@garygentry/system1 0.4.0 → 0.5.0

package/dist/bundle/chunks/{chunk-QYUSJUFX.mjs → chunk-TMAJXDTE.mjs}

@@ -1,15 +1,13 @@
 import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
 import {
-  CLI_PACKAGE,
   DecisionsError,
   ProviderError,
-  VERSION,
   __commonJS,
   __export,
   __require,
   __toESM,
   isDecisionsError
-} from "./chunk-WZIVOY5Q.mjs";
+} from "./chunk-MH6THLCO.mjs";
 
 // ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
@@ -24,9 +22,9 @@ var require_identity = __commonJS({
     var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
     var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
     var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isMap2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
     var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
-    var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
+    var isScalar2 = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
     var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
     function isCollection(node) {
       if (node && typeof node === "object")
@@ -48,7 +46,7 @@ var require_identity = __commonJS({
         }
       return false;
     }
-    var hasAnchor = (node) => (isScalar(node) || isCollection(node)) && !!node.anchor;
+    var hasAnchor = (node) => (isScalar2(node) || isCollection(node)) && !!node.anchor;
     exports.ALIAS = ALIAS;
     exports.DOC = DOC;
     exports.MAP = MAP;
@@ -60,10 +58,10 @@ var require_identity = __commonJS({
     exports.isAlias = isAlias;
     exports.isCollection = isCollection;
     exports.isDocument = isDocument;
-    exports.isMap = isMap;
+    exports.isMap = isMap2;
     exports.isNode = isNode;
     exports.isPair = isPair;
-    exports.isScalar = isScalar;
+    exports.isScalar = isScalar2;
     exports.isSeq = isSeq;
   }
 });
@@ -3764,29 +3762,29 @@ var require_resolve_props = __commonJS({
       let comma = null;
       let found2 = null;
       let start = null;
-      for (const token of tokens) {
+      for (const token2 of tokens) {
         if (reqSpace) {
-          if (token.type !== "space" && token.type !== "newline" && token.type !== "comma")
-            onError(token.offset, "MISSING_CHAR", "Tags and anchors must be separated from the next token by white space");
+          if (token2.type !== "space" && token2.type !== "newline" && token2.type !== "comma")
+            onError(token2.offset, "MISSING_CHAR", "Tags and anchors must be separated from the next token by white space");
           reqSpace = false;
         }
         if (tab) {
-          if (atNewline && token.type !== "comment" && token.type !== "newline") {
+          if (atNewline && token2.type !== "comment" && token2.type !== "newline") {
             onError(tab, "TAB_AS_INDENT", "Tabs are not allowed as indentation");
           }
           tab = null;
         }
-        switch (token.type) {
+        switch (token2.type) {
           case "space":
-            if (!flow && (indicator !== "doc-start" || next?.type !== "flow-collection") && token.source.includes("	")) {
-              tab = token;
+            if (!flow && (indicator !== "doc-start" || next?.type !== "flow-collection") && token2.source.includes("	")) {
+              tab = token2;
             }
             hasSpace = true;
             break;
           case "comment": {
             if (!hasSpace)
-              onError(token, "MISSING_CHAR", "Comments must be separated from other tokens by white space characters");
-            const cb = token.source.substring(1) || " ";
+              onError(token2, "MISSING_CHAR", "Comments must be separated from other tokens by white space characters");
+            const cb = token2.source.substring(1) || " ";
             if (!comment)
               comment = cb;
             else
@@ -3798,33 +3796,33 @@ var require_resolve_props = __commonJS({
           case "newline":
             if (atNewline) {
               if (comment)
-                comment += token.source;
+                comment += token2.source;
               else if (!found2 || indicator !== "seq-item-ind")
                 spaceBefore = true;
             } else
-              commentSep += token.source;
+              commentSep += token2.source;
             atNewline = true;
             hasNewline = true;
             if (anchor || tag)
-              newlineAfterProp = token;
+              newlineAfterProp = token2;
             hasSpace = true;
             break;
           case "anchor":
             if (anchor)
-              onError(token, "MULTIPLE_ANCHORS", "A node can have at most one anchor");
-            if (token.source.endsWith(":"))
-              onError(token.offset + token.source.length - 1, "BAD_ALIAS", "Anchor ending in : is ambiguous", true);
-            anchor = token;
-            start ?? (start = token.offset);
+              onError(token2, "MULTIPLE_ANCHORS", "A node can have at most one anchor");
+            if (token2.source.endsWith(":"))
+              onError(token2.offset + token2.source.length - 1, "BAD_ALIAS", "Anchor ending in : is ambiguous", true);
+            anchor = token2;
+            start ?? (start = token2.offset);
             atNewline = false;
             hasSpace = false;
             reqSpace = true;
             break;
           case "tag": {
             if (tag)
-              onError(token, "MULTIPLE_TAGS", "A node can have at most one tag");
-            tag = token;
-            start ?? (start = token.offset);
+              onError(token2, "MULTIPLE_TAGS", "A node can have at most one tag");
+            tag = token2;
+            start ?? (start = token2.offset);
             atNewline = false;
             hasSpace = false;
             reqSpace = true;
@@ -3832,25 +3830,25 @@ var require_resolve_props = __commonJS({
           }
           case indicator:
             if (anchor || tag)
-              onError(token, "BAD_PROP_ORDER", `Anchors and tags must be after the ${token.source} indicator`);
+              onError(token2, "BAD_PROP_ORDER", `Anchors and tags must be after the ${token2.source} indicator`);
             if (found2)
-              onError(token, "UNEXPECTED_TOKEN", `Unexpected ${token.source} in ${flow ?? "collection"}`);
-            found2 = token;
+              onError(token2, "UNEXPECTED_TOKEN", `Unexpected ${token2.source} in ${flow ?? "collection"}`);
+            found2 = token2;
             atNewline = indicator === "seq-item-ind" || indicator === "explicit-key-ind";
             hasSpace = false;
             break;
           case "comma":
             if (flow) {
               if (comma)
-                onError(token, "UNEXPECTED_TOKEN", `Unexpected , in ${flow}`);
-              comma = token;
+                onError(token2, "UNEXPECTED_TOKEN", `Unexpected , in ${flow}`);
+              comma = token2;
               atNewline = false;
               hasSpace = false;
               break;
             }
           // else fallthrough
           default:
-            onError(token, "UNEXPECTED_TOKEN", `Unexpected ${token.type} token`);
+            onError(token2, "UNEXPECTED_TOKEN", `Unexpected ${token2.type} token`);
             atNewline = false;
             hasSpace = false;
         }
@@ -4123,15 +4121,15 @@ var require_resolve_end = __commonJS({
       if (end) {
         let hasSpace = false;
         let sep2 = "";
-        for (const token of end) {
-          const { source, type } = token;
+        for (const token2 of end) {
+          const { source, type } = token2;
           switch (type) {
             case "space":
               hasSpace = true;
               break;
             case "comment": {
               if (reqSpace && !hasSpace)
-                onError(token, "MISSING_CHAR", "Comments must be separated from other tokens by white space characters");
+                onError(token2, "MISSING_CHAR", "Comments must be separated from other tokens by white space characters");
               const cb = source.substring(1) || " ";
               if (!comment)
                 comment = cb;
@@ -4146,7 +4144,7 @@ var require_resolve_end = __commonJS({
               hasSpace = true;
               break;
             default:
-              onError(token, "UNEXPECTED_TOKEN", `Unexpected ${type} at node end`);
+              onError(token2, "UNEXPECTED_TOKEN", `Unexpected ${type} at node end`);
           }
           offset += source.length;
         }
@@ -4170,11 +4168,11 @@ var require_resolve_flow_collection = __commonJS({
     var utilContainsNewline = require_util_contains_newline();
     var utilMapIncludes = require_util_map_includes();
     var blockMsg = "Block collections are not allowed within flow collections";
-    var isBlock = (token) => token && (token.type === "block-map" || token.type === "block-seq");
+    var isBlock = (token2) => token2 && (token2.type === "block-map" || token2.type === "block-seq");
     function resolveFlowCollection({ composeNode, composeEmptyNode }, ctx, fc, onError, tag) {
-      const isMap = fc.start.source === "{";
-      const fcName = isMap ? "flow map" : "flow sequence";
-      const NodeClass = tag?.nodeClass ?? (isMap ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
+      const isMap2 = fc.start.source === "{";
+      const fcName = isMap2 ? "flow map" : "flow sequence";
+      const NodeClass = tag?.nodeClass ?? (isMap2 ? YAMLMap.YAMLMap : YAMLSeq.YAMLSeq);
       const coll = new NodeClass(ctx.schema);
       coll.flow = true;
       const atRoot = ctx.atRoot;
@@ -4210,7 +4208,7 @@ var require_resolve_flow_collection = __commonJS({
             offset = props.end;
             continue;
           }
-          if (!isMap && ctx.options.strict && utilContainsNewline.containsNewline(key))
+          if (!isMap2 && ctx.options.strict && utilContainsNewline.containsNewline(key))
             onError(
               key,
               // checked by containsNewline()
@@ -4250,7 +4248,7 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep2 && !props.found) {
+        if (!isMap2 && !sep2 && !props.found) {
           const valueNode = value ? composeNode(ctx, value, props, onError) : composeEmptyNode(ctx, props.end, sep2, null, props, onError);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
@@ -4273,7 +4271,7 @@ var require_resolve_flow_collection = __commonJS({
             startOnNewline: false
           });
           if (valueProps.found) {
-            if (!isMap && !props.found && ctx.options.strict) {
+            if (!isMap2 && !props.found && ctx.options.strict) {
               if (sep2)
                 for (const st of sep2) {
                   if (st === valueProps.found)
@@ -4305,7 +4303,7 @@ var require_resolve_flow_collection = __commonJS({
           const pair = new Pair.Pair(keyNode, valueNode);
           if (ctx.options.keepSourceTokens)
             pair.srcToken = collItem;
-          if (isMap) {
+          if (isMap2) {
             const map = coll;
             if (utilMapIncludes.mapIncludes(ctx, map.items, keyNode))
               onError(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
@@ -4321,7 +4319,7 @@ var require_resolve_flow_collection = __commonJS({
           offset = valueNode ? valueNode.range[2] : valueProps.end;
         }
       }
-      const expectedEnd = isMap ? "}" : "]";
+      const expectedEnd = isMap2 ? "}" : "]";
       const [ce, ...ee] = fc.end;
       let cePos = offset;
       if (ce?.source === expectedEnd)
@@ -4362,8 +4360,8 @@ var require_compose_collection = __commonJS({
     var resolveBlockMap = require_resolve_block_map();
     var resolveBlockSeq = require_resolve_block_seq();
     var resolveFlowCollection = require_resolve_flow_collection();
-    function resolveCollection(CN, ctx, token, onError, tagName, tag) {
-      const coll = token.type === "block-map" ? resolveBlockMap.resolveBlockMap(CN, ctx, token, onError, tag) : token.type === "block-seq" ? resolveBlockSeq.resolveBlockSeq(CN, ctx, token, onError, tag) : resolveFlowCollection.resolveFlowCollection(CN, ctx, token, onError, tag);
+    function resolveCollection(CN, ctx, token2, onError, tagName, tag) {
+      const coll = token2.type === "block-map" ? resolveBlockMap.resolveBlockMap(CN, ctx, token2, onError, tag) : token2.type === "block-seq" ? resolveBlockSeq.resolveBlockSeq(CN, ctx, token2, onError, tag) : resolveFlowCollection.resolveFlowCollection(CN, ctx, token2, onError, tag);
       const Coll = coll.constructor;
       if (tagName === "!" || tagName === Coll.tagName) {
         coll.tag = Coll.tagName;
@@ -4373,10 +4371,10 @@ var require_compose_collection = __commonJS({
         coll.tag = tagName;
       return coll;
     }
-    function composeCollection(CN, ctx, token, props, onError) {
+    function composeCollection(CN, ctx, token2, props, onError) {
       const tagToken = props.tag;
       const tagName = !tagToken ? null : ctx.directives.tagName(tagToken.source, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg));
-      if (token.type === "block-seq") {
+      if (token2.type === "block-seq") {
         const { anchor, newlineAfterProp: nl } = props;
         const lastProp = anchor && tagToken ? anchor.offset > tagToken.offset ? anchor : tagToken : anchor ?? tagToken;
         if (lastProp && (!nl || nl.offset < lastProp.offset)) {
@@ -4384,9 +4382,9 @@ var require_compose_collection = __commonJS({
           onError(lastProp, "MISSING_CHAR", message);
         }
       }
-      const expType = token.type === "block-map" ? "map" : token.type === "block-seq" ? "seq" : token.start.source === "{" ? "map" : "seq";
+      const expType = token2.type === "block-map" ? "map" : token2.type === "block-seq" ? "seq" : token2.start.source === "{" ? "map" : "seq";
       if (!tagToken || !tagName || tagName === "!" || tagName === YAMLMap.YAMLMap.tagName && expType === "map" || tagName === YAMLSeq.YAMLSeq.tagName && expType === "seq") {
-        return resolveCollection(CN, ctx, token, onError, tagName);
+        return resolveCollection(CN, ctx, token2, onError, tagName);
       }
       let tag = ctx.schema.tags.find((t) => t.tag === tagName && t.collection === expType);
       if (!tag) {
@@ -4400,10 +4398,10 @@ var require_compose_collection = __commonJS({
           } else {
             onError(tagToken, "TAG_RESOLVE_FAILED", `Unresolved tag: ${tagName}`, true);
           }
-          return resolveCollection(CN, ctx, token, onError, tagName);
+          return resolveCollection(CN, ctx, token2, onError, tagName);
         }
       }
-      const coll = resolveCollection(CN, ctx, token, onError, tagName, tag);
+      const coll = resolveCollection(CN, ctx, token2, onError, tagName, tag);
       const res = tag.resolve?.(coll, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg), ctx.options) ?? coll;
       const node = identity.isNode(res) ? res : new Scalar.Scalar(res);
       node.range = coll.range;
@@ -4553,31 +4551,31 @@ var require_resolve_block_scalar = __commonJS({
       let comment = "";
       let length = source.length;
       for (let i = 1; i < props.length; ++i) {
-        const token = props[i];
-        switch (token.type) {
+        const token2 = props[i];
+        switch (token2.type) {
           case "space":
             hasSpace = true;
           // fallthrough
           case "newline":
-            length += token.source.length;
+            length += token2.source.length;
             break;
           case "comment":
             if (strict2 && !hasSpace) {
               const message = "Comments must be separated from other tokens by white space characters";
-              onError(token, "MISSING_CHAR", message);
+              onError(token2, "MISSING_CHAR", message);
             }
-            length += token.source.length;
-            comment = token.source.substring(1);
+            length += token2.source.length;
+            comment = token2.source.substring(1);
             break;
           case "error":
-            onError(token, "UNEXPECTED_TOKEN", token.message);
-            length += token.source.length;
+            onError(token2, "UNEXPECTED_TOKEN", token2.message);
+            length += token2.source.length;
             break;
           /* istanbul ignore next should not happen */
           default: {
-            const message = `Unexpected token in block scalar header: ${token.type}`;
-            onError(token, "UNEXPECTED_TOKEN", message);
-            const ts = token.source;
+            const message = `Unexpected token in block scalar header: ${token2.type}`;
+            onError(token2, "UNEXPECTED_TOKEN", message);
+            const ts = token2.source;
             if (ts && typeof ts === "string")
               length += ts.length;
           }
@@ -4828,25 +4826,25 @@ var require_compose_scalar = __commonJS({
     var Scalar = require_Scalar();
     var resolveBlockScalar = require_resolve_block_scalar();
     var resolveFlowScalar = require_resolve_flow_scalar();
-    function composeScalar(ctx, token, tagToken, onError) {
-      const { value, type, comment, range } = token.type === "block-scalar" ? resolveBlockScalar.resolveBlockScalar(ctx, token, onError) : resolveFlowScalar.resolveFlowScalar(token, ctx.options.strict, onError);
+    function composeScalar(ctx, token2, tagToken, onError) {
+      const { value, type, comment, range } = token2.type === "block-scalar" ? resolveBlockScalar.resolveBlockScalar(ctx, token2, onError) : resolveFlowScalar.resolveFlowScalar(token2, ctx.options.strict, onError);
       const tagName = tagToken ? ctx.directives.tagName(tagToken.source, (msg) => onError(tagToken, "TAG_RESOLVE_FAILED", msg)) : null;
       let tag;
       if (ctx.options.stringKeys && ctx.atKey) {
         tag = ctx.schema[identity.SCALAR];
       } else if (tagName)
         tag = findScalarTagByName(ctx.schema, value, tagName, tagToken, onError);
-      else if (token.type === "scalar")
-        tag = findScalarTagByTest(ctx, value, token, onError);
+      else if (token2.type === "scalar")
+        tag = findScalarTagByTest(ctx, value, token2, onError);
       else
         tag = ctx.schema[identity.SCALAR];
       let scalar;
       try {
-        const res = tag.resolve(value, (msg) => onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg), ctx.options);
+        const res = tag.resolve(value, (msg) => onError(tagToken ?? token2, "TAG_RESOLVE_FAILED", msg), ctx.options);
         scalar = identity.isScalar(res) ? res : new Scalar.Scalar(res);
       } catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
-        onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg);
+        onError(tagToken ?? token2, "TAG_RESOLVE_FAILED", msg);
         scalar = new Scalar.Scalar(value);
       }
       scalar.range = range;
@@ -4884,7 +4882,7 @@ var require_compose_scalar = __commonJS({
       onError(tagToken, "TAG_RESOLVE_FAILED", `Unresolved tag: ${tagName}`, tagName !== "tag:yaml.org,2002:str");
       return schema[identity.SCALAR];
     }
-    function findScalarTagByTest({ atKey, directives, schema }, value, token, onError) {
+    function findScalarTagByTest({ atKey, directives, schema }, value, token2, onError) {
       const tag = schema.tags.find((tag2) => (tag2.default === true || atKey && tag2.default === "key") && tag2.test?.test(value)) || schema[identity.SCALAR];
       if (schema.compat) {
         const compat = schema.compat.find((tag2) => tag2.default && tag2.test?.test(value)) ?? schema[identity.SCALAR];
@@ -4892,7 +4890,7 @@ var require_compose_scalar = __commonJS({
           const ts = directives.tagString(tag.tag);
           const cs = directives.tagString(compat.tag);
           const msg = `Value may be parsed as either ${ts} or ${cs}`;
-          onError(token, "TAG_RESOLVE_FAILED", msg, true);
+          onError(token2, "TAG_RESOLVE_FAILED", msg, true);
         }
       }
       return tag;
@@ -4942,22 +4940,22 @@ var require_compose_node = __commonJS({
     var resolveEnd = require_resolve_end();
     var utilEmptyScalarPosition = require_util_empty_scalar_position();
     var CN = { composeNode, composeEmptyNode };
-    function composeNode(ctx, token, props, onError) {
+    function composeNode(ctx, token2, props, onError) {
       const atKey = ctx.atKey;
       const { spaceBefore, comment, anchor, tag } = props;
       let node;
       let isSrcToken = true;
-      switch (token.type) {
+      switch (token2.type) {
         case "alias":
-          node = composeAlias(ctx, token, onError);
+          node = composeAlias(ctx, token2, onError);
           if (anchor || tag)
-            onError(token, "ALIAS_PROPS", "An alias node must not specify any properties");
+            onError(token2, "ALIAS_PROPS", "An alias node must not specify any properties");
           break;
         case "scalar":
         case "single-quoted-scalar":
         case "double-quoted-scalar":
         case "block-scalar":
-          node = composeScalar.composeScalar(ctx, token, tag, onError);
+          node = composeScalar.composeScalar(ctx, token2, tag, onError);
           if (anchor)
             node.anchor = anchor.source.substring(1);
           break;
@@ -4965,47 +4963,47 @@ var require_compose_node = __commonJS({
         case "block-seq":
         case "flow-collection":
           try {
-            node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+            node = composeCollection.composeCollection(CN, ctx, token2, props, onError);
             if (anchor)
               node.anchor = anchor.source.substring(1);
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            onError(token, "RESOURCE_EXHAUSTION", message);
+            onError(token2, "RESOURCE_EXHAUSTION", message);
           }
           break;
         default: {
-          const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
-          onError(token, "UNEXPECTED_TOKEN", message);
+          const message = token2.type === "error" ? token2.message : `Unsupported token (type: ${token2.type})`;
+          onError(token2, "UNEXPECTED_TOKEN", message);
           isSrcToken = false;
         }
       }
-      node ?? (node = composeEmptyNode(ctx, token.offset, void 0, null, props, onError));
+      node ?? (node = composeEmptyNode(ctx, token2.offset, void 0, null, props, onError));
       if (anchor && node.anchor === "")
         onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
       if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
         const msg = "With stringKeys, all keys must be strings";
-        onError(tag ?? token, "NON_STRING_KEY", msg);
+        onError(tag ?? token2, "NON_STRING_KEY", msg);
       }
       if (spaceBefore)
         node.spaceBefore = true;
       if (comment) {
-        if (token.type === "scalar" && token.source === "")
+        if (token2.type === "scalar" && token2.source === "")
           node.comment = comment;
         else
           node.commentBefore = comment;
       }
       if (ctx.options.keepSourceTokens && isSrcToken)
-        node.srcToken = token;
+        node.srcToken = token2;
       return node;
     }
     function composeEmptyNode(ctx, offset, before, pos, { spaceBefore, comment, anchor, tag, end }, onError) {
-      const token = {
+      const token2 = {
         type: "scalar",
         offset: utilEmptyScalarPosition.emptyScalarPosition(offset, before, pos),
         indent: -1,
         source: ""
       };
-      const node = composeScalar.composeScalar(ctx, token, tag, onError);
+      const node = composeScalar.composeScalar(ctx, token2, tag, onError);
       if (anchor) {
         node.anchor = anchor.source.substring(1);
         if (node.anchor === "")
@@ -5196,28 +5194,28 @@ ${cb}` : comment;
        * @param endOffset - Should be set if `forceDoc` is also set, to set the document range end and to indicate errors correctly.
        */
       *compose(tokens, forceDoc = false, endOffset = -1) {
-        for (const token of tokens)
-          yield* this.next(token);
+        for (const token2 of tokens)
+          yield* this.next(token2);
         yield* this.end(forceDoc, endOffset);
       }
       /** Advance the composer by one CST token. */
-      *next(token) {
+      *next(token2) {
         if (node_process.env.LOG_STREAM)
-          console.dir(token, { depth: null });
-        switch (token.type) {
+          console.dir(token2, { depth: null });
+        switch (token2.type) {
           case "directive":
-            this.directives.add(token.source, (offset, message, warning) => {
-              const pos = getErrorPos(token);
+            this.directives.add(token2.source, (offset, message, warning) => {
+              const pos = getErrorPos(token2);
               pos[0] += offset;
               this.onError(pos, "BAD_DIRECTIVE", message, warning);
             });
-            this.prelude.push(token.source);
+            this.prelude.push(token2.source);
             this.atDirectives = true;
             break;
           case "document": {
-            const doc = composeDoc.composeDoc(this.options, this.directives, token, this.onError);
+            const doc = composeDoc.composeDoc(this.options, this.directives, token2, this.onError);
             if (this.atDirectives && !doc.directives.docStart)
-              this.onError(token, "MISSING_CHAR", "Missing directives-end/doc-start indicator line");
+              this.onError(token2, "MISSING_CHAR", "Missing directives-end/doc-start indicator line");
             this.decorate(doc, false);
             if (this.doc)
               yield this.doc;
@@ -5230,11 +5228,11 @@ ${cb}` : comment;
             break;
           case "comment":
           case "newline":
-            this.prelude.push(token.source);
+            this.prelude.push(token2.source);
             break;
           case "error": {
-            const msg = token.source ? `${token.message}: ${JSON.stringify(token.source)}` : token.message;
-            const error = new errors.YAMLParseError(getErrorPos(token), "UNEXPECTED_TOKEN", msg);
+            const msg = token2.source ? `${token2.message}: ${JSON.stringify(token2.source)}` : token2.message;
+            const error = new errors.YAMLParseError(getErrorPos(token2), "UNEXPECTED_TOKEN", msg);
             if (this.atDirectives || !this.doc)
               this.errors.push(error);
             else
@@ -5244,11 +5242,11 @@ ${cb}` : comment;
           case "doc-end": {
             if (!this.doc) {
               const msg = "Unexpected doc-end without preceding document";
-              this.errors.push(new errors.YAMLParseError(getErrorPos(token), "UNEXPECTED_TOKEN", msg));
+              this.errors.push(new errors.YAMLParseError(getErrorPos(token2), "UNEXPECTED_TOKEN", msg));
               break;
             }
             this.doc.directives.docEnd = true;
-            const end = resolveEnd.resolveEnd(token.end, token.offset + token.source.length, this.doc.options.strict, this.onError);
+            const end = resolveEnd.resolveEnd(token2.end, token2.offset + token2.source.length, this.doc.options.strict, this.onError);
             this.decorate(this.doc, true);
             if (end.comment) {
               const dc = this.doc.comment;
@@ -5259,7 +5257,7 @@ ${end.comment}` : end.comment;
             break;
           }
           default:
-            this.errors.push(new errors.YAMLParseError(getErrorPos(token), "UNEXPECTED_TOKEN", `Unsupported token ${token.type}`));
+            this.errors.push(new errors.YAMLParseError(getErrorPos(token2), "UNEXPECTED_TOKEN", `Unsupported token ${token2.type}`));
         }
       }
       /**
@@ -5296,8 +5294,8 @@ var require_cst_scalar = __commonJS({
     var resolveFlowScalar = require_resolve_flow_scalar();
     var errors = require_errors();
     var stringifyString = require_stringifyString();
-    function resolveAsScalar(token, strict2 = true, onError) {
-      if (token) {
+    function resolveAsScalar(token2, strict2 = true, onError) {
+      if (token2) {
         const _onError = (pos, code, message) => {
           const offset = typeof pos === "number" ? pos : Array.isArray(pos) ? pos[0] : pos.offset;
           if (onError)
@@ -5305,13 +5303,13 @@ var require_cst_scalar = __commonJS({
           else
             throw new errors.YAMLParseError([offset, offset + 1], code, message);
         };
-        switch (token.type) {
+        switch (token2.type) {
           case "scalar":
           case "single-quoted-scalar":
           case "double-quoted-scalar":
-            return resolveFlowScalar.resolveFlowScalar(token, strict2, _onError);
+            return resolveFlowScalar.resolveFlowScalar(token2, strict2, _onError);
           case "block-scalar":
-            return resolveBlockScalar.resolveBlockScalar({ options: { strict: strict2 } }, token, _onError);
+            return resolveBlockScalar.resolveBlockScalar({ options: { strict: strict2 } }, token2, _onError);
         }
       }
       return null;
@@ -5348,13 +5346,13 @@ var require_cst_scalar = __commonJS({
           return { type: "scalar", offset, indent, source, end };
       }
     }
-    function setScalarValue(token, value, context = {}) {
+    function setScalarValue(token2, value, context = {}) {
       let { afterKey = false, implicitKey = false, inFlow = false, type } = context;
-      let indent = "indent" in token ? token.indent : null;
+      let indent = "indent" in token2 ? token2.indent : null;
       if (afterKey && typeof indent === "number")
         indent += 2;
       if (!type)
-        switch (token.type) {
+        switch (token2.type) {
           case "single-quoted-scalar":
             type = "QUOTE_SINGLE";
             break;
@@ -5362,7 +5360,7 @@ var require_cst_scalar = __commonJS({
             type = "QUOTE_DOUBLE";
             break;
           case "block-scalar": {
-            const header = token.props[0];
+            const header = token2.props[0];
             if (header.type !== "block-scalar-header")
               throw new Error("Invalid block scalar header");
             type = header.source[0] === ">" ? "BLOCK_FOLDED" : "BLOCK_LITERAL";
@@ -5380,40 +5378,40 @@ var require_cst_scalar = __commonJS({
       switch (source[0]) {
         case "|":
         case ">":
-          setBlockScalarValue(token, source);
+          setBlockScalarValue(token2, source);
           break;
         case '"':
-          setFlowScalarValue(token, source, "double-quoted-scalar");
+          setFlowScalarValue(token2, source, "double-quoted-scalar");
           break;
         case "'":
-          setFlowScalarValue(token, source, "single-quoted-scalar");
+          setFlowScalarValue(token2, source, "single-quoted-scalar");
           break;
         default:
-          setFlowScalarValue(token, source, "scalar");
+          setFlowScalarValue(token2, source, "scalar");
       }
     }
-    function setBlockScalarValue(token, source) {
+    function setBlockScalarValue(token2, source) {
       const he = source.indexOf("\n");
       const head = source.substring(0, he);
       const body = source.substring(he + 1) + "\n";
-      if (token.type === "block-scalar") {
-        const header = token.props[0];
+      if (token2.type === "block-scalar") {
+        const header = token2.props[0];
         if (header.type !== "block-scalar-header")
           throw new Error("Invalid block scalar header");
         header.source = head;
-        token.source = body;
+        token2.source = body;
       } else {
-        const { offset } = token;
-        const indent = "indent" in token ? token.indent : -1;
+        const { offset } = token2;
+        const indent = "indent" in token2 ? token2.indent : -1;
         const props = [
           { type: "block-scalar-header", offset, indent, source: head }
         ];
-        if (!addEndtoBlockProps(props, "end" in token ? token.end : void 0))
+        if (!addEndtoBlockProps(props, "end" in token2 ? token2.end : void 0))
           props.push({ type: "newline", offset: -1, indent, source: "\n" });
-        for (const key of Object.keys(token))
+        for (const key of Object.keys(token2))
           if (key !== "type" && key !== "offset")
-            delete token[key];
-        Object.assign(token, { type: "block-scalar", indent, props, source: body });
+            delete token2[key];
+        Object.assign(token2, { type: "block-scalar", indent, props, source: body });
       }
     }
     function addEndtoBlockProps(props, end) {
@@ -5430,40 +5428,40 @@ var require_cst_scalar = __commonJS({
           }
       return false;
     }
-    function setFlowScalarValue(token, source, type) {
-      switch (token.type) {
+    function setFlowScalarValue(token2, source, type) {
+      switch (token2.type) {
         case "scalar":
         case "double-quoted-scalar":
         case "single-quoted-scalar":
-          token.type = type;
-          token.source = source;
+          token2.type = type;
+          token2.source = source;
           break;
         case "block-scalar": {
-          const end = token.props.slice(1);
+          const end = token2.props.slice(1);
           let oa = source.length;
-          if (token.props[0].type === "block-scalar-header")
-            oa -= token.props[0].source.length;
+          if (token2.props[0].type === "block-scalar-header")
+            oa -= token2.props[0].source.length;
           for (const tok of end)
             tok.offset += oa;
-          delete token.props;
-          Object.assign(token, { type, source, end });
+          delete token2.props;
+          Object.assign(token2, { type, source, end });
           break;
         }
         case "block-map":
         case "block-seq": {
-          const offset = token.offset + source.length;
-          const nl = { type: "newline", offset, indent: token.indent, source: "\n" };
-          delete token.items;
-          Object.assign(token, { type, source, end: [nl] });
+          const offset = token2.offset + source.length;
+          const nl = { type: "newline", offset, indent: token2.indent, source: "\n" };
+          delete token2.items;
+          Object.assign(token2, { type, source, end: [nl] });
           break;
         }
         default: {
-          const indent = "indent" in token ? token.indent : -1;
-          const end = "end" in token && Array.isArray(token.end) ? token.end.filter((st) => st.type === "space" || st.type === "comment" || st.type === "newline") : [];
-          for (const key of Object.keys(token))
+          const indent = "indent" in token2 ? token2.indent : -1;
+          const end = "end" in token2 && Array.isArray(token2.end) ? token2.end.filter((st) => st.type === "space" || st.type === "comment" || st.type === "newline") : [];
+          for (const key of Object.keys(token2))
             if (key !== "type" && key !== "offset")
-              delete token[key];
-          Object.assign(token, { type, indent, source, end });
+              delete token2[key];
+          Object.assign(token2, { type, indent, source, end });
         }
       }
     }
@@ -5478,40 +5476,40 @@ var require_cst_stringify = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/parse/cst-stringify.js"(exports) {
     "use strict";
     var stringify = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
-    function stringifyToken(token) {
-      switch (token.type) {
+    function stringifyToken(token2) {
+      switch (token2.type) {
         case "block-scalar": {
           let res = "";
-          for (const tok of token.props)
+          for (const tok of token2.props)
             res += stringifyToken(tok);
-          return res + token.source;
+          return res + token2.source;
         }
         case "block-map":
         case "block-seq": {
           let res = "";
-          for (const item of token.items)
+          for (const item of token2.items)
             res += stringifyItem(item);
           return res;
         }
         case "flow-collection": {
-          let res = token.start.source;
-          for (const item of token.items)
+          let res = token2.start.source;
+          for (const item of token2.items)
             res += stringifyItem(item);
-          for (const st of token.end)
+          for (const st of token2.end)
             res += st.source;
           return res;
         }
         case "document": {
-          let res = stringifyItem(token);
-          if (token.end)
-            for (const st of token.end)
+          let res = stringifyItem(token2);
+          if (token2.end)
+            for (const st of token2.end)
               res += st.source;
           return res;
         }
         default: {
-          let res = token.source;
-          if ("end" in token && token.end)
-            for (const st of token.end)
+          let res = token2.source;
+          if ("end" in token2 && token2.end)
+            for (const st of token2.end)
               res += st.source;
           return res;
         }
@@ -5573,16 +5571,16 @@ var require_cst_visit = __commonJS({
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
-        const token = item[field];
-        if (token && "items" in token) {
-          for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path.concat([[field, i]])), token.items[i], visitor);
+        const token2 = item[field];
+        if (token2 && "items" in token2) {
+          for (let i = 0; i < token2.items.length; ++i) {
+            const ci = _visit(Object.freeze(path.concat([[field, i]])), token2.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
               return BREAK;
             else if (ci === REMOVE) {
-              token.items.splice(i, 1);
+              token2.items.splice(i, 1);
               i -= 1;
             }
           }
@@ -5607,10 +5605,10 @@ var require_cst = __commonJS({
     var DOCUMENT = "";
     var FLOW_END = "";
     var SCALAR = "";
-    var isCollection = (token) => !!token && "items" in token;
-    var isScalar = (token) => !!token && (token.type === "scalar" || token.type === "single-quoted-scalar" || token.type === "double-quoted-scalar" || token.type === "block-scalar");
-    function prettyToken(token) {
-      switch (token) {
+    var isCollection = (token2) => !!token2 && "items" in token2;
+    var isScalar2 = (token2) => !!token2 && (token2.type === "scalar" || token2.type === "single-quoted-scalar" || token2.type === "double-quoted-scalar" || token2.type === "block-scalar");
+    function prettyToken(token2) {
+      switch (token2) {
         case BOM:
           return "<BOM>";
         case DOCUMENT:
@@ -5620,7 +5618,7 @@ var require_cst = __commonJS({
         case SCALAR:
           return "<SCALAR>";
         default:
-          return JSON.stringify(token);
+          return JSON.stringify(token2);
       }
     }
     function tokenType(source) {
@@ -5692,7 +5690,7 @@ var require_cst = __commonJS({
     exports.FLOW_END = FLOW_END;
     exports.SCALAR = SCALAR;
     exports.isCollection = isCollection;
-    exports.isScalar = isScalar;
+    exports.isScalar = isScalar2;
     exports.prettyToken = prettyToken;
     exports.tokenType = tokenType;
   }
@@ -6344,8 +6342,8 @@ var require_parser = __commonJS({
       }
       return -1;
     }
-    function isFlowToken(token) {
-      switch (token?.type) {
+    function isFlowToken(token2) {
+      switch (token2?.type) {
         case "alias":
         case "scalar":
         case "single-quoted-scalar":
@@ -6552,38 +6550,38 @@ var require_parser = __commonJS({
         return this.stack[this.stack.length - n];
       }
       *pop(error) {
-        const token = error ?? this.stack.pop();
-        if (!token) {
+        const token2 = error ?? this.stack.pop();
+        if (!token2) {
           const message = "Tried to pop an empty stack";
           yield { type: "error", offset: this.offset, source: "", message };
         } else if (this.stack.length === 0) {
-          yield token;
+          yield token2;
         } else {
           const top = this.peek(1);
-          if (token.type === "block-scalar") {
-            token.indent = "indent" in top ? top.indent : 0;
-          } else if (token.type === "flow-collection" && top.type === "document") {
-            token.indent = 0;
+          if (token2.type === "block-scalar") {
+            token2.indent = "indent" in top ? top.indent : 0;
+          } else if (token2.type === "flow-collection" && top.type === "document") {
+            token2.indent = 0;
           }
-          if (token.type === "flow-collection")
-            fixFlowSeqItems(token);
+          if (token2.type === "flow-collection")
+            fixFlowSeqItems(token2);
           switch (top.type) {
             case "document":
-              top.value = token;
+              top.value = token2;
               break;
             case "block-scalar":
-              top.props.push(token);
+              top.props.push(token2);
               break;
             case "block-map": {
               const it = top.items[top.items.length - 1];
               if (it.value) {
-                top.items.push({ start: [], key: token, sep: [] });
+                top.items.push({ start: [], key: token2, sep: [] });
                 this.onKeyLine = true;
                 return;
               } else if (it.sep) {
-                it.value = token;
+                it.value = token2;
               } else {
-                Object.assign(it, { key: token, sep: [] });
+                Object.assign(it, { key: token2, sep: [] });
                 this.onKeyLine = !it.explicitKey;
                 return;
               }
@@ -6592,34 +6590,34 @@ var require_parser = __commonJS({
             case "block-seq": {
               const it = top.items[top.items.length - 1];
               if (it.value)
-                top.items.push({ start: [], value: token });
+                top.items.push({ start: [], value: token2 });
               else
-                it.value = token;
+                it.value = token2;
               break;
             }
             case "flow-collection": {
               const it = top.items[top.items.length - 1];
               if (!it || it.value)
-                top.items.push({ start: [], key: token, sep: [] });
+                top.items.push({ start: [], key: token2, sep: [] });
               else if (it.sep)
-                it.value = token;
+                it.value = token2;
               else
-                Object.assign(it, { key: token, sep: [] });
+                Object.assign(it, { key: token2, sep: [] });
               return;
             }
             /* istanbul ignore next should not happen */
             default:
               yield* this.pop();
-              yield* this.pop(token);
+              yield* this.pop(token2);
           }
-          if ((top.type === "document" || top.type === "block-map" || top.type === "block-seq") && (token.type === "block-map" || token.type === "block-seq")) {
-            const last = token.items[token.items.length - 1];
-            if (last && !last.sep && !last.value && last.start.length > 0 && findNonEmptyIndex(last.start) === -1 && (token.indent === 0 || last.start.every((st) => st.type !== "comment" || st.indent < token.indent))) {
+          if ((top.type === "document" || top.type === "block-map" || top.type === "block-seq") && (token2.type === "block-map" || token2.type === "block-seq")) {
+            const last = token2.items[token2.items.length - 1];
+            if (last && !last.sep && !last.value && last.start.length > 0 && findNonEmptyIndex(last.start) === -1 && (token2.indent === 0 || last.start.every((st) => st.type !== "comment" || st.indent < token2.indent))) {
               if (top.type === "document")
                 top.end = last.start;
               else
                 top.items.push({ start: last.start });
-              token.items.splice(-1, 1);
+              token2.items.splice(-1, 1);
             }
           }
         }
@@ -7162,7 +7160,7 @@ var require_parser = __commonJS({
             yield* this.pop();
         }
       }
-      *lineEnd(token) {
+      *lineEnd(token2) {
         switch (this.type) {
           case "comma":
           case "doc-start":
@@ -7179,10 +7177,10 @@ var require_parser = __commonJS({
           case "space":
           case "comment":
           default:
-            if (token.end)
-              token.end.push(this.sourceToken);
+            if (token2.end)
+              token2.end.push(this.sourceToken);
             else
-              token.end = [this.sourceToken];
+              token2.end = [this.sourceToken];
             if (this.type === "newline")
               yield* this.pop();
         }
@@ -7647,9 +7645,9 @@ var require_scan = __commonJS({
     var isPathSeparator = (code) => {
       return code === CHAR_FORWARD_SLASH || code === CHAR_BACKWARD_SLASH;
     };
-    var depth = (token) => {
-      if (token.isPrefix !== true) {
-        token.depth = token.isGlobstar ? Infinity : 1;
+    var depth = (token2) => {
+      if (token2.isPrefix !== true) {
+        token2.depth = token2.isGlobstar ? Infinity : 1;
       }
     };
     var scan = (input, options) => {
@@ -7676,7 +7674,7 @@ var require_scan = __commonJS({
       let braces = 0;
       let prev;
       let code;
-      let token = { value: "", depth: 0, isGlob: false };
+      let token2 = { value: "", depth: 0, isGlob: false };
       const eos = () => index >= length;
       const peek = () => str.charCodeAt(index + 1);
       const advance = () => {
@@ -7687,7 +7685,7 @@ var require_scan = __commonJS({
         code = advance();
         let next;
         if (code === CHAR_BACKWARD_SLASH) {
-          backslashes = token.backslashes = true;
+          backslashes = token2.backslashes = true;
           code = advance();
           if (code === CHAR_LEFT_CURLY_BRACE) {
             braceEscaped = true;
@@ -7698,7 +7696,7 @@ var require_scan = __commonJS({
           braces++;
           while (eos() !== true && (code = advance())) {
             if (code === CHAR_BACKWARD_SLASH) {
-              backslashes = token.backslashes = true;
+              backslashes = token2.backslashes = true;
               advance();
               continue;
             }
@@ -7707,8 +7705,8 @@ var require_scan = __commonJS({
               continue;
             }
             if (braceEscaped !== true && code === CHAR_DOT && (code = advance()) === CHAR_DOT) {
-              isBrace = token.isBrace = true;
-              isGlob = token.isGlob = true;
+              isBrace = token2.isBrace = true;
+              isGlob = token2.isGlob = true;
               finished = true;
               if (scanToEnd === true) {
                 continue;
@@ -7716,8 +7714,8 @@ var require_scan = __commonJS({
               break;
             }
             if (braceEscaped !== true && code === CHAR_COMMA) {
-              isBrace = token.isBrace = true;
-              isGlob = token.isGlob = true;
+              isBrace = token2.isBrace = true;
+              isGlob = token2.isGlob = true;
               finished = true;
               if (scanToEnd === true) {
                 continue;
@@ -7728,7 +7726,7 @@ var require_scan = __commonJS({
               braces--;
               if (braces === 0) {
                 braceEscaped = false;
-                isBrace = token.isBrace = true;
+                isBrace = token2.isBrace = true;
                 finished = true;
                 break;
               }
@@ -7741,8 +7739,8 @@ var require_scan = __commonJS({
         }
         if (code === CHAR_FORWARD_SLASH) {
           slashes.push(index);
-          tokens.push(token);
-          token = { value: "", depth: 0, isGlob: false };
+          tokens.push(token2);
+          token2 = { value: "", depth: 0, isGlob: false };
           if (finished === true) continue;
           if (prev === CHAR_DOT && index === start + 1) {
             start += 2;
@@ -7754,8 +7752,8 @@ var require_scan = __commonJS({
         if (opts.noext !== true) {
           const isExtglobChar = code === CHAR_PLUS || code === CHAR_AT || code === CHAR_ASTERISK || code === CHAR_QUESTION_MARK || code === CHAR_EXCLAMATION_MARK;
           if (isExtglobChar === true && peek() === CHAR_LEFT_PARENTHESES) {
-            isGlob = token.isGlob = true;
-            isExtglob = token.isExtglob = true;
+            isGlob = token2.isGlob = true;
+            isExtglob = token2.isExtglob = true;
             finished = true;
             if (code === CHAR_EXCLAMATION_MARK && index === start) {
               negatedExtglob = true;
@@ -7764,7 +7762,7 @@ var require_scan = __commonJS({
               let parens = 0;
               while (eos() !== true && (code = advance())) {
                 if (code === CHAR_BACKWARD_SLASH) {
-                  backslashes = token.backslashes = true;
+                  backslashes = token2.backslashes = true;
                   advance();
                   continue;
                 }
@@ -7783,8 +7781,8 @@ var require_scan = __commonJS({
           }
         }
         if (code === CHAR_ASTERISK) {
-          if (prev === CHAR_ASTERISK) isGlobstar = token.isGlobstar = true;
-          isGlob = token.isGlob = true;
+          if (prev === CHAR_ASTERISK) isGlobstar = token2.isGlobstar = true;
+          isGlob = token2.isGlob = true;
           finished = true;
           if (scanToEnd === true) {
             continue;
@@ -7792,7 +7790,7 @@ var require_scan = __commonJS({
           break;
         }
         if (code === CHAR_QUESTION_MARK) {
-          isGlob = token.isGlob = true;
+          isGlob = token2.isGlob = true;
           finished = true;
           if (scanToEnd === true) {
             continue;
@@ -7802,13 +7800,13 @@ var require_scan = __commonJS({
         if (code === CHAR_LEFT_SQUARE_BRACKET) {
           while (eos() !== true && (next = advance())) {
             if (next === CHAR_BACKWARD_SLASH) {
-              backslashes = token.backslashes = true;
+              backslashes = token2.backslashes = true;
               advance();
               continue;
             }
             if (next === CHAR_RIGHT_SQUARE_BRACKET) {
-              isBracket = token.isBracket = true;
-              isGlob = token.isGlob = true;
+              isBracket = token2.isBracket = true;
+              isGlob = token2.isGlob = true;
               finished = true;
               break;
             }
@@ -7819,17 +7817,17 @@ var require_scan = __commonJS({
           break;
         }
         if (opts.nonegate !== true && code === CHAR_EXCLAMATION_MARK && index === start) {
-          negated = token.negated = true;
+          negated = token2.negated = true;
           start++;
           continue;
         }
         if (opts.noparen !== true && code === CHAR_LEFT_PARENTHESES) {
-          isGlob = token.isGlob = true;
+          isGlob = token2.isGlob = true;
           if (scanToEnd === true) {
             let parens = 1;
             while (eos() !== true && (code = advance())) {
               if (code === CHAR_BACKWARD_SLASH) {
-                backslashes = token.backslashes = true;
+                backslashes = token2.backslashes = true;
                 advance();
                 continue;
               }
@@ -7903,7 +7901,7 @@ var require_scan = __commonJS({
       if (opts.tokens === true) {
         state.maxDepth = 0;
         if (!isPathSeparator(code)) {
-          tokens.push(token);
+          tokens.push(token2);
         }
         state.tokens = tokens;
       }
@@ -7949,7 +7947,7 @@ var require_scan = __commonJS({
 var require_parse = __commonJS({
   "../../node_modules/.pnpm/picomatch@4.0.7/node_modules/picomatch/lib/parse.js"(exports, module) {
     "use strict";
-    var constants2 = require_constants();
+    var constants = require_constants();
     var utils = require_utils();
     var {
       MAX_LENGTH,
@@ -7957,7 +7955,7 @@ var require_parse = __commonJS({
       REGEX_NON_SPECIAL_CHARS,
       REGEX_SPECIAL_CHARS_BACKREF,
       REPLACEMENTS
-    } = constants2;
+    } = constants;
     var expandRange = (args, options) => {
       if (typeof options.expandRange === "function") {
         return options.expandRange(...args, options);
@@ -8166,7 +8164,7 @@ var require_parse = __commonJS({
       if (options.maxExtglobRecursion === false) {
         return { risky: false };
       }
-      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants2.DEFAULT_MAX_EXTGLOB_RECURSION;
+      const max = typeof options.maxExtglobRecursion === "number" ? options.maxExtglobRecursion : constants.DEFAULT_MAX_EXTGLOB_RECURSION;
       const branches = splitTopLevel(body).map((branch) => branch.trim());
       if (branches.length > 1) {
         if (branches.some((branch) => branch === "") || branches.some((branch) => /^[*?]+$/.test(branch)) || hasRepeatedCharPrefixOverlap(branches)) {
@@ -8212,8 +8210,8 @@ var require_parse = __commonJS({
       const bos = { type: "bos", value: "", output: opts.prepend || "" };
       const tokens = [bos];
       const capture = opts.capture ? "" : "?:";
-      const PLATFORM_CHARS = constants2.globChars(opts.windows);
-      const EXTGLOB_CHARS = constants2.extglobChars(PLATFORM_CHARS);
+      const PLATFORM_CHARS = constants.globChars(opts.windows);
+      const EXTGLOB_CHARS = constants.extglobChars(PLATFORM_CHARS);
       const {
         DOT_LITERAL,
         PLUS_LITERAL,
@@ -8272,9 +8270,9 @@ var require_parse = __commonJS({
         state.consumed += value2;
         state.index += num2;
       };
-      const append = (token) => {
-        state.output += token.output != null ? token.output : token.value;
-        consume(token.value);
+      const append = (token2) => {
+        state.output += token2.output != null ? token2.output : token2.value;
+        consume(token2.value);
       };
       const negate = () => {
         let count = 1;
@@ -8324,54 +8322,54 @@ var require_parse = __commonJS({
         prev = tok;
       };
       const extglobOpen = (type, value2) => {
-        const token = { ...EXTGLOB_CHARS[value2], conditions: 1, inner: "" };
-        token.prev = prev;
-        token.parens = state.parens;
-        token.output = state.output;
-        token.startIndex = state.index;
-        token.tokensIndex = tokens.length;
-        const output = (opts.capture ? "(" : "") + token.open;
+        const token2 = { ...EXTGLOB_CHARS[value2], conditions: 1, inner: "" };
+        token2.prev = prev;
+        token2.parens = state.parens;
+        token2.output = state.output;
+        token2.startIndex = state.index;
+        token2.tokensIndex = tokens.length;
+        const output = (opts.capture ? "(" : "") + token2.open;
         increment("parens");
         push({ type, value: value2, output: state.output ? "" : ONE_CHAR });
         push({ type: "paren", extglob: true, value: advance(), output });
-        extglobs.push(token);
+        extglobs.push(token2);
       };
-      const extglobClose = (token) => {
-        const literal = input.slice(token.startIndex, state.index + 1);
-        const body = input.slice(token.startIndex + 2, state.index);
+      const extglobClose = (token2) => {
+        const literal = input.slice(token2.startIndex, state.index + 1);
+        const body = input.slice(token2.startIndex + 2, state.index);
         const analysis = analyzeRepeatedExtglob(body, opts);
-        if ((token.type === "plus" || token.type === "star") && analysis.risky) {
-          const safeOutput = analysis.safeOutput ? (token.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
-          const open = tokens[token.tokensIndex];
+        if ((token2.type === "plus" || token2.type === "star") && analysis.risky) {
+          const safeOutput = analysis.safeOutput ? (token2.output ? "" : ONE_CHAR) + (opts.capture ? `(${analysis.safeOutput})` : analysis.safeOutput) : void 0;
+          const open = tokens[token2.tokensIndex];
           open.type = "text";
           open.value = literal;
           open.output = safeOutput || utils.escapeRegex(literal);
-          for (let i = token.tokensIndex + 1; i < tokens.length; i++) {
+          for (let i = token2.tokensIndex + 1; i < tokens.length; i++) {
             tokens[i].value = "";
             tokens[i].output = "";
             delete tokens[i].suffix;
           }
-          state.output = token.output + open.output;
+          state.output = token2.output + open.output;
           state.backtrack = true;
           push({ type: "paren", extglob: true, value, output: "" });
           decrement("parens");
           return;
         }
-        let output = token.close + (opts.capture ? ")" : "");
+        let output = token2.close + (opts.capture ? ")" : "");
         let rest;
-        if (token.type === "negate") {
+        if (token2.type === "negate") {
           let extglobStar = star;
-          if (token.inner && token.inner.length > 1 && token.inner.includes("/")) {
+          if (token2.inner && token2.inner.length > 1 && token2.inner.includes("/")) {
             extglobStar = globstar(opts);
           }
           if (extglobStar !== star || eos() || /^\)+$/.test(remaining())) {
-            output = token.close = `)$))${extglobStar}`;
+            output = token2.close = `)$))${extglobStar}`;
           }
-          if (token.inner.includes("*") && (rest = remaining()) && /^\.[^\\/.]+$/.test(rest)) {
+          if (token2.inner.includes("*") && (rest = remaining()) && /^\.[^\\/.]+$/.test(rest)) {
             const expression = parse3(rest, { ...options, fastpaths: false }).output;
-            output = token.close = `)${expression})${extglobStar})`;
+            output = token2.close = `)${expression})${extglobStar})`;
           }
-          if (token.prev.type === "bos") {
+          if (token2.prev.type === "bos") {
             state.negatedExtglob = true;
           }
         }
@@ -8830,18 +8828,18 @@ var require_parse = __commonJS({
           consume(value);
           continue;
         }
-        const token = { type: "star", value, output: star };
+        const token2 = { type: "star", value, output: star };
         if (opts.bash === true) {
-          token.output = ".*?";
+          token2.output = ".*?";
           if (prev.type === "bos" || prev.type === "slash") {
-            token.output = nodot + token.output;
+            token2.output = nodot + token2.output;
           }
-          push(token);
+          push(token2);
           continue;
         }
         if (prev && (prev.type === "bracket" || prev.type === "paren") && opts.regex === true) {
-          token.output = value;
-          push(token);
+          token2.output = value;
+          push(token2);
           continue;
         }
         if (state.index === state.start || prev.type === "slash" || prev.type === "dot") {
@@ -8860,7 +8858,7 @@ var require_parse = __commonJS({
             prev.output += ONE_CHAR;
           }
         }
-        push(token);
+        push(token2);
       }
       while (state.brackets > 0) {
         if (opts.strictBrackets === true) throw new SyntaxError(syntaxError("closing", "]"));
@@ -8882,10 +8880,10 @@ var require_parse = __commonJS({
       }
       if (state.backtrack === true) {
         state.output = "";
-        for (const token of state.tokens) {
-          state.output += token.output != null ? token.output : token.value;
-          if (token.suffix) {
-            state.output += token.suffix;
+        for (const token2 of state.tokens) {
+          state.output += token2.output != null ? token2.output : token2.value;
+          if (token2.suffix) {
+            state.output += token2.suffix;
           }
         }
       }
@@ -8909,7 +8907,7 @@ var require_parse = __commonJS({
         NO_DOTS_SLASH,
         STAR,
         START_ANCHOR
-      } = constants2.globChars(opts.windows);
+      } = constants.globChars(opts.windows);
       const nodot = opts.dot ? NO_DOTS : NO_DOT;
       const slashDot = opts.dot ? NO_DOTS_SLASH : NO_DOT;
       const capture = opts.capture ? "" : "?:";
@@ -8967,7 +8965,7 @@ var require_picomatch = __commonJS({
     var scan = require_scan();
     var parse3 = require_parse();
     var utils = require_utils();
-    var constants2 = require_constants();
+    var constants = require_constants();
     var isObject2 = (val) => val && typeof val === "object" && !Array.isArray(val);
     var picomatch4 = (glob2, options, returnState = false) => {
       if (Array.isArray(glob2)) {
@@ -9095,7 +9093,7 @@ var require_picomatch = __commonJS({
         return /$^/;
       }
     };
-    picomatch4.constants = constants2;
+    picomatch4.constants = constants;
     module.exports = picomatch4;
   }
 });
@@ -9117,6 +9115,149 @@ var require_picomatch2 = __commonJS({
   }
 });
 
+// ../core/dist/guard/packs.js
+var PACKS = {
+  "done-check": {
+    summary: "At Stop, checks the change against the criteria files' bullets and blocks once on a confidently unmet one",
+    defaults: {
+      latencyMs: 5e3,
+      maxUsdPerSession: 0.01,
+      criteria: ["TASK.md", ".system1/done.md"],
+      evidence: []
+    }
+  }
+};
+var PACK_NAMES = Object.keys(PACKS);
+function isPackName(name) {
+  return Object.hasOwn(PACKS, name);
+}
+var PACK_KEYS = [
+  "enabled",
+  "enabledAt",
+  "enabledBy",
+  "latencyMs",
+  "maxUsdPerSession",
+  "criteria",
+  "evidence"
+];
+function readGuard(user, userFile, repo, repoFile, warnings) {
+  const layers2 = [
+    { packs: packSections(repo, repoFile, warnings), file: repoFile, which: "repo" },
+    { packs: packSections(user, userFile, warnings), file: userFile, which: "user" }
+  ];
+  const packs = {};
+  for (const name of PACK_NAMES) {
+    const defaults = PACKS[name].defaults;
+    const pack = {
+      enabled: false,
+      latencyMs: defaults.latencyMs,
+      maxUsdPerSession: defaults.maxUsdPerSession,
+      criteria: [...defaults.criteria],
+      evidence: [...defaults.evidence]
+    };
+    const seen = /* @__PURE__ */ new Set();
+    for (const { packs: sections, file, which } of layers2) {
+      const section2 = sections[name];
+      if (!section2)
+        continue;
+      const set = (key, value) => {
+        if (seen.has(key))
+          return;
+        seen.add(key);
+        pack[key] = value;
+      };
+      for (const [key, value] of Object.entries(section2)) {
+        if (value === void 0 || value === null)
+          continue;
+        const path = `guard.packs.${name}.${key}`;
+        if (!PACK_KEYS.includes(key)) {
+          warnings.push(`${file}: unknown key ${path}`);
+          continue;
+        }
+        if (key.startsWith("enabled") && which === "user") {
+          warnings.push(`${file}: ${path} is read only from the repo file (ignored)`);
+          continue;
+        }
+        const bad = (expected) => warnings.push(`${file}: ${path} must be ${expected} (ignored)`);
+        switch (key) {
+          case "enabled":
+            if (typeof value === "boolean")
+              set("enabled", value);
+            else
+              bad("true or false");
+            break;
+          case "enabledAt":
+          case "enabledBy":
+            if (typeof value === "string" && value.trim())
+              set(key, value);
+            else
+              bad("text");
+            break;
+          case "latencyMs":
+            if (typeof value === "number" && Number.isFinite(value) && value > 0)
+              set(key, value);
+            else
+              bad("a number above 0");
+            break;
+          case "maxUsdPerSession":
+            if (typeof value === "number" && Number.isFinite(value) && value >= 0)
+              set(key, value);
+            else
+              bad("a number of at least 0");
+            break;
+          case "criteria":
+          case "evidence":
+            if (Array.isArray(value) && value.every((v) => typeof v === "string" && v.trim()))
+              set(key, value);
+            else
+              bad("a list of file paths");
+            break;
+        }
+      }
+    }
+    packs[name] = pack;
+  }
+  return { packs };
+}
+function packSections(layer, file, warnings) {
+  const guard = layer?.guard;
+  if (guard === void 0 || guard === null)
+    return {};
+  if (!isMapping(guard)) {
+    warnings.push(`${file}: guard must be a mapping (ignored)`);
+    return {};
+  }
+  for (const key of Object.keys(guard)) {
+    if (key !== "packs")
+      warnings.push(`${file}: unknown key guard.${key}`);
+  }
+  const packs = guard.packs;
+  if (packs === void 0 || packs === null)
+    return {};
+  if (!isMapping(packs)) {
+    warnings.push(`${file}: guard.packs must be a mapping (ignored)`);
+    return {};
+  }
+  const out = {};
+  for (const [name, section2] of Object.entries(packs)) {
+    if (!isPackName(name)) {
+      warnings.push(`${file}: unknown guard pack ${name} (known: ${PACK_NAMES.join(", ")})`);
+      continue;
+    }
+    if (section2 === void 0 || section2 === null)
+      continue;
+    if (!isMapping(section2)) {
+      warnings.push(`${file}: guard.packs.${name} must be a mapping (ignored)`);
+      continue;
+    }
+    out[name] = section2;
+  }
+  return out;
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // ../core/dist/route/route.js
 var ROUTE_DEFAULTS = {
   enabled: true,
@@ -9589,6 +9730,7 @@ function loadConfig(options = {}) {
     profiles: [...profileList(user, userFile, warnings), ...profileList(repo, repoFile, warnings)],
     route: readRoute(user, userFile, repo, repoFile, env)
   };
+  const guard = readGuard(user, userFile, repo, repoFile, warnings);
   const key = resolveApiKey(env, userDir);
   const session = detectSession(env);
   return {
@@ -9598,9 +9740,11 @@ function loadConfig(options = {}) {
     repoRoot,
     apiKey: key?.value,
     apiKeySource: key?.source,
+    apiKeyQuoted: key?.quoted ?? false,
     replay: /^(1|true|yes)$/i.test(env.SYSTEM1_REPLAY ?? ""),
     session: session?.id,
     sessionOrigin: session?.origin,
+    guard,
     layers: {
       ...user ? { user: userFile } : {},
       ...repo ? { repo: repoFile } : {},
@@ -9634,11 +9778,21 @@ function readLayer(file) {
   return parsed;
 }
 var KNOWN = {
-  "": ["model", "endpoint", "concurrency", "timeoutMs", "budget", "egress", "profiles", "route"],
+  "": [
+    "model",
+    "endpoint",
+    "concurrency",
+    "timeoutMs",
+    "budget",
+    "egress",
+    "profiles",
+    "route",
+    "guard"
+  ],
   budget: ["maxCalls", "maxUsd"],
   egress: ["consent", "exclude"]
 };
-function unknownKeys(layer, file, which2) {
+function unknownKeys(layer, file, which) {
   if (!layer)
     return [];
   const warnings = Object.keys(layer).filter((k) => !KNOWN[""]?.includes(k)).map((key) => `${file}: unknown key ${key}`);
@@ -9646,7 +9800,7 @@ function unknownKeys(layer, file, which2) {
     const value = layer[section2];
     if (value === void 0 || value === null)
       continue;
-    if (!isMapping(value)) {
+    if (!isMapping2(value)) {
       warnings.push(`${file}: ${section2} must be a mapping (ignored)`);
       continue;
     }
@@ -9656,7 +9810,7 @@ function unknownKeys(layer, file, which2) {
     }
   }
   const egress = layer.egress;
-  if (which2 === "user" && isMapping(egress) && egress.consent !== void 0) {
+  if (which === "user" && isMapping2(egress) && egress.consent !== void 0) {
     warnings.push(`${file}: egress.consent is read only from the repo file (ignored)`);
   }
   return warnings;
@@ -9684,7 +9838,7 @@ function pick(path, rule, layers2, warnings) {
     const [head, key] = path.split(".");
     let value = layer?.[head];
     if (key !== void 0)
-      value = isMapping(value) ? value[key] : void 0;
+      value = isMapping2(value) ? value[key] : void 0;
     if (value === void 0 || value === null)
       continue;
     if (!rule.ok(value))
@@ -9694,7 +9848,7 @@ function pick(path, rule, layers2, warnings) {
   }
   return found2;
 }
-function isMapping(value) {
+function isMapping2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readConsent(repo, file) {
@@ -9841,18 +9995,36 @@ function triggerList(value, file) {
   });
 }
 function resolveApiKey(env, userDir) {
-  const fromEnv = nonEmpty2(env.OPENROUTER_API_KEY);
+  const fromEnv = unquoteKey(env.OPENROUTER_API_KEY);
   if (fromEnv)
-    return { value: fromEnv, source: "env" };
+    return { ...fromEnv, source: "env" };
   const file = join(userDir, "credentials");
   if (!existsSync(file))
     return void 0;
   if (process.platform !== "win32" && (statSync(file).mode & 63) !== 0) {
     throw new DecisionsError("config-error", `${file} is readable by other users. Run \`chmod 600 ${file}\`.`, { file });
   }
-  const parsed = readLayer(file);
-  const value = nonEmpty2(typeof parsed?.openrouter_api_key === "string" ? parsed.openrouter_api_key : void 0);
-  return value ? { value, source: "credentials", file } : void 0;
+  let parsed;
+  try {
+    parsed = readLayer(file);
+  } catch {
+    throw new DecisionsError("config-error", `${file} is not a valid YAML mapping; it should hold one line, \`openrouter_api_key: <key>\``, { file });
+  }
+  const key = unquoteKey(typeof parsed?.openrouter_api_key === "string" ? parsed.openrouter_api_key : void 0, `openrouter_api_key in ${file}`);
+  return key ? { ...key, source: "credentials", file } : void 0;
+}
+function unquoteKey(raw, source = "OPENROUTER_API_KEY") {
+  const value = nonEmpty2(raw);
+  if (!value)
+    return void 0;
+  const quoted = /^(["']).*\1$/s.test(value);
+  const key = quoted ? nonEmpty2(value.slice(1, -1)) : value;
+  if (!key)
+    return void 0;
+  if (/[^\x21-\x7e]/.test(key)) {
+    throw new DecisionsError("config-error", `${source} contains a space, line break or other character an API key can't have; set it again`);
+  }
+  return { value: key, quoted };
 }
 function nonEmpty2(value) {
   return value === void 0 || value.trim() === "" ? void 0 : value.trim();
@@ -9866,15 +10038,56 @@ var HEADER = `# decisions \u2014 per-repo configuration. See https://github.com/
 # egress.consent records that this repo agreed to send content to the decision
 # model's provider (OpenRouter). Path excludes and secret scrubbing always apply.
 `;
+function editable(file, path) {
+  const doc = existsSync2(file) ? (0, import_yaml2.parseDocument)(readFileSync2(file, "utf8")) : (0, import_yaml2.parseDocument)(HEADER);
+  if (doc.errors.length > 0) {
+    throw new DecisionsError("config-error", `${file} is not valid YAML: ${doc.errors[0]?.message}`, {
+      file
+    });
+  }
+  if (!doc.contents || (0, import_yaml2.isScalar)(doc.contents) && doc.contents.value == null) {
+    doc.contents = doc.createNode({});
+  }
+  if (!(0, import_yaml2.isMap)(doc.contents)) {
+    throw new DecisionsError("config-error", `${file} must be a YAML mapping`, { file });
+  }
+  for (let i = 1; i <= path.length; i++) {
+    const at = path.slice(0, i);
+    const node = doc.getIn(at, true);
+    if (node === void 0 || (0, import_yaml2.isMap)(node))
+      continue;
+    if (node === null || (0, import_yaml2.isScalar)(node) && node.value == null) {
+      doc.setIn(at, doc.createNode({}));
+      continue;
+    }
+    throw new DecisionsError("config-error", `${file}: ${at.join(".")} must be a mapping. Correct it by hand, then run the command again`, { file });
+  }
+  return doc;
+}
 function setConsent(repoRoot, granted, by, now = /* @__PURE__ */ new Date()) {
   const file = repoConfigPath(repoRoot);
-  const doc = existsSync2(file) ? (0, import_yaml2.parseDocument)(readFileSync2(file, "utf8")) : (0, import_yaml2.parseDocument)(HEADER);
+  const doc = editable(file, ["egress"]);
   const consent = { granted, at: now.toISOString(), ...by ? { by } : {} };
   doc.setIn(["egress", "consent"], consent);
   mkdirSync(dirname2(file), { recursive: true });
   writeFileSync(file, doc.toString());
   return consent;
 }
+function setGuardEnabled(repoRoot, pack, enabled, by, now = /* @__PURE__ */ new Date()) {
+  const file = repoConfigPath(repoRoot);
+  const path = ["guard", "packs", pack];
+  const doc = editable(file, path);
+  const at = now.toISOString();
+  doc.setIn([...path, "enabled"], enabled);
+  doc.setIn([...path, "enabledAt"], at);
+  if (by)
+    doc.setIn([...path, "enabledBy"], by);
+  else
+    doc.deleteIn([...path, "enabledBy"]);
+  mkdirSync(dirname2(file), { recursive: true });
+  writeFileSync(file, doc.toString());
+  return { enabled, enabledAt: at, ...by ? { enabledBy: by } : {} };
+}
 function assertConsent(consent, repoRoot) {
   if (consent.granted)
     return;
@@ -9931,59 +10144,9 @@ function isExcluded(path, extra = []) {
   return [...DEFAULT_EXCLUDES, ...extra].find((p) => (0, import_picomatch.default)(p, { dot: true })(path));
 }
 
-// ../core/dist/ping.js
-function probeUrl(config) {
-  const origin = new URL(config.endpoint).origin;
-  return `${origin}/api/v1/models/${config.model}/endpoints`;
-}
-async function ping(config, options = {}) {
-  const doFetch = options.fetch ?? fetch;
-  const probe = probeUrl(config);
-  const base2 = {
-    model: config.model,
-    endpoint: config.endpoint,
-    probe,
-    keyPresent: config.apiKey !== void 0
-  };
-  const started = performance.now();
-  try {
-    const response = await doFetch(probe, {
-      signal: AbortSignal.timeout(options.timeoutMs ?? 1e4)
-    });
-    const latencyMs = Math.round(performance.now() - started);
-    if (!response.ok) {
-      return {
-        ...base2,
-        ok: false,
-        latencyMs,
-        httpStatus: response.status,
-        error: `HTTP ${response.status}`
-      };
-    }
-    const body = await response.json();
-    const contextLength = body.data?.endpoints?.[0]?.context_length;
-    return {
-      ...base2,
-      ok: true,
-      latencyMs,
-      httpStatus: response.status,
-      ...typeof contextLength === "number" ? { contextLength } : {}
-    };
-  } catch (error) {
-    return { ...base2, ok: false, error: describe2(error) };
-  }
-}
-function describe2(error) {
-  if (error instanceof Error) {
-    const cause = error.cause;
-    return cause instanceof Error ? `${error.message}: ${cause.message}` : error.message;
-  }
-  return String(error);
-}
-
-// ../core/dist/spec/spec.js
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "node:fs";
-import { basename as basename2, extname, isAbsolute as isAbsolute3, join as join2, relative as relative3, resolve as resolve5 } from "node:path";
+// ../core/dist/guard/state.js
+import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { join as join2 } from "node:path";
 
 // ../../node_modules/.pnpm/typebox@1.3.34/node_modules/typebox/build/system/memory/memory.mjs
 var memory_exports = {};
@@ -13113,8 +13276,8 @@ function Compare(left, right) {
 // ../../node_modules/.pnpm/typebox@1.3.34/node_modules/typebox/build/type/engine/evaluate/broaden.mjs
 function BroadenFilter(type, types, result = [], all = types) {
   return guard_exports.ShiftLeft(types, (left, right) => {
-    const compare2 = Compare(type, left);
-    return guard_exports.IsEqual(compare2, CompareResultLeftInside) || guard_exports.IsEqual(compare2, CompareResultEqual) ? all : guard_exports.IsEqual(compare2, CompareResultDisjoint) ? BroadenFilter(type, right, [...result, left], all) : BroadenFilter(type, right, result, all);
+    const compare = Compare(type, left);
+    return guard_exports.IsEqual(compare, CompareResultLeftInside) || guard_exports.IsEqual(compare, CompareResultEqual) ? all : guard_exports.IsEqual(compare, CompareResultDisjoint) ? BroadenFilter(type, right, [...result, left], all) : BroadenFilter(type, right, result, all);
   }, () => [...result, type]);
 }
 function BroadenType(type, types, result) {
@@ -14997,15 +15160,15 @@ function NextPendingResource(stack, schema) {
   return IsId(schema) ? false : stack.pendingResource;
 }
 function NextLexicalBase(stack, schema) {
-  const entry2 = ResourceEntry(stack, schema);
-  if (entry2)
-    return entry2.base;
+  const entry = ResourceEntry(stack, schema);
+  if (entry)
+    return entry.base;
   return IsId(schema) ? NextUri(schema.$id, stack.lexicalBase).href : stack.lexicalBase;
 }
 function NextResourceBase(stack, schema) {
-  const entry2 = ResourceEntry(stack, schema);
-  if (entry2)
-    return entry2.base;
+  const entry = ResourceEntry(stack, schema);
+  if (entry)
+    return entry.base;
   return IsId(schema) && stack.pendingResource ? NextUri(schema.$id, stack.resourceBase).href : stack.resourceBase;
 }
 function NextUseResourceBaseForReference(stack, schema) {
@@ -15017,9 +15180,9 @@ function NextReferenceBase(stack, schema) {
   return isRetrieved || useResourceBaseForReference ? NextResourceBase(stack, schema) : NextLexicalBase(stack, schema);
 }
 function NextLexicalSchema(stack, schema) {
-  const entry2 = ResourceEntry(stack, schema);
-  if (entry2)
-    return entry2.root;
+  const entry = ResourceEntry(stack, schema);
+  if (entry)
+    return entry.root;
   return IsId(schema) ? schema : stack.lexicalSchema;
 }
 function HasStackKeywords(stack, schema) {
@@ -18185,7 +18348,234 @@ __export(value_exports, {
   Repair: () => Repair
 });
 
+// ../core/dist/store/file.js
+import { randomBytes } from "node:crypto";
+import { closeSync, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync3, renameSync, rmSync, statSync as statSync2, writeFileSync as writeFileSync2, writeSync } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { threadId } from "node:worker_threads";
+function token() {
+  return `${process.pid}.${threadId}.${randomBytes(6).toString("hex")}`;
+}
+function readOr(file) {
+  try {
+    return readFileSync3(file, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function withFileLock(file, options, body) {
+  mkdirSync2(dirname3(file), { recursive: true });
+  const lock = `${file}.lock`;
+  const mine = token();
+  const deadline = Date.now() + options.waitMs;
+  for (; ; ) {
+    try {
+      const fd = openSync(lock, "wx");
+      try {
+        writeSync(fd, mine);
+      } finally {
+        closeSync(fd);
+      }
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      takeOverIfStale(lock, options.staleMs);
+      if (Date.now() > deadline)
+        throw options.busy(lock);
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+  try {
+    return body();
+  } finally {
+    if (readOr(lock) === mine)
+      rmSync(lock, { force: true });
+  }
+}
+function takeOverIfStale(lock, staleMs) {
+  let judged;
+  try {
+    if (Date.now() - statSync2(lock).mtimeMs <= staleMs)
+      return;
+    judged = readOr(lock);
+  } catch {
+    return;
+  }
+  if (judged === void 0)
+    return;
+  const aside = `${lock}.${token()}.stale`;
+  try {
+    renameSync(lock, aside);
+  } catch {
+    return;
+  }
+  if (readOr(aside) === judged) {
+    rmSync(aside, { force: true });
+    return;
+  }
+  try {
+    const fd = openSync(lock, "wx");
+    closeSync(fd);
+    renameSync(aside, lock);
+  } catch {
+    rmSync(aside, { force: true });
+  }
+}
+function writeJsonAtomic(file, value) {
+  writeTextAtomic(file, `${JSON.stringify(value, null, 2)}
+`);
+}
+function writeTextAtomic(file, text) {
+  mkdirSync2(dirname3(file), { recursive: true });
+  const tmp = `${file}.${token()}.tmp`;
+  try {
+    writeFileSync2(tmp, text);
+    renameSync(tmp, file);
+  } catch (error) {
+    rmSync(tmp, { force: true });
+    throw error;
+  }
+}
+
+// ../core/dist/guard/state.js
+var GUARD_STATE_FORMAT = 1;
+var GUARD_STATE_MAX_BYTES = 1e6;
+var CRITERIA_SNAPSHOT_MAX_CHARS = 16384;
+var SESSION_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
+var MAX_SESSIONS = 200;
+var CLOSED = { additionalProperties: false };
+var Sha256 = typebox_exports.String({ pattern: "^[0-9a-f]{64}$" });
+var Time = typebox_exports.String({ pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,3})?Z$" });
+var SESSION_ID_PATTERN = "^(claude|codex):[A-Za-z0-9._-]{1,128}$";
+var MAX_CRITERIA_FILES = 20;
+var SessionSchema = typebox_exports.Object({
+  harness: typebox_exports.Union([typebox_exports.Literal("claude"), typebox_exports.Literal("codex")]),
+  /** The commit the session started from; `null` in a repo with no commits yet. */
+  base: typebox_exports.Union([typebox_exports.String({ pattern: "^[0-9a-f]{40}([0-9a-f]{24})?$" }), typebox_exports.Null()]),
+  /** `first-stop`: SessionStart didn't run, so the base is HEAD at the first Stop. */
+  baseSource: typebox_exports.Union([typebox_exports.Literal("session-start"), typebox_exports.Literal("first-stop")]),
+  startedAt: Time,
+  updatedAt: Time,
+  /** The criteria files at the base, by hash; the text too when it fits. */
+  criteria: typebox_exports.Array(typebox_exports.Object({
+    path: typebox_exports.String({ minLength: 1 }),
+    sha256: Sha256,
+    text: typebox_exports.Optional(typebox_exports.String({ maxLength: CRITERIA_SNAPSHOT_MAX_CHARS }))
+  }, CLOSED), { maxItems: MAX_CRITERIA_FILES }),
+  /** The last check: the hash of what it looked at, and what it did. */
+  last: typebox_exports.Optional(typebox_exports.Object({
+    hash: Sha256,
+    at: Time,
+    outcome: typebox_exports.Union([
+      typebox_exports.Literal("allow"),
+      typebox_exports.Literal("block"),
+      typebox_exports.Literal("skipped")
+    ])
+  }, CLOSED))
+}, CLOSED);
+var GuardStateSchema = typebox_exports.Object({
+  version: typebox_exports.Literal(GUARD_STATE_FORMAT),
+  sessions: typebox_exports.Record(typebox_exports.String({ pattern: SESSION_ID_PATTERN }), SessionSchema)
+}, CLOSED);
+function guardStatePath(repoRoot) {
+  return join2(stateDir(repoRoot), "guard", "state.json");
+}
+function guardStateProblems(value) {
+  const problems = [...value_exports.Errors(GuardStateSchema, value)].map((e) => `${e.instancePath || "/"} ${e.message}`);
+  const sessions = value?.sessions;
+  if (typeof sessions === "object" && sessions !== null) {
+    const pattern = new RegExp(SESSION_ID_PATTERN);
+    for (const id of Object.keys(sessions)) {
+      if (!pattern.test(id))
+        problems.push(`/sessions ${JSON.stringify(id)} is not a session id`);
+    }
+  }
+  return problems;
+}
+function readGuardState(file) {
+  if (!existsSync3(file))
+    return { version: GUARD_STATE_FORMAT, sessions: {} };
+  let size;
+  let text;
+  try {
+    size = statSync3(file).size;
+    if (size > GUARD_STATE_MAX_BYTES)
+      throw unreadable(file, [`it is ${size} bytes, over the limit`]);
+    text = readFileSync4(file, "utf8");
+  } catch (error) {
+    if (error instanceof DecisionsError)
+      throw error;
+    throw unreadable(file, [`cannot read it: ${error.message}`]);
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    throw unreadable(file, [`not JSON: ${error.message}`]);
+  }
+  const problems = guardStateProblems(value);
+  if (problems.length)
+    throw unreadable(file, problems);
+  return value;
+}
+function unreadable(file, problems) {
+  return new DecisionsError("invalid-request", `${file} is not a valid guard state (it was left as it is; delete it to start over):
+  ${problems.join("\n  ")}`, { file, problems });
+}
+function pruneSessions(state, now) {
+  const cutoff = now.getTime() - SESSION_TTL_MS;
+  const at = (s) => Math.min(Date.parse(s.updatedAt), now.getTime());
+  const kept = Object.entries(state.sessions).filter(([, s]) => at(s) >= cutoff).sort(([, a], [, b]) => at(b) - at(a)).slice(0, MAX_SESSIONS);
+  return { ...state, sessions: Object.fromEntries(kept) };
+}
+function updateGuardState(file, change, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  return withFileLock(file, {
+    waitMs: options.waitMs ?? 200,
+    staleMs: 3e4,
+    busy: (lock) => new DecisionsError("invalid-request", `${file} is locked by another guard hook (${lock}). Delete the lock file if no hook is running.`, { file, lock })
+  }, () => {
+    const { state, result } = change(readGuardState(file));
+    if (state) {
+      const next = pruneSessions(state, now);
+      const problems = guardStateProblems(next);
+      if (problems.length) {
+        throw new DecisionsError("invalid-request", `Refused to write an invalid guard state to ${file} (a bug in decide; the file is unchanged):
+  ${problems.join("\n  ")}`, { file, problems });
+      }
+      writeTextAtomic(file, fitToSize(next));
+    }
+    return result;
+  });
+}
+function fitToSize(state) {
+  const text = (s) => `${JSON.stringify(s, null, 2)}
+`;
+  let out = text(state);
+  if (Buffer.byteLength(out) <= GUARD_STATE_MAX_BYTES)
+    return out;
+  const entries = Object.entries(state.sessions).map(([id, s]) => [id, { ...s, criteria: s.criteria.map((c) => ({ ...c })) }]);
+  const current = () => ({ ...state, sessions: Object.fromEntries(entries) });
+  for (let i = entries.length - 1; i >= 0; i--) {
+    for (const c of entries[i]?.[1].criteria ?? [])
+      delete c.text;
+    out = text(current());
+    if (Buffer.byteLength(out) <= GUARD_STATE_MAX_BYTES)
+      return out;
+  }
+  while (entries.length > 0) {
+    entries.pop();
+    out = text(current());
+    if (Buffer.byteLength(out) <= GUARD_STATE_MAX_BYTES)
+      return out;
+  }
+  return out;
+}
+
 // ../core/dist/spec/spec.js
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "node:fs";
+import { basename as basename2, extname, isAbsolute as isAbsolute3, join as join3, relative as relative3, resolve as resolve5 } from "node:path";
 var import_yaml3 = __toESM(require_dist(), 1);
 
 // ../core/dist/project/project.js
@@ -18275,12 +18665,12 @@ function project(input) {
   const kept = [];
   const undecided = [];
   let dropped = 0;
-  for (const row2 of input.rows) {
-    const v = verdictOf(row2.answers, input.undecidedOf(row2), keep, keepAny, input.sort?.question);
+  for (const row of input.rows) {
+    const v = verdictOf(row.answers, input.undecidedOf(row), keep, keepAny, input.sort?.question);
     if (v.verdict === "undecided")
-      undecided.push({ row: row2, questions: v.questions });
+      undecided.push({ row, questions: v.questions });
     else if (v.verdict === "kept")
-      kept.push(row2);
+      kept.push(row);
     else
       dropped += 1;
   }
@@ -18291,13 +18681,13 @@ function project(input) {
   }
   const keptTotal = kept.length;
   const limited = input.limit !== void 0 ? kept.slice(0, input.limit) : kept;
-  const withFields = input.fields ? limited.map((row2) => pickAnswers(row2, input.fields)) : limited;
+  const withFields = input.fields ? limited.map((row) => pickAnswers(row, input.fields)) : limited;
   return { kept: withFields, keptTotal, undecided, dropped };
 }
-function pickAnswers(row2, fields) {
+function pickAnswers(row, fields) {
   return {
-    ...row2,
-    answers: Object.fromEntries(Object.entries(row2.answers).filter(([k]) => fields.includes(k)))
+    ...row,
+    answers: Object.fromEntries(Object.entries(row.answers).filter(([k]) => fields.includes(k)))
   };
 }
 function read(answer, field) {
@@ -18332,18 +18722,18 @@ function num(value) {
 }
 
 // ../core/dist/sources/read.js
-import { execFileSync } from "node:child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync5, realpathSync as realpathSync2, statSync as statSync5 } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve4 } from "node:path";
 
 // ../../node_modules/.pnpm/tinyglobby@0.2.17/node_modules/tinyglobby/dist/index.mjs
-import { readdir, readdirSync, realpath, realpathSync, stat, statSync as statSync2 } from "fs";
+import { readdir, readdirSync, realpath, realpathSync, stat, statSync as statSync4 } from "fs";
 import { isAbsolute, posix, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 
 // ../../node_modules/.pnpm/fdir@6.5.0_picomatch@4.0.7/node_modules/fdir/dist/index.mjs
 import { createRequire } from "module";
-import { basename, dirname as dirname3, normalize, relative, resolve as resolve2, sep } from "path";
+import { basename, dirname as dirname4, normalize, relative, resolve as resolve2, sep } from "path";
 import * as nativeFs from "fs";
 var __require2 = /* @__PURE__ */ createRequire(import.meta.url);
 function cleanPath(path) {
@@ -18414,14 +18804,14 @@ function build$6(root, options) {
   if (relativePaths) return filters && filters.length ? pushDirectoryFilterWithRelativePath(root) : pushDirectoryWithRelativePath(root);
   return filters && filters.length ? pushDirectoryFilter : pushDirectory;
 }
-var pushFileFilterAndCount = (filename, _paths, counts2, filters) => {
-  if (filters.every((filter) => filter(filename, false))) counts2.files++;
+var pushFileFilterAndCount = (filename, _paths, counts, filters) => {
+  if (filters.every((filter) => filter(filename, false))) counts.files++;
 };
 var pushFileFilter = (filename, paths, _counts, filters) => {
   if (filters.every((filter) => filter(filename, false))) paths.push(filename);
 };
-var pushFileCount = (_filename, _paths, counts2, _filters) => {
-  counts2.files++;
+var pushFileCount = (_filename, _paths, counts, _filters) => {
+  counts.files++;
 };
 var pushFile = (filename, paths) => {
   paths.push(filename);
@@ -18487,13 +18877,13 @@ function build$2(options, isSynchronous) {
 }
 function isRecursive(path, resolved, state) {
   if (state.options.useRealPaths) return isRecursiveUsingRealPaths(resolved, state);
-  let parent = dirname3(path);
+  let parent = dirname4(path);
   let depth = 1;
   while (parent !== state.root && depth < 2) {
     const resolvedPath = state.symlinks.get(parent);
     const isSameRoot = !!resolvedPath && (resolvedPath === resolved || resolvedPath.startsWith(resolved) || resolved.startsWith(resolvedPath));
     if (isSameRoot) depth++;
-    else parent = dirname3(parent);
+    else parent = dirname4(parent);
   }
   state.symlinks.set(path, resolved);
   return depth > 1;
@@ -18662,26 +19052,26 @@ var Walker = class {
     if (controller.aborted || signal && signal.aborted || maxFiles && paths.length > maxFiles) return;
     const files = this.getArray(this.state.paths);
     for (let i = 0; i < entries.length; ++i) {
-      const entry2 = entries[i];
-      if (entry2.isFile() || entry2.isSymbolicLink() && !resolveSymlinks$1 && !excludeSymlinks) {
-        const filename = this.joinPath(entry2.name, directoryPath);
+      const entry = entries[i];
+      if (entry.isFile() || entry.isSymbolicLink() && !resolveSymlinks$1 && !excludeSymlinks) {
+        const filename = this.joinPath(entry.name, directoryPath);
         this.pushFile(filename, files, this.state.counts, filters);
-      } else if (entry2.isDirectory()) {
-        let path = joinDirectoryPath(entry2.name, directoryPath, this.state.options.pathSeparator);
-        if (exclude && exclude(entry2.name, path)) continue;
+      } else if (entry.isDirectory()) {
+        let path = joinDirectoryPath(entry.name, directoryPath, this.state.options.pathSeparator);
+        if (exclude && exclude(entry.name, path)) continue;
         this.pushDirectory(path, paths, filters);
         this.walkDirectory(this.state, path, path, depth - 1, this.walk);
-      } else if (this.resolveSymlink && entry2.isSymbolicLink()) {
-        let path = joinPathWithBasePath(entry2.name, directoryPath);
+      } else if (this.resolveSymlink && entry.isSymbolicLink()) {
+        let path = joinPathWithBasePath(entry.name, directoryPath);
         this.resolveSymlink(path, this.state, (stat2, resolvedPath) => {
           if (stat2.isDirectory()) {
             resolvedPath = normalizePath(resolvedPath, this.state.options);
-            if (exclude && exclude(entry2.name, useRealPaths ? resolvedPath : path + pathSeparator)) return;
+            if (exclude && exclude(entry.name, useRealPaths ? resolvedPath : path + pathSeparator)) return;
             this.walkDirectory(this.state, resolvedPath, useRealPaths ? resolvedPath : path + pathSeparator, depth - 1, this.walk);
           } else {
             resolvedPath = useRealPaths ? resolvedPath : path;
             const filename = basename(resolvedPath);
-            const directoryPath$1 = normalizePath(dirname3(resolvedPath), this.state.options);
+            const directoryPath$1 = normalizePath(dirname4(resolvedPath), this.state.options);
             resolvedPath = this.joinPath(filename, directoryPath$1);
             this.pushFile(resolvedPath, files, this.state.counts, filters);
           }
@@ -19092,7 +19482,7 @@ function getOptions(options) {
     realpath: opts.fs.realpath || realpath,
     realpathSync: opts.fs.realpathSync || realpathSync,
     stat: opts.fs.stat || stat,
-    statSync: opts.fs.statSync || statSync2
+    statSync: opts.fs.statSync || statSync4
   });
   if (opts.debug) log("globbing with options:", opts);
   return opts;
@@ -19171,7 +19561,7 @@ async function readSource(spec, options) {
     case "stdin":
       return { documents: [{ id: "stdin", kind: "text", text: spec.text }], skipped: [] };
     case "file":
-      return readFiles([spec.path], options, spec.range);
+      return readFiles([spec.path], options, spec.range, spec.optional);
     case "glob":
       return readGlob(spec.patterns, options);
     case "jsonl":
@@ -19191,24 +19581,26 @@ function parseFileRef(ref) {
   }
   return { path: match[1], range: { start, end } };
 }
-function readFiles(paths, options, range) {
+function readFiles(paths, options, range, optional = false) {
   const documents = [];
   const skipped = [];
   const limit = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
   for (const path of paths) {
     const { absolute, display: rel, real, outside } = resolvePath(options.cwd, path);
-    if (!existsSync3(absolute) || !statSync3(absolute).isFile()) {
+    if (!existsSync4(absolute) || !statSync5(absolute).isFile()) {
+      if (optional)
+        continue;
       throw new DecisionsError("source-error", `No such file: ${rel}`, { path: rel });
     }
     if (outside && !options.allowOutside) {
       skipped.push({ path: rel, reason: "outside-repo", detail: real });
       continue;
     }
-    if (statSync3(absolute).size > limit) {
+    if (statSync5(absolute).size > limit) {
       skipped.push({ path: rel, reason: "too-large", detail: `> ${limit} bytes` });
       continue;
     }
-    const buffer = readFileSync3(absolute);
+    const buffer = readFileSync5(absolute);
     if (buffer.subarray(0, 8e3).includes(0)) {
       skipped.push({ path: rel, reason: "binary" });
       continue;
@@ -19292,13 +19684,13 @@ function insideGitWorkTree(cwd) {
 }
 function readJsonl(path, options) {
   const { absolute, display: rel, real, outside } = resolvePath(options.cwd, path);
-  if (!existsSync3(absolute))
+  if (!existsSync4(absolute))
     throw new DecisionsError("source-error", `No such file: ${rel}`, { path: rel });
   if (outside && !options.allowOutside) {
     return { documents: [], skipped: [{ path: rel, reason: "outside-repo", detail: real }] };
   }
   const documents = [];
-  readFileSync3(absolute, "utf8").split("\n").forEach((line, index) => {
+  readFileSync5(absolute, "utf8").split("\n").forEach((line, index) => {
     if (line.trim() === "")
       return;
     let data;
@@ -19321,7 +19713,7 @@ function readJsonl(path, options) {
   });
   return { documents, skipped: [] };
 }
-function readDiff(spec, options) {
+async function readDiff(spec, options) {
   if (spec.range?.startsWith("-")) {
     throw new DecisionsError("invalid-request", `Invalid diff range "${spec.range}"`);
   }
@@ -19329,17 +19721,19 @@ function readDiff(spec, options) {
   if (spec.staged)
     args.push("--cached");
   args.push(spec.range ?? "HEAD", "--", ...spec.paths ?? []);
-  let out;
-  try {
-    out = execFileSync("git", args, {
+  const out = await new Promise((resolve6, reject) => {
+    execFile("git", args, {
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
-      stdio: ["ignore", "pipe", "pipe"]
+      ...options.signal ? { signal: options.signal } : {}
+    }, (error, stdout, stderr) => {
+      if (!error)
+        return resolve6(stdout);
+      if (error.name === "AbortError")
+        return reject(error);
+      reject(new DecisionsError("source-error", `git diff failed: ${String(stderr || error).trim()}`));
     });
-  } catch (error) {
-    const stderr = String(error.stderr ?? error).trim();
-    throw new DecisionsError("source-error", `git diff failed: ${stderr}`);
-  }
+  });
   return splitDiffByFile(out);
 }
 function splitDiffByFile(diff) {
@@ -19347,9 +19741,15 @@ function splitDiffByFile(diff) {
   const documents = [];
   const skipped = [];
   for (const text of sections) {
-    const raw = /^\+\+\+ (?:b\/)?(.+)$/m.exec(text)?.[1] ?? /^diff --git a\/.+ b\/(.+)$/m.exec(text)?.[1];
-    const decoded = raw === void 0 ? void 0 : unquoteGitPath(raw.trim());
-    const path = decoded?.replace(/^b\//, "");
+    const side = (marker, prefix) => {
+      const found2 = new RegExp(`^\\${marker[0]}\\${marker[1]}\\${marker[2]} (.+)$`, "m").exec(text)?.[1];
+      if (found2 === void 0 || found2.trim() === "/dev/null")
+        return void 0;
+      return unquoteGitPath(found2.trim())?.replace(new RegExp(`^${prefix}/`), "");
+    };
+    const header = /^diff --git a\/.+ b\/(.+)$/m.exec(text)?.[1];
+    const raw = header ?? /^\+\+\+ (.+)$/m.exec(text)?.[1];
+    const path = side("+++", "b") ?? side("---", "a") ?? (header === void 0 ? void 0 : unquoteGitPath(header.trim())?.replace(/^b\//, ""));
     if (path === void 0 || path === "/dev/null") {
       skipped.push({
         path: raw?.trim() ?? "(unnamed)",
@@ -19586,8 +19986,8 @@ function describeExpectation(expectation) {
 }
 
 // ../core/dist/spec/spec.js
-var CLOSED = { additionalProperties: false };
-var Threshold = typebox_exports.Object({ value: typebox_exports.Number(), why: typebox_exports.String({ minLength: 1 }) }, CLOSED);
+var CLOSED2 = { additionalProperties: false };
+var Threshold = typebox_exports.Object({ value: typebox_exports.Number(), why: typebox_exports.String({ minLength: 1 }) }, CLOSED2);
 var SPEC_FORMAT = 1;
 var SpecSchema = typebox_exports.Object({
   /** Spec file format. Absent means 1; a newer one is refused, not guessed. */
@@ -19598,14 +19998,14 @@ var SpecSchema = typebox_exports.Object({
   /** Kept when any of these matches, as well as every `keep`. */
   keepAny: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
   sort: typebox_exports.Optional(typebox_exports.String()),
-  policy: typebox_exports.Optional(typebox_exports.Object({ thresholds: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), Threshold)) }, CLOSED)),
+  policy: typebox_exports.Optional(typebox_exports.Object({ thresholds: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), Threshold)) }, CLOSED2)),
   source: typebox_exports.Optional(typebox_exports.Object({
     glob: typebox_exports.Optional(typebox_exports.Array(typebox_exports.String())),
     file: typebox_exports.Optional(typebox_exports.String()),
     jsonl: typebox_exports.Optional(typebox_exports.String()),
     diff: typebox_exports.Optional(typebox_exports.String()),
     split: typebox_exports.Optional(typebox_exports.String())
-  }, CLOSED)),
+  }, CLOSED2)),
   examples: typebox_exports.Optional(typebox_exports.Array(typebox_exports.Object({
     id: typebox_exports.String({ minLength: 1 }),
     /** The text (or a JSON value, sent as its JSON text) to judge. Give this or `file`. */
@@ -19613,11 +20013,11 @@ var SpecSchema = typebox_exports.Object({
     /** A repo file to judge, `path` or `path:START-END`. Give this or `state`. */
     file: typebox_exports.Optional(typebox_exports.String()),
     expect: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), typebox_exports.Unknown()))
-  }, CLOSED))),
+  }, CLOSED2))),
   provenance: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), typebox_exports.Unknown())),
   /** Anything else a team wants to carry, ignored by the engine. */
   meta: typebox_exports.Optional(typebox_exports.Record(typebox_exports.String(), typebox_exports.Unknown()))
-}, CLOSED);
+}, CLOSED2);
 var NAME = /^[a-z0-9][a-z0-9._-]*$/;
 function parseSpec(text, file, origin) {
   let raw;
@@ -19687,7 +20087,7 @@ function exampleFileProblem(ref, repoRoot) {
   const rel = relative3(repoRoot, full);
   if (isAbsolute3(path) || rel.startsWith("..") || isAbsolute3(rel))
     return "is outside the repo";
-  if (!existsSync4(full))
+  if (!existsSync5(full))
     return "does not exist";
   return void 0;
 }
@@ -19718,23 +20118,23 @@ function isQuestion(value) {
 }
 function specDirs(repoRoot, userConfigDir2, bundled) {
   return {
-    repo: join2(repoRoot, ".system1", "specs"),
-    user: join2(userConfigDir2, "specs"),
+    repo: join3(repoRoot, ".system1", "specs"),
+    user: join3(userConfigDir2, "specs"),
     ...bundled ? { bundled } : {}
   };
 }
 function loadSpec(ref, dirs, cwd) {
   if (ref.includes("/") || ref.endsWith(".yaml") || ref.endsWith(".yml") || ref.endsWith(".json")) {
     const file = isAbsolute3(ref) ? ref : resolve5(cwd, ref);
-    if (!existsSync4(file))
+    if (!existsSync5(file))
       throw new DecisionsError("invalid-request", `No spec file at ${ref}`);
-    return parseSpec(readFileSync4(file, "utf8"), file, "path");
+    return parseSpec(readFileSync6(file, "utf8"), file, "path");
   }
   for (const [origin, dir] of layers(dirs)) {
     for (const ext of [".yaml", ".yml", ".json"]) {
-      const file = join2(dir, `${ref}${ext}`);
-      if (existsSync4(file))
-        return parseSpec(readFileSync4(file, "utf8"), file, origin);
+      const file = join3(dir, `${ref}${ext}`);
+      if (existsSync5(file))
+        return parseSpec(readFileSync6(file, "utf8"), file, origin);
     }
   }
   const known = listSpecs(dirs).map((s) => s.name);
@@ -19744,17 +20144,17 @@ function listSpecs(dirs) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const [origin, dir] of layers(dirs)) {
-    if (!existsSync4(dir))
+    if (!existsSync5(dir))
       continue;
-    for (const entry2 of readdirSync2(dir).sort()) {
-      if (!/\.(ya?ml|json)$/.test(entry2))
+    for (const entry of readdirSync2(dir).sort()) {
+      if (!/\.(ya?ml|json)$/.test(entry))
         continue;
-      const file = join2(dir, entry2);
-      const name = basename2(entry2, extname(entry2));
+      const file = join3(dir, entry);
+      const name = basename2(entry, extname(entry));
       const shadowed = seen.has(name);
       seen.add(name);
       try {
-        const spec = parseSpec(readFileSync4(file, "utf8"), file, origin);
+        const spec = parseSpec(readFileSync6(file, "utf8"), file, origin);
         out.push({
           name,
           origin,
@@ -19814,10 +20214,10 @@ var QuestionSchema = typebox_exports.Union([
 
 // ../core/dist/opportunities/backlog.js
 import { createHash } from "node:crypto";
-import { closeSync, existsSync as existsSync5, mkdirSync as mkdirSync2, openSync, readFileSync as readFileSync5, renameSync, rmSync, statSync as statSync4, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname4, join as join3 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { join as join4 } from "node:path";
 var BACKLOG_FORMAT = 1;
-var CLOSED2 = { additionalProperties: false };
+var CLOSED3 = { additionalProperties: false };
 var Text = typebox_exports.String({ minLength: 1 });
 var Usd = typebox_exports.Number({ minimum: 0, maximum: 1e6 });
 var Status = typebox_exports.Union([
@@ -19831,8 +20231,8 @@ var candidateFields = {
   mode: typebox_exports.Union([typebox_exports.Literal("code"), typebox_exports.Literal("agents")]),
   location: typebox_exports.Object({
     path: Text,
-    lines: typebox_exports.Optional(typebox_exports.Object({ start: typebox_exports.Integer({ minimum: 1 }), end: typebox_exports.Integer({ minimum: 1 }) }, CLOSED2))
-  }, CLOSED2),
+    lines: typebox_exports.Optional(typebox_exports.Object({ start: typebox_exports.Integer({ minimum: 1 }), end: typebox_exports.Integer({ minimum: 1 }) }, CLOSED3))
+  }, CLOSED3),
   /** What does the job today, e.g. "gpt-4o call parsed to an enum". */
   mechanism: Text,
   shape: typebox_exports.Union([
@@ -19864,12 +20264,12 @@ var candidateFields = {
     decisionCostPerItemUsd: Usd,
     /** Where the figures came from. */
     note: typebox_exports.Optional(typebox_exports.String())
-  }, CLOSED2),
+  }, CLOSED3),
   risk: typebox_exports.Object({
     level: typebox_exports.Union([typebox_exports.Literal("low"), typebox_exports.Literal("medium"), typebox_exports.Literal("high")]),
     /** What would go wrong if the replacement erred. */
     note: Text
-  }, CLOSED2),
+  }, CLOSED3),
   /** The next step, e.g. "save the spec with design, then adopt". */
   next: Text,
   /** Defaults to `new`. `rejected` needs a `statusReason`. */
@@ -19879,9 +20279,9 @@ var candidateFields = {
   source: typebox_exports.Object({
     sweep: Text,
     answers: typebox_exports.Union([typebox_exports.Literal("live"), typebox_exports.Literal("replay")])
-  }, CLOSED2)
+  }, CLOSED3)
 };
-var CandidateSchema = typebox_exports.Object(candidateFields, CLOSED2);
+var CandidateSchema = typebox_exports.Object(candidateFields, CLOSED3);
 var OpportunitySchema = typebox_exports.Object({
   id: typebox_exports.String({ pattern: "^op-[0-9a-f]{12}$" }),
   ...candidateFields,
@@ -19891,16 +20291,16 @@ var OpportunitySchema = typebox_exports.Object({
     basis: typebox_exports.Literal("projected"),
     /** volume × (current − decision), per `per`. Negative means it would cost more. */
     savingUsd: typebox_exports.Number()
-  }, CLOSED2),
+  }, CLOSED3),
   firstSeenAt: typebox_exports.String(),
   seenAt: typebox_exports.String()
-}, CLOSED2);
+}, CLOSED3);
 var BacklogSchema = typebox_exports.Object({
   version: typebox_exports.Literal(BACKLOG_FORMAT),
   opportunities: typebox_exports.Array(OpportunitySchema)
-}, CLOSED2);
+}, CLOSED3);
 function backlogPath(repoRoot) {
-  return join3(stateDir(repoRoot), "opportunities.json");
+  return join4(stateDir(repoRoot), "opportunities.json");
 }
 function opportunityId(mode, evidence) {
   const normal = evidence.replace(/\s+/g, " ").trim();
@@ -19949,11 +20349,11 @@ function candidateProblems(c, at) {
   return problems;
 }
 function readBacklog(file) {
-  if (!existsSync5(file))
+  if (!existsSync6(file))
     return { version: BACKLOG_FORMAT, opportunities: [] };
   let text;
   try {
-    text = readFileSync5(file, "utf8");
+    text = readFileSync7(file, "utf8");
   } catch (error) {
     throw malformed2(file, [`cannot read it: ${error.message}`]);
   }
@@ -19975,39 +20375,14 @@ function malformed2(file, problems) {
 var LOCK_WAIT_MS = 5e3;
 var LOCK_STALE_MS = 3e4;
 function withBacklogLock(file, body) {
-  mkdirSync2(dirname4(file), { recursive: true });
-  const lock = `${file}.lock`;
-  const deadline = Date.now() + LOCK_WAIT_MS;
-  for (; ; ) {
-    try {
-      closeSync(openSync(lock, "wx"));
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST")
-        throw error;
-      try {
-        if (Date.now() - statSync4(lock).mtimeMs > LOCK_STALE_MS)
-          rmSync(lock, { force: true });
-      } catch {
-      }
-      if (Date.now() > deadline) {
-        throw new DecisionsError("invalid-request", `${file} is locked by another \`decide opportunities add\` (${lock}). Retry, or delete the lock file if no add is running.`, { file, lock });
-      }
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
-    }
-  }
-  try {
-    return body();
-  } finally {
-    rmSync(lock, { force: true });
-  }
+  return withFileLock(file, {
+    waitMs: LOCK_WAIT_MS,
+    staleMs: LOCK_STALE_MS,
+    busy: (lock) => new DecisionsError("invalid-request", `${file} is locked by another \`decide opportunities add\` (${lock}). Retry, or delete the lock file if no add is running.`, { file, lock })
+  }, body);
 }
 function writeBacklog(file, backlog) {
-  mkdirSync2(dirname4(file), { recursive: true });
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeFileSync2(tmp, `${JSON.stringify(backlog, null, 2)}
-`);
-  renameSync(tmp, file);
+  writeJsonAtomic(file, backlog);
 }
 function mergeCandidates(backlog, candidates, now) {
   const problems = candidates.flatMap((c, i) => candidateProblems(c, `/candidates/${i}`));
@@ -20249,6 +20624,16 @@ var RouteInput = typebox_exports.Object({
   /** The user's prompt, as the harness hook received it. */
   prompt: typebox_exports.String()
 }, strict);
+var HookEvent = typebox_exports.Object({
+  hook_event_name: typebox_exports.String({ minLength: 1, description: "SessionStart or Stop" }),
+  session_id: typebox_exports.String({ minLength: 1 }),
+  cwd: typebox_exports.String({ minLength: 1 }),
+  source: typebox_exports.Optional(typebox_exports.String({ description: "SessionStart: startup, resume, clear, compact" })),
+  stop_hook_active: typebox_exports.Optional(typebox_exports.Boolean()),
+  transcript_path: typebox_exports.Optional(typebox_exports.Union([typebox_exports.String(), typebox_exports.Null()])),
+  turn_id: typebox_exports.Optional(typebox_exports.String({ description: "Codex only" })),
+  last_assistant_message: typebox_exports.Optional(typebox_exports.Union([typebox_exports.String(), typebox_exports.Null()]))
+}, { additionalProperties: true });
 var TOOL_SCHEMAS = {
   ask: AskInput,
   many: ManyInput,
@@ -20258,11 +20643,12 @@ var TOOL_SCHEMAS = {
   "opportunities-add": OpportunitiesAddInput,
   "opportunities-list": OpportunitiesListInput,
   "opportunities-check": OpportunitiesCheckInput,
-  route: RouteInput
+  route: RouteInput,
+  hook: HookEvent
 };
 
 // ../core/dist/tools/context.js
-import { isAbsolute as isAbsolute4, join as join5, relative as relative4 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join6, relative as relative4 } from "node:path";
 
 // ../core/dist/egress/scrub.js
 var SECRET_NAME = "[A-Za-z0-9_.-]*(?:api[_-]?key|secret|token|passw(?:or)?d|pwd|credential|private[_-]?key|auth)[A-Za-z0-9_.-]*";
@@ -20313,42 +20699,42 @@ var RULES = [
     pattern: /(?<=\b[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PAT|CREDENTIALS?)["']?\s*[:=]\s*["']?)(?!\$\{|<|\[REDACTED)(?=[A-Za-z0-9_\-+/=~]*\d)(?=[A-Za-z0-9_\-+/=~]*[A-Za-z])[A-Za-z0-9_\-+/=~]{12,}(?=["'\s,}]|$)/gm
   }
 ];
-function scrubText(text, counts2 = {}) {
+function scrubText(text, counts = {}) {
   let out = text;
   for (const rule of RULES) {
     out = out.replace(rule.pattern, () => {
-      counts2[rule.kind] = (counts2[rule.kind] ?? 0) + 1;
+      counts[rule.kind] = (counts[rule.kind] ?? 0) + 1;
       return `[REDACTED:${rule.kind}]`;
     });
   }
   return out;
 }
-function scrubState(state, counts2 = {}) {
-  return walk(state, counts2);
+function scrubState(state, counts = {}) {
+  return walk(state, counts);
 }
 var SECRET_KEY = new RegExp(`^${SECRET_NAME}$`, "i");
-function walk(value, counts2, key) {
+function walk(value, counts, key) {
   if (typeof value === "string") {
     if (key !== void 0 && SECRET_KEY.test(key) && value.trim().length >= 4) {
-      counts2["assigned-secret"] = (counts2["assigned-secret"] ?? 0) + 1;
+      counts["assigned-secret"] = (counts["assigned-secret"] ?? 0) + 1;
       return "[REDACTED:assigned-secret]";
     }
-    return scrubText(value, counts2);
+    return scrubText(value, counts);
   }
   if (Array.isArray(value))
-    return value.map((v) => walk(v, counts2, key));
+    return value.map((v) => walk(v, counts, key));
   if (value !== null && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, walk(v, counts2, k)]));
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, walk(v, counts, k)]));
   }
   return value;
 }
-function scrubQuestions(questions, counts2 = {}) {
+function scrubQuestions(questions, counts = {}) {
   return Object.fromEntries(Object.entries(questions).map(([name, q]) => [
     name,
     {
       ...q,
-      instructions: scrubText(q.instructions, counts2),
-      ...q.criteria === void 0 ? {} : { criteria: scrubState(q.criteria, counts2) }
+      instructions: scrubText(q.instructions, counts),
+      ...q.criteria === void 0 ? {} : { criteria: scrubState(q.criteria, counts) }
     }
   ]));
 }
@@ -20369,8 +20755,8 @@ function assertStateFits(id, state, questions, profile) {
 
 // ../core/dist/fixtures/store.js
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, join as join4 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync8, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname5, join as join5 } from "node:path";
 var FIXTURE_VERSION = 1;
 function fixtureKey(request) {
   const { model, state, questions } = request;
@@ -20397,13 +20783,13 @@ var FixtureStore = class {
     if (!NAMESPACE.test(namespace)) {
       throw new Error(`Invalid fixture namespace "${namespace}" (lowercase letters, digits, . _ -)`);
     }
-    return join4(this.dir, namespace, `${key}.json`);
+    return join5(this.dir, namespace, `${key}.json`);
   }
   lookup(namespace, request) {
     const file = this.path(namespace, fixtureKey(request));
-    if (!existsSync6(file))
+    if (!existsSync7(file))
       return void 0;
-    const record = JSON.parse(readFileSync6(file, "utf8"));
+    const record = JSON.parse(readFileSync8(file, "utf8"));
     return record.v === FIXTURE_VERSION ? record : void 0;
   }
   record(namespace, request, response, now = /* @__PURE__ */ new Date()) {
@@ -20428,7 +20814,7 @@ var FixtureStore = class {
 // ../core/dist/decide.js
 var ZERO = { input_tokens: 0, output_tokens: 0, cost: 0 };
 function createDecider(options) {
-  const { profile, transport, fixtures, ledger, session } = options;
+  const { profile, transport, fixtures, ledger, session, tag } = options;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const mode = (options.mode ?? "auto") === "auto" ? transport ? "live" : "replay" : options.mode;
   if ((mode === "live" || mode === "record") && !transport) {
@@ -20440,6 +20826,7 @@ function createDecider(options) {
   const log2 = (source, model, usage) => ledger?.append({
     ts: now().toISOString(),
     ...session ? { session } : {},
+    ...tag ? { tag } : {},
     model,
     source,
     calls: 1,
@@ -20498,7 +20885,7 @@ function createDecider(options) {
 }
 
 // ../core/dist/run/spend.js
-import { appendFileSync, existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync7 } from "node:fs";
+import { appendFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync9 } from "node:fs";
 import { dirname as dirname6 } from "node:path";
 function sumUsage(usages) {
   const total = usages.reduce((sum, u) => ({
@@ -20513,15 +20900,15 @@ var SpendLedger = class {
   constructor(file) {
     this.file = file;
   }
-  append(entry2) {
+  append(entry) {
     mkdirSync4(dirname6(this.file), { recursive: true });
-    appendFileSync(this.file, `${JSON.stringify(entry2)}
+    appendFileSync(this.file, `${JSON.stringify(entry)}
 `);
   }
   entries() {
-    if (!existsSync7(this.file))
+    if (!existsSync8(this.file))
       return [];
-    return readFileSync7(this.file, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
+    return readFileSync9(this.file, "utf8").split("\n").filter((line) => line.trim() !== "").flatMap((line) => {
       try {
         return [JSON.parse(line)];
       } catch {
@@ -20530,7 +20917,7 @@ var SpendLedger = class {
     });
   }
   summary(filter = {}) {
-    const rows = this.entries().filter((e) => (filter.session === void 0 || e.session === filter.session) && (filter.since === void 0 || new Date(e.ts) >= filter.since));
+    const rows = this.entries().filter((e) => (filter.session === void 0 || e.session === filter.session) && (filter.tag === void 0 || e.tag === filter.tag) && (filter.since === void 0 || new Date(e.ts) >= filter.since));
     const count = (source) => rows.filter((e) => e.source === source).reduce((n, e) => n + e.calls, 0);
     return {
       ...sumUsage(rows),
@@ -20606,13 +20993,13 @@ function rebasePattern(pattern, cwd, repoRoot) {
   const prefix = relative4(repoRoot, cwd);
   if (prefix === "" || prefix.startsWith("..") || isAbsolute4(prefix) || pattern.startsWith("**/"))
     return pattern;
-  return join5(prefix, pattern);
+  return join6(prefix, pattern);
 }
 function rebase(source, cwd, repoRoot) {
   const prefix = relative4(repoRoot, cwd);
   if (prefix === "" || prefix.startsWith("..") || isAbsolute4(prefix))
     return source;
-  const move = (path) => isAbsolute4(path) ? path : join5(prefix, path);
+  const move = (path) => isAbsolute4(path) ? path : join6(prefix, path);
   switch (source.kind) {
     case "file":
       return { ...source, path: move(source.path) };
@@ -20637,7 +21024,7 @@ function specSources(spec) {
     ...s.diff !== void 0 ? [{ kind: "diff", ...s.diff ? { range: s.diff } : {} }] : []
   ];
 }
-function deciderFor(ctx, profile, mode = "auto") {
+function deciderFor(ctx, profile, mode = "auto", extra = {}) {
   const { config } = ctx;
   const dir = stateDir(config.repoRoot);
   return createDecider({
@@ -20652,14 +21039,15 @@ function deciderFor(ctx, profile, mode = "auto") {
         ...ctx.fetch ? { fetch: ctx.fetch } : {}
       })
     } : {},
-    fixtures: new FixtureStore(join5(dir, "fixtures")),
-    ledger: new SpendLedger(join5(dir, "usage.jsonl")),
+    fixtures: new FixtureStore(join6(dir, "fixtures")),
+    ledger: new SpendLedger(join6(dir, "usage.jsonl")),
     mode: config.replay ? "replay" : mode,
-    ...config.session ? { session: config.session } : {}
+    ...config.session ? { session: config.session } : {},
+    ...extra.tag ? { tag: extra.tag } : {}
   });
 }
 function ledgerFor(ctx) {
-  return new SpendLedger(join5(stateDir(ctx.config.repoRoot), "usage.jsonl"));
+  return new SpendLedger(join6(stateDir(ctx.config.repoRoot), "usage.jsonl"));
 }
 
 // ../core/dist/run/budget.js
@@ -20705,26 +21093,27 @@ async function prepare(input) {
     cwd: input.cwd,
     ...input.maxFileBytes ? { maxFileBytes: input.maxFileBytes } : {},
     ...input.allowOutside ? { allowOutside: true } : {},
+    ...input.signal ? { signal: input.signal } : {},
     ...input.filter?.length ? { filter: input.filter, withhold: input.exclude ?? [] } : {}
   });
   const byKind = {};
   let redactedSources = 0;
-  const count = (counts2) => {
-    const found2 = Object.values(counts2).reduce((a, b) => a + b, 0);
-    for (const [kind, n] of Object.entries(counts2))
+  const count = (counts) => {
+    const found2 = Object.values(counts).reduce((a, b) => a + b, 0);
+    for (const [kind, n] of Object.entries(counts))
       byKind[kind] = (byKind[kind] ?? 0) + n;
     return found2;
   };
   const allowed = applyExcludes(read2.documents, input.exclude);
   const chosen = applyFilter(allowed.items, input.filter);
   const documents = chosen.items.map((doc) => {
-    const counts2 = {};
+    const counts = {};
     const scrubbed = {
       ...doc,
-      ...doc.text !== void 0 ? { text: scrubText(doc.text, counts2) } : {},
-      ...doc.data !== void 0 ? { data: scrubState(doc.data, counts2) } : {}
+      ...doc.text !== void 0 ? { text: scrubText(doc.text, counts) } : {},
+      ...doc.data !== void 0 ? { data: scrubState(doc.data, counts) } : {}
     };
-    if (count(counts2) > 0)
+    if (count(counts) > 0)
       redactedSources += 1;
     return scrubbed;
   });
@@ -20733,9 +21122,9 @@ async function prepare(input) {
   const tokens = [];
   const oversize = [];
   const items = kept.flatMap((item) => {
-    const counts2 = {};
-    const state = scrubState(item.state, counts2);
-    if (count(counts2) > 0)
+    const counts = {};
+    const state = scrubState(item.state, counts);
+    if (count(counts) > 0)
       redactedSources += 1;
     try {
       tokens.push(assertStateFits(item.id, state, input.questions, input.profile));
@@ -20815,501 +21204,6 @@ async function mapWithConcurrency(items, limit, worker, onProgress) {
   return results;
 }
 
-// ../core/dist/tools/many.js
-var EXCERPT = 120;
-var SAMPLE = 5;
-async function runMany(ctx, rawInput) {
-  const input = checkInput("many", rawInput);
-  const started = performance.now();
-  const req = resolveRequest(ctx, input);
-  const prepared = await prepare({
-    sources: req.sources,
-    split: req.split,
-    questions: req.questions,
-    profile: req.profile,
-    cwd: ctx.config.repoRoot,
-    exclude: ctx.config.egress.exclude,
-    filter: req.exclude,
-    oversize: "skip",
-    ...input.allowOutside ? { allowOutside: true } : {}
-  });
-  const base2 = {
-    ...req.spec ? { spec: req.spec.name } : {},
-    model: req.profile.id,
-    skipped: summariseSkipped(prepared.skipped),
-    redactions: { total: prepared.redactions.total, items: prepared.redactions.items },
-    projection: prepared.projection
-  };
-  if (input.dryRun) {
-    return {
-      ...base2,
-      dryRun: true,
-      counts: counts(prepared.items.length, 0, 0, 0, 0, 0, prepared.skipped.length),
-      kept: [],
-      undecided: [],
-      failed: [],
-      usage: sumUsage([]),
-      wallClockMs: Math.round(performance.now() - started),
-      sampleIds: prepared.items.slice(0, SAMPLE).map((i) => i.id)
-    };
-  }
-  const decider = deciderFor(ctx, req.profile, input.mode ?? "auto");
-  if (decider.mode !== "replay") {
-    assertConsent(ctx.config.egress.consent, ctx.config.repoRoot);
-    checkBudget(prepared.projection, ctx.config.budget, input.confirm ?? false);
-  }
-  const concurrency = Math.min(input.concurrency ?? ctx.config.concurrency, ctx.config.concurrency);
-  const settled = await mapWithConcurrency(prepared.items, concurrency, (item) => decider.decide({ state: item.state, questions: req.questions, namespace: req.namespace }));
-  const done = [];
-  const failed = [];
-  settled.forEach((outcome, i) => {
-    const item = prepared.items[i];
-    if ("value" in outcome)
-      done.push({ item, result: outcome.value });
-    else
-      failed.push({ id: item.id, ...describe3(outcome.error) });
-  });
-  const [first] = failed;
-  if (done.length === 0 && first && failed.every((f) => f.code === first.code)) {
-    const { error } = settled.find((s) => "error" in s);
-    const details = isDecisionsError(error) ? error.details : {};
-    throw new DecisionsError(first.code === "error" ? "invalid-request" : first.code, failed.length === 1 ? error.message : `All ${failed.length} items failed: ${error.message}`, { ...details, failed: failed.length });
-  }
-  const rows = done.map(({ item, result }) => ({
-    ...row(item, result.answers),
-    flat: result.undecided
-  }));
-  const projected = project({
-    rows,
-    keep: req.keep,
-    keepAny: req.keepAny,
-    ...req.sort ? { sort: req.sort } : {},
-    ...input.limit !== void 0 ? { limit: input.limit } : {},
-    ...input.fields ? { fields: input.fields } : {},
-    undecidedOf: (r) => r.flat
-  });
-  const strip = ({ flat, ...rest }) => ({
-    ...rest,
-    ...flat.length ? { undecided: [...flat] } : {}
-  });
-  return {
-    ...base2,
-    dryRun: false,
-    source: decider.mode === "replay" ? "replay" : "live",
-    counts: counts(prepared.items.length, projected.kept.length, projected.keptTotal, projected.undecided.length, projected.dropped, failed.length, prepared.skipped.length),
-    kept: projected.kept.map(strip),
-    undecided: projected.undecided.map(({ row: row2, questions }) => ({ ...strip(row2), questions })),
-    failed,
-    usage: sumUsage(done.map((d) => d.result.usage)),
-    wallClockMs: Math.round(performance.now() - started)
-  };
-}
-function row(item, answers) {
-  return {
-    id: item.id,
-    ...item.path ? { path: item.path } : {},
-    ...item.lines ? { lines: item.lines } : {},
-    ...traceable(item) ? {} : { excerpt: excerpt(item.state) },
-    answers
-  };
-}
-function traceable(item) {
-  if (item.path === void 0)
-    return false;
-  const oneLine = item.lines !== void 0 && item.lines.start === item.lines.end;
-  return item.id === item.path || !oneLine;
-}
-function excerpt(state) {
-  const text = (typeof state === "string" ? state : JSON.stringify(state)).replace(/\s+/g, " ").trim();
-  return text.length > EXCERPT ? `${text.slice(0, EXCERPT - 1)}\u2026` : text;
-}
-function counts(items, kept, keptTotal, undecided, dropped, failed, skipped) {
-  return { items, kept, keptTotal, undecided, dropped, failed, skipped };
-}
-function summariseSkipped(skipped) {
-  const byReason = {};
-  for (const s of skipped)
-    byReason[s.reason] = (byReason[s.reason] ?? 0) + 1;
-  const ordered = [...skipped].sort((a, b) => Number(b.reason === "excluded") - Number(a.reason === "excluded"));
-  return { total: skipped.length, byReason, sample: ordered.slice(0, SAMPLE) };
-}
-function describe3(error) {
-  return isDecisionsError(error) ? { code: error.code, message: error.message } : { code: "error", message: error.message };
-}
-
-// ../core/dist/tools/ask.js
-async function runAsk(ctx, rawInput) {
-  const input = checkInput("ask", rawInput);
-  const req = resolveRequest(ctx, input);
-  const prepared = await prepare({
-    sources: req.sources,
-    split: req.split,
-    questions: req.questions,
-    profile: req.profile,
-    cwd: ctx.config.repoRoot,
-    exclude: ctx.config.egress.exclude,
-    filter: req.exclude,
-    ...input.allowOutside ? { allowOutside: true } : {}
-  });
-  const [item, ...rest] = prepared.items;
-  if (!item || rest.length > 0) {
-    const held = prepared.skipped.filter((s) => s.reason !== "filtered");
-    const left = prepared.skipped.length - held.length;
-    const withheld = (held.length ? ` (${held.length} withheld: ${held.map((s) => `${s.path} ${s.reason}`).join(", ")})` : "") + (left ? ` (${left} left out by --exclude)` : "");
-    throw new DecisionsError("invalid-request", item ? `ask needs exactly one state, but the source gave ${prepared.items.length}. Use \`decide many\` to fan out.` : `The source gave nothing to ask about${withheld}.`, { items: prepared.items.length });
-  }
-  const result = await deciderFor(ctx, req.profile, input.mode ?? "auto").decide({
-    state: item.state,
-    questions: req.questions,
-    namespace: req.namespace
-  });
-  const verdict = req.keep.length > 0 || req.keepAny.length > 0 ? verdictOf(result.answers, result.undecided, req.keep, req.keepAny).verdict : void 0;
-  return {
-    ...req.spec ? { spec: req.spec.name } : {},
-    id: item.id,
-    ...item.path ? { path: item.path } : {},
-    ...item.lines ? { lines: item.lines } : {},
-    source: result.source,
-    model: result.model,
-    servedBy: result.servedBy,
-    answers: result.answers,
-    undecided: result.undecided,
-    ...verdict ? { verdict } : {},
-    usage: result.usage,
-    latencyMs: result.latencyMs,
-    skipped: summariseSkipped(prepared.skipped),
-    redactions: { total: prepared.redactions.total, items: prepared.redactions.items }
-  };
-}
-
-// ../core/dist/tools/doctor.js
-import { accessSync, constants, existsSync as existsSync8, statSync as statSync5 } from "node:fs";
-import { delimiter, join as join6 } from "node:path";
-function routeCheck(config) {
-  try {
-    route("", config);
-    if (!config.enabled) {
-      return {
-        name: "route",
-        status: "ok",
-        detail: "routing hints are off (route.enabled or SYSTEM1_ROUTE)"
-      };
-    }
-    const names = activeTriggers(config).map((t) => t.name);
-    return {
-      name: "route",
-      status: "ok",
-      detail: `routing hints on: ${names.length ? names.join(", ") : "no triggers"}`
-    };
-  } catch (error) {
-    return {
-      name: "route",
-      status: "warn",
-      detail: `routing hints are silent: ${error instanceof Error ? error.message : String(error)}`,
-      fix: 'correct route: in the config file (test it with `decide route --text "\u2026"`)'
-    };
-  }
-}
-function backlogProblem(error) {
-  const problems = isDecisionsError(error) ? error.details?.problems : void 0;
-  const first = Array.isArray(problems) ? problems[0] : void 0;
-  const count = Array.isArray(problems) && problems.length > 1 ? ` (+${problems.length - 1} more)` : "";
-  return `the backlog doesn't validate: ${first ?? (error instanceof Error ? error.message : String(error))}${count}`;
-}
-function backlogCheck(repoRoot) {
-  const file = backlogPath(repoRoot);
-  if (!existsSync8(file))
-    return { name: "backlog", status: "ok", detail: "no scout backlog yet" };
-  try {
-    const { opportunities } = readBacklog(file);
-    return {
-      name: "backlog",
-      status: "ok",
-      detail: `${opportunities.length} opportunit${opportunities.length === 1 ? "y" : "ies"} in ${file}`
-    };
-  } catch (error) {
-    return {
-      name: "backlog",
-      status: "warn",
-      detail: backlogProblem(error),
-      fix: "`decide opportunities check` lists every problem; correct the file by hand or move it aside (decide never repairs it)"
-    };
-  }
-}
-var CODEX_RULE = 'prefix_rule(pattern = ["decide"], decision = "allow")';
-async function runDoctor(options) {
-  const { env } = options;
-  const harness = detectHarness(env) ?? null;
-  const checks = [
-    {
-      name: "cli",
-      status: "ok",
-      detail: `decide ${VERSION} on node ${process.version}${options.cliPath ? ` (${options.cliPath})` : ""}`
-    },
-    pathCheck(harness, env)
-  ];
-  const onPath = which("decide", env.PATH ?? "");
-  if (onPath && options.probeVersion) {
-    checks.push(await versionCheck(onPath, options.probeVersion, env));
-  }
-  const report2 = (ctx2, live2) => ({
-    healthy: !checks.some((c) => c.status === "fail"),
-    live: live2,
-    harness,
-    session: ctx2?.config.session ?? null,
-    version: VERSION,
-    node: process.version,
-    checks
-  });
-  let ctx;
-  try {
-    ctx = createContext(options);
-  } catch (error) {
-    checks.push({
-      name: "config",
-      status: "fail",
-      detail: error instanceof Error ? error.message : String(error),
-      fix: "correct the config file or environment variable named above"
-    });
-    return report2(void 0, false);
-  }
-  const { config } = ctx;
-  if (config.warnings.length > 0) {
-    checks.push({
-      name: "config-keys",
-      status: "warn",
-      detail: `ignored: ${config.warnings.join("; ")}`,
-      fix: "correct or remove these keys (docs/configuration.md lists every key)"
-    });
-  }
-  checks.push(config.apiKey ? { name: "key", status: "ok", detail: `OPENROUTER_API_KEY present (${config.apiKeySource})` } : {
-    name: "key",
-    status: "warn",
-    detail: "no API key: only replay works",
-    // The file this shell would read: XDG_CONFIG_HOME moves it.
-    fix: `set OPENROUTER_API_KEY, or write \`openrouter_api_key: <key>\` to ${join6(userConfigDir(env, options.home), "credentials")} (create its directory first; chmod 600)`
-  });
-  checks.push(config.egress.consent.granted ? { name: "consent", status: "ok", detail: `egress consent granted for ${config.repoRoot}` } : {
-    name: "consent",
-    status: "warn",
-    detail: `no egress consent for ${config.repoRoot}: live calls are refused`,
-    fix: "if the user agrees, they grant it themselves (an agent must not): `decide config egress allow` in a terminal in this repo, or through their agent prompt's shell escape (not as a chat message) with --confirm added"
-  });
-  checks.push(routeCheck(config.route));
-  checks.push(backlogCheck(config.repoRoot));
-  let reach;
-  try {
-    reach = await ping({
-      endpoint: config.endpoint,
-      model: config.model,
-      apiKey: config.apiKey,
-      replay: config.replay
-    }, ctx.fetch ? { fetch: ctx.fetch } : {});
-  } catch (error) {
-    checks.push({
-      name: "config",
-      status: "fail",
-      detail: `endpoint ${config.endpoint}: ${error instanceof Error ? error.message : String(error)}`,
-      fix: "correct SYSTEM1_ENDPOINT or `endpoint` in the config file"
-    });
-    return report2(ctx, false);
-  }
-  if (reach.ok) {
-    checks.push({
-      name: "network",
-      status: "ok",
-      detail: `${config.model} reachable in ${reach.latencyMs} ms`
-    });
-  } else {
-    const sandboxed = env.CODEX_SANDBOX_NETWORK_DISABLED === "1";
-    checks.push({
-      name: "network",
-      // Replay needs no network, so an unreachable endpoint only warns there.
-      status: config.replay ? "warn" : "fail",
-      detail: `${reach.probe}: ${reach.error ?? "unreachable"}${sandboxed ? " (Codex sandbox has network disabled)" : ""}`,
-      fix: networkFix(reach.httpStatus, harness, sandboxed, env)
-    });
-  }
-  const live = !config.replay && config.apiKey !== void 0 && config.egress.consent.granted && reach.ok === true;
-  return report2(ctx, live);
-}
-function pathCheck(harness, env) {
-  const onPath = which("decide", env.PATH ?? "");
-  if (onPath)
-    return { name: "path", status: "ok", detail: `decide on PATH: ${onPath}` };
-  if (harness === "claude") {
-    return {
-      name: "path",
-      status: "warn",
-      detail: "decide is not on PATH, so the decisions plugin's bin/ is not loaded",
-      fix: "install the decisions plugin from its marketplace, or start Claude Code with `--plugin-dir <checkout>/plugins/system1`"
-    };
-  }
-  return {
-    name: "path",
-    status: "warn",
-    detail: "decide is not on PATH. Codex and Pi do not add plugin bin/ to PATH",
-    fix: `npm i -g ${CLI_PACKAGE}@${VERSION}`
-  };
-}
-async function versionCheck(path, probe, env) {
-  let raw;
-  try {
-    raw = await probe(path);
-  } catch {
-  }
-  const found2 = raw?.trim() || void 0;
-  if (raw !== void 0 && found2 === void 0 && env.CODEX_SANDBOX_NETWORK_DISABLED === "1") {
-    return {
-      name: "path-version",
-      status: "ok",
-      detail: "not checked: the Codex sandbox hides a child process's output"
-    };
-  }
-  if (found2 === void 0) {
-    return {
-      name: "path-version",
-      status: "warn",
-      detail: `could not read the version of ${path}`,
-      fix: `run \`${path} version\` to see why; reinstall it if it fails`
-    };
-  }
-  if (found2 === VERSION) {
-    return {
-      name: "path-version",
-      status: "ok",
-      detail: `decide on PATH is ${found2}, same as this one`
-    };
-  }
-  return {
-    name: "path-version",
-    status: "warn",
-    detail: `decide on PATH is ${found2}, but this one is ${VERSION}: agents will run the one on PATH`,
-    fix: `npm i -g ${CLI_PACKAGE}@${VERSION}, or remove the other decide (${path})`
-  };
-}
-function networkFix(httpStatus, harness, sandboxed, env) {
-  if (httpStatus === 404)
-    return "the endpoint does not know this model: check SYSTEM1_MODEL / `model` and SYSTEM1_ENDPOINT / `endpoint`";
-  if (httpStatus !== void 0 && httpStatus >= 500)
-    return `the provider answered HTTP ${httpStatus}: retry later`;
-  if (httpStatus !== void 0)
-    return `the endpoint answered HTTP ${httpStatus}: check SYSTEM1_ENDPOINT / \`endpoint\``;
-  if (sandboxed) {
-    return `add \`${CODEX_RULE}\` to ${env.CODEX_HOME?.trim() || "~/.codex"}/rules/system1.rules, then restart Codex (it covers commands that start with decide; a pipe into decide stays offline)`;
-  }
-  if (harness === "claude")
-    return "allow outbound access to openrouter.ai in Claude Code's sandbox settings";
-  return "check that this machine can reach openrouter.ai (proxy, firewall, DNS)";
-}
-function which(name, path) {
-  for (const dir of path.split(delimiter)) {
-    if (!dir)
-      continue;
-    const candidate = join6(dir, name);
-    try {
-      accessSync(candidate, constants.X_OK);
-      if (statSync5(candidate).isFile())
-        return candidate;
-    } catch {
-    }
-  }
-  return void 0;
-}
-
-// ../core/dist/tools/opportunities.js
-import { existsSync as existsSync9 } from "node:fs";
-function runOpportunitiesAdd(ctx, rawInput, now = () => /* @__PURE__ */ new Date()) {
-  const input = checkInput("opportunities-add", rawInput);
-  const file = backlogPath(ctx.config.repoRoot);
-  const merged2 = withBacklogLock(file, () => {
-    const result = mergeCandidates(readBacklog(file), input.candidates, now().toISOString());
-    writeBacklog(file, result.backlog);
-    return result;
-  });
-  return {
-    file,
-    added: merged2.added,
-    updated: merged2.updated,
-    staled: merged2.staled,
-    total: merged2.backlog.opportunities.length
-  };
-}
-function runOpportunitiesList(ctx, rawInput = {}) {
-  const input = checkInput("opportunities-list", rawInput);
-  const filters = (input.keep ?? []).map(parseRecordFilter);
-  const sort = parseRecordSort(input.sort ?? "projected:desc");
-  assertFields(input.fields);
-  const file = backlogPath(ctx.config.repoRoot);
-  const { opportunities } = readBacklog(file);
-  const matched = opportunities.filter((o) => filters.every((f) => recordMatches(o, f))).sort((a, b) => compare(readField(a, sort.field), readField(b, sort.field), sort.direction));
-  const shown = input.limit === void 0 ? matched : matched.slice(0, input.limit);
-  return {
-    file,
-    total: opportunities.length,
-    matched: matched.length,
-    basis: "projected",
-    opportunities: shown.map((o) => pick2(o, input.fields))
-  };
-}
-function runOpportunitiesCheck(ctx, rawInput = {}) {
-  checkInput("opportunities-check", rawInput);
-  const file = backlogPath(ctx.config.repoRoot);
-  const backlog = readBacklog(file);
-  const byStatus = {};
-  for (const o of backlog.opportunities)
-    byStatus[o.status] = (byStatus[o.status] ?? 0) + 1;
-  return { file, exists: existsSync9(file), entries: backlog.opportunities.length, byStatus };
-}
-function compare(a, b, direction) {
-  if (a === void 0 || b === void 0)
-    return a === b ? 0 : a === void 0 ? 1 : -1;
-  const order = typeof a === "number" && typeof b === "number" ? a - b : String(a).localeCompare(String(b));
-  return direction === "asc" ? order : -order;
-}
-function pick2(o, fields) {
-  if (!fields)
-    return o;
-  const out = { id: o.id };
-  for (const f of fields)
-    if (Object.hasOwn(o, f))
-      out[f] = o[f];
-  return out;
-}
-function assertFields(fields = []) {
-  const unknown = fields.filter((f) => !ENTRY_FIELDS.includes(f));
-  if (unknown.length) {
-    throw new DecisionsError("invalid-request", `--fields: no field ${unknown.join(", ")}. Fields: ${ENTRY_FIELDS.join(", ")}`);
-  }
-}
-
-// ../core/dist/tools/route.js
-function runRoute(options, rawInput) {
-  const problems = checkRouteInput(rawInput);
-  if (problems.length > 0) {
-    throw new DecisionsError("invalid-request", `Invalid route input:
-  ${problems.join("\n  ")}`, {
-      problems
-    });
-  }
-  const input = rawInput;
-  const config = loadConfig(options);
-  const { user, repo } = config.layers;
-  return {
-    ...route(input.prompt, config.route),
-    files: { ...user ? { user } : {}, ...repo ? { repo } : {} }
-  };
-}
-function checkRouteInput(input) {
-  if (typeof input !== "object" || input === null || Array.isArray(input))
-    return ["/ must be an object"];
-  const extra = Object.keys(input).filter((k) => k !== "prompt");
-  return [
-    ...typeof input.prompt === "string" ? [] : ["/prompt must be a string"],
-    ...extra.map((k) => `/${k} is not allowed`)
-  ];
-}
-
 // ../core/dist/spec/lint.js
 var LINT_SEVERITY = {
   "no-way-out": "warning",
@@ -21346,6 +21240,9 @@ function lintQuestions(questions) {
   }
   return out;
 }
+function lintStatement(text, question) {
+  return unsupported(text, question);
+}
 function lintSpec(spec) {
   const out = lintQuestions(spec.questions);
   const thresholds = spec.policy?.thresholds ?? {};
@@ -21374,7 +21271,6 @@ function lintSpec(spec) {
 var NUMERIC = /* @__PURE__ */ new Set([">=", ">", "<=", "<"]);
 function lintQuestion(name, q) {
   const out = [];
-  const texts = [q.instructions, ...criteriaTexts(q)];
   if (q.type === "choice") {
     const options = Object.entries(q.criteria);
     const wayOut = ([key, desc]) => key.split(/[_\-\s/]+/).some((t) => WAY_OUT_KEY.test(t)) || WAY_OUT_TEXT.test(desc);
@@ -21432,244 +21328,66 @@ function dedupe(findings) {
   });
 }
 
-// ../core/dist/tools/spec-check.js
-async function runSpecCheck(ctx, rawInput) {
-  const input = checkInput("spec-check", rawInput);
-  const spec = loadSpec(input.spec, ctx.specDirs, ctx.cwd);
-  const lint = lintSpec(spec);
-  const examples = spec.examples ?? [];
-  if (examples.length === 0) {
-    throw new DecisionsError("invalid-request", `Spec "${spec.name}" has no examples to check. Add some under examples: (id, state or file, expect).`);
-  }
-  assertExamples(spec);
-  const profile = resolveProfile(input.model ?? ctx.config.model, allProfiles(ctx.config));
-  const root = ctx.config.repoRoot;
-  const prepared = [];
-  for (const example of examples) {
-    const expect = example.expect ? parseExpect(example.expect, spec.questions, example.id) : {};
-    const refused = example.file !== void 0 ? exampleFileProblem(example.file, root) : void 0;
-    if (refused) {
-      prepared.push({ id: example.id, expect, reason: `${example.file} ${refused}` });
-      continue;
-    }
-    const source = example.file !== void 0 ? { kind: "file", ...parseFileRef(example.file) } : {
-      kind: "text",
-      // A structured state is sent as its JSON text.
-      text: typeof example.state === "string" ? example.state : JSON.stringify(example.state),
-      id: example.id
-    };
-    try {
-      const prep = await prepare({
-        sources: [source],
-        split: parseSplit("file"),
-        questions: spec.questions,
-        profile,
-        cwd: root,
-        exclude: ctx.config.egress.exclude
-      });
-      const [item, ...rest] = prep.items;
-      const why = prep.skipped[0];
-      prepared.push(item && rest.length === 0 ? { id: example.id, expect, prep } : {
-        id: example.id,
-        expect,
-        reason: why ? `${why.path} ${why.reason}` : `gave ${prep.items.length} states, not 1`
-      });
-    } catch (error) {
-      if (!isDecisionsError(error) || !["state-too-large", "source-error"].includes(error.code)) {
-        throw error;
-      }
-      prepared.push({ id: example.id, expect, reason: error.message.split("\n")[0] });
-    }
-  }
-  const decider = deciderFor(ctx, profile, input.mode ?? "replay");
-  if (decider.mode !== "replay") {
-    assertConsent(ctx.config.egress.consent, root);
-    const parts = prepared.flatMap((p) => p.prep ? [p.prep.projection] : []);
-    checkBudget(combineProjections(profile, parts), ctx.config.budget, input.confirm ?? false);
-  }
-  const results = [];
-  const usages = [];
-  let misses = 0;
-  for (const { id, expect, prep, reason } of prepared) {
-    const item = prep?.items[0];
-    if (!prep || !item) {
-      results.push({ id, status: "withheld", reason: reason ?? "not sent" });
-      continue;
-    }
-    try {
-      const r = await decider.decide({
-        state: item.state,
-        questions: spec.questions,
-        namespace: spec.name
-      });
-      usages.push(r.usage);
-      results.push(judge(id, r.answers, r.undecided, expect));
-    } catch (error) {
-      if (isDecisionsError(error) && error.code === "replay-miss") {
-        misses += 1;
-        continue;
-      }
-      throw error;
-    }
-  }
-  if (misses > 0) {
-    throw new DecisionsError("replay-miss", `${misses} of ${examples.length} examples of "${spec.name}" have no recorded answer. Record them with \`decide spec check ${spec.name} --live\` (needs a key and repo consent).`, { misses });
-  }
-  const counts2 = {
-    examples: results.length,
-    pass: 0,
-    fail: 0,
-    undecided: 0,
-    captured: 0,
-    withheld: 0
-  };
-  for (const r of results)
-    counts2[r.status] += 1;
-  return {
-    spec: spec.name,
-    file: spec.file,
-    model: profile.id,
-    source: decider.mode === "replay" ? "replay" : "live",
-    passed: counts2.fail === 0 && counts2.undecided === 0 && counts2.withheld === 0,
-    counts: counts2,
-    examples: results,
-    usage: sumUsage(usages),
-    skipped: summariseSkipped(prepared.flatMap((p) => p.prep?.skipped ?? [])),
-    lint
-  };
-}
-function judge(id, answers, flat, expect) {
-  const entries = Object.entries(expect);
-  if (entries.length === 0) {
-    return { id, status: "captured", answers, ...flat.length ? { undecided: flat } : {} };
-  }
-  const failures = [];
-  const undecided = [];
-  for (const [question, expectation] of entries) {
-    const answer = answers[question];
-    const isFlat = flat.includes(question);
-    if (expectation.kind === "undecided") {
-      if (!isFlat)
-        failures.push({ question, expected: "undecided" });
-    } else if (isFlat) {
-      undecided.push(question);
-    } else if (!answer || !meets(question, answer, expectation)) {
-      failures.push({ question, expected: describeExpectation(expectation) });
-    }
-  }
-  const status = failures.length ? "fail" : undecided.length ? "undecided" : "pass";
-  return {
-    id,
-    status,
-    answers,
-    ...failures.length ? { failures } : {},
-    ...undecided.length ? { undecided } : {}
-  };
-}
-
-// ../core/dist/tools/spec-lint.js
-import { basename as basename3, extname as extname2 } from "node:path";
-function runSpecLint(ctx, rawInput = {}) {
-  const input = checkInput("spec-lint", rawInput);
-  const specs = input.spec ? [named(ctx, input.spec)] : listSpecs(ctx.specDirs).filter((s) => !s.shadowed).map((s) => s.error ? { name: s.name, file: s.file, origin: s.origin, findings: [], invalid: s.error } : (
-    // Loaded by path, so keep the layer it was listed from.
-    { ...entry(loadSpec(s.file, ctx.specDirs, ctx.cwd)), origin: s.origin }
-  ));
-  const all = specs.flatMap((s) => s.findings);
-  const counts2 = {
-    specs: specs.length,
-    errors: all.filter((f) => f.severity === "error").length,
-    warnings: all.filter((f) => f.severity === "warning").length,
-    invalid: specs.filter((s) => s.invalid).length
-  };
-  return { specs, counts: counts2, passed: counts2.errors === 0 && counts2.invalid === 0 };
-}
-function named(ctx, ref) {
-  try {
-    return entry(loadSpec(ref, ctx.specDirs, ctx.cwd));
-  } catch (error) {
-    const file = isDecisionsError(error) ? error.details?.file : void 0;
-    if (typeof file !== "string")
-      throw error;
-    return {
-      name: basename3(file, extname2(file)),
-      file,
-      origin: "path",
-      findings: [],
-      invalid: error.message
-    };
-  }
-}
-function entry(spec) {
-  return { name: spec.name, file: spec.file, origin: spec.origin, findings: lintSpec(spec) };
-}
-
-// ../core/dist/tools/usage.js
-function runUsage(ctx, rawInput = {}) {
-  const input = checkInput("usage", rawInput);
-  const since = input.since ? new Date(input.since) : void 0;
-  if (since && Number.isNaN(since.getTime())) {
-    throw new DecisionsError("invalid-request", `--since "${input.since}" is not a date`);
-  }
-  const session = input.session === "current" ? currentSession(ctx) : input.session;
-  const ledger = ledgerFor(ctx);
-  return {
-    basis: "measured",
-    ...ledger.summary({
-      ...session ? { session } : {},
-      ...since ? { since } : {}
-    }),
-    ledger: ledger.file,
-    ...session ? { session } : {},
-    ...input.since ? { since: input.since } : {}
-  };
-}
-function currentSession(ctx) {
-  if (ctx.config.session)
-    return ctx.config.session;
-  throw new DecisionsError("invalid-request", "no current session: not running under Claude Code, Codex or Pi, and SYSTEM1_SESSION is not set");
-}
-
-// ../core/dist/wiring.js
-var DEFAULT_MODEL = DEFAULT_MODEL_ID;
-function resolveConnection(env = process.env) {
-  return {
-    endpoint: nonEmpty3(env.SYSTEM1_ENDPOINT) ?? DEFAULT_ENDPOINT,
-    model: nonEmpty3(env.SYSTEM1_MODEL) ?? DEFAULT_MODEL,
-    apiKey: nonEmpty3(env.OPENROUTER_API_KEY),
-    replay: /^(1|true|yes)$/i.test(env.SYSTEM1_REPLAY ?? "")
-  };
-}
-function nonEmpty3(value) {
-  return value === void 0 || value.trim() === "" ? void 0 : value.trim();
-}
-
 export {
+  PACKS,
+  PACK_NAMES,
+  isPackName,
+  DEFAULT_MODEL_ID,
+  resolveProfile,
   activeTriggers,
+  route,
+  DEFAULT_ENDPOINT,
+  detectHarness,
+  userConfigDir,
   repoConfigPath,
   loadConfig,
   allProfiles,
+  unquoteKey,
   setConsent,
+  setGuardEnabled,
+  assertConsent,
+  assertStateFits,
   DEFAULT_EXCLUDES,
-  probeUrl,
-  ping,
+  CRITERIA_SNAPSHOT_MAX_CHARS,
+  MAX_CRITERIA_FILES,
+  guardStatePath,
+  readGuardState,
+  updateGuardState,
+  verdictOf,
+  project,
+  backlogPath,
+  readBacklog,
+  withBacklogLock,
+  writeBacklog,
+  mergeCandidates,
+  ENTRY_FIELDS,
+  parseRecordFilter,
+  parseRecordSort,
+  readField,
+  recordMatches,
+  project2,
+  combineProjections,
+  checkBudget,
   parseFileRef,
+  parseSplit,
+  prepare,
+  mapWithConcurrency,
+  sumUsage,
+  parseExpect,
+  meets,
+  describeExpectation,
+  lintStatement,
+  lintSpec,
   exampleProblems,
+  exampleFileProblem,
   assertExamples,
   parseQuestionSet,
   loadSpec,
   listSpecs,
   TOOL_SCHEMAS,
   createContext,
-  runMany,
-  runAsk,
-  runDoctor,
-  runOpportunitiesAdd,
-  runOpportunitiesList,
-  runOpportunitiesCheck,
-  runRoute,
-  runSpecCheck,
-  runSpecLint,
-  runUsage,
-  resolveConnection
+  checkInput,
+  resolveRequest,
+  deciderFor,
+  ledgerFor
 };