdGate(argv) {
 	const { gateMain } = await import("./gate-lazy.js");
 	const r = await gateMain(argv);
@@ -26346,6 +28282,112 @@ async function cmdGate(argv) {
 	if (r.stdout !== void 0) console.log(r.stdout);
 	return r.exitCode;
 }
+async function cmdMigrate(argv) {
+	const [from, ...rest] = argv;
+	if (from !== "v1") throw new UsageError("migrate: source format must be v1");
+	const { values, positionals } = opts(rest, {
+		out: {
+			type: "string",
+			short: "o"
+		},
+		profile: { type: "string" },
+		cas: { type: "string" },
+		content: { type: "string" },
+		name: { type: "string" },
+		overwrite: { type: "boolean" }
+	});
+	const file = positionals[0];
+	if (file === void 0) throw new UsageError("migrate v1: <manifest.json> is required");
+	const { migrateV1 } = await import("./migrate-lazy.js");
+	const contentDir = path.resolve(values.content ?? path.dirname(path.resolve(file)));
+	const migrateOpts = {
+		version: MIGRATE_VERSION,
+		resolveContent: async (rel) => {
+			try {
+				return new Uint8Array(await readFile(path.join(contentDir, rel)));
+			} catch (err) {
+				if (err.code === "ENOENT") return void 0;
+				throw err;
+			}
+		}
+	};
+	if (values.profile !== void 0) migrateOpts.profile = values.profile;
+	if (values.name !== void 0) migrateOpts.name = values.name;
+	if (values.overwrite === true) migrateOpts.overwrite = true;
+	if (values.cas !== void 0) migrateOpts.casRoot = await realRootArg(values.cas);
+	const { plan, report } = await migrateV1(await readJson(file), migrateOpts);
+	if (values.out !== void 0) {
+		await writeFile(path.resolve(values.out), `${JSON.stringify(plan, null, 2)}\n`, "utf8");
+		out({
+			...report,
+			out: values.out
+		});
+	} else out({
+		plan,
+		report
+	});
+	return report.ok ? EXIT_OK : EXIT_FAIL;
+}
+let MIGRATE_VERSION = "0.0.0";
+async function cmdSnapshot(argv) {
+	const { values } = opts(argv, {
+		root: { type: "string" },
+		out: {
+			type: "string",
+			short: "o"
+		},
+		include: {
+			type: "string",
+			multiple: true
+		},
+		exclude: {
+			type: "string",
+			multiple: true
+		},
+		"max-files": { type: "string" },
+		"max-bytes": { type: "string" },
+		"no-gitignore": { type: "boolean" },
+		"no-digest": { type: "boolean" }
+	});
+	const rootReal = await realRootArg(values.root);
+	const snapOpts = {
+		respectGitignore: values["no-gitignore"] !== true,
+		withContentDigest: values["no-digest"] !== true
+	};
+	if (values.include !== void 0) snapOpts.include = values.include;
+	if (values.exclude !== void 0) snapOpts.exclude = values.exclude;
+	for (const [flag, key] of [["max-files", "maxFiles"], ["max-bytes", "maxBytes"]]) {
+		const raw = values[flag];
+		if (raw === void 0) continue;
+		const n = Number(raw);
+		if (!Number.isInteger(n) || n < 0) throw new UsageError(`--${flag} must be a non-negative integer`);
+		snapOpts[key] = n;
+	}
+	const snap = await snapshotRoot(rootReal, snapOpts);
+	if (values.out !== void 0) {
+		await writeFile(path.resolve(values.out), `${JSON.stringify(snap, null, 2)}\n`, "utf8");
+		out({
+			snapshotDigest: snap.snapshotDigest,
+			...snap.body.counts,
+			truncated: snap.body.truncated,
+			out: values.out
+		});
+	} else out(snap);
+	return EXIT_OK;
+}
+function parseSnapshotFile(raw, label) {
+	const parsed = RepoSnapshotSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_MANIFEST", `${label} does not match RepoSnapshotSchema`, { details: { issues: parsed.error.issues.slice(0, 20).map((i) => `${i.path.join(".")}: ${i.message}`) } });
+	return parsed.data;
+}
+async function cmdSnapshotDiff(argv) {
+	const { positionals } = opts(argv, {});
+	const [a, b] = positionals;
+	if (a === void 0 || b === void 0) throw new UsageError("snapshot-diff: <a.json> <b.json> are required");
+	const [sa, sb] = await Promise.all([readJson(a), readJson(b)]);
+	out(diffSnapshots(parseSnapshotFile(sa, a), parseSnapshotFile(sb, b)));
+	return EXIT_OK;
+}
 const VERBS = {
 	mcp: cmdMcp,
 	compile: cmdCompile,
@@ -26353,12 +28395,21 @@ const VERBS = {
 	check: cmdCheck,
 	apply: cmdApply,
 	rollback: cmdRollback,
+	gc: cmdGc,
 	diff: cmdDiff,
 	schema: cmdSchema,
-	gate: cmdGate
+	emitters: cmdEmitters,
+	keygen: cmdKeygen,
+	sign: cmdSign,
+	trust: cmdTrust,
+	gate: cmdGate,
+	migrate: cmdMigrate,
+	snapshot: cmdSnapshot,
+	"snapshot-diff": cmdSnapshotDiff
 };
 async function main(argv, version) {
 	const HELP = help(version);
+	MIGRATE_VERSION = version;
 	const [verb, ...rest] = argv;
 	if (verb === void 0 || verb === "--help" || verb === "-h" || verb === "help") {
 		process.stdout.write(HELP);
@@ -26387,7 +28438,7 @@ async function main(argv, version) {
 			console.error(`error: ${err.message}\n\n${HELP}`);
 			return EXIT_USAGE;
 		}
-		if (err instanceof AxiomError) {
+		if (isAxiomError(err)) {
 			console.error(JSON.stringify(err.toJSON()));
 			return EXIT_USAGE;
 		}