@helmsmith/workbrokr 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,2468 @@
+// ../../platform/core/cli-kit-lib/src/auth-provider.ts
+var noopAuthProvider = {
+  async getToken() {
+    throw new Error(
+      "noopAuthProvider.getToken() called \u2014 wire a real AuthProvider via createCli({ auth })"
+    );
+  },
+  async whoami() {
+    return null;
+  }
+};
+
+// ../../platform/core/cli-kit-lib/src/create-cli.ts
+import { Command } from "commander";
+function createCli(opts) {
+  const program2 = new Command();
+  program2.name(opts.name).version(opts.version);
+  if (opts.description) program2.description(opts.description);
+  program2.configureOutput({
+    outputError: (str, write) => write(str)
+  });
+  return { program: program2, auth: opts.auth ?? noopAuthProvider };
+}
+
+// src/commands/audit.ts
+import chalk3 from "chalk";
+
+// ../../platform/core/workkit-lib/src/config.ts
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync as mkdirSync2,
+  readFileSync,
+  realpathSync as realpathSync2,
+  writeFileSync
+} from "fs";
+import { join } from "path";
+
+// ../../platform/core/workkit-lib/src/errors.ts
+var REFUSALS = /* @__PURE__ */ new Set([
+  "MANIFEST_INVALID",
+  "AREA_UNKNOWN",
+  "TYPE_UNKNOWN",
+  "MODE_UNKNOWN",
+  "MAIN_CHECKOUT",
+  "WORKTREE_INVALID",
+  "PROTECTED_BRANCH",
+  "EFFORT_OPEN",
+  "EFFORT_NOT_FOUND",
+  "SCOPE_CONFLICT",
+  "COMMONS_LOCKED",
+  "NO_FREE_SLOT",
+  "LEASE_NOT_FOUND",
+  "PORT_RANGE_TAKEN",
+  "SYNC_CONFLICT",
+  "DIRTY_WORKTREE",
+  "UNPUSHED"
+]);
+function exitCodeFor(code) {
+  return REFUSALS.has(code) ? 2 : 1;
+}
+var WorkkitError = class extends Error {
+  code;
+  details;
+  constructor(code, message, details) {
+    super(message);
+    this.name = "WorkkitError";
+    this.code = code;
+    if (details) this.details = details;
+  }
+};
+function toErrorBody(err) {
+  if (err instanceof WorkkitError) {
+    return err.details ? { code: err.code, message: err.message, details: err.details } : { code: err.code, message: err.message };
+  }
+  return { code: "INTERNAL", message: err instanceof Error ? err.message : String(err) };
+}
+
+// ../../platform/core/workkit-lib/src/git.ts
+import { spawnSync } from "child_process";
+import { mkdirSync, realpathSync } from "fs";
+import { dirname } from "path";
+var Git = class {
+  constructor(cwd) {
+    this.cwd = cwd;
+  }
+  cwd;
+  tryRun(args) {
+    const r = spawnSync("git", args, { cwd: this.cwd, encoding: "utf8" });
+    return { code: r.status ?? 1, out: r.stdout ?? "", err: r.stderr ?? "" };
+  }
+  run(args) {
+    const r = this.tryRun(args);
+    if (r.code !== 0) {
+      throw new WorkkitError(
+        "GIT_FAILED",
+        `git ${args.join(" ")} (in ${this.cwd}): ${r.err.trim() || r.out.trim()}`,
+        {
+          args,
+          cwd: this.cwd
+        }
+      );
+    }
+    return r.out;
+  }
+  lines(args) {
+    return this.run(args).split("\n").map((l) => l.trim()).filter(Boolean);
+  }
+  /** The checkout's top level (symlinks resolved). */
+  root() {
+    return realpathSync(this.run(["rev-parse", "--show-toplevel"]).trim());
+  }
+  /** The main checkout's top level, from any worktree of the repo. */
+  mainRoot() {
+    const common = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim()
+    );
+    return dirname(common);
+  }
+  /** The main checkout is the one whose git dir IS the common dir (compared as absolute realpaths). */
+  isMainCheckout() {
+    const gitDir = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-dir"]).trim()
+    );
+    const common = realpathSync(
+      this.run(["rev-parse", "--path-format=absolute", "--git-common-dir"]).trim()
+    );
+    return gitDir === common;
+  }
+  currentBranch() {
+    return this.run(["branch", "--show-current"]).trim();
+  }
+  branchExists(name) {
+    return this.tryRun(["rev-parse", "--verify", "-q", `refs/heads/${name}`]).code === 0;
+  }
+  remoteBranchExists(name) {
+    return this.run(["ls-remote", "--heads", "origin", name]).trim().length > 0;
+  }
+  fetch(branch) {
+    this.run(["fetch", "-q", "origin", branch]);
+  }
+  hasUpstream() {
+    return this.tryRun(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]).code === 0;
+  }
+  /** Commits on HEAD that origin does not have: against the upstream, else the same-named remote branch, else origin/<base>. */
+  unpushedCount(base) {
+    let ref = `origin/${base}`;
+    if (this.hasUpstream()) ref = "@{u}";
+    else if (this.remoteBranchExists(this.currentBranch())) ref = `origin/${this.currentBranch()}`;
+    return this.lines(["rev-list", `${ref}..HEAD`]).length;
+  }
+  isDirty() {
+    return this.run(["status", "--porcelain"]).trim().length > 0;
+  }
+  changedPathsStaged() {
+    return this.lines(["diff", "--cached", "--name-only"]);
+  }
+  changedPaths(from, to) {
+    return this.lines(["diff", "--name-only", "--no-renames", from, to]);
+  }
+  /** Paths this branch changed since it diverged from origin/<base> (three-dot), without the base's own changes. */
+  changedSince(base) {
+    return this.lines(["diff", "--name-only", "--no-renames", `origin/${base}...HEAD`]);
+  }
+  commitsNotOn(base) {
+    return this.lines(["rev-list", `origin/${base}..HEAD`]);
+  }
+  rev(ref) {
+    return this.run(["rev-parse", ref]).trim();
+  }
+  /** Fast-forward when HEAD has no own commits, otherwise merge; never rebase. A conflict is left in place. */
+  syncFrom(base) {
+    const target = `origin/${base}`;
+    const before = this.rev("HEAD");
+    const targetRev = this.rev(target);
+    if (before === targetRev) return { kind: "up-to-date", before, after: before, conflicted: [] };
+    if (this.tryRun(["merge-base", "--is-ancestor", "HEAD", target]).code === 0) {
+      this.run(["merge", "--ff-only", "-q", target]);
+      return { kind: "ff", before, after: this.rev("HEAD"), conflicted: [] };
+    }
+    if (this.tryRun(["merge-base", "--is-ancestor", target, "HEAD"]).code === 0) {
+      return { kind: "up-to-date", before, after: before, conflicted: [] };
+    }
+    const merged = this.tryRun(["merge", "--no-edit", "-q", target]);
+    if (merged.code === 0)
+      return { kind: "merge", before, after: this.rev("HEAD"), conflicted: [] };
+    const conflicted = this.lines(["diff", "--name-only", "--diff-filter=U"]);
+    return { kind: "conflict", before, after: before, conflicted };
+  }
+  worktreeAdd(path, branch, startPoint) {
+    mkdirSync(dirname(path), { recursive: true });
+    if (this.branchExists(branch)) this.run(["worktree", "add", "-q", path, branch]);
+    else
+      this.run(["worktree", "add", "-q", "--no-track", "-b", branch, path, startPoint ?? "HEAD"]);
+  }
+  worktreeRemove(path) {
+    this.run(["worktree", "remove", "--force", path]);
+  }
+  checkout(branch, createFrom) {
+    if (this.branchExists(branch)) this.run(["checkout", "-q", branch]);
+    else this.run(["checkout", "-q", "--no-track", "-b", branch, createFrom ?? "HEAD"]);
+  }
+  push(branch) {
+    this.run(["push", "-q", "-u", "origin", branch]);
+  }
+  deleteLocalBranch(branch) {
+    this.run(["branch", "-q", "-D", branch]);
+  }
+};
+
+// ../../platform/core/workkit-lib/src/config.ts
+function renderTemplate(s, vars) {
+  return s.replace(/\$\{([A-Z0-9_]+)\}/g, (_, name) => {
+    if (!(name in vars)) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `template references ${name}, which this effort does not define`
+      );
+    }
+    return vars[name];
+  });
+}
+function slotVars(m, o) {
+  const vars = {
+    SLOT: o.slot === void 0 ? "" : String(o.slot),
+    PROJECT: m.project,
+    AREA: o.area ?? "",
+    BRANCH: o.branch ?? "",
+    WORKTREE: o.worktree ?? "",
+    LOG_DIR: o.logDir ?? "",
+    PORT_STORYBOOK: o.storybookPort === void 0 ? "" : String(o.storybookPort)
+  };
+  for (const service of Object.keys(m.ports.services)) {
+    const p = o.ports[service];
+    vars[`PORT_${service.toUpperCase()}`] = p === void 0 ? "" : String(p);
+  }
+  return vars;
+}
+function ensureExcluded(worktree, patterns) {
+  const r = new Git(worktree).tryRun(["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (r.code !== 0) return;
+  const common = realpathSync2(r.out.trim());
+  const file = join(common, "info", "exclude");
+  mkdirSync2(join(common, "info"), { recursive: true });
+  const present = new Set(
+    existsSync(file) ? readFileSync(file, "utf8").split("\n").map((l) => l.trim()) : []
+  );
+  const missing = patterns.filter((p) => !present.has(p));
+  if (missing.length === 0) return;
+  appendFileSync(
+    file,
+    `${present.size ? "\n" : ""}# written by @helmsmith/workkit: per-worktree config and logs
+${missing.join("\n")}
+`
+  );
+}
+function emitWorktreeConfig(a) {
+  ensureExcluded(a.worktree, [
+    ".slot",
+    a.m.env.file,
+    `${a.m.logs.dir.replace(/\/+$/, "")}/`,
+    `${a.m.worktreeRoot.replace(/\/+$/, "")}/`
+  ]);
+  const logDir = join(a.worktree, a.m.logs.dir);
+  mkdirSync2(logDir, { recursive: true });
+  const vars = slotVars(a.m, { ...a, logDir });
+  const envFile = join(a.worktree, a.m.env.file);
+  const lines = Object.entries(a.m.env.template).map(([k, v]) => `${k}=${renderTemplate(v, vars)}`);
+  writeFileSync(envFile, `${lines.join("\n")}
+`);
+  let slotFile;
+  if (a.slot !== void 0) {
+    slotFile = join(a.worktree, ".slot");
+    writeFileSync(slotFile, `${a.slot}
+`);
+  }
+  return slotFile ? { envFile, slotFile, logDir, vars } : { envFile, logDir, vars };
+}
+
+// ../../platform/core/workkit-lib/src/guards.ts
+import { existsSync as existsSync2, realpathSync as realpathSync3 } from "fs";
+
+// ../../platform/core/workkit-lib/src/scopes.ts
+import picomatch from "picomatch";
+function areaVars(area) {
+  const parts = area.split("/");
+  return { group: parts.slice(0, -1).join("/"), section: parts[parts.length - 1] };
+}
+function fill(template, vars) {
+  let missing = false;
+  const out = template.replace(/\{(group|section|module)\}/g, (_, name) => {
+    const v = vars[name];
+    if (v === void 0 || v === "") {
+      missing = true;
+      return "";
+    }
+    return v;
+  });
+  return missing ? null : out;
+}
+function expandScopes(m, area, mode) {
+  const spec = m.areas[area];
+  if (!spec)
+    throw new WorkkitError(
+      "AREA_UNKNOWN",
+      `unknown area "${area}" (known: ${Object.keys(m.areas).join(", ")})`
+    );
+  const vars = { ...areaVars(area), module: spec.module };
+  const out = [];
+  for (const t of m.scopes.frontend) {
+    const g = fill(t, vars);
+    if (g) out.push(g);
+  }
+  if (mode === "fullstack") {
+    if (!spec.module) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `area "${area}" has no module, so a fullstack effort cannot hold a backend scope; add areas["${area}"].module or use --mode frontend`
+      );
+    }
+    for (const t of m.scopes.backend) {
+      const g = fill(t, vars);
+      if (g) out.push(g);
+    }
+  }
+  out.push(...spec.extraScopes ?? []);
+  return out;
+}
+function literalPrefix(glob) {
+  const i = glob.search(/[*?[{]/);
+  return i < 0 ? glob : glob.slice(0, i);
+}
+function globsOverlap(a, b) {
+  const pairs = [];
+  for (const x of a) {
+    const px = literalPrefix(x);
+    for (const y of b) {
+      const py = literalPrefix(y);
+      if (px.startsWith(py) || py.startsWith(px)) pairs.push(`${x} ~ ${y}`);
+    }
+  }
+  return pairs;
+}
+function pathsMatching(paths, globs) {
+  if (globs.length === 0) return [];
+  const isMatch = picomatch(globs, { dot: true });
+  return paths.filter((p) => isMatch(p));
+}
+function commonsTouched(m, paths) {
+  return Object.entries(m.commons).filter(([, globs]) => pathsMatching(paths, globs).length > 0).map(([name]) => name);
+}
+
+// ../../platform/core/workkit-lib/src/guards.ts
+function assertNotProtected(m, branch) {
+  if (m.protectedBranches.includes(branch)) {
+    throw new WorkkitError(
+      "PROTECTED_BRANCH",
+      `branch "${branch}" is protected (${m.protectedBranches.join(", ")}): work happens on <type>/<area> branches, never here`,
+      { branch }
+    );
+  }
+}
+var same = (a, b) => {
+  try {
+    return realpathSync3(a) === realpathSync3(b);
+  } catch {
+    return a === b;
+  }
+};
+function checkCommit(c) {
+  const refusals = [];
+  if (c.m.protectedBranches.includes(c.branch)) {
+    refusals.push(
+      `branch "${c.branch}" is protected (${c.m.protectedBranches.join(", ")}): work happens on <type>/<area> branches, never here`
+    );
+  }
+  const efforts = new Map(c.registry.efforts({ project: c.project }).map((e) => [e.id, e]));
+  for (const lease of c.registry.leases({ project: c.project, kind: "commons" })) {
+    if (lease.owner.session === c.ownerSession) continue;
+    const holder = efforts.get(lease.effort);
+    if (holder && c.checkoutRoot && existsSync2(holder.worktree) && same(holder.worktree, c.checkoutRoot))
+      continue;
+    const globs = c.m.commons[String(lease.value)] ?? [];
+    const hit = pathsMatching(c.stagedPaths, globs);
+    if (hit.length > 0) {
+      refusals.push(
+        `commons "${lease.value}" is write-locked by ${lease.owner.session} (effort ${lease.effort}, since ${lease.touched}); staged: ${hit.join(", ")}`
+      );
+    }
+  }
+  return { refusals };
+}
+function checkPush(c) {
+  const refusals = [];
+  const warnings = [];
+  const destination = (c.remoteRef ?? `refs/heads/${c.branch}`).replace(/^refs\/heads\//, "");
+  if (c.m.protectedBranches.includes(destination)) {
+    refusals.push(
+      c.isDelete ? `refusing to delete protected branch "${destination}"` : `"${destination}" is protected (${c.m.protectedBranches.join(", ")}): nothing is pushed to it directly, open a PR from ${c.branch || "an area branch"}`
+    );
+    return { refusals, warnings };
+  }
+  if (c.isDelete) return { refusals, warnings };
+  const effort = c.registry.efforts({ project: c.project, state: "active" }).find((e) => e.branch === c.branch);
+  const commons = commonsTouched(c.m, c.changedPaths);
+  if (effort) {
+    const allCommonsGlobs = Object.values(c.m.commons).flat();
+    const inScope = new Set(pathsMatching(c.changedPaths, [...effort.scopes, ...allCommonsGlobs]));
+    const outside = c.changedPaths.filter((p) => !inScope.has(p));
+    if (outside.length > 0) {
+      warnings.push(
+        `${outside.length} changed path(s) are outside the effort's scope (${effort.area}): ${outside.join(", ")} \u2014 add a scope template or expect a merge collision`
+      );
+    }
+  }
+  for (const name of commons)
+    warnings.push(`commons ${name} touched: the other areas are told at \`work finish\``);
+  return { refusals, warnings };
+}
+
+// ../../platform/core/workkit-lib/src/hooks.ts
+import { chmodSync, lstatSync, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
+
+// ../../platform/core/workkit-lib/src/manifest.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL } from "url";
+import { z } from "zod";
+var MANIFEST_FILES = [
+  "helmsmith.config.ts",
+  "helmsmith.config.mjs",
+  "helmsmith.config.json"
+];
+var BRANCH_NAME = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+var BRANCH_NAME_HINT = 'must be a plain ref name: letters, digits, ".", "_", "/", "-"';
+var Service = z.object({
+  start: z.string().min(1),
+  stop: z.string().min(1),
+  health: z.string().min(1),
+  healthyCodes: z.array(z.number().int()).optional(),
+  reset: z.string().optional(),
+  healthTimeoutMs: z.number().int().positive().optional()
+});
+var Schema = z.object({
+  project: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+  baseBranch: z.string().regex(BRANCH_NAME, BRANCH_NAME_HINT),
+  protectedBranches: z.array(z.string().regex(BRANCH_NAME, BRANCH_NAME_HINT)).optional(),
+  worktreeRoot: z.string().default(".claude/worktrees"),
+  branch: z.object({ types: z.array(z.string().regex(/^[a-z]+$/)).min(1) }).default({ types: ["feature", "chore", "fix"] }),
+  slots: z.object({
+    count: z.number().int().min(1).max(100),
+    reserved: z.array(z.number().int().min(0))
+  }).default({ count: 10, reserved: [0] }),
+  ports: z.object({
+    services: z.record(z.string(), z.object({ base: z.number().int().min(1024).max(65535) }))
+  }),
+  services: z.record(z.string(), Service),
+  storybook: z.object({ hostRoot: z.string() }).optional(),
+  logs: z.object({ dir: z.string() }).default({ dir: ".logs" }),
+  env: z.object({ file: z.string(), template: z.record(z.string(), z.string()) }).optional(),
+  refresh: z.array(
+    z.object({
+      when: z.string().optional(),
+      always: z.boolean().optional(),
+      run: z.string().optional(),
+      mark: z.string().optional()
+    })
+  ).default([]),
+  scopes: z.object({ frontend: z.array(z.string()), backend: z.array(z.string()) }),
+  areas: z.record(
+    z.string().regex(/^[a-z0-9-]+(\/[a-z0-9-]+)*$/),
+    z.object({
+      module: z.string().optional(),
+      commons: z.array(z.string()).optional(),
+      extraScopes: z.array(z.string()).optional()
+    })
+  ),
+  commons: z.record(z.string(), z.array(z.string())).default({}),
+  expiry: z.object({
+    slotHours: z.number().positive(),
+    commonsHours: z.number().positive(),
+    storybookHours: z.number().positive()
+  }).default({ slotHours: 12, commonsHours: 4, storybookHours: 2 }),
+  archive: z.object({
+    paths: z.array(z.string()),
+    keepDays: z.number().int().positive(),
+    keepPerArea: z.number().int().positive()
+  }).default({ paths: [], keepDays: 30, keepPerArea: 5 })
+});
+function templateVariables(m) {
+  const vars = /* @__PURE__ */ new Set([
+    "SLOT",
+    "LOG_DIR",
+    "PROJECT",
+    "AREA",
+    "BRANCH",
+    "WORKTREE",
+    "PORT_STORYBOOK"
+  ]);
+  for (const s of Object.keys(m.ports.services)) vars.add(`PORT_${s.toUpperCase()}`);
+  return vars;
+}
+function defaultEnv(services) {
+  const template = { SLOT: "${SLOT}", LOG_DIR: "${LOG_DIR}" };
+  for (const s of services) template[`PORT_${s.toUpperCase()}`] = `\${PORT_${s.toUpperCase()}}`;
+  return { file: ".env.slot", template };
+}
+function validateManifest(raw) {
+  const parsed = Schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new WorkkitError(
+      "MANIFEST_INVALID",
+      parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")
+    );
+  }
+  const m = parsed.data;
+  const problems = [];
+  const areas = Object.keys(m.areas).sort();
+  for (const a of areas) {
+    for (const b of areas) {
+      if (a !== b && b.startsWith(`${a}/`)) {
+        problems.push(`area "${a}" is an ancestor of "${b}": areas must be leaves`);
+      }
+    }
+  }
+  for (const s of Object.keys(m.services)) {
+    if (!m.ports.services[s]) problems.push(`service "${s}" has no port base under ports.services`);
+  }
+  for (const s of Object.keys(m.ports.services)) {
+    if (!m.services[s] && s !== "storybook") problems.push(`port "${s}" names no service`);
+  }
+  for (const r of m.slots.reserved) {
+    if (r >= m.slots.count) problems.push(`reserved slot ${r} is outside 0..${m.slots.count - 1}`);
+  }
+  const env = m.env ?? defaultEnv(Object.keys(m.ports.services));
+  const allowed = templateVariables(m);
+  for (const [k, v] of Object.entries(env.template)) {
+    for (const [, name] of v.matchAll(/\$\{([A-Z0-9_]+)\}/g)) {
+      if (!allowed.has(name)) {
+        problems.push(
+          `env.template.${k} references ${name}, which no slot derives (allowed: ${[...allowed].join(", ")})`
+        );
+      }
+    }
+  }
+  for (const [area, spec] of Object.entries(m.areas)) {
+    for (const c of spec.commons ?? []) {
+      if (!m.commons[c])
+        problems.push(`area "${area}" names commons "${c}", which is not declared`);
+    }
+  }
+  if (problems.length) throw new WorkkitError("MANIFEST_INVALID", problems.join("; "));
+  return { ...m, protectedBranches: m.protectedBranches ?? [m.baseBranch], env };
+}
+async function loadManifest(repoRoot) {
+  for (const name of MANIFEST_FILES) {
+    const file = join2(repoRoot, name);
+    if (!existsSync3(file)) continue;
+    if (name.endsWith(".json")) return validateManifest(JSON.parse(readFileSync2(file, "utf8")));
+    const mod = await import(`${pathToFileURL(file).href}?t=${Date.now()}`);
+    return validateManifest(mod.default);
+  }
+  throw new WorkkitError(
+    "MANIFEST_NOT_FOUND",
+    `no ${MANIFEST_FILES.join(" | ")} in ${repoRoot}; run \`work init\``
+  );
+}
+
+// ../../platform/core/workkit-lib/src/hooks.ts
+var HOOKS_DIR = ".helmsmith/hooks";
+function preCommitScript(protectedBranches) {
+  return `#!/bin/sh
+# Installed by \`work init\` (@helmsmith/workbrokr). The protected-branch rule lives here; the rest in workbrokr.
+PROTECTED="${protectedBranches.join(" ")}"
+branch=$(git symbolic-ref --short -q HEAD)
+for p in $PROTECTED; do
+  if [ "$branch" = "$p" ]; then
+    echo "work: branch \\"$branch\\" is protected ($PROTECTED): work happens on <type>/<area> branches, never here" >&2
+    exit 2
+  fi
+done
+if ! command -v workbrokr >/dev/null 2>&1; then
+  echo "work: workbrokr is not on PATH; commons and scope checks skipped (npm i -g @helmsmith/workbrokr)" >&2
+  exit 0
+fi
+exec workbrokr hook pre-commit "$@"
+`;
+}
+function prePushScript(protectedBranches) {
+  return `#!/bin/sh
+# Installed by \`work init\` (@helmsmith/workbrokr). Refuses a push to, or a delete of, a protected branch here; the rest in workbrokr.
+PROTECTED="${protectedBranches.join(" ")}"
+input=$(cat)
+printf '%s\\n' "$input" | while read -r lref lsha rref rsha; do
+  [ -n "$rref" ] || continue
+  dest=\${rref#refs/heads/}
+  for p in $PROTECTED; do
+    if [ "$dest" = "$p" ]; then
+      echo "work: \\"$dest\\" is protected ($PROTECTED): nothing is pushed to it directly, open a PR from an area branch" >&2
+      exit 2
+    fi
+  done
+done || exit 2
+if ! command -v workbrokr >/dev/null 2>&1; then
+  echo "work: workbrokr is not on PATH; scope and commons warnings skipped" >&2
+  exit 0
+fi
+printf '%s\\n' "$input" | exec workbrokr hook pre-push "$@"
+`;
+}
+function installHooks(repoRoot, opts) {
+  for (const b of opts.protectedBranches) {
+    if (!BRANCH_NAME.test(b))
+      throw new WorkkitError("MANIFEST_INVALID", `protected branch "${b}" is not a plain ref name`);
+  }
+  const hooksDir = join3(repoRoot, HOOKS_DIR);
+  mkdirSync3(hooksDir, { recursive: true });
+  const files = [];
+  const scripts = [
+    ["pre-commit", preCommitScript(opts.protectedBranches)],
+    ["pre-push", prePushScript(opts.protectedBranches)]
+  ];
+  for (const [name, body] of scripts) {
+    const file = join3(hooksDir, name);
+    let existing;
+    try {
+      existing = lstatSync(file);
+    } catch {
+      existing = void 0;
+    }
+    if (existing?.isSymbolicLink()) {
+      throw new WorkkitError("INTERNAL", `refusing to write hook ${file}: it is a symlink`, {
+        file
+      });
+    }
+    writeFileSync2(file, body);
+    chmodSync(file, 493);
+    files.push(file);
+  }
+  new Git(repoRoot).run(["config", "core.hooksPath", HOOKS_DIR]);
+  return { hooksDir, files };
+}
+
+// ../../platform/core/workkit-lib/src/paths.ts
+import { homedir } from "os";
+import { join as join4 } from "path";
+function homeDir(env = process.env) {
+  return env.HELMSMITH_HOME && env.HELMSMITH_HOME.length > 0 ? env.HELMSMITH_HOME : join4(homedir(), ".cache", "helmsmith");
+}
+var registryFile = (home) => join4(home, "registry.json");
+var lockDir = (home) => join4(home, "registry.lock");
+
+// ../../platform/core/workkit-lib/src/ports.ts
+function portsForSlot(m, slot) {
+  return Object.fromEntries(
+    Object.entries(m.ports.services).map(([service, { base }]) => [service, base + slot])
+  );
+}
+function rangesFor(m) {
+  return Object.fromEntries(
+    Object.entries(m.ports.services).map(([service, { base }]) => [
+      service,
+      { base, count: m.slots.count }
+    ])
+  );
+}
+function rangesOverlap(a, b) {
+  return a.base < b.base + b.count && b.base < a.base + a.count;
+}
+function claimRanges(registry, m, repoRoot) {
+  const mine = rangesFor(m);
+  const others = Object.entries(registry.read().projects).filter(([name]) => name !== m.project);
+  for (const [service, range] of Object.entries(mine)) {
+    for (const [name, entry] of others) {
+      for (const [theirService, theirs] of Object.entries(entry.ranges)) {
+        if (rangesOverlap(range, theirs)) {
+          throw new WorkkitError(
+            "PORT_RANGE_TAKEN",
+            `ports ${range.base}-${range.base + range.count - 1} for "${service}" overlap project "${name}" (${theirService}: ${theirs.base}-${theirs.base + theirs.count - 1}); pick another base in ports.services.${service}`,
+            { project: name, service, theirs }
+          );
+        }
+      }
+    }
+  }
+  registry.upsertProject(m.project, { root: repoRoot, ranges: mine });
+}
+
+// ../../platform/core/workkit-lib/src/refresh.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import picomatch2 from "picomatch";
+function matchesWhen(glob) {
+  const isMatch = picomatch2(glob, { dot: true });
+  return (p) => isMatch(p);
+}
+function selectRefresh(entries, changedPaths) {
+  const runs = [];
+  const marks = [];
+  for (const e of entries) {
+    const hit = e.always === true || e.when !== void 0 && changedPaths.some(matchesWhen(e.when));
+    if (!hit) continue;
+    if (e.run) runs.push(e.run);
+    if (e.mark) marks.push(e.mark);
+  }
+  return { runs, marks };
+}
+function runRefresh(runs, cwd, log, env = process.env) {
+  for (const cmd of runs) {
+    log(`$ ${cmd}`);
+    const r = spawnSync2("sh", ["-c", cmd], { cwd, env, encoding: "utf8" });
+    if (r.stdout) log(r.stdout.trimEnd());
+    if (r.stderr) log(r.stderr.trimEnd());
+    if (r.status !== 0) {
+      throw new WorkkitError("INTERNAL", `refresh command failed (${r.status}): ${cmd}`, {
+        cmd,
+        status: r.status
+      });
+    }
+  }
+}
+
+// ../../platform/core/workkit-lib/src/registry.ts
+import { randomBytes } from "crypto";
+import {
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync3,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+var newId = (prefix) => `${prefix}_${randomBytes(4).toString("hex")}`;
+var EMPTY = { version: 1, projects: {}, leases: [], efforts: [] };
+var LOCK_STALE_MS = 3e4;
+var LOCK_WAIT_MS = 5e3;
+function sleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+var Registry = class _Registry {
+  constructor(home, now2) {
+    this.home = home;
+    this.now = now2;
+  }
+  home;
+  now;
+  static open(home, now2 = () => /* @__PURE__ */ new Date()) {
+    mkdirSync4(home, { recursive: true });
+    return new _Registry(home, now2);
+  }
+  /** The registry as it is on disk. A file that does not parse is refused, never replaced. */
+  read() {
+    const file = registryFile(this.home);
+    if (!existsSync4(file)) return structuredClone(EMPTY);
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync3(file, "utf8"));
+    } catch (err) {
+      throw new WorkkitError(
+        "INTERNAL",
+        `${file} is corrupt (${err instanceof Error ? err.message : String(err)}); nothing was changed. Move it aside (mv ${file} ${file}.corrupt-$(date +%s)) to start fresh, knowing its leases and running pids are lost`,
+        { file }
+      );
+    }
+    const r = parsed;
+    if (!r || typeof r !== "object" || r.version !== 1) {
+      throw new WorkkitError(
+        "INTERNAL",
+        `${file} has an unknown registry version (${String(r?.version)}); this build reads version 1`,
+        { file }
+      );
+    }
+    return {
+      version: 1,
+      projects: r.projects ?? {},
+      leases: r.leases ?? [],
+      efforts: r.efforts ?? [],
+      notices: r.notices ?? []
+    };
+  }
+  /** Lock, re-read, mutate, write atomically, unlock. The only way state changes. */
+  update(fn) {
+    const lock = lockDir(this.home);
+    const started = Date.now();
+    for (; ; ) {
+      try {
+        mkdirSync4(lock);
+        break;
+      } catch {
+        try {
+          if (Date.now() - statSync(lock).mtimeMs > LOCK_STALE_MS) {
+            rmSync(lock, { recursive: true, force: true });
+            continue;
+          }
+        } catch {
+          continue;
+        }
+        if (Date.now() - started > LOCK_WAIT_MS) {
+          throw new WorkkitError(
+            "INTERNAL",
+            `registry lock ${lock} held for over ${LOCK_WAIT_MS} ms`
+          );
+        }
+        sleep(25);
+      }
+    }
+    try {
+      const r = this.read();
+      const out = fn(r);
+      const file = registryFile(this.home);
+      const tmp = `${file}.${process.pid}.tmp`;
+      writeFileSync3(tmp, `${JSON.stringify(r, null, 2)}
+`);
+      renameSync(tmp, file);
+      return out;
+    } finally {
+      rmSync(lock, { recursive: true, force: true });
+    }
+  }
+  project(name) {
+    return this.read().projects[name];
+  }
+  upsertProject(name, entry) {
+    this.update((r) => {
+      r.projects[name] = entry;
+    });
+  }
+  leases(filter = {}) {
+    return this.read().leases.filter(
+      (l) => Object.entries(filter).every(([k, v]) => l[k] === v)
+    );
+  }
+  efforts(filter = {}) {
+    return this.read().efforts.filter(
+      (e) => Object.entries(filter).every(([k, v]) => e[k] === v)
+    );
+  }
+  activeEffortFor(project, area) {
+    return this.efforts({ project, area, state: "active" })[0];
+  }
+  /** An effort that is being started counts as open: nobody else may start on the area meanwhile. */
+  openEffortFor(project, area) {
+    return this.efforts({ project, area }).find(
+      (e) => e.state === "starting" || e.state === "active"
+    );
+  }
+  addNotice(project, area, notice) {
+    this.update((r) => {
+      r.notices = [...r.notices ?? [], { project, area, notice }];
+    });
+  }
+  notices(project, area) {
+    return (this.read().notices ?? []).filter((n) => n.project === project && n.area === area).map((n) => n.notice);
+  }
+  clearNotices(project, area) {
+    this.update((r) => {
+      r.notices = (r.notices ?? []).filter((n) => !(n.project === project && n.area === area));
+    });
+  }
+  allocateSlot(project, m, owner, effort, exclude = /* @__PURE__ */ new Set()) {
+    return this.update((r) => {
+      const taken = new Set(
+        r.leases.filter((l) => l.project === project && l.kind === "slot").map((l) => l.value)
+      );
+      const reserved = new Set(m.slots.reserved);
+      let slot = -1;
+      for (let n = 0; n < m.slots.count; n++) {
+        if (!taken.has(n) && !reserved.has(n) && !exclude.has(n)) {
+          slot = n;
+          break;
+        }
+      }
+      if (slot < 0) {
+        throw new WorkkitError(
+          "NO_FREE_SLOT",
+          `no free slot in ${project} (0..${m.slots.count - 1}, reserved ${[...reserved].join(",")})`
+        );
+      }
+      const lease = this.lease(
+        project,
+        "slot",
+        slot,
+        owner,
+        effort,
+        m.expiry.slotHours,
+        portsForSlot(m, slot)
+      );
+      r.leases.push(lease);
+      return lease;
+    });
+  }
+  addLease(kind, project, value, owner, effort, hours, extra = {}) {
+    return this.update((r) => {
+      const l = { ...this.lease(project, kind, value, owner, effort, hours), ...extra };
+      r.leases.push(l);
+      return l;
+    });
+  }
+  lease(project, kind, value, owner, effort, hours, ports) {
+    const now2 = this.now();
+    return {
+      id: newId("lease"),
+      project,
+      kind,
+      value,
+      ...ports ? { ports } : {},
+      owner,
+      effort,
+      created: now2.toISOString(),
+      touched: now2.toISOString(),
+      expires: new Date(now2.getTime() + hours * 36e5).toISOString()
+    };
+  }
+  touch(leaseId, hours) {
+    this.update((r) => {
+      const l = r.leases.find((x) => x.id === leaseId);
+      if (!l) throw new WorkkitError("LEASE_NOT_FOUND", leaseId);
+      const now2 = this.now();
+      l.touched = now2.toISOString();
+      l.expires = new Date(now2.getTime() + hours * 36e5).toISOString();
+    });
+  }
+  patchLease(leaseId, patch) {
+    this.update((r) => {
+      const i = r.leases.findIndex((x) => x.id === leaseId);
+      if (i < 0) throw new WorkkitError("LEASE_NOT_FOUND", leaseId);
+      r.leases[i] = { ...r.leases[i], ...patch };
+    });
+  }
+  release(leaseId) {
+    this.update((r) => {
+      r.leases = r.leases.filter((l) => l.id !== leaseId);
+    });
+  }
+  expired(now2 = this.now()) {
+    return this.read().leases.filter((l) => Date.parse(l.expires) < now2.getTime());
+  }
+  addEffort(e) {
+    this.update((r) => {
+      r.efforts.push(e);
+    });
+  }
+  updateEffort(id, patch) {
+    return this.update((r) => {
+      const i = r.efforts.findIndex((e) => e.id === id);
+      if (i < 0) throw new WorkkitError("EFFORT_NOT_FOUND", `no effort ${id}`);
+      r.efforts[i] = { ...r.efforts[i], ...patch };
+      return r.efforts[i];
+    });
+  }
+  removeEfforts(predicate) {
+    return this.update((r) => {
+      const before = r.efforts.length;
+      r.efforts = r.efforts.filter((e) => !predicate(e));
+      return before - r.efforts.length;
+    });
+  }
+};
+
+// ../../platform/core/workkit-lib/src/runner.ts
+import { spawn, spawnSync as spawnSync3 } from "child_process";
+import { closeSync, openSync } from "fs";
+import { join as join5 } from "path";
+var DEFAULT_HEALTH_TIMEOUT_MS = 18e4;
+var HEALTH_POLL_MS = 1e3;
+var PROBE_CAP_MS = 1e4;
+var STOP_COMMAND_TIMEOUT_MS = 15e3;
+var STOP_GRACE_MS = 5e3;
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pidSignature(pid) {
+  const r = spawnSync3("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" });
+  return r.status === 0 ? (r.stdout ?? "").trim() : "";
+}
+function probe(spec, cwd, env, timeoutMs = PROBE_CAP_MS) {
+  const r = spawnSync3("sh", ["-c", spec.health], {
+    cwd,
+    env,
+    encoding: "utf8",
+    timeout: Math.max(100, timeoutMs)
+  });
+  const out = (r.stdout ?? "").trim();
+  const last = out.split(/\s+/).filter(Boolean).pop() ?? "";
+  if (r.error) return { healthy: false, last: `probe ${r.error.message}` };
+  if (r.status !== 0) return { healthy: false, last: (r.stderr ?? "").trim() || out };
+  if (spec.healthyCodes && spec.healthyCodes.length > 0)
+    return { healthy: spec.healthyCodes.includes(Number(last)), last };
+  return { healthy: true, last };
+}
+async function waitHealthy(o) {
+  const budget = o.timeoutMs ?? o.spec.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;
+  const deadline = Date.now() + budget;
+  let last = "";
+  while (Date.now() < deadline) {
+    const p = probe(o.spec, o.cwd, o.env, Math.min(PROBE_CAP_MS, deadline - Date.now()));
+    if (p.healthy) return;
+    last = p.last;
+    if (Date.now() >= deadline) break;
+    await sleep2(Math.min(HEALTH_POLL_MS, Math.max(0, deadline - Date.now())));
+  }
+  throw new WorkkitError(
+    "HEALTH_TIMEOUT",
+    `service "${o.name}" was not healthy within ${(budget / 1e3).toFixed(0)} s (last probe: ${last || "no output"})`,
+    { service: o.name, last }
+  );
+}
+function spawnService(name, spec, a) {
+  const fd = openSync(join5(a.logDir, `${name}.log`), "a");
+  try {
+    const child = spawn("sh", ["-c", spec.start], {
+      cwd: a.cwd,
+      env: a.env,
+      detached: true,
+      stdio: ["ignore", fd, fd]
+    });
+    child.unref();
+    if (child.pid === void 0) {
+      throw new WorkkitError("SERVICE_FAILED", `service "${name}" did not spawn: ${spec.start}`, {
+        service: name
+      });
+    }
+    return child.pid;
+  } finally {
+    closeSync(fd);
+  }
+}
+async function startServices(a) {
+  const pids = {};
+  const signatures = {};
+  for (const [name, spec] of Object.entries(a.m.services)) {
+    a.onLog?.(`starting ${name}: ${spec.start}`);
+    pids[name] = spawnService(name, spec, a);
+    signatures[name] = pidSignature(pids[name]);
+    a.onSpawn?.(name, pids[name], signatures[name]);
+    try {
+      await waitHealthy({ name, spec, cwd: a.cwd, env: a.env });
+    } catch (err) {
+      await stopServices({ m: a.m, cwd: a.cwd, env: a.env, pids, signatures, onLog: a.onLog });
+      throw err;
+    }
+    a.onLog?.(`${name} healthy (pid ${pids[name]})`);
+  }
+  return { pids, signatures };
+}
+function killGroup(pid, signal) {
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    try {
+      process.kill(pid, signal);
+    } catch {
+    }
+  }
+}
+async function stopServices(o) {
+  const names = Object.keys(o.m.services).filter((n) => o.pids[n] !== void 0).reverse();
+  if (!o.skipStopCommands) {
+    for (const name of names) {
+      const spec = o.m.services[name];
+      o.onLog?.(`stopping ${name}: ${spec.stop}`);
+      const r = spawnSync3("sh", ["-c", spec.stop], {
+        cwd: o.cwd,
+        env: o.env,
+        encoding: "utf8",
+        timeout: STOP_COMMAND_TIMEOUT_MS
+      });
+      if (r.error) o.onLog?.(`stop command for ${name} ${r.error.message}`);
+    }
+  }
+  const ours = names.filter((n) => {
+    const pid = o.pids[n];
+    if (!isAlive(pid)) return false;
+    const expected = o.signatures?.[n];
+    if (expected === void 0) return true;
+    const actual = pidSignature(pid);
+    if (actual !== expected) {
+      o.onLog?.(
+        `not signalling pid ${pid} (${n}): it is no longer the process started for this lease`
+      );
+      return false;
+    }
+    return true;
+  });
+  const alive = () => ours.filter((n) => isAlive(o.pids[n]));
+  if (alive().length === 0) return;
+  for (const n of alive()) killGroup(o.pids[n], "SIGTERM");
+  const deadline = Date.now() + STOP_GRACE_MS;
+  while (alive().length > 0 && Date.now() < deadline) await sleep2(200);
+  for (const n of alive()) killGroup(o.pids[n], "SIGKILL");
+  const hardDeadline = Date.now() + STOP_GRACE_MS;
+  while (alive().length > 0 && Date.now() < hardDeadline) await sleep2(100);
+}
+
+// ../../platform/core/workkit-lib/src/session.ts
+import { hostname, userInfo } from "os";
+function currentOwner(env = process.env) {
+  const named = [env.WORK_SESSION, env.CLAUDE_SESSION_NAME, env.CLAUDE_CODE_SESSION_ID].find(
+    (v) => v !== void 0 && v.length > 0
+  );
+  return { session: named ?? `${userInfo().username}@${hostname()}`, pid: process.pid };
+}
+
+// src/lib/context.ts
+import chalk from "chalk";
+
+// src/lib/storybrokr.ts
+import { spawnSync as spawnSync4 } from "child_process";
+function run(args) {
+  const r = spawnSync4("storybrokr", args, { encoding: "utf8" });
+  if (r.error) {
+    throw new WorkkitError(
+      "STORYBROKR_FAILED",
+      `storybrokr is not installed (npm i -g @helmsmith/storybrokr): ${r.error.message}`
+    );
+  }
+  return { code: r.status ?? 1, out: r.stdout ?? "", err: r.stderr ?? "" };
+}
+var storybrokrCli = {
+  async up(story, hostRoot) {
+    const r = run(["up", story, "--host", hostRoot, "--json"]);
+    if (r.code !== 0) {
+      throw new WorkkitError(
+        "STORYBROKR_FAILED",
+        `storybrokr up ${story} failed: ${r.err.trim() || r.out.trim()}`
+      );
+    }
+    const record = JSON.parse(r.out);
+    return { id: record.id, port: record.port, url: record.url };
+  },
+  async down(id) {
+    const r = run(["down", id]);
+    if (r.code !== 0)
+      throw new WorkkitError("STORYBROKR_FAILED", `storybrokr down ${id} failed: ${r.err.trim()}`);
+  }
+};
+
+// src/lib/context.ts
+function resolveRepoRoot(cwd, override) {
+  if (override) return override;
+  return new Git(cwd).mainRoot();
+}
+async function buildCtx(opts = {}) {
+  const repoRoot = resolveRepoRoot(opts.cwd ?? process.cwd(), opts.projectRoot);
+  const manifest = await loadManifest(repoRoot);
+  const home = homeDir();
+  const registry = Registry.open(home);
+  if (!registry.project(manifest.project)) claimRanges(registry, manifest, repoRoot);
+  return {
+    home,
+    repoRoot,
+    manifest,
+    registry,
+    owner: currentOwner(),
+    runner: { start: startServices, stop: stopServices },
+    storybrokr: storybrokrCli,
+    log: opts.quiet ? () => {
+    } : (line) => console.error(chalk.gray(line))
+  };
+}
+
+// src/lib/effort.ts
+import {
+  appendFileSync as appendFileSync2,
+  cpSync,
+  existsSync as existsSync5,
+  mkdirSync as mkdirSync5,
+  readdirSync,
+  realpathSync as realpathSync4,
+  rmSync as rmSync2,
+  statSync as statSync2
+} from "fs";
+import { connect, createServer } from "net";
+import { dirname as dirname2, join as join6 } from "path";
+var worktreePathFor = (ctx, area) => join6(ctx.repoRoot, ctx.manifest.worktreeRoot, area);
+var branchFor = (type, area) => `${type}/${area}`;
+var now = () => (/* @__PURE__ */ new Date()).toISOString();
+var STARTING_GRACE_MS = 30 * 6e4;
+var realpathOr = (p) => {
+  try {
+    return realpathSync4(p);
+  } catch {
+    return p;
+  }
+};
+function hoursFor(m, kind) {
+  return {
+    slot: m.expiry.slotHours,
+    storybook: m.expiry.storybookHours,
+    commons: m.expiry.commonsHours
+  }[kind];
+}
+function touchEffort(ctx, effort) {
+  for (const l of ctx.registry.leases({ effort: effort.id }))
+    ctx.registry.touch(l.id, hoursFor(ctx.manifest, l.kind));
+  ctx.registry.updateEffort(effort.id, { lastActivity: now() });
+}
+function portBusy(port) {
+  return new Promise((resolve3) => {
+    const srv = createServer();
+    srv.once("error", () => resolve3(true));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve3(false)));
+  });
+}
+async function busyPorts(ports) {
+  const out = [];
+  for (const [service, port] of Object.entries(ports))
+    if (await portBusy(port)) out.push(`${service}=${port}`);
+  return out;
+}
+function portAnswers(port) {
+  return new Promise((resolve3) => {
+    const sock = connect({ port, host: "127.0.0.1" });
+    const done = (v) => {
+      sock.destroy();
+      resolve3(v);
+    };
+    sock.setTimeout(300, () => done(false));
+    sock.once("connect", () => done(true));
+    sock.once("error", () => done(false));
+  });
+}
+async function anyPortAnswers(ports) {
+  for (const port of Object.values(ports ?? {})) if (await portAnswers(port)) return true;
+  return false;
+}
+function guardStart(ctx, o) {
+  const m = ctx.manifest;
+  const spec = m.areas[o.area];
+  if (!spec)
+    throw new WorkkitError(
+      "AREA_UNKNOWN",
+      `unknown area "${o.area}" (known: ${Object.keys(m.areas).join(", ")})`,
+      { area: o.area }
+    );
+  if (!m.branch.types.includes(o.type))
+    throw new WorkkitError(
+      "TYPE_UNKNOWN",
+      `unknown type "${o.type}" (allowed: ${m.branch.types.join(", ")})`,
+      { type: o.type }
+    );
+  if (o.mode !== "frontend" && o.mode !== "fullstack")
+    throw new WorkkitError("MODE_UNKNOWN", `unknown mode "${o.mode}" (frontend | fullstack)`);
+  const branch = branchFor(o.type, o.area);
+  assertNotProtected(m, branch);
+  const scopes = expandScopes(m, o.area, o.mode);
+  const commons = spec.commons ?? [];
+  const warnings = [];
+  if (commons.length > 0) {
+    for (const e of ctx.registry.efforts({ project: m.project })) {
+      if (e.area === o.area || e.state !== "active" && e.state !== "starting" || !existsSync5(e.worktree))
+        continue;
+      const changed = new Git(e.worktree).tryRun(["diff", "--name-only", "--no-renames", `origin/${m.baseBranch}...HEAD`]).out.split("\n").filter(Boolean);
+      const hit = commonsTouched(m, changed).filter((c) => commons.includes(c));
+      if (hit.length > 0)
+        warnings.push(
+          `${e.area} (${e.branch}, ${e.owner.session}) already has commits under commons ${hit.join(", ")}: coordinate or wait for its merge`
+        );
+    }
+  }
+  return { branch, scopes, commons, warnings };
+}
+function reserveEffort(ctx, o, branch, scopes, commons) {
+  const m = ctx.manifest;
+  const effort = {
+    id: newId("eff"),
+    project: m.project,
+    area: o.area,
+    type: o.type,
+    mode: o.mode,
+    branch,
+    worktree: worktreePathFor(ctx, o.area),
+    owner: ctx.owner,
+    state: "starting",
+    scopes,
+    commons,
+    leases: [],
+    notices: [],
+    started: now(),
+    lastActivity: now()
+  };
+  ctx.registry.update((r) => {
+    const open = r.efforts.filter(
+      (e) => e.project === m.project && (e.state === "active" || e.state === "starting")
+    );
+    const onArea = open.find((e) => e.area === o.area);
+    if (onArea) {
+      throw new WorkkitError(
+        "EFFORT_OPEN",
+        `an effort is open on ${o.area} (${onArea.branch}, ${onArea.mode}) owned by ${onArea.owner.session} since ${onArea.started}; finish it, or pass --join to work in the same checkout`,
+        { owner: onArea.owner.session, effort: onArea.id, branch: onArea.branch }
+      );
+    }
+    for (const e of open) {
+      const pairs = globsOverlap(scopes, e.scopes);
+      if (pairs.length > 0) {
+        throw new WorkkitError(
+          "SCOPE_CONFLICT",
+          `scope overlaps the open effort on ${e.area} (${e.branch}, owner ${e.owner.session}): ${pairs.join("; ")}`,
+          { with: e.area, owner: e.owner.session, effort: e.id, pairs }
+        );
+      }
+    }
+    r.efforts.push(effort);
+  });
+  return effort;
+}
+function ensureWorktree(ctx, area, branch) {
+  const m = ctx.manifest;
+  const path = worktreePathFor(ctx, area);
+  const main = new Git(ctx.repoRoot);
+  main.fetch(m.baseBranch);
+  if (!existsSync5(path)) {
+    main.worktreeAdd(path, branch, `origin/${m.baseBranch}`);
+    return new Git(path);
+  }
+  const registered = main.run(["worktree", "list", "--porcelain"]).split("\n").filter((l) => l.startsWith("worktree ")).map((l) => realpathOr(l.slice(9)));
+  const real = realpathOr(path);
+  const wg = new Git(path);
+  const topLevel = wg.tryRun(["rev-parse", "--show-toplevel"]);
+  if (!registered.includes(real) || topLevel.code !== 0 || realpathOr(topLevel.out.trim()) !== real || wg.isMainCheckout()) {
+    throw new WorkkitError(
+      "WORKTREE_INVALID",
+      `${path} exists but is not this repository's worktree for ${area} (a leftover directory?); move it away, or \`git worktree prune\` and retry`,
+      { worktree: path }
+    );
+  }
+  const current = wg.currentBranch();
+  if (current !== branch) {
+    if (current.endsWith(`/${area}`) && wg.commitsNotOn(m.baseBranch).length > 0) {
+      throw new WorkkitError(
+        "EFFORT_OPEN",
+        `${current} holds ${wg.commitsNotOn(m.baseBranch).length} commit(s) not yet on ${m.baseBranch}: ship or finish it first, or --join it`,
+        { branch: current, area }
+      );
+    }
+    if (wg.isDirty())
+      throw new WorkkitError(
+        "DIRTY_WORKTREE",
+        `${path} has uncommitted changes on ${current}; commit or park them before switching to ${branch}`,
+        { worktree: path }
+      );
+    wg.checkout(branch, `origin/${m.baseBranch}`);
+  }
+  return wg;
+}
+function appendLog(file, line) {
+  appendFileSync2(file, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`);
+}
+async function startEffort(ctx, o) {
+  const m = ctx.manifest;
+  const { branch, scopes, commons, warnings } = guardStart(ctx, o);
+  const notices = ctx.registry.notices(m.project, o.area);
+  const open = ctx.registry.openEffortFor(m.project, o.area);
+  if (open && o.join) {
+    touchEffort(ctx, open);
+    return {
+      effort: open,
+      leases: ctx.registry.leases({ effort: open.id }),
+      sync: "skipped",
+      refreshed: [],
+      marks: [],
+      joined: true,
+      warnings,
+      notices
+    };
+  }
+  const effort = reserveEffort(ctx, o, branch, scopes, commons);
+  const leases = [];
+  const abandon = async (stopPids) => {
+    for (const l of ctx.registry.leases({ effort: effort.id })) {
+      if (stopPids && l.kind === "slot" && l.pids && Object.keys(l.pids).length > 0) {
+        await ctx.runner.stop({
+          m,
+          cwd: effort.worktree,
+          env: process.env,
+          pids: l.pids,
+          signatures: l.signatures,
+          onLog: ctx.log
+        }).catch(() => void 0);
+      }
+      ctx.registry.release(l.id);
+    }
+    ctx.registry.removeEfforts((e) => e.id === effort.id);
+  };
+  const onSignal = () => {
+    abandon(true).finally(() => process.exit(130));
+  };
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+  try {
+    const wg = ensureWorktree(ctx, o.area, branch);
+    const worktree = wg.root();
+    ctx.registry.updateEffort(effort.id, { worktree });
+    effort.worktree = worktree;
+    const logDir = join6(worktree, m.logs.dir);
+    mkdirSync5(logDir, { recursive: true });
+    const refreshLog = join6(logDir, "refresh.log");
+    let sync = "skipped";
+    let changed = [];
+    if (o.sync !== false) {
+      wg.fetch(m.baseBranch);
+      const r = wg.syncFrom(m.baseBranch);
+      if (r.kind === "conflict") {
+        throw new WorkkitError(
+          "SYNC_CONFLICT",
+          `merging origin/${m.baseBranch} into ${branch} conflicts in ${r.conflicted.join(", ")}; resolve in ${worktree}, commit, then rerun with --no-sync`,
+          { conflicted: r.conflicted, worktree }
+        );
+      }
+      sync = r.kind;
+      if (r.kind === "ff" || r.kind === "merge") changed = wg.changedPaths(r.before, r.after);
+    }
+    const sel = selectRefresh(m.refresh, changed);
+    runRefresh(sel.runs, worktree, (l) => {
+      appendLog(refreshLog, l);
+      ctx.log(l);
+    });
+    for (const name of commons)
+      leases.push(
+        ctx.registry.addLease(
+          "commons",
+          m.project,
+          name,
+          ctx.owner,
+          effort.id,
+          m.expiry.commonsHours
+        )
+      );
+    if (o.mode === "fullstack") {
+      const exclude = /* @__PURE__ */ new Set();
+      let slot;
+      const busyNotes = [];
+      for (; ; ) {
+        const candidate = ctx.registry.allocateSlot(m.project, m, ctx.owner, effort.id, exclude);
+        const busy = await busyPorts(candidate.ports ?? {});
+        if (busy.length === 0) {
+          slot = candidate;
+          break;
+        }
+        ctx.registry.release(candidate.id);
+        exclude.add(candidate.value);
+        busyNotes.push(`slot ${candidate.value}: ${busy.join(", ")} already in use`);
+        ctx.log(busyNotes[busyNotes.length - 1]);
+      }
+      if (!slot) throw new WorkkitError("NO_FREE_SLOT", busyNotes.join("; "));
+      leases.push(slot);
+      if (busyNotes.length) warnings.push(...busyNotes);
+      const cfg = emitWorktreeConfig({
+        m,
+        worktree,
+        slot: slot.value,
+        ports: slot.ports ?? {},
+        area: o.area,
+        branch
+      });
+      const env = { ...process.env, ...cfg.vars };
+      if (sel.marks.includes("db-reset") && m.services.postgres?.reset) {
+        runRefresh([m.services.postgres.reset], worktree, (l) => appendLog(refreshLog, l), env);
+      }
+      const pids = {};
+      const signatures = {};
+      const result = await ctx.runner.start({
+        m,
+        cwd: worktree,
+        env,
+        logDir,
+        onLog: ctx.log,
+        onSpawn: (service, pid, signature) => {
+          pids[service] = pid;
+          signatures[service] = signature;
+          ctx.registry.patchLease(slot.id, { pids: { ...pids }, signatures: { ...signatures } });
+        }
+      });
+      ctx.registry.patchLease(slot.id, {
+        pids: result.pids,
+        signatures: result.signatures ?? signatures
+      });
+    } else {
+      let storybookPort;
+      if (o.story) {
+        const hostRoot = m.storybook ? join6(worktree, m.storybook.hostRoot) : worktree;
+        const inst = await ctx.storybrokr.up(o.story, hostRoot);
+        storybookPort = inst.port;
+        leases.push(
+          ctx.registry.addLease(
+            "storybook",
+            m.project,
+            inst.id,
+            ctx.owner,
+            effort.id,
+            m.expiry.storybookHours,
+            { ports: { storybook: inst.port } }
+          )
+        );
+      }
+      emitWorktreeConfig({ m, worktree, ports: {}, storybookPort, area: o.area, branch });
+    }
+    const active = ctx.registry.updateEffort(effort.id, {
+      state: "active",
+      leases: leases.map((l) => l.id),
+      lastActivity: now()
+    });
+    return {
+      effort: active,
+      leases: ctx.registry.leases({ effort: effort.id }),
+      sync,
+      refreshed: sel.runs,
+      marks: sel.marks,
+      joined: false,
+      warnings,
+      notices
+    };
+  } catch (err) {
+    await abandon(true);
+    throw err;
+  } finally {
+    process.off("SIGINT", onSignal);
+    process.off("SIGTERM", onSignal);
+  }
+}
+function behindBase(ctx, worktree) {
+  if (!existsSync5(worktree)) return 0;
+  const g = new Git(worktree);
+  g.tryRun(["fetch", "-q", "origin", ctx.manifest.baseBranch]);
+  const r = g.tryRun(["rev-list", "--count", `HEAD..origin/${ctx.manifest.baseBranch}`]);
+  return r.code === 0 ? Number(r.out.trim()) || 0 : 0;
+}
+function statusFor(ctx, area) {
+  const m = ctx.manifest;
+  const names = (area ? [area] : Object.keys(m.areas)).sort();
+  const areas = names.map((name) => {
+    const effort = ctx.registry.openEffortFor(m.project, name);
+    if (effort && area) touchEffort(ctx, effort);
+    const worktree = worktreePathFor(ctx, name);
+    const out = {
+      area: name,
+      leases: effort ? ctx.registry.leases({ effort: effort.id }) : [],
+      behindBase: behindBase(ctx, worktree),
+      notices: ctx.registry.notices(m.project, name)
+    };
+    if (effort) out.effort = effort;
+    if (existsSync5(worktree)) out.worktree = worktree;
+    return out;
+  });
+  return { project: m.project, areas, leases: ctx.registry.leases({ project: m.project }) };
+}
+function slotEnv(m, slot) {
+  return slotVars(m, { slot, ports: portsForSlot(m, slot) });
+}
+function effortEnv(ctx, area) {
+  const m = ctx.manifest;
+  const effort = ctx.registry.openEffortFor(m.project, area);
+  if (!effort)
+    throw new WorkkitError(
+      "EFFORT_NOT_FOUND",
+      `no open effort on ${area}; \`work start --area ${area} \u2026\` first`,
+      { area }
+    );
+  touchEffort(ctx, effort);
+  const slot = ctx.registry.leases({ effort: effort.id, kind: "slot" })[0];
+  const sb = ctx.registry.leases({ effort: effort.id, kind: "storybook" })[0];
+  const vars = slotVars(m, {
+    slot: slot ? slot.value : void 0,
+    ports: slot?.ports ?? {},
+    storybookPort: sb?.ports?.storybook,
+    area,
+    branch: effort.branch,
+    worktree: effort.worktree,
+    logDir: join6(effort.worktree, m.logs.dir)
+  });
+  return { ...vars, MODE: effort.mode };
+}
+function leaseEnv(ctx, effort, lease) {
+  const vars = slotVars(ctx.manifest, {
+    slot: lease.kind === "slot" ? lease.value : void 0,
+    ports: lease.ports ?? {},
+    area: effort.area,
+    branch: effort.branch,
+    worktree: effort.worktree,
+    logDir: join6(effort.worktree, ctx.manifest.logs.dir)
+  });
+  return { ...process.env, ...vars };
+}
+async function releaseLease(ctx, effort, lease) {
+  try {
+    if (lease.kind === "slot" && lease.pids && Object.keys(lease.pids).length > 0) {
+      const hasWorktree = effort !== void 0 && existsSync5(effort.worktree);
+      await ctx.runner.stop({
+        m: ctx.manifest,
+        cwd: hasWorktree && effort ? effort.worktree : ctx.repoRoot,
+        env: effort ? leaseEnv(ctx, effort, lease) : process.env,
+        pids: lease.pids,
+        signatures: lease.signatures,
+        skipStopCommands: !hasWorktree,
+        onLog: ctx.log
+      });
+    } else if (lease.kind === "storybook") {
+      await ctx.storybrokr.down(String(lease.value));
+    }
+  } catch (err) {
+    ctx.log(
+      `while releasing ${lease.kind} ${lease.value}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  ctx.registry.release(lease.id);
+}
+function leaveNotices(ctx, effort, commons) {
+  if (commons.length === 0) return 0;
+  const notice = {
+    from: effort.branch,
+    text: `commons ${commons.join(", ")} changed on ${effort.branch}: sync and re-verify`,
+    at: now()
+  };
+  let count = 0;
+  for (const area of Object.keys(ctx.manifest.areas)) {
+    if (area === effort.area) continue;
+    ctx.registry.addNotice(ctx.manifest.project, area, notice);
+    count++;
+  }
+  return count;
+}
+async function finishEffort(ctx, o) {
+  const m = ctx.manifest;
+  const effort = ctx.registry.openEffortFor(m.project, o.area) ?? ctx.registry.efforts({ project: m.project, area: o.area, state: "parked" }).sort((a, b) => b.started.localeCompare(a.started))[0];
+  if (!effort)
+    throw new WorkkitError("EFFORT_NOT_FOUND", `no open or parked effort on ${o.area}`, {
+      area: o.area
+    });
+  const g = new Git(effort.worktree);
+  let parked = false;
+  if (g.isDirty()) {
+    if (!o.park) {
+      throw new WorkkitError(
+        "DIRTY_WORKTREE",
+        `${effort.worktree} has uncommitted changes: commit them, or \`work finish --park\` to commit them as wip(${effort.area}) and push`,
+        { worktree: effort.worktree }
+      );
+    }
+    g.run(["add", "-A"]);
+    g.run(["commit", "-q", "-m", `wip(${effort.area}): parked ${now()}`]);
+    parked = true;
+  }
+  for (const lease of ctx.registry.leases({ effort: effort.id }))
+    await releaseLease(ctx, effort, lease);
+  g.push(effort.branch);
+  const notices = leaveNotices(ctx, effort, commonsTouched(m, g.changedSince(m.baseBranch)));
+  const finished = ctx.registry.updateEffort(effort.id, { state: "finished", lastActivity: now() });
+  return { effort: finished, pushed: true, parked, notices };
+}
+async function reapLeases(ctx, o = {}) {
+  const m = ctx.manifest;
+  const at = o.now ?? /* @__PURE__ */ new Date();
+  const efforts = new Map(ctx.registry.efforts({ project: m.project }).map((e) => [e.id, e]));
+  const leases = ctx.registry.leases({ project: m.project });
+  const doomed = /* @__PURE__ */ new Set();
+  for (const l of leases) {
+    const effort = efforts.get(l.effort);
+    if (effort?.state === "starting" && Date.now() - Date.parse(effort.started) < STARTING_GRACE_MS)
+      continue;
+    const expired = Date.parse(l.expires) < at.getTime();
+    const orphaned = !effort || !existsSync5(effort.worktree);
+    const garbage = orphaned && !await anyPortAnswers(l.ports);
+    if (expired || garbage) doomed.add(l.effort);
+  }
+  const reaped = leases.filter((l) => doomed.has(l.effort));
+  if (o.dryRun) return { reaped };
+  for (const lease of reaped) await releaseLease(ctx, efforts.get(lease.effort), lease);
+  for (const id of doomed) {
+    const effort = efforts.get(id);
+    if (effort && (effort.state === "active" || effort.state === "starting")) {
+      ctx.registry.updateEffort(effort.id, {
+        state: "parked",
+        parkedReason: `idle: a lease expired by ${at.toISOString()}`,
+        lastActivity: now()
+      });
+    }
+  }
+  return { reaped };
+}
+var ARCHIVE_DIR = ".slot-archive";
+function dirSize(path) {
+  if (!existsSync5(path)) return 0;
+  let total = 0;
+  for (const entry of readdirSync(path, { withFileTypes: true })) {
+    const p = join6(path, entry.name);
+    total += entry.isDirectory() ? dirSize(p) : statSync2(p).size;
+  }
+  return total;
+}
+function archiveWorktree(ctx, area, worktree) {
+  const m = ctx.manifest;
+  const areaRoot = join6(ctx.repoRoot, ARCHIVE_DIR, area);
+  const stamp = now().replace(/[-:]/g, "").replace("T", "-").slice(0, 15);
+  const target = join6(areaRoot, stamp);
+  const archived = [];
+  for (const rel of m.archive.paths) {
+    const src = join6(worktree, rel);
+    if (!existsSync5(src)) continue;
+    const dst = join6(target, rel);
+    mkdirSync5(dirname2(dst), { recursive: true });
+    cpSync(src, dst, { recursive: true });
+    archived.push(dst);
+  }
+  if (archived.length > 0) ensureExcluded(ctx.repoRoot, [`${ARCHIVE_DIR}/`]);
+  if (existsSync5(areaRoot)) {
+    const stamps = readdirSync(areaRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort().reverse();
+    const cutoff = Date.now() - m.archive.keepDays * 864e5;
+    stamps.forEach((d, i) => {
+      const t = statSync2(join6(areaRoot, d)).mtimeMs;
+      if (i >= m.archive.keepPerArea || t < cutoff)
+        rmSync2(join6(areaRoot, d), { recursive: true, force: true });
+    });
+  }
+  return archived;
+}
+async function retireArea(ctx, o) {
+  const m = ctx.manifest;
+  if (!m.areas[o.area])
+    throw new WorkkitError("AREA_UNKNOWN", `unknown area "${o.area}"`, { area: o.area });
+  const open = ctx.registry.openEffortFor(m.project, o.area);
+  if (open)
+    throw new WorkkitError(
+      "EFFORT_OPEN",
+      `an effort is open on ${o.area} (${open.owner.session}); \`work finish\` it first`,
+      { owner: open.owner.session }
+    );
+  const worktree = worktreePathFor(ctx, o.area);
+  const main = new Git(ctx.repoRoot);
+  let archived = [];
+  if (existsSync5(worktree)) {
+    const g = new Git(worktree);
+    if (g.isDirty())
+      throw new WorkkitError(
+        "UNPUSHED",
+        `${worktree} has uncommitted changes; commit and push them (or \`work finish --park\`) before retiring`,
+        { worktree }
+      );
+    const unpushed = g.unpushedCount(m.baseBranch);
+    if (unpushed > 0)
+      throw new WorkkitError(
+        "UNPUSHED",
+        `${g.currentBranch()} has ${unpushed} commit(s) not on origin; push before retiring`,
+        { worktree, unpushed }
+      );
+    archived = archiveWorktree(ctx, o.area, worktree);
+    main.worktreeRemove(worktree);
+  }
+  const branchesDeleted = [];
+  const branchesKept = [];
+  for (const type of m.branch.types) {
+    const branch = `${type}/${o.area}`;
+    if (!main.branchExists(branch)) continue;
+    const onOrigin = main.remoteBranchExists(branch) && main.tryRun(["rev-list", "--count", `origin/${branch}..${branch}`]).out.trim() === "0";
+    if (onOrigin) {
+      main.deleteLocalBranch(branch);
+      branchesDeleted.push(branch);
+    } else branchesKept.push(branch);
+  }
+  ctx.registry.removeEfforts((e) => e.project === m.project && e.area === o.area);
+  ctx.registry.clearNotices(m.project, o.area);
+  return { archived, removed: worktree, branchesDeleted, branchesKept };
+}
+var BEHIND_LIMIT = 20;
+var NOTICE_STALE_MS = 7 * 864e5;
+var ARCHIVE_LIMIT_BYTES = 5 * 1024 ** 3;
+function registeredWorktrees(ctx) {
+  const out = [];
+  const porcelain = new Git(ctx.repoRoot).run(["worktree", "list", "--porcelain"]);
+  let current = null;
+  for (const line of porcelain.split("\n")) {
+    if (line.startsWith("worktree ")) current = { path: line.slice(9), branch: "" };
+    else if (line.startsWith("branch ") && current)
+      current.branch = line.slice(7).replace(/^refs\/heads\//, "");
+    else if (line === "" && current) {
+      out.push(current);
+      current = null;
+    }
+  }
+  if (current) out.push(current);
+  const wtRoot = join6(realpathOr(ctx.repoRoot), ctx.manifest.worktreeRoot);
+  return out.filter((w) => existsSync5(w.path) && realpathOr(w.path).startsWith(wtRoot));
+}
+async function auditProject(ctx) {
+  const m = ctx.manifest;
+  const findings = [];
+  const types = m.branch.types.join("|");
+  const areaOf = (branch) => {
+    const match = new RegExp(`^(${types})/(.+)$`).exec(branch);
+    return match && m.areas[match[2]] ? match[2] : null;
+  };
+  for (const w of registeredWorktrees(ctx)) {
+    const area = areaOf(w.branch);
+    if (!area) {
+      findings.push({
+        kind: "foreign-branch",
+        detail: `${w.path} is on "${w.branch || "detached HEAD"}", not a <type>/<area> branch of a declared area`
+      });
+      continue;
+    }
+    const g = new Git(w.path);
+    if (g.isDirty())
+      findings.push({
+        kind: "dirty",
+        area,
+        detail: `${w.path} has uncommitted changes on ${w.branch}`
+      });
+    const unpushed = g.unpushedCount(m.baseBranch);
+    if (unpushed > 0)
+      findings.push({
+        kind: "unpushed",
+        area,
+        detail: `${w.branch} has ${unpushed} commit(s) not on origin`
+      });
+    const behind = behindBase(ctx, w.path);
+    if (behind > BEHIND_LIMIT)
+      findings.push({
+        kind: "behind-base",
+        area,
+        detail: `${w.branch} is ${behind} commits behind ${m.baseBranch}`
+      });
+  }
+  const nowMs = Date.now();
+  for (const l of ctx.registry.leases({ project: m.project })) {
+    const half = (Date.parse(l.touched) + Date.parse(l.expires)) / 2;
+    if (nowMs > half)
+      findings.push({
+        kind: "lease-aging",
+        detail: `${l.kind} ${l.value} held by ${l.owner.session}, last used ${l.touched}, expires ${l.expires}`
+      });
+  }
+  for (const area of Object.keys(m.areas)) {
+    for (const n of ctx.registry.notices(m.project, area)) {
+      if (nowMs - Date.parse(n.at) > NOTICE_STALE_MS)
+        findings.push({ kind: "notice-stale", area, detail: `${n.text} (since ${n.at})` });
+    }
+  }
+  const bytes = dirSize(join6(ctx.repoRoot, ARCHIVE_DIR));
+  if (bytes > ARCHIVE_LIMIT_BYTES)
+    findings.push({
+      kind: "archive-size",
+      detail: `${ARCHIVE_DIR} holds ${(bytes / 1024 ** 3).toFixed(1)} GB`
+    });
+  return findings;
+}
+
+// src/commands/_shared/output.ts
+import chalk2 from "chalk";
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+function fail(err, json) {
+  const body = toErrorBody(err);
+  if (json) console.error(JSON.stringify(body));
+  else {
+    console.error(chalk2.red(`${body.code}: ${body.message}`));
+    if (body.details) console.error(chalk2.gray(`  ${JSON.stringify(body.details)}`));
+  }
+  process.exit(exitCodeFor(body.code));
+}
+function warn(line) {
+  console.error(chalk2.yellow(`! ${line}`));
+}
+
+// src/commands/audit.ts
+function registerAudit(program2) {
+  program2.command("audit").description(
+    "List what would otherwise be forgotten: unsaved work, stray checkouts, aging leases, drift, stale notices"
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the findings as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+      const findings = await auditProject(ctx);
+      if (o.json) printJson(findings);
+      else if (findings.length === 0) console.log(chalk3.green("nothing forgotten"));
+      else
+        for (const f of findings)
+          console.log(
+            `${chalk3.yellow(f.kind.padEnd(14))} ${f.area ? `${f.area}  ` : ""}${f.detail}`
+          );
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/env.ts
+function registerEnv(program2) {
+  program2.command("env").description("The slot-derived variables of an area's open effort, or of a slot number alone").option("--area <area>", "the area whose open effort to read").option(
+    "--slot <n>",
+    "compute the variables for this slot from the manifest alone",
+    (v) => Number(v)
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print as JSON (default: KEY=value lines)").option("--sh", "print KEY=value lines (the default)").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+      let vars;
+      if (o.area) vars = effortEnv(ctx, o.area);
+      else if (o.slot !== void 0 && Number.isInteger(o.slot))
+        vars = slotEnv(ctx.manifest, o.slot);
+      else throw new WorkkitError("EFFORT_NOT_FOUND", "pass --area <area> or --slot <n>");
+      if (o.json) printJson(vars);
+      else for (const [k, v] of Object.entries(vars)) console.log(`${k}=${v}`);
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/finish.ts
+import chalk4 from "chalk";
+function registerFinish(program2) {
+  program2.command("finish").description(
+    "Stop the effort's runner, release its leases, push its branch; the worktree and branch stay"
+  ).requiredOption("--area <area>", "the area whose open effort to finish").option("--park", "commit uncommitted changes as wip(<area>) instead of refusing").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+      const r = await finishEffort(ctx, { area: o.area, park: o.park });
+      if (o.json) printJson(r);
+      else {
+        console.log(
+          `${chalk4.bold(r.effort.area)} finished: ${r.effort.branch} pushed${r.parked ? " (uncommitted changes parked as wip)" : ""}`
+        );
+        if (r.notices) console.log(`  ${r.notices} area(s) told about commons changes`);
+      }
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/hook.ts
+import { readFileSync as readFileSync4, realpathSync as realpathSync5 } from "fs";
+import { resolve } from "path";
+import chalk5 from "chalk";
+var ZEROS = /^0+$/;
+async function hookContext(cwd) {
+  const git = new Git(cwd);
+  const repoRoot = git.mainRoot();
+  try {
+    const manifest = await loadManifest(repoRoot);
+    return { git, repoRoot, manifest, registry: Registry.open(homeDir()) };
+  } catch (err) {
+    if (err instanceof WorkkitError && err.code === "MANIFEST_NOT_FOUND") return null;
+    throw err;
+  }
+}
+async function runPreCommit(cwd) {
+  const c = await hookContext(cwd);
+  if (!c) return 0;
+  const root = c.git.root();
+  touchByWorktree(c.registry, c.manifest, root);
+  const { refusals } = checkCommit({
+    m: c.manifest,
+    registry: c.registry,
+    git: c.git,
+    project: c.manifest.project,
+    branch: c.git.currentBranch(),
+    stagedPaths: c.git.changedPathsStaged(),
+    ownerSession: currentOwner().session,
+    checkoutRoot: root
+  });
+  for (const r of refusals) console.error(chalk5.red(`work: ${r}`));
+  return refusals.length ? 2 : 0;
+}
+async function runPrePush(cwd, stdin) {
+  const c = await hookContext(cwd);
+  if (!c) return 0;
+  touchByWorktree(c.registry, c.manifest, c.git.root());
+  let code = 0;
+  for (const line of stdin.split("\n").filter(Boolean)) {
+    const [localRef, localSha, remoteRef, remoteSha] = line.split(/\s+/);
+    if (!localRef || !localSha || !remoteRef) continue;
+    const isDelete = ZEROS.test(localSha);
+    const branch = isDelete ? "" : localRef.replace(/^refs\/heads\//, "");
+    let changed = [];
+    if (!isDelete) {
+      const from = remoteSha && !ZEROS.test(remoteSha) ? remoteSha : `origin/${c.manifest.baseBranch}`;
+      const range = remoteSha && !ZEROS.test(remoteSha) ? `${from}..${localSha}` : `${from}...${localSha}`;
+      changed = c.git.tryRun(["diff", "--name-only", "--no-renames", range]).out.split("\n").filter(Boolean);
+    }
+    const { refusals, warnings } = checkPush({
+      m: c.manifest,
+      registry: c.registry,
+      git: c.git,
+      project: c.manifest.project,
+      branch,
+      remoteRef,
+      isDelete,
+      changedPaths: changed
+    });
+    for (const w of warnings) console.error(chalk5.yellow(`work: ${w}`));
+    for (const r of refusals) console.error(chalk5.red(`work: ${r}`));
+    if (refusals.length) code = 2;
+  }
+  return code;
+}
+function touchByWorktree(registry, m, root) {
+  const same2 = (p) => {
+    try {
+      return realpathSync5(p) === realpathSync5(root);
+    } catch {
+      return false;
+    }
+  };
+  const hours = {
+    slot: m.expiry.slotHours,
+    storybook: m.expiry.storybookHours,
+    commons: m.expiry.commonsHours
+  };
+  for (const e of registry.efforts({ project: m.project })) {
+    if (e.state !== "active" && e.state !== "starting" || !same2(e.worktree)) continue;
+    for (const l of registry.leases({ effort: e.id })) registry.touch(l.id, hours[l.kind]);
+    registry.updateEffort(e.id, { lastActivity: (/* @__PURE__ */ new Date()).toISOString() });
+  }
+}
+function registerHook(program2) {
+  const hook = program2.command("hook").description("Entry points the installed git hooks call");
+  hook.command("pre-commit").description("Refuse commits on protected branches and writes under write-locked commons").action(async () => {
+    try {
+      process.exit(await runPreCommit(process.cwd()));
+    } catch (err) {
+      fail(err, false);
+    }
+  });
+  hook.command("pre-push").description(
+    "Refuse pushes to protected branches; warn when paths leave the effort scope or touch commons"
+  ).argument("[remote]", "passed by git, unused").argument("[url]", "passed by git, unused").action(async () => {
+    try {
+      const stdin = process.stdin.isTTY ? "" : readFileSync4(0, "utf8");
+      process.exit(await runPrePush(process.cwd(), stdin));
+    } catch (err) {
+      fail(err, false);
+    }
+  });
+  const hooks = program2.command("hooks").description("Manage the git hooks in a clone");
+  hooks.command("install").description(
+    "Write .helmsmith/hooks and point this clone's core.hooksPath at them (for a repo whose manifest already exists)"
+  ).option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const repoRoot = o.projectRoot ? resolve(o.projectRoot) : new Git(process.cwd()).mainRoot();
+      const manifest = await loadManifest(repoRoot);
+      const out = installHooks(repoRoot, { protectedBranches: manifest.protectedBranches });
+      if (o.json) printJson(out);
+      else for (const f of out.files) console.log(`installed ${f}`);
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/init.ts
+import { existsSync as existsSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7, resolve as resolve2 } from "path";
+var STORYBOOK_BASE = 6100;
+function defaultService(name) {
+  const PORT = `\${PORT_${name.toUpperCase()}}`;
+  if (name === "postgres" || name === "db") {
+    return {
+      start: `docker compose up -d ${name}`,
+      stop: `docker compose stop ${name}`,
+      health: `pg_isready -h 127.0.0.1 -p ${PORT} -q`,
+      healthTimeoutMs: 12e4
+    };
+  }
+  return {
+    start: `make -C ${name} dev`,
+    stop: `make -C ${name} dev-stop`,
+    health: `curl -sf -o /dev/null http://127.0.0.1:${PORT}/health`,
+    healthTimeoutMs: 3e5
+  };
+}
+function buildStarterManifest(o) {
+  const ports = {};
+  const services = {};
+  for (const spec of o.services) {
+    const m = /^([a-z][a-z0-9_-]*)=(\d{4,5})$/.exec(spec);
+    if (!m)
+      throw new WorkkitError("MANIFEST_INVALID", `--service expects name=port, got "${spec}"`);
+    ports[m[1]] = { base: Number(m[2]) };
+    services[m[1]] = defaultService(m[1]);
+  }
+  if (o.storybookHost) ports.storybook = { base: STORYBOOK_BASE };
+  const manifest = {
+    project: o.project,
+    baseBranch: o.baseBranch,
+    protectedBranches: [o.baseBranch],
+    worktreeRoot: o.worktreeRoot ?? ".claude/worktrees",
+    branch: { types: ["feature", "chore", "fix"] },
+    slots: { count: 10, reserved: [0] },
+    ports: { services: ports },
+    services,
+    ...o.storybookHost ? { storybook: { hostRoot: o.storybookHost } } : {},
+    logs: { dir: ".logs" },
+    refresh: [],
+    scopes: {
+      frontend: [
+        "app/{group}/{section}/**",
+        "components/{group}/{section}/**",
+        "app/api/{section}/**"
+      ],
+      backend: ["services/{module}/**"]
+    },
+    areas: {},
+    commons: {},
+    expiry: { slotHours: 12, commonsHours: 4, storybookHours: 2 },
+    archive: { paths: [], keepDays: 30, keepPerArea: 5 }
+  };
+  validateManifest(manifest);
+  return manifest;
+}
+var HEADER = `// biome-ignore-all lint/suspicious/noTemplateCurlyInString: \${PORT_*} are the manifest's own placeholders
+// helmsmith.config.mjs \u2014 read by \`work\` (@helmsmith/workbrokr). Written by \`work init\`.
+// Edit: the services' start/stop/health commands, the scope templates, the areas (leaves only,
+// each with its backend module) and the commons. Nothing here is read by the application.
+`;
+function runInit(o) {
+  const repoRoot = resolve2(o.repoRoot);
+  for (const name of MANIFEST_FILES) {
+    if (existsSync6(join7(repoRoot, name)) && !o.force) {
+      throw new WorkkitError(
+        "MANIFEST_INVALID",
+        `${name} already exists in ${repoRoot}; pass --force to overwrite`
+      );
+    }
+  }
+  const manifest = buildStarterManifest(o);
+  const manifestPath = join7(repoRoot, "helmsmith.config.mjs");
+  writeFileSync4(manifestPath, `${HEADER}export default ${JSON.stringify(manifest, null, 2)};
+`);
+  claimRanges(Registry.open(o.home), validateManifest(manifest), repoRoot);
+  const hooks = o.hooks ? installHooks(repoRoot, { protectedBranches: [o.baseBranch] }).files : [];
+  return { manifestPath, hooks };
+}
+function defaultRepoRoot() {
+  try {
+    return new Git(process.cwd()).mainRoot();
+  } catch {
+    return process.cwd();
+  }
+}
+function defaultBaseBranch(repoRoot) {
+  const g = new Git(repoRoot);
+  const head = g.tryRun(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+  if (head.code === 0) return head.out.trim().replace(/^origin\//, "");
+  return "main";
+}
+function registerInit(program2) {
+  program2.command("init").description(
+    "Write helmsmith.config.mjs for this repo, claim its port ranges, install the git hooks"
+  ).requiredOption("--project <name>", "project name (lowercase, digits, dashes)").option("--base-branch <branch>", "base branch (default: origin's HEAD, else main)").option(
+    "--service <name=port>",
+    "a service and its slot-0 port; repeat per service",
+    (v, acc) => [...acc, v],
+    []
+  ).option("--storybook-host <dir>", "the package whose .storybook storybrokr boots from").option("--worktree-root <dir>", "where area worktrees live (default .claude/worktrees)").option("--repo-root <dir>", "repository root (default: the main checkout of the cwd)").option("--no-hooks", "do not install the git hooks").option("--force", "overwrite an existing manifest").option("--json", "print the result as JSON").action(
+    (o) => {
+      try {
+        const repoRoot = o.repoRoot ? resolve2(o.repoRoot) : defaultRepoRoot();
+        if (o.service.length === 0)
+          throw new WorkkitError(
+            "MANIFEST_INVALID",
+            "at least one --service name=port is required"
+          );
+        const out = runInit({
+          repoRoot,
+          home: homeDir(),
+          project: o.project,
+          baseBranch: o.baseBranch ?? defaultBaseBranch(repoRoot),
+          services: o.service,
+          storybookHost: o.storybookHost,
+          worktreeRoot: o.worktreeRoot,
+          hooks: o.hooks,
+          force: o.force === true
+        });
+        if (o.json) printJson(out);
+        else {
+          console.log(`wrote ${out.manifestPath}`);
+          for (const h of out.hooks) console.log(`installed ${h}`);
+          console.log(
+            "next: edit the services and areas, commit helmsmith.config.mjs and .helmsmith/hooks, then `work start`"
+          );
+        }
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z2 } from "zod";
+
+// src/version.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname3, join as join8 } from "path";
+import { fileURLToPath } from "url";
+function findPackageJson(startDir) {
+  let dir = startDir;
+  for (; ; ) {
+    const candidate = join8(dir, "package.json");
+    if (existsSync7(candidate)) return candidate;
+    const parent = dirname3(dir);
+    if (parent === dir) throw new Error(`package.json not found above ${startDir}`);
+    dir = parent;
+  }
+}
+var pkgFile = findPackageJson(dirname3(fileURLToPath(import.meta.url)));
+var VERSION = JSON.parse(readFileSync5(pkgFile, "utf8")).version;
+
+// src/mcp/server.ts
+var ok = (value) => ({
+  content: [{ type: "text", text: JSON.stringify(value, null, 2) }]
+});
+var failed = (err) => ({
+  content: [{ type: "text", text: JSON.stringify(toErrorBody(err)) }],
+  isError: true
+});
+async function guard(fn) {
+  try {
+    return ok(await fn());
+  } catch (err) {
+    return failed(err);
+  }
+}
+function buildMcpServer(ctxFactory) {
+  const server = new McpServer({ name: "work", version: VERSION });
+  server.registerTool(
+    "work_start",
+    {
+      description: "Start an effort on an area: its worktree on <type>/<area>, synced from the base branch, refreshed, leased (a slot for fullstack, a storybrokr instance for frontend with a story) and running. Refuses with EFFORT_OPEN (another effort is open; join=true to share it), SCOPE_CONFLICT, SYNC_CONFLICT (resolve in the worktree, rerun with sync=false).",
+      inputSchema: {
+        area: z2.string().describe("a leaf area from helmsmith.config (e.g. org/applications)"),
+        type: z2.string().describe("feature | chore | fix"),
+        mode: z2.enum(["frontend", "fullstack"]),
+        story: z2.string().optional().describe(
+          "frontend: story file or component folder for storybrokr, relative to its host"
+        ),
+        join: z2.boolean().optional().describe("work in the already-open effort instead of refusing"),
+        sync: z2.boolean().optional().describe("fetch and merge the base branch first (default true)")
+      }
+    },
+    async ({ area, type, mode, story, join: join9, sync }) => guard(async () => startEffort(await ctxFactory(), { area, type, mode, story, join: join9, sync }))
+  );
+  server.registerTool(
+    "work_status",
+    {
+      description: "Per area: the open effort, its leases, how far behind the base branch it is, pending notices; plus every lease of the project.",
+      inputSchema: { area: z2.string().optional() }
+    },
+    async ({ area }) => guard(async () => statusFor(await ctxFactory(), area))
+  );
+  server.registerTool(
+    "work_finish",
+    {
+      description: "Stop the effort's runner, release its leases, push its branch, leave commons notices. The worktree and branch stay. Refuses DIRTY_WORKTREE unless park=true (commits as wip).",
+      inputSchema: { area: z2.string(), park: z2.boolean().optional() }
+    },
+    async ({ area, park }) => guard(async () => finishEffort(await ctxFactory(), { area, park }))
+  );
+  server.registerTool(
+    "work_reap",
+    {
+      description: "Expire idle leases: stop only what they started, release them, park their efforts. dryRun lists without touching.",
+      inputSchema: { dryRun: z2.boolean().optional() }
+    },
+    async ({ dryRun }) => guard(async () => reapLeases(await ctxFactory(), { dryRun }))
+  );
+  server.registerTool(
+    "work_audit",
+    {
+      description: "Findings: dirty or unpushed area worktrees, foreign worktrees, aging leases, drift from the base branch, stale notices, archive size.",
+      inputSchema: {}
+    },
+    async () => guard(async () => auditProject(await ctxFactory()))
+  );
+  server.registerTool(
+    "work_env",
+    {
+      description: "The slot-derived variables of an area's open effort (PORT_*, SLOT, LOG_DIR, WORKTREE, BRANCH, MODE).",
+      inputSchema: { area: z2.string() }
+    },
+    async ({ area }) => guard(async () => effortEnv(await ctxFactory(), area))
+  );
+  return server;
+}
+async function runStdio() {
+  const server = buildMcpServer(() => buildCtx({ quiet: true }));
+  await server.connect(new StdioServerTransport());
+}
+
+// src/commands/mcp.ts
+function registerMcp(program2) {
+  program2.command("mcp").description("Serve the MCP stdio interface (the same verbs as the CLI)").action(async () => {
+    await runStdio();
+  });
+}
+
+// src/commands/reap.ts
+import chalk6 from "chalk";
+function registerReap(program2) {
+  program2.command("reap").description(
+    "Expire idle leases: stop only what they started, release them, park their efforts"
+  ).option("--dry-run", "list what would be reaped without touching anything").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+      const r = await reapLeases(ctx, { dryRun: o.dryRun });
+      if (o.json) printJson(r);
+      else if (r.reaped.length === 0) console.log(chalk6.gray("nothing to reap"));
+      else
+        for (const l of r.reaped)
+          console.log(
+            `${o.dryRun ? "would reap" : "reaped"} ${l.kind} ${l.value} (${l.owner.session}, expired ${l.expires})`
+          );
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/retire.ts
+import chalk7 from "chalk";
+function registerRetire(program2) {
+  program2.command("retire").description(
+    "Archive an area's evidence, remove its worktree and its local branches that are on origin (the only destructive verb)"
+  ).requiredOption("--area <area>", "the area to retire").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+      const r = await retireArea(ctx, { area: o.area });
+      if (o.json) printJson(r);
+      else {
+        console.log(`${chalk7.bold(o.area)} retired: removed ${r.removed}`);
+        for (const a of r.archived) console.log(`  archived ${a}`);
+        for (const b of r.branchesDeleted) console.log(`  deleted local branch ${b}`);
+        for (const b of r.branchesKept)
+          console.log(chalk7.yellow(`  kept ${b}: not fully on origin`));
+      }
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/commands/start.ts
+import chalk8 from "chalk";
+function printStart(r) {
+  const e = r.effort;
+  console.log(
+    `${chalk8.bold(e.area)}  ${e.type}/${e.mode}  ${e.branch}${r.joined ? chalk8.yellow("  (joined)") : ""}`
+  );
+  console.log(`  worktree  ${e.worktree}`);
+  console.log(
+    `  sync      ${r.sync}${r.refreshed.length ? `  refreshed: ${r.refreshed.join("; ")}` : ""}`
+  );
+  for (const l of r.leases) {
+    const ports = l.ports ? `  ${Object.entries(l.ports).map(([k, v]) => `${k}=${v}`).join(" ")}` : "";
+    console.log(`  lease     ${l.kind} ${l.value}${ports}  expires ${l.expires}`);
+  }
+  for (const w of r.warnings) warn(w);
+  for (const n of r.notices) console.log(chalk8.yellow(`  notice    ${n.text} (${n.at})`));
+}
+function registerStart(program2) {
+  program2.command("start").description(
+    "Start an effort: the area's worktree on <type>/<area>, synced from the base branch, leased and running"
+  ).requiredOption("--area <area>", "a leaf area from helmsmith.config (e.g. org/applications)").requiredOption("--type <type>", "feature | chore | fix (as the manifest allows)").requiredOption("--mode <mode>", "fullstack (a slot) | frontend (storybrokr)").option(
+    "--story <path>",
+    "frontend: the story file or component folder storybrokr boots, relative to the Storybook host"
+  ).option("--join", "work in the already-open effort on this area instead of refusing").option("--no-sync", "skip the fetch and merge from the base branch (reproducing something)").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the result as JSON").action(
+    async (o) => {
+      try {
+        const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: Boolean(o.json) });
+        const r = await startEffort(ctx, {
+          area: o.area,
+          type: o.type,
+          mode: o.mode,
+          story: o.story,
+          join: o.join,
+          sync: o.sync
+        });
+        if (o.json) printJson(r);
+        else printStart(r);
+      } catch (err) {
+        fail(err, Boolean(o.json));
+      }
+    }
+  );
+}
+
+// src/commands/status.ts
+import chalk9 from "chalk";
+var age = (iso) => {
+  const mins = Math.max(0, Math.round((Date.now() - Date.parse(iso)) / 6e4));
+  return mins < 60 ? `${mins}m` : mins < 1440 ? `${Math.round(mins / 60)}h` : `${Math.round(mins / 1440)}d`;
+};
+var expiresIn = (iso) => {
+  const mins = Math.round((Date.parse(iso) - Date.now()) / 6e4);
+  return mins <= 0 ? chalk9.red("expired") : mins < 60 ? `${mins}m` : `${Math.round(mins / 60)}h`;
+};
+function printStatus(r) {
+  console.log(chalk9.bold(`${r.project}`));
+  const cols = ["AREA", "TYPE/MODE", "BRANCH", "OWNER", "STARTED", "LEASES", "BEHIND", "NOTICES"];
+  const rows = r.areas.map((a) => [
+    a.area,
+    a.effort ? `${a.effort.type}/${a.effort.mode}` : chalk9.gray("-"),
+    a.effort?.branch ?? chalk9.gray("-"),
+    a.effort?.owner.session ?? chalk9.gray("-"),
+    a.effort ? age(a.effort.started) : chalk9.gray("-"),
+    a.leases.length ? a.leases.map((l) => `${l.kind}:${l.value}`).join(",") : chalk9.gray("-"),
+    a.behindBase > 0 ? chalk9.yellow(String(a.behindBase)) : "0",
+    a.notices.length ? chalk9.yellow(String(a.notices.length)) : "0"
+  ]);
+  const plain = (s) => s.replace(/\u001b\[[0-9;]*m/g, "");
+  const widths = cols.map((c, i) => Math.max(c.length, ...rows.map((row) => plain(row[i]).length)));
+  const line = (cells) => cells.map((c, i) => c + " ".repeat(widths[i] - plain(c).length)).join("  ");
+  console.log(chalk9.bold(line(cols)));
+  for (const row of rows) console.log(line(row));
+  if (r.leases.length) {
+    console.log("");
+    console.log(chalk9.bold("KIND       VALUE        OWNER                 AGE   EXPIRES-IN"));
+    for (const l of r.leases) {
+      console.log(
+        `${l.kind.padEnd(10)} ${String(l.value).padEnd(12)} ${l.owner.session.padEnd(21)} ${age(l.created).padEnd(5)} ${expiresIn(l.expires)}`
+      );
+    }
+  }
+}
+function registerStatus(program2) {
+  program2.command("status").description("Open efforts, leases, drift from the base branch and notices, per area").option("--area <area>", "one area only").option("--project-root <dir>", "repository root (default: the main checkout of the cwd)").option("--json", "print the report as JSON").action(async (o) => {
+    try {
+      const ctx = await buildCtx({ projectRoot: o.projectRoot, quiet: true });
+      const r = statusFor(ctx, o.area);
+      if (o.json) printJson(r);
+      else printStatus(r);
+    } catch (err) {
+      fail(err, Boolean(o.json));
+    }
+  });
+}
+
+// src/cli.ts
+var { program } = createCli({
+  name: "work",
+  version: VERSION,
+  description: "Area-based work: start, status, finish, reap, retire, audit."
+});
+registerInit(program);
+registerStart(program);
+registerStatus(program);
+registerEnv(program);
+registerFinish(program);
+registerReap(program);
+registerRetire(program);
+registerAudit(program);
+registerHook(program);
+registerMcp(program);
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map