@hlix/cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,4701 +1,4 @@
 #!/usr/bin/env node
-import {
-  __commonJS,
-  __toESM
-} from "./chunk-FYS2JH42.js";
-
-// ../../node_modules/.bun/ignore@7.0.5/node_modules/ignore/index.js
-var require_ignore = __commonJS({
-  "../../node_modules/.bun/ignore@7.0.5/node_modules/ignore/index.js"(exports, module) {
-    "use strict";
-    function makeArray(subject) {
-      return Array.isArray(subject) ? subject : [subject];
-    }
-    var UNDEFINED = void 0;
-    var EMPTY = "";
-    var SPACE = " ";
-    var ESCAPE = "\\";
-    var REGEX_TEST_BLANK_LINE = /^\s+$/;
-    var REGEX_INVALID_TRAILING_BACKSLASH = /(?:[^\\]|^)\\$/;
-    var REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION = /^\\!/;
-    var REGEX_REPLACE_LEADING_EXCAPED_HASH = /^\\#/;
-    var REGEX_SPLITALL_CRLF = /\r?\n/g;
-    var REGEX_TEST_INVALID_PATH = /^\.{0,2}\/|^\.{1,2}$/;
-    var REGEX_TEST_TRAILING_SLASH = /\/$/;
-    var SLASH = "/";
-    var TMP_KEY_IGNORE = "node-ignore";
-    if (typeof Symbol !== "undefined") {
-      TMP_KEY_IGNORE = /* @__PURE__ */ Symbol.for("node-ignore");
-    }
-    var KEY_IGNORE = TMP_KEY_IGNORE;
-    var define = (object, key, value) => {
-      Object.defineProperty(object, key, { value });
-      return value;
-    };
-    var REGEX_REGEXP_RANGE = /([0-z])-([0-z])/g;
-    var RETURN_FALSE = () => false;
-    var sanitizeRange = (range) => range.replace(
-      REGEX_REGEXP_RANGE,
-      (match2, from, to) => from.charCodeAt(0) <= to.charCodeAt(0) ? match2 : EMPTY
-    );
-    var cleanRangeBackSlash = (slashes) => {
-      const { length } = slashes;
-      return slashes.slice(0, length - length % 2);
-    };
-    var REPLACERS = [
-      [
-        // Remove BOM
-        // TODO:
-        // Other similar zero-width characters?
-        /^\uFEFF/,
-        () => EMPTY
-      ],
-      // > Trailing spaces are ignored unless they are quoted with backslash ("\")
-      [
-        // (a\ ) -> (a )
-        // (a  ) -> (a)
-        // (a ) -> (a)
-        // (a \ ) -> (a  )
-        /((?:\\\\)*?)(\\?\s+)$/,
-        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY)
-      ],
-      // Replace (\ ) with ' '
-      // (\ ) -> ' '
-      // (\\ ) -> '\\ '
-      // (\\\ ) -> '\\ '
-      [
-        /(\\+?)\s/g,
-        (_, m1) => {
-          const { length } = m1;
-          return m1.slice(0, length - length % 2) + SPACE;
-        }
-      ],
-      // Escape metacharacters
-      // which is written down by users but means special for regular expressions.
-      // > There are 12 characters with special meanings:
-      // > - the backslash \,
-      // > - the caret ^,
-      // > - the dollar sign $,
-      // > - the period or dot .,
-      // > - the vertical bar or pipe symbol |,
-      // > - the question mark ?,
-      // > - the asterisk or star *,
-      // > - the plus sign +,
-      // > - the opening parenthesis (,
-      // > - the closing parenthesis ),
-      // > - and the opening square bracket [,
-      // > - the opening curly brace {,
-      // > These special characters are often called "metacharacters".
-      [
-        /[\\$.|*+(){^]/g,
-        (match2) => `\\${match2}`
-      ],
-      [
-        // > a question mark (?) matches a single character
-        /(?!\\)\?/g,
-        () => "[^/]"
-      ],
-      // leading slash
-      [
-        // > A leading slash matches the beginning of the pathname.
-        // > For example, "/*.c" matches "cat-file.c" but not "mozilla-sha1/sha1.c".
-        // A leading slash matches the beginning of the pathname
-        /^\//,
-        () => "^"
-      ],
-      // replace special metacharacter slash after the leading slash
-      [
-        /\//g,
-        () => "\\/"
-      ],
-      [
-        // > A leading "**" followed by a slash means match in all directories.
-        // > For example, "**/foo" matches file or directory "foo" anywhere,
-        // > the same as pattern "foo".
-        // > "**/foo/bar" matches file or directory "bar" anywhere that is directly
-        // >   under directory "foo".
-        // Notice that the '*'s have been replaced as '\\*'
-        /^\^*\\\*\\\*\\\//,
-        // '**/foo' <-> 'foo'
-        () => "^(?:.*\\/)?"
-      ],
-      // starting
-      [
-        // there will be no leading '/'
-        //   (which has been replaced by section "leading slash")
-        // If starts with '**', adding a '^' to the regular expression also works
-        /^(?=[^^])/,
-        function startingReplacer() {
-          return !/\/(?!$)/.test(this) ? "(?:^|\\/)" : "^";
-        }
-      ],
-      // two globstars
-      [
-        // Use lookahead assertions so that we could match more than one `'/**'`
-        /\\\/\\\*\\\*(?=\\\/|$)/g,
-        // Zero, one or several directories
-        // should not use '*', or it will be replaced by the next replacer
-        // Check if it is not the last `'/**'`
-        (_, index, str) => index + 6 < str.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
-      ],
-      // normal intermediate wildcards
-      [
-        // Never replace escaped '*'
-        // ignore rule '\*' will match the path '*'
-        // 'abc.*/' -> go
-        // 'abc.*'  -> skip this rule,
-        //    coz trailing single wildcard will be handed by [trailing wildcard]
-        /(^|[^\\]+)(\\\*)+(?=.+)/g,
-        // '*.js' matches '.js'
-        // '*.js' doesn't match 'abc'
-        (_, p1, p2) => {
-          const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
-          return p1 + unescaped;
-        }
-      ],
-      [
-        // unescape, revert step 3 except for back slash
-        // For example, if a user escape a '\\*',
-        // after step 3, the result will be '\\\\\\*'
-        /\\\\\\(?=[$.|*+(){^])/g,
-        () => ESCAPE
-      ],
-      [
-        // '\\\\' -> '\\'
-        /\\\\/g,
-        () => ESCAPE
-      ],
-      [
-        // > The range notation, e.g. [a-zA-Z],
-        // > can be used to match one of the characters in a range.
-        // `\` is escaped by step 3
-        /(\\)?\[([^\]/]*?)(\\*)($|\])/g,
-        (match2, leadEscape, range, endEscape, close) => leadEscape === ESCAPE ? `\\[${range}${cleanRangeBackSlash(endEscape)}${close}` : close === "]" ? endEscape.length % 2 === 0 ? `[${sanitizeRange(range)}${endEscape}]` : "[]" : "[]"
-      ],
-      // ending
-      [
-        // 'js' will not match 'js.'
-        // 'ab' will not match 'abc'
-        /(?:[^*])$/,
-        // WTF!
-        // https://git-scm.com/docs/gitignore
-        // changes in [2.22.1](https://git-scm.com/docs/gitignore/2.22.1)
-        // which re-fixes #24, #38
-        // > If there is a separator at the end of the pattern then the pattern
-        // > will only match directories, otherwise the pattern can match both
-        // > files and directories.
-        // 'js*' will not match 'a.js'
-        // 'js/' will not match 'a.js'
-        // 'js' will match 'a.js' and 'a.js/'
-        (match2) => /\/$/.test(match2) ? `${match2}$` : `${match2}(?=$|\\/$)`
-      ]
-    ];
-    var REGEX_REPLACE_TRAILING_WILDCARD = /(^|\\\/)?\\\*$/;
-    var MODE_IGNORE = "regex";
-    var MODE_CHECK_IGNORE = "checkRegex";
-    var UNDERSCORE = "_";
-    var TRAILING_WILD_CARD_REPLACERS = {
-      [MODE_IGNORE](_, p1) {
-        const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
-        return `${prefix}(?=$|\\/$)`;
-      },
-      [MODE_CHECK_IGNORE](_, p1) {
-        const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
-        return `${prefix}(?=$|\\/$)`;
-      }
-    };
-    var makeRegexPrefix = (pattern) => REPLACERS.reduce(
-      (prev, [matcher, replacer]) => prev.replace(matcher, replacer.bind(pattern)),
-      pattern
-    );
-    var isString = (subject) => typeof subject === "string";
-    var checkPattern = (pattern) => pattern && isString(pattern) && !REGEX_TEST_BLANK_LINE.test(pattern) && !REGEX_INVALID_TRAILING_BACKSLASH.test(pattern) && pattern.indexOf("#") !== 0;
-    var splitPattern = (pattern) => pattern.split(REGEX_SPLITALL_CRLF).filter(Boolean);
-    var IgnoreRule = class {
-      constructor(pattern, mark, body, ignoreCase, negative, prefix) {
-        this.pattern = pattern;
-        this.mark = mark;
-        this.negative = negative;
-        define(this, "body", body);
-        define(this, "ignoreCase", ignoreCase);
-        define(this, "regexPrefix", prefix);
-      }
-      get regex() {
-        const key = UNDERSCORE + MODE_IGNORE;
-        if (this[key]) {
-          return this[key];
-        }
-        return this._make(MODE_IGNORE, key);
-      }
-      get checkRegex() {
-        const key = UNDERSCORE + MODE_CHECK_IGNORE;
-        if (this[key]) {
-          return this[key];
-        }
-        return this._make(MODE_CHECK_IGNORE, key);
-      }
-      _make(mode, key) {
-        const str = this.regexPrefix.replace(
-          REGEX_REPLACE_TRAILING_WILDCARD,
-          // It does not need to bind pattern
-          TRAILING_WILD_CARD_REPLACERS[mode]
-        );
-        const regex = this.ignoreCase ? new RegExp(str, "i") : new RegExp(str);
-        return define(this, key, regex);
-      }
-    };
-    var createRule = ({
-      pattern,
-      mark
-    }, ignoreCase) => {
-      let negative = false;
-      let body = pattern;
-      if (body.indexOf("!") === 0) {
-        negative = true;
-        body = body.substr(1);
-      }
-      body = body.replace(REGEX_REPLACE_LEADING_EXCAPED_EXCLAMATION, "!").replace(REGEX_REPLACE_LEADING_EXCAPED_HASH, "#");
-      const regexPrefix = makeRegexPrefix(body);
-      return new IgnoreRule(
-        pattern,
-        mark,
-        body,
-        ignoreCase,
-        negative,
-        regexPrefix
-      );
-    };
-    var RuleManager = class {
-      constructor(ignoreCase) {
-        this._ignoreCase = ignoreCase;
-        this._rules = [];
-      }
-      _add(pattern) {
-        if (pattern && pattern[KEY_IGNORE]) {
-          this._rules = this._rules.concat(pattern._rules._rules);
-          this._added = true;
-          return;
-        }
-        if (isString(pattern)) {
-          pattern = {
-            pattern
-          };
-        }
-        if (checkPattern(pattern.pattern)) {
-          const rule = createRule(pattern, this._ignoreCase);
-          this._added = true;
-          this._rules.push(rule);
-        }
-      }
-      // @param {Array<string> | string | Ignore} pattern
-      add(pattern) {
-        this._added = false;
-        makeArray(
-          isString(pattern) ? splitPattern(pattern) : pattern
-        ).forEach(this._add, this);
-        return this._added;
-      }
-      // Test one single path without recursively checking parent directories
-      //
-      // - checkUnignored `boolean` whether should check if the path is unignored,
-      //   setting `checkUnignored` to `false` could reduce additional
-      //   path matching.
-      // - check `string` either `MODE_IGNORE` or `MODE_CHECK_IGNORE`
-      // @returns {TestResult} true if a file is ignored
-      test(path, checkUnignored, mode) {
-        let ignored = false;
-        let unignored = false;
-        let matchedRule;
-        this._rules.forEach((rule) => {
-          const { negative } = rule;
-          if (unignored === negative && ignored !== unignored || negative && !ignored && !unignored && !checkUnignored) {
-            return;
-          }
-          const matched = rule[mode].test(path);
-          if (!matched) {
-            return;
-          }
-          ignored = !negative;
-          unignored = negative;
-          matchedRule = negative ? UNDEFINED : rule;
-        });
-        const ret = {
-          ignored,
-          unignored
-        };
-        if (matchedRule) {
-          ret.rule = matchedRule;
-        }
-        return ret;
-      }
-    };
-    var throwError = (message, Ctor) => {
-      throw new Ctor(message);
-    };
-    var checkPath = (path, originalPath, doThrow) => {
-      if (!isString(path)) {
-        return doThrow(
-          `path must be a string, but got \`${originalPath}\``,
-          TypeError
-        );
-      }
-      if (!path) {
-        return doThrow(`path must not be empty`, TypeError);
-      }
-      if (checkPath.isNotRelative(path)) {
-        const r = "`path.relative()`d";
-        return doThrow(
-          `path should be a ${r} string, but got "${originalPath}"`,
-          RangeError
-        );
-      }
-      return true;
-    };
-    var isNotRelative = (path) => REGEX_TEST_INVALID_PATH.test(path);
-    checkPath.isNotRelative = isNotRelative;
-    checkPath.convert = (p) => p;
-    var Ignore = class {
-      constructor({
-        ignorecase = true,
-        ignoreCase = ignorecase,
-        allowRelativePaths = false
-      } = {}) {
-        define(this, KEY_IGNORE, true);
-        this._rules = new RuleManager(ignoreCase);
-        this._strictPathCheck = !allowRelativePaths;
-        this._initCache();
-      }
-      _initCache() {
-        this._ignoreCache = /* @__PURE__ */ Object.create(null);
-        this._testCache = /* @__PURE__ */ Object.create(null);
-      }
-      add(pattern) {
-        if (this._rules.add(pattern)) {
-          this._initCache();
-        }
-        return this;
-      }
-      // legacy
-      addPattern(pattern) {
-        return this.add(pattern);
-      }
-      // @returns {TestResult}
-      _test(originalPath, cache, checkUnignored, slices) {
-        const path = originalPath && checkPath.convert(originalPath);
-        checkPath(
-          path,
-          originalPath,
-          this._strictPathCheck ? throwError : RETURN_FALSE
-        );
-        return this._t(path, cache, checkUnignored, slices);
-      }
-      checkIgnore(path) {
-        if (!REGEX_TEST_TRAILING_SLASH.test(path)) {
-          return this.test(path);
-        }
-        const slices = path.split(SLASH).filter(Boolean);
-        slices.pop();
-        if (slices.length) {
-          const parent = this._t(
-            slices.join(SLASH) + SLASH,
-            this._testCache,
-            true,
-            slices
-          );
-          if (parent.ignored) {
-            return parent;
-          }
-        }
-        return this._rules.test(path, false, MODE_CHECK_IGNORE);
-      }
-      _t(path, cache, checkUnignored, slices) {
-        if (path in cache) {
-          return cache[path];
-        }
-        if (!slices) {
-          slices = path.split(SLASH).filter(Boolean);
-        }
-        slices.pop();
-        if (!slices.length) {
-          return cache[path] = this._rules.test(path, checkUnignored, MODE_IGNORE);
-        }
-        const parent = this._t(
-          slices.join(SLASH) + SLASH,
-          cache,
-          checkUnignored,
-          slices
-        );
-        return cache[path] = parent.ignored ? parent : this._rules.test(path, checkUnignored, MODE_IGNORE);
-      }
-      ignores(path) {
-        return this._test(path, this._ignoreCache, false).ignored;
-      }
-      createFilter() {
-        return (path) => !this.ignores(path);
-      }
-      filter(paths) {
-        return makeArray(paths).filter(this.createFilter());
-      }
-      // @returns {TestResult}
-      test(path) {
-        return this._test(path, this._testCache, true);
-      }
-    };
-    var factory = (options) => new Ignore(options);
-    var isPathValid = (path) => checkPath(path && checkPath.convert(path), path, RETURN_FALSE);
-    var setupWindows = () => {
-      const makePosix = (str) => /^\\\\\?\\/.test(str) || /["<>|\u0000-\u001F]+/u.test(str) ? str : str.replace(/\\/g, "/");
-      checkPath.convert = makePosix;
-      const REGEX_TEST_WINDOWS_PATH_ABSOLUTE = /^[a-z]:\//i;
-      checkPath.isNotRelative = (path) => REGEX_TEST_WINDOWS_PATH_ABSOLUTE.test(path) || isNotRelative(path);
-    };
-    if (
-      // Detect `process` so that it can run in browsers.
-      typeof process !== "undefined" && process.platform === "win32"
-    ) {
-      setupWindows();
-    }
-    module.exports = factory;
-    factory.default = factory;
-    module.exports.isPathValid = isPathValid;
-    define(module.exports, /* @__PURE__ */ Symbol.for("setupWindows"), setupWindows);
-  }
-});
-
-// src/cli.ts
-import { resolve as resolve3 } from "path";
-import { parseArgs } from "util";
-
-// ../../node_modules/.bun/openapi-fetch@0.17.0/node_modules/openapi-fetch/dist/index.mjs
-var PATH_PARAM_RE = /\{[^{}]+\}/g;
-var supportsRequestInitExt = () => {
-  return typeof process === "object" && Number.parseInt(process?.versions?.node?.substring(0, 2)) >= 18 && process.versions.undici;
-};
-function randomID() {
-  return Math.random().toString(36).slice(2, 11);
-}
-function createClient(clientOptions) {
-  let {
-    baseUrl = "",
-    Request: CustomRequest = globalThis.Request,
-    fetch: baseFetch = globalThis.fetch,
-    querySerializer: globalQuerySerializer,
-    bodySerializer: globalBodySerializer,
-    pathSerializer: globalPathSerializer,
-    headers: baseHeaders,
-    requestInitExt = void 0,
-    ...baseOptions
-  } = { ...clientOptions };
-  requestInitExt = supportsRequestInitExt() ? requestInitExt : void 0;
-  baseUrl = removeTrailingSlash(baseUrl);
-  const globalMiddlewares = [];
-  async function coreFetch(schemaPath, fetchOptions) {
-    const {
-      baseUrl: localBaseUrl,
-      fetch = baseFetch,
-      Request: Request2 = CustomRequest,
-      headers,
-      params = {},
-      parseAs = "json",
-      querySerializer: requestQuerySerializer,
-      bodySerializer = globalBodySerializer ?? defaultBodySerializer,
-      pathSerializer: requestPathSerializer,
-      body,
-      middleware: requestMiddlewares = [],
-      ...init
-    } = fetchOptions || {};
-    let finalBaseUrl = baseUrl;
-    if (localBaseUrl) {
-      finalBaseUrl = removeTrailingSlash(localBaseUrl) ?? baseUrl;
-    }
-    let querySerializer = typeof globalQuerySerializer === "function" ? globalQuerySerializer : createQuerySerializer(globalQuerySerializer);
-    if (requestQuerySerializer) {
-      querySerializer = typeof requestQuerySerializer === "function" ? requestQuerySerializer : createQuerySerializer({
-        ...typeof globalQuerySerializer === "object" ? globalQuerySerializer : {},
-        ...requestQuerySerializer
-      });
-    }
-    const pathSerializer = requestPathSerializer || globalPathSerializer || defaultPathSerializer;
-    const serializedBody = body === void 0 ? void 0 : bodySerializer(
-      body,
-      // Note: we declare mergeHeaders() both here and below because it’s a bit of a chicken-or-egg situation:
-      // bodySerializer() needs all headers so we aren’t dropping ones set by the user, however,
-      // the result of this ALSO sets the lowest-priority content-type header. So we re-merge below,
-      // setting the content-type at the very beginning to be overwritten.
-      // Lastly, based on the way headers work, it’s not a simple “present-or-not” check becauase null intentionally un-sets headers.
-      mergeHeaders(baseHeaders, headers, params.header)
-    );
-    const finalHeaders = mergeHeaders(
-      // with no body, we should not to set Content-Type
-      serializedBody === void 0 || // if serialized body is FormData; browser will correctly set Content-Type & boundary expression
-      serializedBody instanceof FormData ? {} : {
-        "Content-Type": "application/json"
-      },
-      baseHeaders,
-      headers,
-      params.header
-    );
-    const finalMiddlewares = [...globalMiddlewares, ...requestMiddlewares];
-    const requestInit = {
-      redirect: "follow",
-      ...baseOptions,
-      ...init,
-      body: serializedBody,
-      headers: finalHeaders
-    };
-    let id;
-    let options;
-    let request = new Request2(
-      createFinalURL(schemaPath, { baseUrl: finalBaseUrl, params, querySerializer, pathSerializer }),
-      requestInit
-    );
-    let response;
-    for (const key in init) {
-      if (!(key in request)) {
-        request[key] = init[key];
-      }
-    }
-    if (finalMiddlewares.length) {
-      id = randomID();
-      options = Object.freeze({
-        baseUrl: finalBaseUrl,
-        fetch,
-        parseAs,
-        querySerializer,
-        bodySerializer,
-        pathSerializer
-      });
-      for (const m of finalMiddlewares) {
-        if (m && typeof m === "object" && typeof m.onRequest === "function") {
-          const result = await m.onRequest({
-            request,
-            schemaPath,
-            params,
-            options,
-            id
-          });
-          if (result) {
-            if (result instanceof Request2) {
-              request = result;
-            } else if (result instanceof Response) {
-              response = result;
-              break;
-            } else {
-              throw new Error("onRequest: must return new Request() or Response() when modifying the request");
-            }
-          }
-        }
-      }
-    }
-    if (!response) {
-      try {
-        response = await fetch(request, requestInitExt);
-      } catch (error2) {
-        let errorAfterMiddleware = error2;
-        if (finalMiddlewares.length) {
-          for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
-            const m = finalMiddlewares[i];
-            if (m && typeof m === "object" && typeof m.onError === "function") {
-              const result = await m.onError({
-                request,
-                error: errorAfterMiddleware,
-                schemaPath,
-                params,
-                options,
-                id
-              });
-              if (result) {
-                if (result instanceof Response) {
-                  errorAfterMiddleware = void 0;
-                  response = result;
-                  break;
-                }
-                if (result instanceof Error) {
-                  errorAfterMiddleware = result;
-                  continue;
-                }
-                throw new Error("onError: must return new Response() or instance of Error");
-              }
-            }
-          }
-        }
-        if (errorAfterMiddleware) {
-          throw errorAfterMiddleware;
-        }
-      }
-      if (finalMiddlewares.length) {
-        for (let i = finalMiddlewares.length - 1; i >= 0; i--) {
-          const m = finalMiddlewares[i];
-          if (m && typeof m === "object" && typeof m.onResponse === "function") {
-            const result = await m.onResponse({
-              request,
-              response,
-              schemaPath,
-              params,
-              options,
-              id
-            });
-            if (result) {
-              if (!(result instanceof Response)) {
-                throw new Error("onResponse: must return new Response() when modifying the response");
-              }
-              response = result;
-            }
-          }
-        }
-      }
-    }
-    const contentLength = response.headers.get("Content-Length");
-    if (response.status === 204 || request.method === "HEAD" || contentLength === "0" && !response.headers.get("Transfer-Encoding")?.includes("chunked")) {
-      return response.ok ? { data: void 0, response } : { error: void 0, response };
-    }
-    if (response.ok) {
-      const getResponseData = async () => {
-        if (parseAs === "stream") {
-          return response.body;
-        }
-        if (parseAs === "json" && !contentLength) {
-          const raw = await response.text();
-          return raw ? JSON.parse(raw) : void 0;
-        }
-        return await response[parseAs]();
-      };
-      return { data: await getResponseData(), response };
-    }
-    let error = await response.text();
-    try {
-      error = JSON.parse(error);
-    } catch {
-    }
-    return { error, response };
-  }
-  return {
-    request(method, url, init) {
-      return coreFetch(url, { ...init, method: method.toUpperCase() });
-    },
-    /** Call a GET endpoint */
-    GET(url, init) {
-      return coreFetch(url, { ...init, method: "GET" });
-    },
-    /** Call a PUT endpoint */
-    PUT(url, init) {
-      return coreFetch(url, { ...init, method: "PUT" });
-    },
-    /** Call a POST endpoint */
-    POST(url, init) {
-      return coreFetch(url, { ...init, method: "POST" });
-    },
-    /** Call a DELETE endpoint */
-    DELETE(url, init) {
-      return coreFetch(url, { ...init, method: "DELETE" });
-    },
-    /** Call a OPTIONS endpoint */
-    OPTIONS(url, init) {
-      return coreFetch(url, { ...init, method: "OPTIONS" });
-    },
-    /** Call a HEAD endpoint */
-    HEAD(url, init) {
-      return coreFetch(url, { ...init, method: "HEAD" });
-    },
-    /** Call a PATCH endpoint */
-    PATCH(url, init) {
-      return coreFetch(url, { ...init, method: "PATCH" });
-    },
-    /** Call a TRACE endpoint */
-    TRACE(url, init) {
-      return coreFetch(url, { ...init, method: "TRACE" });
-    },
-    /** Register middleware */
-    use(...middleware) {
-      for (const m of middleware) {
-        if (!m) {
-          continue;
-        }
-        if (typeof m !== "object" || !("onRequest" in m || "onResponse" in m || "onError" in m)) {
-          throw new Error("Middleware must be an object with one of `onRequest()`, `onResponse() or `onError()`");
-        }
-        globalMiddlewares.push(m);
-      }
-    },
-    /** Unregister middleware */
-    eject(...middleware) {
-      for (const m of middleware) {
-        const i = globalMiddlewares.indexOf(m);
-        if (i !== -1) {
-          globalMiddlewares.splice(i, 1);
-        }
-      }
-    }
-  };
-}
-function serializePrimitiveParam(name, value, options) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "object") {
-    throw new Error(
-      "Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these."
-    );
-  }
-  return `${name}=${options?.allowReserved === true ? value : encodeURIComponent(value)}`;
-}
-function serializeObjectParam(name, value, options) {
-  if (!value || typeof value !== "object") {
-    return "";
-  }
-  const values = [];
-  const joiner = {
-    simple: ",",
-    label: ".",
-    matrix: ";"
-  }[options.style] || "&";
-  if (options.style !== "deepObject" && options.explode === false) {
-    for (const k in value) {
-      values.push(k, options.allowReserved === true ? value[k] : encodeURIComponent(value[k]));
-    }
-    const final2 = values.join(",");
-    switch (options.style) {
-      case "form": {
-        return `${name}=${final2}`;
-      }
-      case "label": {
-        return `.${final2}`;
-      }
-      case "matrix": {
-        return `;${name}=${final2}`;
-      }
-      default: {
-        return final2;
-      }
-    }
-  }
-  for (const k in value) {
-    const finalName = options.style === "deepObject" ? `${name}[${k}]` : k;
-    values.push(serializePrimitiveParam(finalName, value[k], options));
-  }
-  const final = values.join(joiner);
-  return options.style === "label" || options.style === "matrix" ? `${joiner}${final}` : final;
-}
-function serializeArrayParam(name, value, options) {
-  if (!Array.isArray(value)) {
-    return "";
-  }
-  if (options.explode === false) {
-    const joiner2 = { form: ",", spaceDelimited: "%20", pipeDelimited: "|" }[options.style] || ",";
-    const final = (options.allowReserved === true ? value : value.map((v) => encodeURIComponent(v))).join(joiner2);
-    switch (options.style) {
-      case "simple": {
-        return final;
-      }
-      case "label": {
-        return `.${final}`;
-      }
-      case "matrix": {
-        return `;${name}=${final}`;
-      }
-      // case "spaceDelimited":
-      // case "pipeDelimited":
-      default: {
-        return `${name}=${final}`;
-      }
-    }
-  }
-  const joiner = { simple: ",", label: ".", matrix: ";" }[options.style] || "&";
-  const values = [];
-  for (const v of value) {
-    if (options.style === "simple" || options.style === "label") {
-      values.push(options.allowReserved === true ? v : encodeURIComponent(v));
-    } else {
-      values.push(serializePrimitiveParam(name, v, options));
-    }
-  }
-  return options.style === "label" || options.style === "matrix" ? `${joiner}${values.join(joiner)}` : values.join(joiner);
-}
-function createQuerySerializer(options) {
-  return function querySerializer(queryParams) {
-    const search = [];
-    if (queryParams && typeof queryParams === "object") {
-      for (const name in queryParams) {
-        const value = queryParams[name];
-        if (value === void 0 || value === null) {
-          continue;
-        }
-        if (Array.isArray(value)) {
-          if (value.length === 0) {
-            continue;
-          }
-          search.push(
-            serializeArrayParam(name, value, {
-              style: "form",
-              explode: true,
-              ...options?.array,
-              allowReserved: options?.allowReserved || false
-            })
-          );
-          continue;
-        }
-        if (typeof value === "object") {
-          search.push(
-            serializeObjectParam(name, value, {
-              style: "deepObject",
-              explode: true,
-              ...options?.object,
-              allowReserved: options?.allowReserved || false
-            })
-          );
-          continue;
-        }
-        search.push(serializePrimitiveParam(name, value, options));
-      }
-    }
-    return search.join("&");
-  };
-}
-function defaultPathSerializer(pathname, pathParams) {
-  let nextURL = pathname;
-  for (const match2 of pathname.match(PATH_PARAM_RE) ?? []) {
-    let name = match2.substring(1, match2.length - 1);
-    let explode = false;
-    let style = "simple";
-    if (name.endsWith("*")) {
-      explode = true;
-      name = name.substring(0, name.length - 1);
-    }
-    if (name.startsWith(".")) {
-      style = "label";
-      name = name.substring(1);
-    } else if (name.startsWith(";")) {
-      style = "matrix";
-      name = name.substring(1);
-    }
-    if (!pathParams || pathParams[name] === void 0 || pathParams[name] === null) {
-      continue;
-    }
-    const value = pathParams[name];
-    if (Array.isArray(value)) {
-      nextURL = nextURL.replace(match2, serializeArrayParam(name, value, { style, explode }));
-      continue;
-    }
-    if (typeof value === "object") {
-      nextURL = nextURL.replace(match2, serializeObjectParam(name, value, { style, explode }));
-      continue;
-    }
-    if (style === "matrix") {
-      nextURL = nextURL.replace(match2, `;${serializePrimitiveParam(name, value)}`);
-      continue;
-    }
-    nextURL = nextURL.replace(match2, style === "label" ? `.${encodeURIComponent(value)}` : encodeURIComponent(value));
-  }
-  return nextURL;
-}
-function defaultBodySerializer(body, headers) {
-  if (body instanceof FormData) {
-    return body;
-  }
-  if (headers) {
-    const contentType = headers.get instanceof Function ? headers.get("Content-Type") ?? headers.get("content-type") : headers["Content-Type"] ?? headers["content-type"];
-    if (contentType === "application/x-www-form-urlencoded") {
-      return new URLSearchParams(body).toString();
-    }
-  }
-  return JSON.stringify(body);
-}
-function createFinalURL(pathname, options) {
-  let finalURL = `${options.baseUrl}${pathname}`;
-  if (options.params?.path) {
-    finalURL = options.pathSerializer(finalURL, options.params.path);
-  }
-  let search = options.querySerializer(options.params.query ?? {});
-  if (search.startsWith("?")) {
-    search = search.substring(1);
-  }
-  if (search) {
-    finalURL += `?${search}`;
-  }
-  return finalURL;
-}
-function mergeHeaders(...allHeaders) {
-  const finalHeaders = new Headers();
-  for (const h of allHeaders) {
-    if (!h || typeof h !== "object") {
-      continue;
-    }
-    const iterator = h instanceof Headers ? h.entries() : Object.entries(h);
-    for (const [k, v] of iterator) {
-      if (v === null) {
-        finalHeaders.delete(k);
-      } else if (Array.isArray(v)) {
-        for (const v2 of v) {
-          finalHeaders.append(k, v2);
-        }
-      } else if (v !== void 0) {
-        finalHeaders.set(k, v);
-      }
-    }
-  }
-  return finalHeaders;
-}
-function removeTrailingSlash(url) {
-  if (url.endsWith("/")) {
-    return url.substring(0, url.length - 1);
-  }
-  return url;
-}
-
-// ../api-client/src/client.ts
-function createHlixClient(options) {
-  return createClient({
-    baseUrl: options.baseUrl,
-    headers: options.headers,
-    fetch: options.fetch
-  });
-}
-
-// ../sdk/src/auth.ts
-var apiKeyCredential = (apiKey) => ({
-  kind: "apiKey",
-  apiKey
-});
-function credentialHeaders(credential) {
-  return credential.kind === "apiKey" ? { "x-api-key": credential.apiKey } : { cookie: credential.cookie };
-}
-function organizationHeaders(organizationId) {
-  return organizationId ? { "X-Organization-Id": organizationId } : {};
-}
-function authHeaders(credential, organizationId) {
-  return {
-    ...credentialHeaders(credential),
-    ...organizationHeaders(organizationId)
-  };
-}
-
-// ../sdk/src/errors.ts
-function errorMessageOf(body) {
-  if (typeof body !== "object" || body === null) return null;
-  const { error } = body;
-  return typeof error === "string" ? error : null;
-}
-var HlixError = class extends Error {
-  status;
-  body;
-  requestId;
-  method;
-  url;
-  constructor(message, init) {
-    super(message);
-    this.name = new.target.name;
-    this.status = init.status;
-    this.body = init.body;
-    this.requestId = init.requestId ?? null;
-    this.method = init.method;
-    this.url = init.url;
-  }
-};
-var HlixValidationError = class extends HlixError {
-  /** The decoded `ZodIssue[]`; empty when the server sent a plain message. */
-  issues;
-  constructor(message, init, issues) {
-    super(message, init);
-    this.issues = issues;
-  }
-};
-var HlixBadRequestError = class extends HlixError {
-};
-var HlixAuthenticationError = class extends HlixError {
-};
-var HlixPermissionError = class extends HlixError {
-};
-var HlixNotFoundError = class extends HlixError {
-};
-var HlixConflictError = class extends HlixError {
-};
-var HlixRateLimitError = class extends HlixError {
-  retryAfter;
-  constructor(message, init, retryAfter) {
-    super(message, init);
-    this.retryAfter = retryAfter;
-  }
-};
-var HlixNotImplementedError = class extends HlixError {
-};
-var HlixServerError = class extends HlixError {
-};
-var HlixTransportError = class extends Error {
-  method;
-  url;
-  constructor(message, init) {
-    super(message, { cause: init.cause });
-    this.name = "HlixTransportError";
-    this.method = init.method;
-    this.url = init.url;
-  }
-};
-function validationIssues(body) {
-  if (typeof body !== "object" || body === null) return null;
-  const candidate = body;
-  if (candidate.success !== false) return null;
-  const raw = candidate.error?.message;
-  if (typeof raw !== "string") return null;
-  try {
-    const parsed = JSON.parse(raw);
-    return Array.isArray(parsed) ? parsed : [];
-  } catch {
-    return [];
-  }
-}
-function retryAfterSeconds(headers) {
-  const raw = headers.get("retry-after");
-  if (!raw) return null;
-  const seconds = Number(raw);
-  return Number.isFinite(seconds) && seconds >= 0 ? seconds : null;
-}
-function errorForResponse(response, body, request) {
-  const init = {
-    status: response.status,
-    body,
-    requestId: response.headers.get("x-request-id"),
-    method: request.method,
-    url: request.url
-  };
-  const stated = errorMessageOf(body);
-  const fallback = `${request.method} ${request.url} failed with ${response.status}`;
-  const issues = validationIssues(body);
-  if (issues) {
-    return new HlixValidationError(
-      `${request.method} ${request.url}: request body failed validation`,
-      init,
-      issues
-    );
-  }
-  const message = stated ?? fallback;
-  switch (response.status) {
-    case 400:
-      return new HlixBadRequestError(message, init);
-    case 401:
-      return new HlixAuthenticationError(message, init);
-    case 403:
-      return new HlixPermissionError(message, init);
-    case 404:
-      return new HlixNotFoundError(message, init);
-    case 409:
-      return new HlixConflictError(message, init);
-    case 429:
-      return new HlixRateLimitError(message, init, retryAfterSeconds(response.headers));
-    case 501:
-      return new HlixNotImplementedError(message, init);
-    default:
-      return response.status >= 500 ? new HlixServerError(message, init) : new HlixError(message, init);
-  }
-}
-
-// ../sdk/src/retry.ts
-var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
-  "GET",
-  "HEAD",
-  "PUT",
-  "DELETE",
-  "OPTIONS",
-  "TRACE"
-]);
-function isIdempotent(method) {
-  return IDEMPOTENT_METHODS.has(method.toUpperCase());
-}
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([
-  429,
-  500,
-  502,
-  503,
-  504
-]);
-function isRetryableStatus(status) {
-  return RETRYABLE_STATUSES.has(status);
-}
-var DEFAULT_RETRY = {
-  attempts: 3,
-  baseDelayMs: 200,
-  maxDelayMs: 5e3
-};
-function backoffDelayMs(attempt, policy, retryAfterSeconds3, random = Math.random) {
-  if (retryAfterSeconds3 !== null) {
-    return Math.min(retryAfterSeconds3 * 1e3, policy.maxDelayMs);
-  }
-  const ceiling = Math.min(policy.baseDelayMs * 2 ** attempt, policy.maxDelayMs);
-  return Math.round(random() * ceiling);
-}
-function shouldRetry(input) {
-  if (!isIdempotent(input.method)) return false;
-  if (input.attempt + 1 >= input.policy.attempts) return false;
-  return input.status === null || isRetryableStatus(input.status);
-}
-
-// ../sdk/src/http.ts
-var wait = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
-function retryAfterSeconds2(response) {
-  const raw = response.headers.get("retry-after");
-  if (!raw) return null;
-  const seconds = Number(raw);
-  return Number.isFinite(seconds) && seconds >= 0 ? seconds : null;
-}
-function retryingFetch(options) {
-  const { base, policy } = options;
-  const sleep = options.sleep ?? wait;
-  const random = options.random ?? Math.random;
-  return async (input) => {
-    const method = input.method.toUpperCase();
-    const replayable = isIdempotent(method) ? input.clone() : null;
-    for (let attempt = 0; ; attempt += 1) {
-      const request = attempt === 0 ? input : replayable.clone();
-      let response;
-      try {
-        response = await base(request);
-      } catch (cause) {
-        if (!replayable || !shouldRetry({ method, attempt, policy, status: null })) {
-          throw new HlixTransportError(
-            `${method} ${input.url}: ${cause instanceof Error ? cause.message : String(cause)}`,
-            { method, url: input.url, cause }
-          );
-        }
-        await sleep(backoffDelayMs(attempt, policy, null, random));
-        continue;
-      }
-      if (!shouldRetry({ method, attempt, policy, status: response.status })) {
-        return response;
-      }
-      if (!replayable) return response;
-      await sleep(backoffDelayMs(attempt, policy, retryAfterSeconds2(response), random));
-    }
-  };
-}
-function unwrap(result, request) {
-  if (result.response.ok) return result.data;
-  throw errorForResponse(result.response, result.error ?? result.data, request);
-}
-
-// ../sdk/src/streaming.ts
-var emptyFrame = () => ({ event: null, data: [], id: null, retry: null });
-function applyField(frame, name, value) {
-  switch (name) {
-    case "event":
-      frame.event = value;
-      return;
-    case "data":
-      frame.data.push(value);
-      return;
-    case "id":
-      if (!value.includes("\0")) frame.id = value;
-      return;
-    case "retry": {
-      if (/^\d+$/.test(value)) frame.retry = Number(value);
-      return;
-    }
-    default:
-      return;
-  }
-}
-function dispatch(frame) {
-  const data = frame.data.join("\n");
-  const event = frame.event;
-  const id = frame.id;
-  frame.data = [];
-  frame.event = null;
-  if (data === "") return null;
-  return { event, data, id, retry: frame.retry };
-}
-function consumeLine(frame, line) {
-  if (line === "") return dispatch(frame);
-  if (line.startsWith(":")) return null;
-  const colon = line.indexOf(":");
-  if (colon === -1) {
-    applyField(frame, line, "");
-    return null;
-  }
-  const name = line.slice(0, colon);
-  let value = line.slice(colon + 1);
-  if (value.startsWith(" ")) value = value.slice(1);
-  applyField(frame, name, value);
-  return null;
-}
-function splitLines(buffer) {
-  const lines = [];
-  let start = 0;
-  for (let i = 0; i < buffer.length; i += 1) {
-    const ch = buffer[i];
-    if (ch !== "\n" && ch !== "\r") continue;
-    lines.push(buffer.slice(start, i));
-    if (ch === "\r" && buffer[i + 1] === "\n") i += 1;
-    start = i + 1;
-  }
-  return { lines, rest: buffer.slice(start) };
-}
-async function* parseSseStream(body, signal) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder();
-  const frame = emptyFrame();
-  let buffer = "";
-  const abort = () => void reader.cancel().catch(() => {
-  });
-  signal?.addEventListener("abort", abort, { once: true });
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      const { lines, rest } = splitLines(buffer);
-      buffer = rest;
-      for (const line of lines) {
-        const event = consumeLine(frame, line);
-        if (event) yield event;
-      }
-      if (signal?.aborted) return;
-    }
-    buffer += decoder.decode();
-    if (buffer !== "") {
-      const event = consumeLine(frame, buffer);
-      if (event) yield event;
-    }
-    const trailing = dispatch(frame);
-    if (trailing) yield trailing;
-  } finally {
-    signal?.removeEventListener("abort", abort);
-    reader.releaseLock();
-  }
-}
-
-// ../sdk/src/index.ts
-var Hlix = class {
-  /** The un-opinionated transport, for anything this facade does not wrap. */
-  raw;
-  baseUrl;
-  headers;
-  fetcher;
-  constructor(options) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-    this.headers = authHeaders(options.credential, options.organizationId);
-    const policy = { ...DEFAULT_RETRY, ...options.retry };
-    const base = options.fetch ?? ((input) => globalThis.fetch(input));
-    this.fetcher = retryingFetch({ base, policy });
-    this.raw = createHlixClient({
-      baseUrl: this.baseUrl,
-      headers: this.headers,
-      fetch: this.fetcher
-    });
-  }
-  at(method, path) {
-    return { method, url: `${this.baseUrl}${path}` };
-  }
-  projects = {
-    list: async () => unwrap(
-      await this.raw.GET("/v1/api/projects"),
-      this.at("GET", "/v1/api/projects")
-    ),
-    get: async (id) => unwrap(
-      await this.raw.GET("/v1/api/projects/{id}", { params: { path: { id } } }),
-      this.at("GET", `/v1/api/projects/${id}`)
-    ),
-    create: async (body) => unwrap(
-      await this.raw.POST("/v1/api/projects", { body }),
-      this.at("POST", "/v1/api/projects")
-    ),
-    delete: async (id) => unwrap(
-      await this.raw.DELETE("/v1/api/projects/{id}", {
-        params: { path: { id } }
-      }),
-      this.at("DELETE", `/v1/api/projects/${id}`)
-    ),
-    start: async (id, body) => unwrap(
-      await this.raw.POST("/v1/api/projects/{id}/start", {
-        params: { path: { id } },
-        body
-      }),
-      this.at("POST", `/v1/api/projects/${id}/start`)
-    )
-  };
-  imports = {
-    create: async (body) => {
-      const result = await this.raw.POST("/v1/api/imports", { body });
-      return unwrap(result, this.at("POST", "/v1/api/imports"));
-    },
-    get: async (id) => unwrap(
-      await this.raw.GET("/v1/api/imports/{id}", {
-        params: { path: { id } }
-      }),
-      this.at("GET", `/v1/api/imports/${id}`)
-    ),
-    finalize: async (id, body) => {
-      const result = await this.raw.POST("/v1/api/imports/{id}/finalize", {
-        params: { path: { id } },
-        body
-      });
-      return unwrap(
-        result,
-        this.at("POST", `/v1/api/imports/${id}/finalize`)
-      );
-    },
-    uploadBundle: async (upload, bundle, options = {}) => {
-      const chunkSize = options.chunkSize ?? 8 * 1024 * 1024;
-      if (chunkSize <= 0 || chunkSize % (256 * 1024) !== 0) {
-        throw new Error("Import upload chunkSize must be a positive multiple of 256 KiB");
-      }
-      const url = upload.url.startsWith("/") ? `${this.baseUrl}${upload.url}` : upload.url;
-      if (upload.kind === "hlix-stream") {
-        const request = new Request(url, {
-          method: "PUT",
-          headers: {
-            ...this.headers,
-            "content-type": "application/x-git-bundle",
-            "content-length": String(bundle.size)
-          },
-          body: bundle,
-          signal: options.signal
-        });
-        const response = await this.fetcher(request);
-        if (!response.ok) await this.throwUploadError(response, url);
-        options.onProgress?.(bundle.size, bundle.size);
-        return;
-      }
-      let offset = 0;
-      while (offset < bundle.size) {
-        const end = Math.min(offset + chunkSize, bundle.size);
-        const request = new Request(url, {
-          method: "PUT",
-          headers: {
-            "content-type": "application/x-git-bundle",
-            "content-length": String(end - offset),
-            "content-range": `bytes ${offset}-${end - 1}/${bundle.size}`
-          },
-          body: bundle.slice(offset, end),
-          signal: options.signal
-        });
-        const response = await this.fetcher(request);
-        if (response.status !== 308 && !response.ok) {
-          await this.throwUploadError(response, url);
-        }
-        const acknowledged = response.headers.get("range")?.match(/bytes=0-(\d+)/)?.[1];
-        offset = acknowledged ? Number(acknowledged) + 1 : end;
-        if (!Number.isSafeInteger(offset) || offset < end || offset > bundle.size) {
-          throw new Error("Import upload server returned an invalid acknowledged range");
-        }
-        options.onProgress?.(offset, bundle.size);
-      }
-    }
-  };
-  revisions = {
-    head: async (projectId) => unwrap(
-      await this.raw.GET("/v1/api/projects/{id}/revisions/head", {
-        params: { path: { id: projectId } }
-      }),
-      this.at("GET", `/v1/api/projects/${projectId}/revisions/head`)
-    ),
-    protectedFiles: async (projectId) => unwrap(
-      await this.raw.GET("/v1/api/projects/{id}/protected-files", {
-        params: { path: { id: projectId } }
-      }),
-      this.at("GET", `/v1/api/projects/${projectId}/protected-files`)
-    ),
-    createUpload: async (projectId, body) => {
-      const result = await this.raw.POST("/v1/api/projects/{id}/revisions/uploads", {
-        params: { path: { id: projectId } },
-        body
-      });
-      return unwrap(result, this.at("POST", `/v1/api/projects/${projectId}/revisions/uploads`));
-    },
-    finalize: async (projectId, uploadId, body) => {
-      const result = await this.raw.POST(
-        "/v1/api/projects/{id}/revisions/uploads/{uploadId}/finalize",
-        { params: { path: { id: projectId, uploadId } }, body }
-      );
-      return unwrap(
-        result,
-        this.at("POST", `/v1/api/projects/${projectId}/revisions/uploads/${uploadId}/finalize`)
-      );
-    },
-    uploadBundle: async (upload, bundle, options = {}) => this.imports.uploadBundle(upload, bundle, options),
-    downloadBundle: async (projectId, revisionId) => {
-      const path = `/v1/api/projects/${projectId}/revisions/${revisionId}/bundle`;
-      const request = new Request(`${this.baseUrl}${path}`, {
-        method: "GET",
-        headers: this.headers
-      });
-      const response = await this.fetcher(request);
-      if (!response.ok) await this.throwUploadError(response, `${this.baseUrl}${path}`);
-      return response.blob();
-    }
-  };
-  resources = {
-    importSkill: async (projectId, body) => unwrap(
-      await this.raw.POST("/v1/api/projects/{id}/resources/skill", {
-        params: { path: { id: projectId } },
-        body
-      }),
-      this.at("POST", `/v1/api/projects/${projectId}/resources/skill`)
-    ),
-    importAgent: async (projectId, body) => unwrap(
-      await this.raw.POST("/v1/api/projects/{id}/resources/agent", {
-        params: { path: { id: projectId } },
-        body
-      }),
-      this.at("POST", `/v1/api/projects/${projectId}/resources/agent`)
-    ),
-    importMcp: async (projectId, body) => unwrap(
-      await this.raw.POST("/v1/api/projects/{id}/resources/mcp", {
-        params: { path: { id: projectId } },
-        body
-      }),
-      this.at("POST", `/v1/api/projects/${projectId}/resources/mcp`)
-    )
-  };
-  async throwUploadError(response, url) {
-    let body = null;
-    try {
-      body = await response.json();
-    } catch {
-      body = await response.text().catch(() => null);
-    }
-    throw errorForResponse(response, body, { method: "PUT", url });
-  }
-  tasks = {
-    list: async (query) => unwrap(
-      await this.raw.GET("/v1/api/tasks", { params: { query: query ?? {} } }),
-      this.at("GET", "/v1/api/tasks")
-    ),
-    get: async (id) => unwrap(
-      await this.raw.GET("/v1/api/tasks/{id}", { params: { path: { id } } }),
-      this.at("GET", `/v1/api/tasks/${id}`)
-    ),
-    create: async (body) => unwrap(
-      await this.raw.POST("/v1/api/tasks", { body }),
-      this.at("POST", "/v1/api/tasks")
-    ),
-    update: async (id, body) => unwrap(
-      await this.raw.PATCH("/v1/api/tasks/{id}", {
-        params: { path: { id } },
-        body
-      }),
-      this.at("PATCH", `/v1/api/tasks/${id}`)
-    ),
-    listComments: async (id) => unwrap(
-      await this.raw.GET("/v1/api/tasks/{id}/comments", {
-        params: { path: { id } }
-      }),
-      this.at("GET", `/v1/api/tasks/${id}/comments`)
-    ),
-    addComment: async (id, body) => unwrap(
-      await this.raw.POST("/v1/api/tasks/{id}/comments", {
-        params: { path: { id } },
-        body
-      }),
-      this.at("POST", `/v1/api/tasks/${id}/comments`)
-    ),
-    /** The verified review evidence — the same observation QA reviews. */
-    review: async (id) => unwrap(
-      await this.raw.GET("/v1/api/tasks/{id}/review", {
-        params: { path: { id } }
-      }),
-      this.at("GET", `/v1/api/tasks/${id}/review`)
-    ),
-    /** Live status frames. A terminal status closes the stream server-side. */
-    stream: (id, init) => this.stream(`/v1/api/tasks/${id}/stream`, init)
-  };
-  cycles = {
-    list: async (query) => unwrap(
-      await this.raw.GET("/v1/api/cycles", {
-        params: { query: query ?? {} }
-      }),
-      this.at("GET", "/v1/api/cycles")
-    ),
-    get: async (id) => unwrap(
-      await this.raw.GET("/v1/api/cycles/{id}", {
-        params: { path: { id } }
-      }),
-      this.at("GET", `/v1/api/cycles/${id}`)
-    ),
-    /** Creation is a PROPOSAL — the orchestrator owns the roadmap. */
-    propose: async (body) => unwrap(
-      await this.raw.POST("/v1/api/cycles", { body }),
-      this.at("POST", "/v1/api/cycles")
-    ),
-    stream: (id, init) => this.stream(`/v1/api/cycles/${id}/stream`, init)
-  };
-  /**
-   * Invoices the agency issues to its own customer.
-   *
-   * NOT the hlix subscription — that is Polar's, and the two never meet.
-   *
-   * There is no `update`, because there is no route that could edit an issued
-   * invoice: a correction is `void` plus a new draft naming it through
-   * `replacesInvoiceId`. And `create` names no customer — the customer is
-   * derived from the billables being invoiced.
-   */
-  clientInvoices = {
-    list: async (query) => unwrap(
-      await this.raw.GET("/v1/api/client-billing/invoices", {
-        params: { query: query ?? {} }
-      }),
-      this.at("GET", "/v1/api/client-billing/invoices")
-    ),
-    get: async (id) => unwrap(
-      await this.raw.GET("/v1/api/client-billing/invoices/{id}", {
-        params: { path: { id } }
-      }),
-      this.at("GET", `/v1/api/client-billing/invoices/${id}`)
-    ),
-    createDraft: async (body) => unwrap(
-      await this.raw.POST("/v1/api/client-billing/invoices", { body }),
-      this.at("POST", "/v1/api/client-billing/invoices")
-    ),
-    /** The number is assigned by the server, gapless per workspace. */
-    issue: async (id) => unwrap(
-      await this.raw.POST("/v1/api/client-billing/invoices/{id}/issue", {
-        params: { path: { id } },
-        body: {}
-      }),
-      this.at("POST", `/v1/api/client-billing/invoices/${id}/issue`)
-    ),
-    void: async (id, reason) => unwrap(
-      await this.raw.POST("/v1/api/client-billing/invoices/{id}/void", {
-        params: { path: { id } },
-        body: { reason }
-      }),
-      this.at("POST", `/v1/api/client-billing/invoices/${id}/void`)
-    ),
-    pay: async (id) => unwrap(
-      await this.raw.POST("/v1/api/client-billing/invoices/{id}/pay", {
-        params: { path: { id } },
-        body: {}
-      }),
-      this.at("POST", `/v1/api/client-billing/invoices/${id}/pay`)
-    ),
-    /**
-     * Open a PROVIDER-HOSTED checkout. Returns a URL and nothing else — no card
-     * field and no payment credential ever passes through hlix or this client.
-     * It does not mark the invoice paid: that happens only when the provider's
-     * signed webhook reconciles.
-     */
-    paymentLink: async (id, body = {}) => unwrap(
-      await this.raw.POST(
-        "/v1/api/client-billing/invoices/{id}/payment-link",
-        { params: { path: { id } }, body }
-      ),
-      this.at("POST", `/v1/api/client-billing/invoices/${id}/payment-link`)
-    )
-  };
-  /**
-   * Consume any `text/event-stream` route.
-   *
-   * Deliberately NOT routed through the typed client: `openapi-fetch` parses
-   * the body, and a stream must not be parsed — it has to be read as it
-   * arrives. Retry does not apply either; a stream that drops mid-flight has
-   * already delivered events, and silently restarting it would replay them.
-   */
-  async *stream(path, init) {
-    const url = `${this.baseUrl}${path}`;
-    const request = new Request(url, {
-      headers: { ...this.headers, accept: "text/event-stream" },
-      signal: init?.signal
-    });
-    const response = await globalThis.fetch(request);
-    if (!response.ok || !response.body) {
-      let body = null;
-      try {
-        body = await response.json();
-      } catch {
-        body = null;
-      }
-      throw errorForResponse(response, body, { method: "GET", url });
-    }
-    yield* parseSseStream(response.body, init?.signal);
-  }
-};
-
-// src/errors.ts
-var CliError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "CliError";
-    this.code = code;
-  }
-};
-
-// src/output.ts
-var JSON_SCHEMA_VERSION = 1;
-var jsonSuccess = (command, data) => ({
-  schemaVersion: JSON_SCHEMA_VERSION,
-  command,
-  data
-});
-var jsonFailure = (command, error) => ({
-  schemaVersion: JSON_SCHEMA_VERSION,
-  command,
-  error
-});
-function renderJson(payload) {
-  return `${JSON.stringify(payload, null, 2)}
-`;
-}
-function renderFields(fields) {
-  const width = Math.max(0, ...fields.map(([key]) => key.length));
-  return fields.map(([k, v]) => `${k.padEnd(width)}  ${v}`).join("\n");
-}
-function renderTable(headers, rows) {
-  const widths = headers.map(
-    (header, column) => Math.max(header.length, ...rows.map((row) => (row[column] ?? "").length))
-  );
-  const line = (cells) => cells.map((cell, i) => cell.padEnd(widths[i])).join("  ").trimEnd();
-  return [line(headers), line(widths.map((w) => "-".repeat(w))), ...rows.map(line)].join("\n");
-}
-
-// src/target.ts
-import { statSync as statSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve2 } from "path";
-
-// src/config.ts
-import {
-  closeSync,
-  constants,
-  existsSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  statSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-function configPath(env = process.env) {
-  const base = env.HLIX_CONFIG_HOME ?? env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
-  return join(base, "hlix", "credentials.json");
-}
-function readCredential(env = process.env) {
-  const fromEnv = env.HLIX_API_KEY;
-  if (fromEnv) {
-    return {
-      baseUrl: env.HLIX_BASE_URL ?? "https://server.hlix.ai",
-      apiKey: fromEnv,
-      ...env.HLIX_WORKSPACE_ID ? { organizationId: env.HLIX_WORKSPACE_ID } : {}
-    };
-  }
-  try {
-    const parsed = JSON.parse(readFileSync(configPath(env), "utf8"));
-    return parsed.apiKey && parsed.baseUrl ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function storedCredentialFile(env = process.env) {
-  const path = configPath(env);
-  return existsSync(path) ? path : null;
-}
-function removeCredential(env = process.env) {
-  const path = configPath(env);
-  if (!existsSync(path)) return { path, removed: false, reason: "absent" };
-  const entry = lstatSync(path);
-  if (entry.isSymbolicLink() || !entry.isFile()) {
-    throw new Error("Refusing to remove a credential path that is not a regular file.");
-  }
-  const uid = process.getuid?.();
-  if (uid !== void 0 && statSync(path).uid !== uid) {
-    throw new Error("Refusing to remove a credential file owned by another user.");
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    parsed = null;
-  }
-  const document = parsed;
-  if (!document || typeof document.apiKey !== "string" || typeof document.baseUrl !== "string") {
-    throw new Error(`Refusing to remove ${path}: it is not a credential written by this CLI.`);
-  }
-  unlinkSync(path);
-  return { path, removed: true, reason: "removed" };
-}
-function writeCredential(credential, env = process.env) {
-  const path = configPath(env);
-  const directory = dirname(path);
-  mkdirSync(directory, { recursive: true, mode: 448 });
-  if (lstatSync(directory).isSymbolicLink()) {
-    throw new Error("Refusing to write credentials through a symlinked directory.");
-  }
-  if (existsSync(path)) {
-    const entry = lstatSync(path);
-    if (entry.isSymbolicLink() || !entry.isFile()) {
-      throw new Error("Refusing to replace a credential path that is not a regular file.");
-    }
-    const getuid = process.getuid?.();
-    if (getuid !== void 0 && statSync(path).uid !== getuid) {
-      throw new Error("Refusing to replace a credential file owned by another user.");
-    }
-  }
-  const temporary = join(directory, `.credentials.${process.pid}.${crypto.randomUUID()}.tmp`);
-  let fd;
-  try {
-    fd = openSync(
-      temporary,
-      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
-      384
-    );
-    writeFileSync(fd, `${JSON.stringify(credential, null, 2)}
-`, "utf8");
-    fsyncSync(fd);
-    closeSync(fd);
-    fd = void 0;
-    renameSync(temporary, path);
-    const dirFd = openSync(directory, constants.O_RDONLY);
-    try {
-      try {
-        fsyncSync(dirFd);
-      } catch (error) {
-        const code = error.code;
-        if (code !== "EINVAL" && code !== "ENOTSUP") throw error;
-      }
-    } finally {
-      closeSync(dirFd);
-    }
-  } catch (error) {
-    if (fd !== void 0) closeSync(fd);
-    if (existsSync(temporary)) unlinkSync(temporary);
-    throw error;
-  }
-  return path;
-}
-
-// src/project/config.ts
-import {
-  constants as constants2,
-  existsSync as existsSync2,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  closeSync as closeSync2,
-  fsyncSync as fsyncSync2,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname2, join as join2, resolve } from "path";
-function assertRegularOrMissing(path) {
-  if (!existsSync2(path)) return;
-  const entry = lstatSync2(path);
-  if (entry.isSymbolicLink() || !entry.isFile()) {
-    throw new Error(`Refusing to replace a non-regular Hlix file: ${path}`);
-  }
-}
-function atomicJson(path, value) {
-  const directory = dirname2(path);
-  mkdirSync2(directory, { recursive: true, mode: 448 });
-  if (lstatSync2(directory).isSymbolicLink()) {
-    throw new Error(`Refusing to write through a symlinked Hlix directory: ${directory}`);
-  }
-  assertRegularOrMissing(path);
-  const temporary = join2(directory, `.hlix-${process.pid}-${crypto.randomUUID()}.tmp`);
-  let fd;
-  try {
-    fd = openSync2(
-      temporary,
-      constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | constants2.O_NOFOLLOW,
-      384
-    );
-    writeFileSync2(fd, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-    fsyncSync2(fd);
-    closeSync2(fd);
-    fd = void 0;
-    renameSync2(temporary, path);
-  } catch (error) {
-    if (fd !== void 0) closeSync2(fd);
-    if (existsSync2(temporary)) unlinkSync2(temporary);
-    throw error;
-  }
-}
-function projectConfigPath(root) {
-  return join2(resolve(root), ".hlix", "config.json");
-}
-function projectStatePath(root) {
-  return join2(resolve(root), ".hlix", "state.json");
-}
-function readProjectConfig(root) {
-  try {
-    const parsed = JSON.parse(readFileSync2(projectConfigPath(root), "utf8"));
-    return parsed.schemaVersion === 1 && parsed.workspaceId && parsed.apiUrl ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function writeProjectConfig(root, config) {
-  atomicJson(projectConfigPath(root), config);
-  const ignorePath = join2(resolve(root), ".hlix", ".gitignore");
-  if (!existsSync2(ignorePath)) writeFileSync2(ignorePath, "state.json\n", { mode: 420, flag: "wx" });
-  const hlixIgnore = join2(resolve(root), ".hlixignore");
-  if (!existsSync2(hlixIgnore)) {
-    writeFileSync2(
-      hlixIgnore,
-      "# Additional project-local paths to exclude from Hlix snapshots.\n",
-      { mode: 420, flag: "wx" }
-    );
-  }
-}
-function writeProjectState(root, state) {
-  atomicJson(projectStatePath(root), state);
-}
-function readProjectState(root) {
-  try {
-    const parsed = JSON.parse(readFileSync2(projectStatePath(root), "utf8"));
-    return parsed.schemaVersion === 1 && parsed.revisionId && parsed.generation > 0 ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-
-// src/target.ts
-var DEFAULT_BASE_URL = "https://server.hlix.ai";
-function findProjectBinding(cwd) {
-  let root = resolve2(cwd);
-  for (; ; ) {
-    const config = readProjectConfig(root);
-    if (config) return { root, config };
-    const parent = dirname3(root);
-    if (parent === root) return null;
-    root = parent;
-  }
-}
-function isDirectory(path) {
-  try {
-    return statSync2(path).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function text(value) {
-  if (typeof value !== "string") return void 0;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : void 0;
-}
-var sameUrl = (a, b) => a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
-function resolveTarget(input) {
-  const { env, flags, cwd } = input;
-  const binding2 = findProjectBinding(cwd);
-  const credential = readCredential(env);
-  const credentialSource = credential ? env.HLIX_API_KEY ? "env" : "file" : null;
-  const stored = credentialSource === "file" ? credential : null;
-  const flagBaseUrl = text(flags["base-url"]);
-  const envBaseUrl = text(env.HLIX_BASE_URL);
-  const flagWorkspace = text(flags.workspace);
-  const envWorkspace = text(env.HLIX_WORKSPACE_ID);
-  const baseUrl = flagBaseUrl ?? envBaseUrl ?? binding2?.config.apiUrl ?? stored?.baseUrl ?? DEFAULT_BASE_URL;
-  const baseUrlSource = flagBaseUrl ? "flag" : envBaseUrl ? "env" : binding2?.config.apiUrl ? "project" : stored?.baseUrl ? "credential" : "default";
-  const workspaceId = flagWorkspace ?? envWorkspace ?? binding2?.config.workspaceId ?? stored?.organizationId ?? null;
-  const workspaceSource = flagWorkspace ? "flag" : envWorkspace ? "env" : binding2?.config.workspaceId ? "project" : stored?.organizationId ? "credential" : null;
-  return {
-    baseUrl,
-    baseUrlSource,
-    workspaceId,
-    workspaceSource,
-    credential,
-    credentialSource,
-    credentialPath: configPath(env),
-    binding: binding2,
-    conflict: conflictWith(binding2, {
-      flagBaseUrl,
-      envBaseUrl,
-      flagWorkspace,
-      envWorkspace
-    })
-  };
-}
-function conflictWith(binding2, explicit) {
-  if (!binding2) return null;
-  const where = `${binding2.root} is bound to`;
-  const fix = "Drop the override, or point --cwd at a folder bound to it.";
-  if (explicit.flagWorkspace && explicit.flagWorkspace !== binding2.config.workspaceId) {
-    return `${where} workspace ${binding2.config.workspaceId}, but --workspace names ${explicit.flagWorkspace}. ${fix}`;
-  }
-  if (explicit.envWorkspace && explicit.envWorkspace !== binding2.config.workspaceId) {
-    return `${where} workspace ${binding2.config.workspaceId}, but HLIX_WORKSPACE_ID names ${explicit.envWorkspace}. ${fix}`;
-  }
-  if (explicit.flagBaseUrl && !sameUrl(explicit.flagBaseUrl, binding2.config.apiUrl)) {
-    return `${where} ${binding2.config.apiUrl}, but --base-url names ${explicit.flagBaseUrl}. ${fix}`;
-  }
-  if (explicit.envBaseUrl && !sameUrl(explicit.envBaseUrl, binding2.config.apiUrl)) {
-    return `${where} ${binding2.config.apiUrl}, but HLIX_BASE_URL names ${explicit.envBaseUrl}. ${fix}`;
-  }
-  return null;
-}
-
-// src/cli.ts
-function errorCode(error) {
-  if (error instanceof CliError) return { code: error.code, status: null };
-  if (error instanceof HlixValidationError) return { code: "invalid_request", status: 400 };
-  if (error instanceof HlixBadRequestError) return { code: "bad_request", status: 400 };
-  if (error instanceof HlixAuthenticationError) return { code: "unauthenticated", status: 401 };
-  if (error instanceof HlixPermissionError) return { code: "forbidden", status: 403 };
-  if (error instanceof HlixNotFoundError) return { code: "not_found", status: 404 };
-  if (error instanceof HlixConflictError) return { code: "conflict", status: 409 };
-  if (error instanceof HlixRateLimitError) return { code: "rate_limited", status: 429 };
-  if (error instanceof HlixNotImplementedError) return { code: "not_implemented", status: 501 };
-  if (error instanceof HlixServerError) {
-    return { code: "server_error", status: error.status };
-  }
-  if (error instanceof HlixTransportError) return { code: "unreachable", status: null };
-  return { code: "unknown", status: null };
-}
-var messageOf = (error) => error instanceof Error ? error.message : String(error);
-function clientFor(env, options) {
-  const target = resolveTarget({ env, flags: options.flags, cwd: options.cwd });
-  if (target.conflict) throw new CliError("workspace_mismatch", target.conflict);
-  if (!target.credential) {
-    throw new CliError(
-      "unauthenticated",
-      "No credential. Run `hlix auth login`, or set HLIX_API_KEY for CI."
-    );
-  }
-  return new Hlix({
-    baseUrl: target.baseUrl,
-    credential: apiKeyCredential(target.credential.apiKey),
-    ...target.workspaceId ? { organizationId: target.workspaceId } : {}
-  });
-}
-function helpText(commands2) {
-  const width = Math.max(...commands2.map((c) => c.name.length));
-  const lines = commands2.map((c) => `  hlix ${c.name.padEnd(width)}  ${c.summary}`).join("\n");
-  return `hlix \u2014 the hlix control-plane CLI
-
-Usage:
-  hlix <command> [options]
-
-Commands:
-${lines}
-
-Options:
-  --json              Machine-readable output (a versioned, stable contract)
-  --cwd <dir>         Operate on another directory instead of the current one
-  --workspace <id>    Workspace to act in, overriding the folder's binding
-  --base-url <url>    API to talk to, overriding the folder's binding
-  --help              Show this help
-  --version           Show the installed CLI version
-
-A command targets the workspace named by, in order: an explicit flag, the
-HLIX_* environment, the nearest .hlix/config.json, then the stored credential.
-Run \`hlix status\` to see which one applied.
-`;
-}
-function match(commands2, argv) {
-  for (const command of [...commands2].sort((a, b) => b.name.length - a.name.length)) {
-    const words = command.name.split(" ");
-    if (words.every((word, i) => argv[i] === word)) {
-      return { command, rest: argv.slice(words.length) };
-    }
-  }
-  return null;
-}
-async function runCli(commands2, argv, io) {
-  if (argv.some((arg) => arg === "--api-key" || arg.startsWith("--api-key="))) {
-    io.stderr("error: API keys are never accepted as command-line arguments. Run `hlix auth login` and use the hidden prompt.\n");
-    return 2;
-  }
-  let parsed;
-  try {
-    parsed = parseArgs({
-      args: argv,
-      allowPositionals: true,
-      strict: true,
-      options: {
-        json: { type: "boolean" },
-        help: { type: "boolean" },
-        version: { type: "boolean" },
-        cwd: { type: "string" },
-        "base-url": { type: "string" },
-        workspace: { type: "string" },
-        "dry-run": { type: "boolean" },
-        "env-file": { type: "string" },
-        history: { type: "string" },
-        name: { type: "string" },
-        stack: { type: "string" },
-        status: { type: "string" },
-        project: { type: "string" },
-        yes: { type: "boolean" },
-        force: { type: "boolean" },
-        runtime: { type: "string" },
-        profile: { type: "string" },
-        server: { type: "string" },
-        "allow-stdio": { type: "boolean" }
-      }
-    });
-  } catch (error) {
-    const json2 = argv.includes("--json");
-    const message = messageOf(error);
-    if (json2) {
-      io.stdout(renderJson(jsonFailure("cli", { code: "invalid_usage", message, status: null })));
-    } else {
-      io.stderr(`${message}
-`);
-    }
-    return 2;
-  }
-  const json = parsed.values.json === true;
-  const positionals = parsed.positionals;
-  if (parsed.values.version === true) {
-    const { version } = await import("./package-WT5SD5LO.js");
-    io.stdout(`${version}
-`);
-    return 0;
-  }
-  if (positionals.length === 0 || parsed.values.help === true) {
-    const hit2 = match(commands2, positionals);
-    io.stdout(hit2 ? `${hit2.command.usage}
-` : helpText(commands2));
-    return positionals.length === 0 && parsed.values.help !== true ? 1 : 0;
-  }
-  const hit = match(commands2, positionals);
-  if (!hit) {
-    const name = positionals.join(" ");
-    if (json) {
-      io.stdout(
-        renderJson(
-          jsonFailure(name, {
-            code: "unknown_command",
-            message: `Unknown command: ${name}`,
-            status: null
-          })
-        )
-      );
-    } else {
-      io.stderr(`Unknown command: ${name}
-
-${helpText(commands2)}`);
-    }
-    return 2;
-  }
-  const globalOptions = /* @__PURE__ */ new Set(["json", "help", "version", "cwd", "workspace", "base-url"]);
-  const allowedOptions = new Set(hit.command.options ?? []);
-  const unsupported = Object.entries(parsed.values).filter(([name, value]) => value !== void 0 && !globalOptions.has(name) && !allowedOptions.has(name)).map(([name]) => `--${name}`);
-  const bounds = hit.command.args ?? { min: 0, max: 0 };
-  const positionalError = hit.rest.length < bounds.min ? { code: "missing_argument", message: hit.command.usage.split("\n")[0] } : hit.rest.length > bounds.max ? { code: "invalid_usage", message: hit.command.usage.split("\n")[0] } : null;
-  const cwdFlag = typeof parsed.values.cwd === "string" ? parsed.values.cwd : void 0;
-  const cwd = resolve3(cwdFlag ?? ".");
-  const cwdError = cwdFlag !== void 0 && !isDirectory(cwd) ? { code: "invalid_usage", message: `--cwd is not a directory: ${cwd}` } : null;
-  const usageError = unsupported.length > 0 ? { code: "invalid_usage", message: `Unsupported option for ${hit.command.name}: ${unsupported.join(", ")}` } : cwdError ?? positionalError;
-  if (usageError) {
-    if (json) {
-      io.stdout(renderJson(jsonFailure(hit.command.name, { ...usageError, status: null })));
-    } else {
-      io.stderr(`error: ${usageError.message}
-
-${hit.command.usage}
-`);
-    }
-    return 2;
-  }
-  const flags = parsed.values;
-  const context = {
-    ...io,
-    args: hit.rest,
-    json,
-    flags,
-    cwd,
-    requireClient: (at) => clientFor(io.env, { cwd: at ?? cwd, flags })
-  };
-  try {
-    return await hit.command.run(context);
-  } catch (error) {
-    const { code, status } = errorCode(error);
-    if (json) {
-      io.stdout(
-        renderJson(
-          jsonFailure(hit.command.name, { code, message: messageOf(error), status })
-        )
-      );
-    } else {
-      io.stderr(`error: ${messageOf(error)}
-`);
-    }
-    return code === "unauthenticated" || code === "forbidden" ? 3 : 1;
-  }
-}
-
-// src/commands/auth.ts
-var authLogin = {
-  name: "auth login",
-  summary: "Verify and store a credential for this machine",
-  usage: [
-    "Usage: hlix auth login --workspace <id> [--base-url <url>]",
-    "",
-    "  --base-url   Defaults to https://server.hlix.ai",
-    "  --workspace  Required. Workspace (organization) id to act in",
-    "",
-    "The API key is read from a hidden prompt and never accepted as an argument.",
-    "For CI, set HLIX_API_KEY and HLIX_WORKSPACE_ID in the environment."
-  ].join("\n"),
-  supportsJson: true,
-  options: ["base-url", "workspace"],
-  async run(ctx) {
-    const organizationId = typeof ctx.flags.workspace === "string" ? ctx.flags.workspace : ctx.env.HLIX_WORKSPACE_ID;
-    if (!organizationId) {
-      throw new CliError("missing_argument", "--workspace is required.");
-    }
-    const apiKey = ctx.env.HLIX_API_KEY ?? await ctx.readSecret?.("Hlix API key: ") ?? "";
-    if (!apiKey) {
-      throw new CliError(
-        "missing_credential",
-        "No API key entered. Run from a terminal or set HLIX_API_KEY for CI."
-      );
-    }
-    const baseUrl = typeof ctx.flags["base-url"] === "string" ? ctx.flags["base-url"] : ctx.env.HLIX_BASE_URL ?? DEFAULT_BASE_URL;
-    const parsedBaseUrl = new URL(baseUrl);
-    const loopback = parsedBaseUrl.hostname === "localhost" || parsedBaseUrl.hostname === "127.0.0.1" || parsedBaseUrl.hostname === "::1";
-    if (parsedBaseUrl.protocol !== "https:" && !(parsedBaseUrl.protocol === "http:" && loopback)) {
-      throw new CliError("invalid_base_url", "--base-url must use HTTPS (HTTP is allowed only for localhost).");
-    }
-    const probe = new Hlix({
-      baseUrl,
-      credential: apiKeyCredential(apiKey),
-      organizationId,
-      retry: { attempts: 1 }
-    });
-    await probe.projects.list();
-    const path = writeCredential({ baseUrl, apiKey, organizationId }, ctx.env);
-    if (ctx.json) {
-      ctx.stdout(
-        renderJson(jsonSuccess(authLogin.name, { baseUrl, organizationId, credentialPath: path }))
-      );
-    } else {
-      ctx.stdout(`Signed in to ${baseUrl}
-Credential stored at ${path}
-`);
-    }
-    return 0;
-  }
-};
-var authStatus = {
-  name: "auth status",
-  summary: "Show which credential is in use, where it came from, and whether it works",
-  usage: [
-    "Usage: hlix auth status [--json]",
-    "",
-    "Names the SOURCE of the credential \u2014 the environment or the stored file \u2014",
-    "and verifies it against the API. The key itself is never printed, not even",
-    "a prefix: machine output gets piped into logs."
-  ].join("\n"),
-  supportsJson: true,
-  async run(ctx) {
-    const target = resolveTarget({ env: ctx.env, flags: ctx.flags, cwd: ctx.cwd });
-    if (target.conflict) throw new CliError("workspace_mismatch", target.conflict);
-    if (!target.credential) {
-      throw new CliError(
-        "unauthenticated",
-        "No credential. Run `hlix auth login`, or set HLIX_API_KEY for CI."
-      );
-    }
-    try {
-      await ctx.requireClient().projects.list();
-    } catch (error) {
-      ctx.stderr(
-        `credential from ${target.credentialSource}, workspace ${target.workspaceId ?? "none"}, api ${target.baseUrl}
-`
-      );
-      throw error;
-    }
-    const data = {
-      credentialSource: target.credentialSource,
-      credentialPath: target.credentialSource === "file" ? target.credentialPath : null,
-      baseUrl: target.baseUrl,
-      baseUrlSource: target.baseUrlSource,
-      workspaceId: target.workspaceId,
-      workspaceSource: target.workspaceSource,
-      valid: true
-    };
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(authStatus.name, data)));
-      return 0;
-    }
-    ctx.stdout(
-      `${renderFields([
-        [
-          "credential",
-          target.credentialSource === "env" ? "environment (HLIX_API_KEY)" : `file (${target.credentialPath})`
-        ],
-        ["api", `${target.baseUrl} (from ${target.baseUrlSource})`],
-        [
-          "workspace",
-          target.workspaceId ? `${target.workspaceId} (from ${target.workspaceSource})` : "none"
-        ],
-        ["status", "valid"]
-      ])}
-`
-    );
-    return 0;
-  }
-};
-var authLogout = {
-  name: "auth logout",
-  summary: "Remove the stored credential from this machine",
-  usage: [
-    "Usage: hlix auth logout [--yes] [--json]",
-    "",
-    "Removes ~/.config/hlix/credentials.json after confirming. A credential",
-    "supplied through HLIX_API_KEY is not removed \u2014 unset it in the shell that",
-    "set it."
-  ].join("\n"),
-  supportsJson: true,
-  options: ["yes"],
-  async run(ctx) {
-    const target = resolveTarget({ env: ctx.env, flags: ctx.flags, cwd: ctx.cwd });
-    if (target.credentialSource === "env") {
-      const stored = storedCredentialFile(ctx.env);
-      if (!stored) {
-        const data = { removed: false, reason: "environment", path: null };
-        if (ctx.json) ctx.stdout(renderJson(jsonSuccess(authLogout.name, data)));
-        else ctx.stdout("HLIX_API_KEY is set in this environment; unset it there to sign out.\n");
-        return 0;
-      }
-      if (ctx.flags.yes !== true) {
-        const data = { removed: false, reason: "environment", path: stored };
-        if (ctx.json) ctx.stdout(renderJson(jsonSuccess(authLogout.name, data)));
-        else {
-          ctx.stdout(
-            `HLIX_API_KEY is set in this environment; unset it there to sign out.
-A stored credential also exists at ${stored} \u2014 repeat with --yes to remove it.
-`
-          );
-        }
-        return 0;
-      }
-      const removed = removeCredential(ctx.env);
-      if (ctx.json) ctx.stdout(renderJson(jsonSuccess(authLogout.name, removed)));
-      else {
-        ctx.stdout(
-          `Removed ${removed.path}
-HLIX_API_KEY is still set in this environment; unset it there to finish signing out.
-`
-        );
-      }
-      return 0;
-    }
-    if (ctx.flags.yes !== true && target.credential) {
-      if (ctx.json || !ctx.confirm) {
-        throw new CliError(
-          "approval_required",
-          "Removing the stored credential needs approval. Repeat with `--yes`."
-        );
-      }
-      const approved = await ctx.confirm(
-        `Remove the stored credential at ${target.credentialPath}? Signing back in needs the API key again.`
-      );
-      if (!approved) throw new CliError("cancelled", "Logout cancelled.");
-    }
-    const removal = removeCredential(ctx.env);
-    if (ctx.json) ctx.stdout(renderJson(jsonSuccess(authLogout.name, removal)));
-    else {
-      ctx.stdout(
-        removal.removed ? `Removed ${removal.path}
-` : `No stored credential at ${removal.path}
-`
-      );
-    }
-    return 0;
-  }
-};
-
-// src/commands/projects.ts
-function field(row, key) {
-  if (typeof row !== "object" || row === null) return "";
-  const value = row[key];
-  return value === null || value === void 0 ? "" : String(value);
-}
-var projectsList = {
-  name: "projects list",
-  summary: "List the projects in your workspace",
-  usage: "Usage: hlix projects list [--json]",
-  supportsJson: true,
-  async run(ctx) {
-    const projects = await ctx.requireClient().projects.list();
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(projectsList.name, projects)));
-      return 0;
-    }
-    const rows = Array.isArray(projects) ? projects : [];
-    if (rows.length === 0) {
-      ctx.stdout("No projects.\n");
-      return 0;
-    }
-    ctx.stdout(
-      `${renderTable(
-        ["ID", "NAME", "STACK"],
-        rows.map((row) => [field(row, "id"), field(row, "name"), field(row, "stack")])
-      )}
-`
-    );
-    return 0;
-  }
-};
-var projectsGet = {
-  name: "projects get",
-  summary: "Show one project, defaulting to the one this folder is bound to",
-  usage: [
-    "Usage: hlix projects get [project-id] [--json]",
-    "",
-    "With no id, the project this folder is bound to is used."
-  ].join("\n"),
-  supportsJson: true,
-  args: { min: 0, max: 1 },
-  async run(ctx) {
-    const id = ctx.args[0] ?? findProjectBinding(ctx.cwd)?.config.projectId;
-    if (!id) {
-      throw new CliError(
-        "missing_argument",
-        "A project id is required, or run this inside a folder bound to a project."
-      );
-    }
-    const project = await ctx.requireClient().projects.get(id);
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(projectsGet.name, project)));
-      return 0;
-    }
-    const repos = project.repos;
-    ctx.stdout(
-      `${renderFields(
-        [
-          ["id", field(project, "id")],
-          ["name", field(project, "name")],
-          ["stack", field(project, "stack")],
-          ["status", field(project, "status")],
-          ["repos", Array.isArray(repos) ? String(repos.length) : ""]
-        ].filter(([, value]) => value !== "")
-      )}
-`
-    );
-    return 0;
-  }
-};
-
-// src/commands/tasks.ts
-function requireId(ctx, what) {
-  const id = ctx.args[0];
-  if (!id) throw new CliError("missing_argument", `A ${what} id is required.`);
-  return id;
-}
-function flag(ctx, name) {
-  const value = ctx.flags[name];
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function field2(row, key) {
-  if (typeof row !== "object" || row === null) return "";
-  const value = row[key];
-  return value === null || value === void 0 ? "" : String(value);
-}
-var tasksList = {
-  name: "tasks list",
-  summary: "List tasks, defaulting to the project this folder is bound to",
-  usage: [
-    "Usage: hlix tasks list [--project <id>] [--status <status>] [--json]",
-    "",
-    "With no --project, a folder bound to a project lists that project's tasks;",
-    "anywhere else it lists the workspace's tasks."
-  ].join("\n"),
-  supportsJson: true,
-  options: ["project", "status"],
-  async run(ctx) {
-    const projectId = flag(ctx, "project") ?? findProjectBinding(ctx.cwd)?.config.projectId;
-    const status = flag(ctx, "status");
-    const tasks = await ctx.requireClient().tasks.list({
-      ...projectId ? { projectId } : {},
-      ...status ? { status } : {}
-    });
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(tasksList.name, tasks)));
-      return 0;
-    }
-    const rows = Array.isArray(tasks) ? tasks : [];
-    if (rows.length === 0) {
-      ctx.stdout("No tasks.\n");
-      return 0;
-    }
-    ctx.stdout(
-      `${renderTable(
-        ["ID", "STATUS", "TITLE"],
-        rows.map((row) => [
-          field2(row, "id"),
-          field2(row, "status"),
-          field2(row, "title") || field2(row, "description").split("\n")[0] || ""
-        ])
-      )}
-`
-    );
-    return 0;
-  }
-};
-var tasksGet = {
-  name: "tasks get",
-  summary: "Show one task",
-  usage: "Usage: hlix tasks get <task-id> [--json]",
-  supportsJson: true,
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    const id = requireId(ctx, "task");
-    const task = await ctx.requireClient().tasks.get(id);
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(tasksGet.name, task)));
-      return 0;
-    }
-    ctx.stdout(
-      `${renderFields([
-        ["id", field2(task, "id")],
-        ["status", field2(task, "status")],
-        ["title", field2(task, "title")],
-        ["project", field2(task, "projectId")],
-        ["description", field2(task, "description")]
-      ])}
-`
-    );
-    return 0;
-  }
-};
-var tasksReview = {
-  name: "tasks review",
-  summary: "Show the verified review evidence for a task",
-  usage: "Usage: hlix tasks review <task-id> [--json]",
-  supportsJson: true,
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    const id = requireId(ctx, "task");
-    const evidence = await ctx.requireClient().tasks.review(id);
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(tasksReview.name, evidence)));
-      return 0;
-    }
-    ctx.stdout(`${JSON.stringify(evidence, null, 2)}
-`);
-    return 0;
-  }
-};
-var tasksWatch = {
-  name: "tasks watch",
-  summary: "Stream a task's status changes until it finishes",
-  usage: [
-    "Usage: hlix tasks watch <task-id> [--json]",
-    "",
-    "Streams the task's server-sent status frames and exits when the task",
-    "reaches a terminal status or the server closes the stream.",
-    "",
-    "With --json, each frame is printed as one envelope per line (JSONL) so a",
-    "consumer can read them as they arrive."
-  ].join("\n"),
-  supportsJson: true,
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    const id = requireId(ctx, "task");
-    const client = ctx.requireClient();
-    for await (const event of client.tasks.stream(id)) {
-      let payload;
-      try {
-        payload = JSON.parse(event.data);
-      } catch {
-        payload = event.data;
-      }
-      if (ctx.json) {
-        ctx.stdout(`${JSON.stringify(jsonSuccess(tasksWatch.name, payload))}
-`);
-      } else {
-        const status = field2(payload, "status");
-        const error = field2(payload, "error");
-        ctx.stdout(error ? `error: ${error}
-` : `${status || event.data}
-`);
-      }
-    }
-    return 0;
-  }
-};
-
-// src/prompt.ts
-import { emitKeypressEvents } from "readline";
-import { createInterface } from "readline/promises";
-async function promptSecret(prompt) {
-  if (!process.stdin.isTTY || !process.stdin.setRawMode) {
-    throw new Error("Interactive login requires a terminal. Set HLIX_API_KEY for CI.");
-  }
-  process.stderr.write(prompt);
-  emitKeypressEvents(process.stdin);
-  process.stdin.setRawMode(true);
-  process.stdin.resume();
-  return new Promise((resolve9, reject) => {
-    let value = "";
-    const cleanup = () => {
-      process.stdin.off("keypress", onKeypress);
-      process.stdin.setRawMode(false);
-      process.stdin.pause();
-      process.stderr.write("\n");
-    };
-    const onKeypress = (character, key) => {
-      if (key.ctrl && key.name === "c" || key.name === "escape") {
-        cleanup();
-        reject(new Error("Login cancelled."));
-        return;
-      }
-      if (key.name === "return" || key.name === "enter") {
-        cleanup();
-        resolve9(value);
-        return;
-      }
-      if (key.name === "backspace") {
-        value = value.slice(0, -1);
-        return;
-      }
-      if (character && !key.ctrl) value += character;
-    };
-    process.stdin.on("keypress", onKeypress);
-  });
-}
-async function promptConfirm(prompt) {
-  if (!process.stdin.isTTY || !process.stderr.isTTY) {
-    throw new Error("Interactive approval requires a terminal. Review with --dry-run, then pass --yes.");
-  }
-  const terminal = createInterface({ input: process.stdin, output: process.stderr });
-  try {
-    const answer = (await terminal.question(`${prompt}
-Continue? [y/N] `)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    terminal.close();
-  }
-}
-
-// src/commands/init.ts
-import { realpath as realpath2 } from "fs/promises";
-import { resolve as resolve5 } from "path";
-
-// src/project/scan.ts
-var import_ignore = __toESM(require_ignore(), 1);
-import { createHash } from "crypto";
-import { createReadStream } from "fs";
-import { lstat, readFile as readFile2, readdir, realpath, stat } from "fs/promises";
-import { basename, join as join4, relative, resolve as resolve4, sep } from "path";
-import { spawnSync } from "child_process";
-
-// src/project/environment.ts
-import { readFile } from "fs/promises";
-import { join as join3 } from "path";
-
-// src/project/gitpod.ts
-function yamlScalar(raw) {
-  const value = raw.trim();
-  if (!value || /^[|>[{]/.test(value)) return null;
-  const quoted = value.match(/^(["'])([\s\S]*)\1$/);
-  if (!quoted && /^["']/.test(value)) return null;
-  return (quoted ? quoted[2].trim() : value.replace(/(?:^|\s)#.*$/, "").trim()) || null;
-}
-function gitpodTasks(source) {
-  const lines = source.split(/\r?\n/);
-  const header = lines.findIndex((line) => /^tasks:\s*(?:#.*)?$/.test(line));
-  if (header === -1) return { tasks: [], partial: /^tasks:\s*\S/m.test(source) };
-  const tasks = [];
-  let partial = false;
-  let fieldIndent = -1;
-  for (const line of lines.slice(header + 1)) {
-    if (!line.trim() || /^\s*#/.test(line)) continue;
-    const indent = line.length - line.trimStart().length;
-    const marker = line.match(/^(\s*-(?:\s+|$))(.*)$/);
-    if (marker) {
-      if (fieldIndent !== -1 && indent >= fieldIndent) continue;
-      tasks.push({});
-      fieldIndent = marker[2] ? marker[1].length : -1;
-      if (!marker[2]) continue;
-    } else if (indent === 0) break;
-    else if (tasks.length === 0) continue;
-    else if (fieldIndent === -1) fieldIndent = indent;
-    else if (indent !== fieldIndent) continue;
-    const field3 = (marker ? marker[2] : line.trim()).match(/^([A-Za-z_][A-Za-z0-9_-]*):\s*(.*)$/);
-    if (!field3) continue;
-    const key = field3[1];
-    if (key !== "name" && key !== "before" && key !== "init" && key !== "command") continue;
-    const value = yamlScalar(field3[2]);
-    if (value === null) partial = true;
-    else tasks[tasks.length - 1][key] = value;
-  }
-  return { tasks, partial };
-}
-
-// src/project/environment.ts
-async function text2(root, path) {
-  try {
-    return await readFile(join3(root, ...path.split("/")), "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-function jsonc(input) {
-  try {
-    const withoutComments = input.replace(/(^|[^:\\])\/\/.*$/gm, "$1").replace(/\/\*[\s\S]*?\*\//g, "").replace(/,\s*([}\]])/g, "$1");
-    return JSON.parse(withoutComments);
-  } catch {
-    return null;
-  }
-}
-function commands(value) {
-  if (typeof value === "string" && value.trim()) return [value.trim()];
-  if (Array.isArray(value)) return value.flatMap(commands);
-  if (value && typeof value === "object") {
-    return Object.values(value).flatMap(commands);
-  }
-  return [];
-}
-function secretKeys(value) {
-  if (!value || typeof value !== "object") return [];
-  return Object.keys(value).filter((key) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
-}
-function envReferenceKeys(content, includeTemplateReferences) {
-  const keys = /* @__PURE__ */ new Set();
-  const patterns = [
-    /\bprocess\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
-    /\bimport\.meta\.env\.([A-Za-z_][A-Za-z0-9_]*)/g,
-    /\bos\.(?:getenv|environ\.get)\(\s*["']([A-Za-z_][A-Za-z0-9_]*)/g,
-    /\bos\.Getenv\(\s*["']([A-Za-z_][A-Za-z0-9_]*)/g,
-    /\bENV\[\s*["']([A-Za-z_][A-Za-z0-9_]*)/g
-  ];
-  if (includeTemplateReferences) {
-    patterns.push(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::[-?][^}]*)?\}/g);
-  }
-  for (const pattern of patterns) {
-    for (const match2 of content.matchAll(pattern)) keys.add(match2[1]);
-  }
-  return [...keys];
-}
-function packageManagerInstall(paths, packageManager) {
-  if (paths.has("bun.lock") || paths.has("bun.lockb") || packageManager?.startsWith("bun@")) {
-    return "bun install --frozen-lockfile";
-  }
-  if (paths.has("pnpm-lock.yaml") || packageManager?.startsWith("pnpm@")) {
-    return "pnpm install --frozen-lockfile";
-  }
-  if (paths.has("yarn.lock") || packageManager?.startsWith("yarn@")) {
-    return "yarn install --immutable";
-  }
-  if (paths.has("package-lock.json") || paths.has("npm-shrinkwrap.json")) return "npm ci";
-  if (paths.has("package.json")) return "npm install";
-  return null;
-}
-function safePort(value) {
-  const port = typeof value === "number" ? value : Number(value);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : null;
-}
-function addSource(sources, path, kind) {
-  if (!sources.some((source) => source.path === path && source.kind === kind)) sources.push({ path, kind });
-}
-async function discoverEnvironment(root, paths, readableText) {
-  const sources = [];
-  const install = [];
-  const build = [];
-  const terminals = [];
-  const ports = /* @__PURE__ */ new Map();
-  const required = /* @__PURE__ */ new Set();
-  const observed = /* @__PURE__ */ new Set();
-  const warnings = [];
-  const toolchain = {};
-  let start = null;
-  let gitpodBefore = 0;
-  const cursorText = await text2(root, ".cursor/environment.json");
-  if (cursorText) {
-    addSource(sources, ".cursor/environment.json", "cursor");
-    const config = jsonc(cursorText);
-    if (!config) warnings.push("Could not parse .cursor/environment.json; it remains quarantined.");
-    else {
-      install.push(...commands(config.install));
-      const starts = commands(config.start);
-      if (starts[0]) start = starts[0];
-      if (Array.isArray(config.terminals)) {
-        for (const raw of config.terminals) {
-          if (!raw || typeof raw !== "object") continue;
-          const item = raw;
-          if (typeof item.command !== "string" || !item.command.trim()) continue;
-          terminals.push({
-            name: typeof item.name === "string" && item.name.trim() ? item.name.trim() : "Terminal",
-            command: item.command.trim(),
-            ...typeof item.cwd === "string" && item.cwd.trim() ? { cwd: item.cwd.trim() } : {}
-          });
-        }
-      }
-    }
-  }
-  const devcontainerPath = paths.has(".devcontainer/devcontainer.json") ? ".devcontainer/devcontainer.json" : paths.has("devcontainer.json") ? "devcontainer.json" : null;
-  if (devcontainerPath) {
-    addSource(sources, devcontainerPath, "devcontainer");
-    const config = jsonc(readableText.get(devcontainerPath) ?? await text2(root, devcontainerPath) ?? "");
-    if (!config) warnings.push(`Could not parse ${devcontainerPath}; it remains quarantined.`);
-    else {
-      install.push(
-        ...commands(config.onCreateCommand),
-        ...commands(config.updateContentCommand),
-        ...commands(config.postCreateCommand)
-      );
-      const postStart = commands(config.postStartCommand);
-      if (!start && postStart[0]) start = postStart[0];
-      for (const key of secretKeys(config.secrets)) required.add(key);
-      for (const key of [...secretKeys(config.containerEnv), ...secretKeys(config.remoteEnv)]) required.add(key);
-      if (Array.isArray(config.forwardPorts)) {
-        for (const value of config.forwardPorts) {
-          const port = safePort(value);
-          if (port) ports.set(port, { port, visibility: "private" });
-        }
-      }
-    }
-  }
-  if (paths.has(".gitpod.yml")) {
-    addSource(sources, ".gitpod.yml", "gitpod");
-    const gitpodText = readableText.get(".gitpod.yml") ?? await text2(root, ".gitpod.yml");
-    if (gitpodText === null) warnings.push("Could not read .gitpod.yml; its task commands were not imported.");
-    else {
-      const gitpod = gitpodTasks(gitpodText);
-      gitpodBefore = gitpod.tasks.filter((task) => task.before).length;
-      for (const task of gitpod.tasks) {
-        if (task.before) install.push(task.before);
-        if (task.init) install.push(task.init);
-        if (!task.command) continue;
-        if (!start) start = task.command;
-        else terminals.push({ name: task.name ?? "Terminal", command: task.command });
-      }
-      if (gitpod.partial) {
-        warnings.push(
-          "Some .gitpod.yml task values are not plain `key: value` scalars and were not imported; review .gitpod.yml before approving cloud setup."
-        );
-      }
-    }
-  }
-  for (const path of ["Dockerfile", "docker-compose.yml", "docker-compose.yaml", "compose.yml", "compose.yaml"]) {
-    if (paths.has(path)) addSource(sources, path, "docker");
-  }
-  for (const path of ["project.toml", "nixpacks.toml", "railpack.json", "Aptfile"]) {
-    if (paths.has(path)) addSource(sources, path, "buildpack");
-  }
-  for (const path of ["fly.toml", "railway.json", "render.yaml", "vercel.json", "netlify.toml"]) {
-    if (paths.has(path)) addSource(sources, path, "platform");
-  }
-  const packageText = readableText.get("package.json") ?? await text2(root, "package.json");
-  if (packageText) {
-    addSource(sources, "package.json", "package");
-    try {
-      const pkg = JSON.parse(packageText);
-      if (pkg.engines?.node) toolchain.node = pkg.engines.node;
-      const inferredInstall = packageManagerInstall(paths, pkg.packageManager);
-      if (inferredInstall && install.length === gitpodBefore) install.push(inferredInstall);
-      if (pkg.scripts?.build && build.length === 0) build.push(`${pkg.packageManager?.split("@")[0] ?? (paths.has("bun.lock") ? "bun" : "npm")} run build`);
-      const dev = pkg.scripts?.dev ? `${paths.has("bun.lock") ? "bun" : "npm"} run dev` : null;
-      const run2 = pkg.scripts?.start ? `${paths.has("bun.lock") ? "bun" : "npm"} run start` : dev;
-      if (!start && run2) start = run2;
-    } catch {
-      warnings.push("Could not parse package.json for environment discovery.");
-    }
-  }
-  if (paths.has("uv.lock")) install.push("uv sync --frozen");
-  else if (paths.has("poetry.lock")) install.push("poetry install --no-interaction");
-  else if (paths.has("requirements.txt")) install.push("python -m pip install -r requirements.txt");
-  if (paths.has("go.mod")) install.push("go mod download");
-  if (paths.has("Procfile")) {
-    addSource(sources, "Procfile", "procfile");
-    const procfile = readableText.get("Procfile") ?? "";
-    const web = procfile.split(/\r?\n/).find((line) => /^web\s*:/.test(line));
-    if (web) start = web.replace(/^web\s*:\s*/, "").trim() || start;
-  }
-  const versions = [
-    [".node-version", "node"],
-    [".nvmrc", "node"],
-    [".python-version", "python"]
-  ];
-  for (const [path, key] of versions) {
-    const value = (readableText.get(path) ?? await text2(root, path))?.trim();
-    if (value) {
-      toolchain[key] = value;
-      addSource(sources, path, "tool-version");
-    }
-  }
-  const toolVersions = readableText.get(".tool-versions") ?? await text2(root, ".tool-versions");
-  if (toolVersions) {
-    addSource(sources, ".tool-versions", "tool-version");
-    for (const raw of toolVersions.split(/\r?\n/)) {
-      const [name, value] = raw.trim().split(/\s+/, 2);
-      if (!value) continue;
-      if (name === "nodejs") toolchain.node = value;
-      else if (name === "python") toolchain.python = value;
-      else if (name === "bun") toolchain.bun = value;
-    }
-  }
-  const mise = readableText.get("mise.toml") ?? await text2(root, "mise.toml");
-  if (mise) {
-    addSource(sources, "mise.toml", "tool-version");
-    for (const match2 of mise.matchAll(/^\s*(node|python|bun)\s*=\s*["']([^"']+)["']/gm)) {
-      toolchain[match2[1]] = match2[2];
-    }
-  }
-  for (const [path, content] of readableText) {
-    const includeTemplateReferences = /(?:^|\/)(?:Dockerfile|Procfile)$/i.test(path) || /\.(?:jsonc?|ya?ml|toml|ini|conf|config|env|sh|bash|zsh|fish)$/i.test(path);
-    for (const key of envReferenceKeys(content, includeTemplateReferences)) observed.add(key);
-    for (const match2 of content.matchAll(/(?:--port(?:=|\s+)|PORT\s*=\s*)(\d{2,5})/g)) {
-      const port = safePort(match2[1]);
-      if (port) ports.set(port, { port, visibility: "private" });
-    }
-  }
-  if (sources.length === 0 && paths.size > 0) addSource(sources, "repository", "detected");
-  const dedupe = (values) => [...new Set(values.filter(Boolean))];
-  const signalCount = sources.length + install.length + (start ? 1 : 0);
-  return {
-    sources: sources.sort((a, b) => a.path.localeCompare(b.path)),
-    toolchain,
-    install: dedupe(install),
-    build: dedupe(build),
-    start,
-    terminals,
-    ports: [...ports.values()].sort((a, b) => a.port - b.port),
-    requiredSecretKeys: [...required].sort(),
-    observedSecretKeys: [...observed].sort(),
-    confidence: signalCount >= 4 ? "high" : signalCount >= 2 ? "medium" : "low",
-    warnings
-  };
-}
-
-// src/project/manifest.ts
-var PROJECT_MANIFEST_VERSION = 2;
-
-// src/project/scan.ts
-var DEFAULT_MAX_FILES = 25e3;
-var DEFAULT_MAX_FILE_BYTES = 50 * 1024 * 1024;
-var DEFAULT_MAX_TOTAL_BYTES = 500 * 1024 * 1024;
-var HISTORY_COMMIT_LIMIT = 1e4;
-var MAX_PROTECTED_FILE_BYTES = 1024 * 1024;
-var MAX_PROTECTED_TOTAL_BYTES = 10 * 1024 * 1024;
-var DEFAULT_IGNORES = [
-  ".git/",
-  ".hlix/",
-  "node_modules/",
-  ".next/",
-  ".turbo/",
-  ".cache/",
-  "dist/",
-  "build/",
-  "coverage/",
-  "__pycache__/",
-  ".venv/",
-  "venv/",
-  "target/",
-  ".DS_Store"
-];
-var SAFE_ENV_EXAMPLE = /(^|\/)\.env\.(example|sample|template)$/i;
-var DOTENV_FILE = /(^|\/)\.env(?:\.[^/]+)?$/i;
-var CREDENTIAL_FILE = /(^|\/)(?:\.envrc|\.netrc|\.npmrc|\.pypirc|credentials(?:\.[^/]+)?(?:\.json|\.toml)?|service-account[^/]*\.json|firebase-adminsdk[^/]*\.json|application_default_credentials\.json|\.docker\/config\.json|\.cargo\/credentials(?:\.toml)?|\.gem\/credentials|\.bundle\/config|(?:pip|pypi)\.conf|\.aws\/credentials|[^/]+\.(?:pem|key|p12|pfx)|terraform\.tfvars(?:\.json)?)$/i;
-var MCP_FILE = /(^|\/)(?:\.mcp\.json|mcp\.json|claude_desktop_config\.json)$/i;
-var AGENT_RESOURCE = /(^|\/)(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.github\/copilot-instructions\.md)$/i;
-var SKILL_RESOURCE = /(^|\/)(?:\.agents|\.claude)\/skills\//i;
-var HIGH_CONFIDENCE_SECRET = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|npm_[A-Za-z0-9]{30,}|gh[opusr]_[A-Za-z0-9_]{30,}|glpat-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{30,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{20,}/;
-var STRUCTURED_CONFIG = /\.(?:json|ya?ml|toml|ini|conf|config)$/i;
-var STRUCTURED_LITERAL_SECRET = /(?:^|[,{\s])(?:["']?(?:api[_-]?key|access[_-]?token|auth(?:orization)?|client[_-]?secret|password|private[_-]?key|secret|token)["']?)\s*(?::|=)\s*["']?(?!\$\{|process\.env|import\.meta\.env|os\.(?:getenv|environ\.get)|<|replace|example|changeme)[A-Za-z0-9+/_=.:-]{12,}/im;
-var RESERVED_CONTROL_ENV = /^HLIX_[A-Za-z0-9_]*$/;
-var AMBIENT_RUNTIME_ENV = /* @__PURE__ */ new Set([
-  "CI",
-  "HOME",
-  "LANG",
-  "LOGNAME",
-  "NODE_ENV",
-  "OLDPWD",
-  "PATH",
-  "PORT",
-  "PWD",
-  "SHELL",
-  "SHLVL",
-  "TERM",
-  "TMPDIR",
-  "USER",
-  "_"
-]);
-function posixPath(path) {
-  return path.split(sep).join("/");
-}
-function git(root, args, maxBuffer = 10 * 1024 * 1024) {
-  return spawnSync("git", ["-C", root, ...args], {
-    encoding: "utf8",
-    maxBuffer,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-}
-async function sha256(path) {
-  const hash2 = createHash("sha256");
-  for await (const chunk of createReadStream(path)) hash2.update(chunk);
-  return hash2.digest("hex");
-}
-function stable(value) {
-  if (Array.isArray(value)) return `[${value.map(stable).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${stable(item)}`).join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-function parseDotenv(content) {
-  const values = {};
-  for (const [index, rawLine] of String(content).replace(/^\uFEFF/, "").split(/\r?\n/).entries()) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-    const assignment = line.startsWith("export ") ? line.slice(7).trimStart() : line;
-    const match2 = assignment.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
-    if (!match2) throw new Error(`Invalid dotenv assignment on line ${index + 1}`);
-    let value = match2[2] ?? "";
-    if (value.startsWith('"')) {
-      if (!value.endsWith('"')) throw new Error(`Unclosed dotenv quote on line ${index + 1}`);
-      value = value.slice(1, -1).replace(/\\n/g, "\n").replace(/\\r/g, "\r");
-    } else if (value.startsWith("'")) {
-      if (!value.endsWith("'")) throw new Error(`Unclosed dotenv quote on line ${index + 1}`);
-      value = value.slice(1, -1);
-    } else {
-      value = value.replace(/\s+#.*$/, "").trimEnd();
-    }
-    values[match2[1]] = value;
-  }
-  return values;
-}
-function hasShellExpansion(rawValue) {
-  let quote = null;
-  for (let index = 0; index < rawValue.length; index += 1) {
-    const char = rawValue[index];
-    if (char === "\\" && quote !== "single") {
-      if (rawValue[index + 1] !== "$") return true;
-      index += 1;
-      continue;
-    }
-    if (char === "'" && quote !== "double") {
-      quote = quote === "single" ? null : "single";
-      continue;
-    }
-    if (char === '"' && quote !== "single") {
-      quote = quote === "double" ? null : "double";
-      continue;
-    }
-    if (quote !== "single" && (char === "$" || char === "`")) return true;
-    if (quote === null && (char === "<" || char === ">") && rawValue[index + 1] === "(") return true;
-  }
-  return quote !== null;
-}
-function parseEnvrcLiterals(content) {
-  const values = {};
-  const keys = /* @__PURE__ */ new Set();
-  const dynamicKeys = /* @__PURE__ */ new Set();
-  for (const rawLine of String(content).replace(/^\uFEFF/, "").split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-    const assignment = line.startsWith("export ") ? line.slice(7).trimStart() : line;
-    const match2 = assignment.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
-    if (!match2) continue;
-    const key = match2[1];
-    const rawValue = match2[2] ?? "";
-    keys.add(key);
-    if (hasShellExpansion(rawValue)) {
-      delete values[key];
-      dynamicKeys.add(key);
-      continue;
-    }
-    try {
-      const parsed = parseDotenv(`${key}=${rawValue}`);
-      const value = parsed[key];
-      if (value === void 0) throw new Error("missing literal");
-      values[key] = rawValue.trimStart().startsWith("'") ? value : value.replace(/\\\$/g, "$");
-      dynamicKeys.delete(key);
-    } catch {
-      delete values[key];
-      dynamicKeys.add(key);
-    }
-  }
-  return { values, keys: [...keys].sort(), dynamicKeys: [...dynamicKeys].sort() };
-}
-async function isSelectedGitRoot(root) {
-  const result = git(root, ["rev-parse", "--show-toplevel"]);
-  if (result.status !== 0) return false;
-  try {
-    return await realpath(result.stdout.trim()) === root;
-  } catch {
-    return false;
-  }
-}
-function trackedFiles(root, isGit) {
-  if (!isGit) return /* @__PURE__ */ new Set();
-  const result = git(root, ["ls-files", "-z"]);
-  if (result.status !== 0) throw new Error("Could not enumerate tracked files.");
-  return new Set(result.stdout.split("\0").filter(Boolean).map(posixPath));
-}
-async function loadIgnore(root) {
-  const hardMatcher = (0, import_ignore.default)().add(DEFAULT_IGNORES);
-  const matcher = (0, import_ignore.default)().add(DEFAULT_IGNORES);
-  for (const name of [".gitignore", ".hlixignore"]) {
-    try {
-      const path = join4(root, name);
-      const metadata = await lstat(path);
-      if (metadata.isFile()) matcher.add(await readFile2(path, "utf8"));
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-    }
-  }
-  return { hardMatcher, matcher };
-}
-function resourceKind(path) {
-  if (MCP_FILE.test(path)) return "mcp";
-  if (SKILL_RESOURCE.test(path)) return "skill";
-  if (AGENT_RESOURCE.test(path)) return "agent";
-  return null;
-}
-function secretKind(path) {
-  if (DOTENV_FILE.test(path) && !SAFE_ENV_EXAMPLE.test(path)) return "dotenv";
-  if (CREDENTIAL_FILE.test(path)) return "credential";
-  return null;
-}
-function inferStack(paths) {
-  if (paths.has("package.json")) return "typescript";
-  if (paths.has("pyproject.toml") || paths.has("requirements.txt")) return "python";
-  if (paths.has("go.mod")) return "go";
-  if (paths.has("Cargo.toml")) return "rust";
-  if (paths.has("composer.json")) return "php";
-  if (paths.has("Gemfile")) return "ruby";
-  return "other";
-}
-function activeDotenvFiles(paths, explicit) {
-  if (explicit) return [posixPath(explicit)];
-  const priority = /* @__PURE__ */ new Map([
-    [".env", 0],
-    [".env.development", 1],
-    [".env.local", 2],
-    [".env.development.local", 3]
-  ]);
-  const active = paths.filter((path) => priority.has(basename(path).toLocaleLowerCase("en-US"))).sort((a, b) => {
-    const directory = a.slice(0, -basename(a).length).localeCompare(b.slice(0, -basename(b).length));
-    return directory || priority.get(basename(a).toLocaleLowerCase("en-US")) - priority.get(basename(b).toLocaleLowerCase("en-US"));
-  });
-  return active.length > 0 ? active : paths.length === 1 ? [...paths] : [];
-}
-function parseMcp(path, content) {
-  try {
-    const parsed = JSON.parse(content);
-    if (!parsed.mcpServers || typeof parsed.mcpServers !== "object") return [];
-    return Object.entries(parsed.mcpServers).map(([name, raw]) => {
-      const server = raw && typeof raw === "object" ? raw : {};
-      const transport = server.type === "http" || server.type === "sse" || server.type === "stdio" ? server.type : typeof server.command === "string" ? "stdio" : typeof server.url === "string" ? "http" : "unknown";
-      const env = server.env && typeof server.env === "object" ? server.env : {};
-      return {
-        sourcePath: path,
-        name,
-        transport,
-        ...typeof server.command === "string" ? { command: server.command } : {},
-        ...Array.isArray(server.args) && server.args.every((arg) => typeof arg === "string") ? { args: server.args } : {},
-        ...typeof server.url === "string" ? { url: server.url } : {},
-        envKeys: Object.keys(env).sort(),
-        enabled: false
-      };
-    });
-  } catch {
-    return [];
-  }
-}
-function parseHistoryOutput(output2, reason) {
-  const findings = [];
-  let commit = "unknown";
-  for (const line of output2.split(/\r?\n/)) {
-    if (line.startsWith("@@")) commit = line.slice(2);
-    else if (line.trim()) findings.push({ commit, path: posixPath(line.trim()), reason });
-    if (findings.length >= 100) break;
-  }
-  return findings;
-}
-function scanHistory(root, isGit) {
-  if (!isGit) {
-    return { head: null, branch: null, refs: [], commitCount: 0, complete: true, findings: [] };
-  }
-  const head = git(root, ["rev-parse", "HEAD"]).stdout.trim() || null;
-  const branchResult = git(root, ["symbolic-ref", "--short", "-q", "HEAD"]);
-  const branch = branchResult.status === 0 ? branchResult.stdout.trim() || null : null;
-  const count = Number.parseInt(git(root, ["rev-list", "--count", "--all"]).stdout.trim(), 10) || 0;
-  const refsResult = git(root, [
-    "for-each-ref",
-    "--format=%(refname)%00%(objectname)",
-    "refs/heads",
-    "refs/tags"
-  ]);
-  const refs = refsResult.stdout.split("\n").filter(Boolean).map((line) => {
-    const [name, oid] = line.split("\0");
-    return { name, oid };
-  }).filter(({ name, oid }) => /^refs\/(?:heads|tags)\/.+/.test(name) && /^[0-9a-f]{40,64}$/.test(oid)).sort((a, b) => a.name.localeCompare(b.name));
-  const common = ["log", "--all", `--max-count=${HISTORY_COMMIT_LIMIT}`, "--pretty=format:@@%H", "--name-only"];
-  const paths = git(root, [...common, "--", ".env", ".env.*", "*.pem", "*.key", ".npmrc", "*.tfvars"]);
-  const patterns = git(root, [
-    "log",
-    "--all",
-    `--max-count=${HISTORY_COMMIT_LIMIT}`,
-    "-G",
-    "BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY|npm_[A-Za-z0-9]{30,}|gh[opusr]_[A-Za-z0-9_]{30,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{20,}",
-    "--pretty=format:@@%H",
-    "--name-only"
-  ]);
-  const dedupe = /* @__PURE__ */ new Map();
-  for (const finding of [
-    ...parseHistoryOutput(paths.stdout, "sensitive-path"),
-    ...parseHistoryOutput(patterns.stdout, "secret-pattern")
-  ]) {
-    dedupe.set(`${finding.commit}:${finding.path}:${finding.reason}`, finding);
-  }
-  return {
-    head,
-    branch,
-    refs,
-    commitCount: count,
-    complete: count <= HISTORY_COMMIT_LIMIT && refs.length <= 1e3 && refsResult.status === 0 && paths.status === 0 && patterns.status === 0,
-    findings: [...dedupe.values()].slice(0, 100)
-  };
-}
-async function scanProject(selectedRoot, options = {}) {
-  const root = await realpath(resolve4(selectedRoot));
-  if (!(await stat(root)).isDirectory()) throw new Error("Import target must be a directory.");
-  const isGit = await isSelectedGitRoot(root);
-  const tracked = trackedFiles(root, isGit);
-  const { hardMatcher, matcher } = await loadIgnore(root);
-  const files = [];
-  const secretFiles = [];
-  const resources = [];
-  const mcpServers = [];
-  const skipped = [];
-  const blocking = [];
-  const selectedEnvPath = options.envFile ? posixPath(relative(root, resolve4(root, options.envFile))) : void 0;
-  const selectedEnvIsContained = selectedEnvPath !== void 0 && selectedEnvPath !== "" && selectedEnvPath !== ".." && !selectedEnvPath.startsWith("../");
-  if (options.envFile && !selectedEnvIsContained) {
-    blocking.push(`Selected environment file must stay inside the project: ${options.envFile}`);
-  }
-  const dotenvValues = /* @__PURE__ */ new Map();
-  const envrcValues = /* @__PURE__ */ new Map();
-  const envrcKeysByPath = /* @__PURE__ */ new Map();
-  const envrcDynamicKeysByPath = /* @__PURE__ */ new Map();
-  const protectedConfigWarnings = [];
-  const protectedFiles = [];
-  const readableText = /* @__PURE__ */ new Map();
-  const maxFiles = options.maxFiles ?? DEFAULT_MAX_FILES;
-  const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
-  const maxTotalBytes = options.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
-  let totalBytes = 0;
-  let protectedBytes = 0;
-  const visit = async (directory) => {
-    const entries = await readdir(directory, { withFileTypes: true });
-    entries.sort((a, b) => a.name.localeCompare(b.name));
-    for (const entry of entries) {
-      const absolute = join4(directory, entry.name);
-      const path = posixPath(relative(root, absolute));
-      if (entry.name === ".git") {
-        if (path !== ".git") blocking.push(`Nested Git repository is not supported: ${path}`);
-        continue;
-      }
-      const metadata = await lstat(absolute);
-      const ignoredPath = entry.isDirectory() ? `${path}/` : path;
-      const isTracked = tracked.has(path);
-      const ignored = !isTracked && matcher.ignores(ignoredPath);
-      const hardIgnored = !isTracked && hardMatcher.ignores(ignoredPath);
-      if (metadata.isSymbolicLink()) {
-        skipped.push({ path, reason: "symlink" });
-        if (!ignored) blocking.push(`Symlinks are not imported in this release: ${path}`);
-        continue;
-      }
-      if (entry.isDirectory()) {
-        if (hardIgnored) continue;
-        await visit(absolute);
-        continue;
-      }
-      const resource = resourceKind(path);
-      const kind = secretKind(path);
-      if (ignored && !resource && !kind) continue;
-      if (!entry.isFile()) {
-        skipped.push({ path, reason: "non-regular-file" });
-        continue;
-      }
-      if (files.length + secretFiles.length + resources.length >= maxFiles) {
-        blocking.push(`Project exceeds the ${maxFiles} file limit.`);
-        return;
-      }
-      if (metadata.size > maxFileBytes) {
-        blocking.push(`File exceeds the ${maxFileBytes} byte limit: ${path}`);
-        continue;
-      }
-      totalBytes += metadata.size;
-      if (totalBytes > maxTotalBytes) {
-        blocking.push(`Project exceeds the ${maxTotalBytes} byte total limit.`);
-        return;
-      }
-      const digest = await sha256(absolute);
-      if (resource) {
-        if (metadata.size > MAX_PROTECTED_FILE_BYTES) {
-          blocking.push(`Protected configuration exceeds the ${MAX_PROTECTED_FILE_BYTES} byte limit: ${path}`);
-          continue;
-        }
-        const content = await readFile2(absolute);
-        protectedBytes += content.byteLength;
-        if (protectedBytes > MAX_PROTECTED_TOTAL_BYTES) {
-          blocking.push(`Protected project files exceed the ${MAX_PROTECTED_TOTAL_BYTES} byte total limit.`);
-          continue;
-        }
-        resources.push({ path, kind: resource, size: metadata.size, sha256: digest });
-        protectedFiles.push({ path, kind: resource, contentBase64: content.toString("base64") });
-        if (resource === "mcp") {
-          mcpServers.push(...parseMcp(path, content.toString("utf8")));
-        }
-        continue;
-      }
-      if (kind) {
-        if (metadata.size > MAX_PROTECTED_FILE_BYTES) {
-          blocking.push(`Protected file exceeds the ${MAX_PROTECTED_FILE_BYTES} byte limit: ${path}`);
-          continue;
-        }
-        const content = await readFile2(absolute);
-        protectedBytes += content.byteLength;
-        if (protectedBytes > MAX_PROTECTED_TOTAL_BYTES) {
-          blocking.push(`Protected project files exceed the ${MAX_PROTECTED_TOTAL_BYTES} byte total limit.`);
-          continue;
-        }
-        let keys = [];
-        if (kind === "dotenv") {
-          try {
-            const values = parseDotenv(content);
-            const importableValues = {};
-            for (const [key, value] of Object.entries(values)) {
-              if (RESERVED_CONTROL_ENV.test(key)) {
-                blocking.push(`Hlix control-plane environment keys cannot be imported into a project: ${key}`);
-                continue;
-              }
-              importableValues[key] = value;
-            }
-            dotenvValues.set(path, importableValues);
-            keys = Object.keys(importableValues).sort();
-          } catch {
-            blocking.push(`Could not parse environment file: ${path}`);
-          }
-        } else if (basename(path) === ".envrc") {
-          const parsed = parseEnvrcLiterals(content);
-          const importableValues = {};
-          const importableKeys = /* @__PURE__ */ new Set();
-          const importableDynamicKeys = [];
-          for (const [key, value] of Object.entries(parsed.values)) {
-            if (RESERVED_CONTROL_ENV.test(key)) {
-              blocking.push(`Hlix control-plane environment keys cannot be imported into a project: ${key}`);
-              continue;
-            }
-            if (AMBIENT_RUNTIME_ENV.has(key)) {
-              protectedConfigWarnings.push(`Ignored ambient runtime assignment in ${path}: ${key}`);
-              continue;
-            }
-            importableKeys.add(key);
-            importableValues[key] = value;
-          }
-          envrcValues.set(path, importableValues);
-          for (const key of parsed.dynamicKeys) {
-            if (RESERVED_CONTROL_ENV.test(key)) {
-              blocking.push(`Hlix control-plane environment keys cannot be imported into a project: ${key}`);
-              continue;
-            }
-            if (AMBIENT_RUNTIME_ENV.has(key)) {
-              protectedConfigWarnings.push(`Ignored ambient runtime assignment in ${path}: ${key}`);
-              continue;
-            }
-            importableKeys.add(key);
-            importableDynamicKeys.push(key);
-          }
-          envrcKeysByPath.set(path, [...importableKeys].sort());
-          envrcDynamicKeysByPath.set(path, importableDynamicKeys.sort());
-          keys = [...importableKeys].sort();
-          if (importableDynamicKeys.length > 0) {
-            protectedConfigWarnings.push(
-              `Did not execute dynamic .envrc assignments; collect their resolved local values when available: ${importableDynamicKeys.join(", ")}`
-            );
-          }
-        }
-        secretFiles.push({ path, kind, keys, size: metadata.size, sha256: digest });
-        protectedFiles.push({ path, kind, contentBase64: content.toString("base64") });
-        continue;
-      }
-      if (metadata.size <= 1024 * 1024) {
-        const content = await readFile2(absolute);
-        const preview = content.toString("utf8");
-        readableText.set(path, preview);
-        if (HIGH_CONFIDENCE_SECRET.test(preview) || STRUCTURED_CONFIG.test(path) && STRUCTURED_LITERAL_SECRET.test(preview)) {
-          protectedBytes += content.byteLength;
-          if (protectedBytes > MAX_PROTECTED_TOTAL_BYTES) {
-            blocking.push(`Protected project files exceed the ${MAX_PROTECTED_TOTAL_BYTES} byte total limit.`);
-            continue;
-          }
-          secretFiles.push({ path, kind: "detected-content", keys: [], size: metadata.size, sha256: digest });
-          protectedFiles.push({ path, kind: "detected-content", contentBase64: content.toString("base64") });
-          continue;
-        }
-      }
-      files.push({
-        path,
-        size: metadata.size,
-        sha256: digest,
-        tracked: isTracked,
-        executable: (metadata.mode & 73) !== 0
-      });
-    }
-  };
-  await visit(root);
-  files.sort((a, b) => a.path.localeCompare(b.path));
-  secretFiles.sort((a, b) => a.path.localeCompare(b.path));
-  resources.sort((a, b) => a.path.localeCompare(b.path));
-  mcpServers.sort((a, b) => `${a.sourcePath}:${a.name}`.localeCompare(`${b.sourcePath}:${b.name}`));
-  const activeEnvFiles = activeDotenvFiles(
-    [...dotenvValues.keys()].sort(),
-    selectedEnvIsContained ? selectedEnvPath : void 0
-  );
-  if (options.envFile && selectedEnvIsContained && !dotenvValues.has(activeEnvFiles[0])) {
-    blocking.push(`Selected environment file was not found or is not a dotenv file: ${options.envFile}`);
-  }
-  const byKey = /* @__PURE__ */ new Map();
-  for (const [path, values] of dotenvValues) {
-    for (const key of Object.keys(values)) byKey.set(key, [...byKey.get(key) ?? [], path]);
-  }
-  for (const [path, keys] of envrcKeysByPath) {
-    for (const key of keys) byKey.set(key, [...byKey.get(key) ?? [], path]);
-  }
-  const envCollisions = [...byKey].filter(([, paths]) => paths.length > 1).map(([key, paths]) => ({ key, paths: paths.sort() })).sort((a, b) => a.key.localeCompare(b.key));
-  const secretValues = {};
-  for (const path of activeEnvFiles) Object.assign(secretValues, dotenvValues.get(path) ?? {});
-  const orderedEnvrcFiles = [...envrcValues.keys()].sort((a, b) => {
-    if (a === ".envrc") return 1;
-    if (b === ".envrc") return -1;
-    return a.localeCompare(b);
-  });
-  const winningEnvrcDynamicKeys = /* @__PURE__ */ new Set();
-  for (const path of orderedEnvrcFiles) {
-    const dynamicKeys = new Set(envrcDynamicKeysByPath.get(path) ?? []);
-    for (const key of envrcKeysByPath.get(path) ?? []) {
-      if (dynamicKeys.has(key)) {
-        delete secretValues[key];
-        winningEnvrcDynamicKeys.add(key);
-        continue;
-      }
-      const value = envrcValues.get(path)?.[key];
-      if (value !== void 0) secretValues[key] = value;
-      winningEnvrcDynamicKeys.delete(key);
-    }
-  }
-  const historyMode = options.historyMode ?? "abort_on_findings";
-  const history = scanHistory(root, isGit);
-  if (!history.complete && historyMode !== "preserve") {
-    blocking.push(`Git history scan exceeded ${HISTORY_COMMIT_LIMIT} commits or failed; import requires explicit --history preserve.`);
-  }
-  if (history.findings.length > 0 && historyMode === "abort_on_findings") {
-    blocking.push("Potential secrets exist in Git history. Abort, sanitize the repository, or explicitly use --history preserve.");
-  }
-  const pathSet = new Set(files.map((file) => file.path));
-  const discoveredEnvironment = await discoverEnvironment(root, pathSet, readableText);
-  const { observedSecretKeys, ...environment } = discoveredEnvironment;
-  environment.warnings.push(...protectedConfigWarnings);
-  const requiredSecretKeys = new Set(environment.requiredSecretKeys);
-  for (const key of winningEnvrcDynamicKeys) requiredSecretKeys.add(key);
-  for (const server of mcpServers) {
-    for (const key of server.envKeys) requiredSecretKeys.add(key);
-  }
-  environment.requiredSecretKeys = [...requiredSecretKeys].sort();
-  for (const key of environment.requiredSecretKeys) {
-    if (RESERVED_CONTROL_ENV.test(key)) {
-      blocking.push(`Hlix control-plane environment keys cannot be imported into a project: ${key}`);
-      continue;
-    }
-    if (secretValues[key] !== void 0) continue;
-    const value = options.environment?.[key];
-    if (value === void 0) {
-      blocking.push(`Required project environment value was not found locally: ${key}`);
-      continue;
-    }
-    secretValues[key] = value;
-  }
-  for (const key of observedSecretKeys) {
-    if (RESERVED_CONTROL_ENV.test(key)) {
-      environment.warnings.push(`Ignored reserved Hlix control-plane environment reference: ${key}`);
-      continue;
-    }
-    if (AMBIENT_RUNTIME_ENV.has(key)) continue;
-    if (secretValues[key] !== void 0) continue;
-    const value = options.environment?.[key];
-    if (value === void 0) {
-      environment.warnings.push(`Observed environment reference has no local value: ${key}`);
-      continue;
-    }
-    secretValues[key] = value;
-  }
-  environment.warnings = [...new Set(environment.warnings)].sort();
-  const manifest = {
-    schemaVersion: PROJECT_MANIFEST_VERSION,
-    rootName: options.rootName ?? basename(root),
-    stack: inferStack(pathSet),
-    git: {
-      detected: isGit,
-      head: history.head,
-      branch: history.branch,
-      refs: history.refs,
-      commitCount: history.commitCount,
-      historyScanComplete: history.complete,
-      historyMode
-    },
-    files,
-    secretFiles,
-    activeEnvFiles,
-    secretKeys: Object.keys(secretValues).sort(),
-    envCollisions,
-    quarantinedResources: resources,
-    mcpServers,
-    historicalSecretFindings: history.findings,
-    skipped,
-    environment,
-    totals: { files: files.length, bytes: files.reduce((sum, file) => sum + file.size, 0) }
-  };
-  const manifestJson = stable(manifest);
-  const manifestSha256 = createHash("sha256").update(manifestJson).digest("hex");
-  return {
-    root,
-    manifest,
-    manifestJson,
-    manifestSha256,
-    secretValues,
-    protectedFiles: protectedFiles.sort((a, b) => a.path.localeCompare(b.path)),
-    blocking: [...new Set(blocking)]
-  };
-}
-
-// src/commands/init.ts
-var initProject = {
-  name: "init",
-  summary: "Configure a local folder for Hlix",
-  usage: [
-    "Usage: hlix init [folder] [--json]",
-    "",
-    "Creates .hlix/config.json, .hlix/.gitignore, and .hlixignore.",
-    "Project configuration is safe to commit; local revision state is ignored."
-  ].join("\n"),
-  supportsJson: true,
-  args: { min: 0, max: 1 },
-  async run(ctx) {
-    if (ctx.args.length > 1) throw new Error("init accepts at most one folder.");
-    const root = await realpath2(resolve5(ctx.cwd, ctx.args[0] ?? "."));
-    const target = resolveTarget({ env: ctx.env, flags: ctx.flags, cwd: root });
-    if (target.conflict) throw new CliError("workspace_mismatch", target.conflict);
-    if (!target.workspaceId) {
-      throw new Error("No workspace selected. Run `hlix auth login --workspace <id>` first.");
-    }
-    await ctx.requireClient(root).projects.list();
-    const existing = readProjectConfig(root);
-    const config = existing ?? {
-      schemaVersion: 1,
-      workspaceId: target.workspaceId,
-      apiUrl: target.baseUrl
-    };
-    writeProjectConfig(root, config);
-    const scan = await scanProject(root, { environment: ctx.env });
-    const data = {
-      root,
-      config,
-      scan: {
-        files: scan.manifest.totals.files,
-        bytes: scan.manifest.totals.bytes,
-        secretFiles: scan.manifest.secretFiles.map((file) => file.path),
-        quarantinedResources: scan.manifest.quarantinedResources.map((item) => item.path),
-        blocking: scan.blocking
-      }
-    };
-    if (ctx.json) ctx.stdout(renderJson(jsonSuccess(initProject.name, data)));
-    else {
-      ctx.stdout(
-        `Initialized ${root}
-Project: ${config.projectId ?? "not imported yet"}
-Workspace: ${config.workspaceId}
-`
-      );
-      if (scan.blocking.length) {
-        ctx.stdout(`
-Review before import:
-${scan.blocking.map((item) => `- ${item}`).join("\n")}
-`);
-      }
-    }
-    return 0;
-  }
-};
-
-// src/commands/import.ts
-import { createHash as createHash3 } from "crypto";
-import { readFile as readFile3, realpath as realpath3 } from "fs/promises";
-import { basename as basename2, resolve as resolve6 } from "path";
-
-// src/project/snapshot.ts
-import { createHash as createHash2 } from "crypto";
-import { createReadStream as createReadStream2 } from "fs";
-import {
-  chmod,
-  copyFile,
-  lstat as lstat2,
-  mkdir,
-  mkdtemp,
-  readdir as readdir2,
-  rm
-} from "fs/promises";
-import { tmpdir } from "os";
-import { dirname as dirname4, join as join5 } from "path";
-import { spawnSync as spawnSync2 } from "child_process";
-function run(cwd, args) {
-  const result = spawnSync2("git", ["-C", cwd, ...args], {
-    encoding: "utf8",
-    maxBuffer: 20 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (result.status !== 0) {
-    const detail = result.stderr.trim().split("\n").at(-1) ?? "git command failed";
-    throw new Error(detail);
-  }
-  return result.stdout.trim();
-}
-async function hash(path) {
-  const digest = createHash2("sha256");
-  for await (const chunk of createReadStream2(path)) digest.update(chunk);
-  return digest.digest("hex");
-}
-async function emptyWorkingTree(repo) {
-  for (const entry of await readdir2(repo)) {
-    if (entry === ".git") continue;
-    await rm(join5(repo, entry), { recursive: true, force: true });
-  }
-}
-async function createProjectSnapshot(scan) {
-  if (scan.blocking.length > 0) {
-    throw new Error(`Project scan has blocking findings:
-- ${scan.blocking.join("\n- ")}`);
-  }
-  const temporary = await mkdtemp(join5(tmpdir(), "hlix-snapshot-"));
-  await chmod(temporary, 448);
-  const repo = join5(temporary, "repo");
-  const mirror = join5(temporary, "source.git");
-  const bundlePath = join5(temporary, "project.bundle");
-  try {
-    if (scan.manifest.git.detected) {
-      const mirrorResult = spawnSync2("git", ["clone", "--mirror", "--no-hardlinks", scan.root, mirror], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      if (mirrorResult.status !== 0) throw new Error(mirrorResult.stderr.trim() || "Could not mirror repository.");
-      const mirroredRefs = new Map(
-        run(mirror, [
-          "for-each-ref",
-          "--format=%(refname)%00%(objectname)",
-          "refs/heads",
-          "refs/tags"
-        ]).split("\n").filter(Boolean).map((line) => line.split("\0", 2))
-      );
-      for (const ref of scan.manifest.git.refs) {
-        if (mirroredRefs.get(ref.name) !== ref.oid) throw new Error(`Git ref changed after scan: ${ref.name}`);
-      }
-      const cloneResult = spawnSync2("git", ["clone", "--no-hardlinks", mirror, repo], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      if (cloneResult.status !== 0) throw new Error(cloneResult.stderr.trim() || "Could not create snapshot clone.");
-      if (!scan.manifest.git.head) throw new Error("Git repository has no HEAD commit.");
-      run(repo, ["checkout", "-B", "main", scan.manifest.git.head]);
-    } else {
-      await mkdir(repo, { recursive: true, mode: 448 });
-      run(repo, ["init", "-b", "main"]);
-    }
-    await emptyWorkingTree(repo);
-    for (const file of scan.manifest.files) {
-      const source = join5(scan.root, ...file.path.split("/"));
-      const sourceEntry = await lstat2(source);
-      if (!sourceEntry.isFile() || sourceEntry.isSymbolicLink()) {
-        throw new Error(`Source changed after scan: ${file.path}`);
-      }
-      if (sourceEntry.size !== file.size || await hash(source) !== file.sha256) {
-        throw new Error(`Source changed after scan: ${file.path}`);
-      }
-      const destination = join5(repo, ...file.path.split("/"));
-      await mkdir(dirname4(destination), { recursive: true, mode: 493 });
-      await copyFile(source, destination);
-      await chmod(destination, file.executable ? 493 : 420);
-    }
-    run(repo, ["config", "user.name", "Hlix Import"]);
-    run(repo, ["config", "user.email", "import@hlix.ai"]);
-    run(repo, ["add", "-A"]);
-    run(repo, ["commit", "--allow-empty", "-m", "chore(hlix): import snapshot"]);
-    const commitSha = run(repo, ["rev-parse", "HEAD"]);
-    const refsToCreate = scan.manifest.git.refs.filter((ref) => ref.name !== "refs/heads/main");
-    if (refsToCreate.length > 0) {
-      const updateResult = spawnSync2("git", ["-C", repo, "update-ref", "--stdin"], {
-        encoding: "utf8",
-        input: refsToCreate.map((ref) => `update ${ref.name} ${ref.oid}`).join("\n") + "\n",
-        stdio: ["pipe", "pipe", "pipe"]
-      });
-      if (updateResult.status !== 0) {
-        throw new Error(updateResult.stderr.trim() || "Could not recreate the approved Git refs.");
-      }
-    }
-    const approvedRefs = refsToCreate.map((ref) => ref.name);
-    const bundleResult = spawnSync2("git", ["-C", repo, "bundle", "create", bundlePath, "--stdin"], {
-      encoding: "utf8",
-      input: ["refs/heads/main", ...approvedRefs].join("\n") + "\n",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    if (bundleResult.status !== 0) {
-      throw new Error(bundleResult.stderr.trim() || "Could not create the approved Git bundle.");
-    }
-    run(repo, ["bundle", "verify", bundlePath]);
-    await chmod(bundlePath, 384);
-    const bundleSize = (await lstat2(bundlePath)).size;
-    const bundleSha256 = await hash(bundlePath);
-    return {
-      bundlePath,
-      bundleSha256,
-      bundleSize,
-      commitSha,
-      dispose: () => rm(temporary, { recursive: true, force: true })
-    };
-  } catch (error) {
-    await rm(temporary, { recursive: true, force: true });
-    throw error;
-  }
-}
-
-// src/commands/import.ts
-function flagString(flags, name) {
-  const value = flags[name];
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function idempotencyKey(manifestSha256, bundleSha256) {
-  return createHash3("sha256").update(`project-import-v1\0${manifestSha256}\0${bundleSha256}`).digest("hex");
-}
-function trustPrompt(scan) {
-  const setup = scan.manifest.environment.install;
-  const protectedCount = scan.manifest.secretFiles.length + scan.manifest.quarantinedResources.length;
-  if (setup.length === 0 && protectedCount === 0 && scan.manifest.secretKeys.length === 0) return null;
-  const lines = [
-    "Hlix will upload this project and encrypted protected files to your selected workspace."
-  ];
-  if (setup.length > 0) {
-    lines.push("Detected cloud setup commands:", ...setup.map((command) => `- ${command}`));
-  }
-  if (scan.manifest.secretKeys.length > 0) {
-    lines.push(
-      "Project secret keys available to cloud tasks:",
-      ...scan.manifest.secretKeys.map((key) => `- ${key}`)
-    );
-  }
-  if (scan.manifest.quarantinedResources.length > 0) {
-    lines.push(
-      "Quarantined resources (preserved but not activated):",
-      ...scan.manifest.quarantinedResources.map((item) => `- ${item.kind}: ${item.path}`)
-    );
-  }
-  if (scan.manifest.environment.warnings.length > 0) {
-    lines.push(
-      "Environment warnings:",
-      ...scan.manifest.environment.warnings.map((warning) => `- ${warning}`)
-    );
-  }
-  lines.push("Setup runs inside the isolated Coding Workspace and may access project secrets.");
-  return lines.join("\n");
-}
-var importProject = {
-  name: "import",
-  summary: "Import a local project into your Hlix workspace",
-  usage: [
-    "Usage: hlix import [folder] [options]",
-    "",
-    "Options:",
-    "  --dry-run                 Scan and report without uploading",
-    "  --env-file <path>         Override automatic development dotenv precedence",
-    "  --history <mode>          abort-on-findings (default) or preserve",
-    "  --name <name>             Cloud project name (defaults to folder name)",
-    "  --stack <stack>           Override detected stack",
-    "  --yes                     Approve the reviewed upload and cloud setup",
-    "  --json                    Machine-readable output (never contains secret values)"
-  ].join("\n"),
-  supportsJson: true,
-  options: ["dry-run", "env-file", "history", "name", "stack", "yes"],
-  args: { min: 0, max: 1 },
-  async run(ctx) {
-    if (ctx.args.length > 1) throw new Error("import accepts at most one folder.");
-    const root = await realpath3(resolve6(ctx.cwd, ctx.args[0] ?? "."));
-    const target = resolveTarget({ env: ctx.env, flags: ctx.flags, cwd: root });
-    if (target.conflict) throw new CliError("workspace_mismatch", target.conflict);
-    if (!target.workspaceId || !target.credential) {
-      throw new CliError(
-        "workspace_required",
-        "No workspace selected. Run `hlix auth login --workspace <id>` first."
-      );
-    }
-    const existing = readProjectConfig(root);
-    if (existing?.projectId) {
-      throw new CliError(
-        "already_imported",
-        "This folder is already bound to an Hlix project. Use `hlix push`."
-      );
-    }
-    const historyFlag = flagString(ctx.flags, "history");
-    if (historyFlag && historyFlag !== "preserve" && historyFlag !== "abort-on-findings") {
-      throw new Error("--history must be `abort-on-findings` or `preserve`.");
-    }
-    if (!existing && ctx.flags["dry-run"] !== true) {
-      writeProjectConfig(root, {
-        schemaVersion: 1,
-        workspaceId: target.workspaceId,
-        apiUrl: target.baseUrl
-      });
-    }
-    const scan = await scanProject(root, {
-      ...flagString(ctx.flags, "env-file") ? { envFile: flagString(ctx.flags, "env-file") } : {},
-      environment: ctx.env,
-      historyMode: historyFlag === "preserve" ? "preserve" : "abort_on_findings"
-    });
-    if (ctx.flags["dry-run"] !== true && scan.blocking.length === 0) {
-      const prompt = trustPrompt(scan);
-      if (prompt && ctx.flags.yes !== true) {
-        if (ctx.json || !ctx.confirm) {
-          throw new CliError(
-            "approval_required",
-            "Import needs approval for protected files or cloud setup. Review with `hlix import --dry-run`, then repeat with `--yes`."
-          );
-        }
-        if (!await ctx.confirm(prompt)) {
-          throw new CliError("cancelled", "Import cancelled.");
-        }
-      }
-    }
-    const report = {
-      root,
-      name: flagString(ctx.flags, "name") ?? basename2(root),
-      stack: flagString(ctx.flags, "stack") ?? scan.manifest.stack,
-      files: scan.manifest.totals.files,
-      bytes: scan.manifest.totals.bytes,
-      activeEnvFiles: scan.manifest.activeEnvFiles,
-      secretKeys: scan.manifest.secretKeys,
-      protectedFiles: scan.manifest.secretFiles.length + scan.manifest.quarantinedResources.length,
-      environment: scan.manifest.environment,
-      historicalSecretFindings: scan.manifest.historicalSecretFindings,
-      quarantinedResources: scan.manifest.quarantinedResources,
-      mcpServers: scan.manifest.mcpServers,
-      skipped: scan.manifest.skipped,
-      blocking: scan.blocking,
-      manifestSha256: scan.manifestSha256
-    };
-    if (ctx.flags["dry-run"] === true) {
-      if (ctx.json) ctx.stdout(renderJson(jsonSuccess(importProject.name, report)));
-      else {
-        const protectedPaths = [
-          ...scan.manifest.secretFiles.map((item) => `${item.kind}: ${item.path}`),
-          ...scan.manifest.quarantinedResources.map((item) => `${item.kind}: ${item.path}`)
-        ];
-        ctx.stdout(
-          [
-            `Project: ${report.name}`,
-            `Stack: ${report.stack}`,
-            `Files: ${report.files}`,
-            `Bytes: ${report.bytes}`,
-            `Environment confidence: ${report.environment.confidence}`,
-            `History findings: ${report.historicalSecretFindings.length}`,
-            "",
-            "Environment evidence:",
-            ...report.environment.sources.length ? report.environment.sources.map(
-              (source) => `- ${source.kind}: ${source.path}`
-            ) : ["- none detected"],
-            "",
-            "Cloud setup commands:",
-            ...report.environment.install.length ? report.environment.install.map((command) => `- ${command}`) : ["- none detected"],
-            "",
-            "Required secret keys:",
-            ...report.environment.requiredSecretKeys.length ? report.environment.requiredSecretKeys.map((key) => `- ${key}`) : ["- none detected"],
-            "",
-            "Collected secret keys:",
-            ...report.secretKeys.length ? report.secretKeys.map((key) => `- ${key}`) : ["- none detected"],
-            "",
-            "Protected and quarantined paths:",
-            ...protectedPaths.length ? protectedPaths.map((path) => `- ${path}`) : ["- none"],
-            "",
-            "Environment warnings:",
-            ...report.environment.warnings.length ? report.environment.warnings.map((warning) => `- ${warning}`) : ["- none"],
-            ...report.blocking.length ? ["", "Blocking findings:", ...report.blocking.map((item) => `- ${item}`)] : []
-          ].join("\n") + "\n"
-        );
-      }
-      return scan.blocking.length ? 1 : 0;
-    }
-    if (scan.blocking.length) {
-      throw new CliError(
-        "scan_blocked",
-        `Project scan blocked import:
-- ${scan.blocking.join("\n- ")}`
-      );
-    }
-    const snapshot = await createProjectSnapshot(scan);
-    try {
-      const client = ctx.requireClient(root);
-      const created = await client.imports.create({
-        idempotencyKey: idempotencyKey(scan.manifestSha256, snapshot.bundleSha256),
-        name: report.name,
-        stack: report.stack,
-        defaultBranch: "main",
-        historyMode: scan.manifest.git.historyMode,
-        manifest: scan.manifest,
-        manifestSha256: scan.manifestSha256,
-        bundleSha256: snapshot.bundleSha256,
-        bundleSize: snapshot.bundleSize,
-        commitSha: snapshot.commitSha
-      });
-      if (created.import.status === "pending_upload") {
-        if (!created.upload) {
-          throw new Error(
-            `Import ${created.import.id} is ${created.import.status} but has no upload target.`
-          );
-        }
-        await client.imports.uploadBundle(
-          created.upload,
-          new Blob([Uint8Array.from(await readFile3(snapshot.bundlePath))]),
-          {
-            onProgress: (uploaded, total) => {
-              if (!ctx.json) ctx.stderr(`Uploading ${uploaded}/${total} bytes\r`);
-            }
-          }
-        );
-      }
-      const finalized = created.import.status === "ready" ? { import: created.import } : await client.imports.finalize(created.import.id, {
-        secrets: scan.secretValues,
-        protectedFiles: scan.protectedFiles
-      });
-      const imported = finalized.import;
-      const projectId = imported.projectId ?? imported.requestedProjectId;
-      if (!projectId || !imported.revisionId || !imported.generation) {
-        throw new Error("Import completed without project revision metadata.");
-      }
-      writeProjectConfig(root, {
-        schemaVersion: 1,
-        projectId,
-        workspaceId: target.workspaceId,
-        apiUrl: target.baseUrl
-      });
-      writeProjectState(root, {
-        schemaVersion: 1,
-        revisionId: imported.revisionId,
-        generation: imported.generation,
-        commitSha: snapshot.commitSha,
-        manifestSha256: scan.manifestSha256,
-        historyMode: scan.manifest.git.historyMode,
-        rootName: scan.manifest.rootName
-      });
-      const result = {
-        projectId,
-        revisionId: imported.revisionId,
-        generation: imported.generation,
-        commitSha: snapshot.commitSha,
-        files: scan.manifest.totals.files,
-        bytes: scan.manifest.totals.bytes
-      };
-      if (ctx.json) ctx.stdout(renderJson(jsonSuccess(importProject.name, result)));
-      else {
-        ctx.stderr("\n");
-        ctx.stdout(
-          `Imported ${report.name}
-Project ID: ${projectId}
-Revision: ${imported.generation}
-`
-        );
-      }
-      return 0;
-    } finally {
-      await snapshot.dispose();
-    }
-  }
-};
-
-// src/commands/status.ts
-var messageOf2 = (error) => error instanceof Error ? error.message : String(error);
-async function localState(ctx, root, historyMode, rootName, base) {
-  try {
-    const scan = await scanProject(root, { historyMode, environment: ctx.env, rootName });
-    return {
-      files: scan.manifest.totals.files,
-      manifestSha256: scan.manifestSha256,
-      changed: base ? scan.manifestSha256 !== base : null,
-      blocking: scan.blocking,
-      error: null
-    };
-  } catch (error) {
-    return { files: null, manifestSha256: null, changed: null, blocking: [], error: messageOf2(error) };
-  }
-}
-var statusCommand = {
-  name: "status",
-  summary: "Show the workspace, folder binding, and local-vs-cloud drift",
-  usage: [
-    "Usage: hlix status [--cwd <dir>] [--json]",
-    "",
-    "Reports the resolved workspace and API with the source that decided each,",
-    "whether this folder is bound to a project, and whether the working tree or",
-    "the cloud head has moved since the last sync. Every finding is a line in",
-    "the output, so the command itself always exits 0; only an argument error",
-    "(rejected before it runs) exits 2."
-  ].join("\n"),
-  supportsJson: true,
-  async run(ctx) {
-    const target = resolveTarget({ env: ctx.env, flags: ctx.flags, cwd: ctx.cwd });
-    const binding2 = target.binding;
-    const state = binding2 ? readProjectState(binding2.root) : null;
-    const local = binding2 ? await localState(
-      ctx,
-      binding2.root,
-      state?.historyMode ?? "preserve",
-      state?.rootName,
-      state?.manifestSha256
-    ) : null;
-    let cloud = null;
-    if (binding2?.config.projectId && target.credential && !target.conflict) {
-      try {
-        const head = (await ctx.requireClient().revisions.head(binding2.config.projectId)).revision;
-        cloud = {
-          revisionId: head.id,
-          generation: head.generation,
-          changed: state ? head.id !== state.revisionId || head.generation !== state.generation : null,
-          error: null
-        };
-      } catch (error) {
-        cloud = { revisionId: "", generation: 0, changed: null, error: errorCode(error).code };
-      }
-    }
-    const data = {
-      cwd: ctx.cwd,
-      workspace: { id: target.workspaceId, source: target.workspaceSource },
-      api: { baseUrl: target.baseUrl, source: target.baseUrlSource },
-      credential: {
-        present: target.credential !== null,
-        source: target.credentialSource,
-        path: target.credentialPath
-      },
-      conflict: target.conflict,
-      project: binding2 ? {
-        root: binding2.root,
-        projectId: binding2.config.projectId ?? null,
-        workspaceId: binding2.config.workspaceId,
-        apiUrl: binding2.config.apiUrl
-      } : null,
-      revision: state ? { id: state.revisionId, generation: state.generation, commitSha: state.commitSha } : null,
-      local,
-      cloud
-    };
-    if (ctx.json) {
-      ctx.stdout(renderJson(jsonSuccess(statusCommand.name, data)));
-      return 0;
-    }
-    const fields = [
-      ["folder", ctx.cwd],
-      ["workspace", target.workspaceId ? `${target.workspaceId} (from ${target.workspaceSource})` : "none \u2014 run `hlix auth login --workspace <id>`"],
-      ["api", `${target.baseUrl} (from ${target.baseUrlSource})`],
-      [
-        "credential",
-        target.credential ? target.credentialSource === "env" ? "environment (HLIX_API_KEY)" : `file (${target.credentialPath})` : "none \u2014 run `hlix auth login`"
-      ],
-      [
-        "project",
-        binding2 ? binding2.config.projectId ?? `initialized at ${binding2.root}, not imported yet` : "none \u2014 run `hlix import .` to bind this folder"
-      ]
-    ];
-    if (state) fields.push(["revision", `generation ${state.generation} (${state.revisionId})`]);
-    if (local) {
-      fields.push([
-        "local",
-        local.error ? `could not scan: ${local.error}` : local.changed === null ? `${local.files} files, no synced base revision` : local.changed ? `${local.files} files, modified since the last sync` : `${local.files} files, matches the last sync`
-      ]);
-      if (local.blocking.length > 0) {
-        fields.push(["blocking", local.blocking.join("; ")]);
-      }
-    }
-    if (cloud) {
-      fields.push([
-        "cloud",
-        cloud.error ? `not checked: ${cloud.error}` : cloud.changed ? `generation ${cloud.generation} available \u2014 run \`hlix pull\`` : `generation ${cloud.generation}, up to date`
-      ]);
-    }
-    if (target.conflict) fields.push(["conflict", target.conflict]);
-    ctx.stdout(`${renderFields(fields)}
-`);
-    return 0;
-  }
-};
-
-// src/commands/sync.ts
-import { createHash as createHash5 } from "crypto";
-import { readFile as readFile4, realpath as realpath5 } from "fs/promises";
-
-// src/project/apply.ts
-import { createHash as createHash4 } from "crypto";
-import { constants as constants3 } from "fs";
-import {
-  chmod as chmod2,
-  copyFile as copyFile2,
-  lstat as lstat3,
-  mkdir as mkdir2,
-  mkdtemp as mkdtemp2,
-  open,
-  realpath as realpath4,
-  rename,
-  rm as rm2,
-  writeFile
-} from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname5, join as join6, relative as relative2, resolve as resolve7, sep as sep2 } from "path";
-import { spawnSync as spawnSync3 } from "child_process";
-function manifestIdentity(manifest) {
-  let value = manifest;
-  if (typeof value === "string") {
-    try {
-      value = JSON.parse(value);
-    } catch {
-      return {};
-    }
-  }
-  if (!value || typeof value !== "object") return {};
-  const record = value;
-  const git3 = record.git && typeof record.git === "object" ? record.git : {};
-  const historyMode = git3.historyMode === "preserve" || git3.historyMode === "abort_on_findings" ? git3.historyMode : void 0;
-  const rootName = typeof record.rootName === "string" && record.rootName.trim() ? record.rootName : void 0;
-  return { historyMode, rootName };
-}
-function manifestFiles(manifest) {
-  let value = manifest;
-  if (typeof value === "string") {
-    try {
-      value = JSON.parse(value);
-    } catch {
-      return [];
-    }
-  }
-  if (!value || typeof value !== "object") return [];
-  const files = value.files;
-  if (!Array.isArray(files)) return [];
-  return files.flatMap((entry) => {
-    if (!entry || typeof entry !== "object") return [];
-    const record = entry;
-    return typeof record.path === "string" && typeof record.sha256 === "string" ? [{ path: record.path, sha256: record.sha256 }] : [];
-  });
-}
-function git2(root, args) {
-  const result = spawnSync3("git", ["-C", root, ...args], {
-    encoding: "utf8",
-    maxBuffer: 50 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  if (result.status !== 0) throw new Error(result.stderr.trim().split("\n").at(-1) ?? "Git command failed");
-  return result.stdout.trim();
-}
-function sha2562(bytes) {
-  return createHash4("sha256").update(bytes).digest("hex");
-}
-async function assertSafeParent(root, path) {
-  const absoluteRoot = await realpath4(root);
-  const target = resolve7(absoluteRoot, ...path.split("/"));
-  if (target !== absoluteRoot && !target.startsWith(absoluteRoot + sep2)) throw new Error(`Protected path escapes the project: ${path}`);
-  const rel = relative2(absoluteRoot, dirname5(target));
-  let current = absoluteRoot;
-  for (const part of rel.split(sep2).filter(Boolean)) {
-    current = join6(current, part);
-    try {
-      const entry = await lstat3(current);
-      if (!entry.isDirectory() || entry.isSymbolicLink()) throw new Error(`Protected path crosses a non-directory: ${path}`);
-    } catch (error) {
-      if (error.code !== "ENOENT") throw error;
-      await mkdir2(current, { mode: 448 });
-    }
-  }
-  return target;
-}
-async function writeProtected(root, path, bytes) {
-  const target = await assertSafeParent(root, path);
-  try {
-    const existing = await lstat3(target);
-    if (!existing.isFile() || existing.isSymbolicLink()) throw new Error(`Refusing to replace non-regular protected file: ${path}`);
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  const temporary = join6(dirname5(target), `.hlix-pull-${crypto.randomUUID()}.tmp`);
-  const handle = await open(
-    temporary,
-    constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW,
-    384
-  );
-  try {
-    await handle.writeFile(bytes);
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-  try {
-    await rename(temporary, target);
-  } catch (error) {
-    await rm2(temporary, { force: true });
-    throw error;
-  }
-}
-async function preflightReplacement(root, path) {
-  const target = await assertSafeParent(root, path);
-  try {
-    const existing = await lstat3(target);
-    if (!existing.isFile() || existing.isSymbolicLink()) {
-      throw new Error(`Refusing to replace non-regular project file: ${path}`);
-    }
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-}
-async function applyPull(root, scan, head, bundleBlob, protectedResponse) {
-  const temporary = await mkdtemp2(join6(tmpdir2(), "hlix-pull-"));
-  await chmod2(temporary, 448);
-  const bundlePath = join6(temporary, "project.bundle");
-  const checkout = join6(temporary, "checkout");
-  try {
-    const bundle = Buffer.from(await bundleBlob.arrayBuffer());
-    if (bundle.byteLength !== head.bundleSize || sha2562(bundle) !== head.bundleSha256) {
-      throw new Error("Downloaded revision bundle failed integrity verification.");
-    }
-    await writeFile(bundlePath, bundle, { mode: 384 });
-    git2(temporary, ["clone", "--no-hardlinks", bundlePath, checkout]);
-    git2(checkout, ["bundle", "verify", bundlePath]);
-    if (git2(checkout, ["rev-parse", "HEAD"]) !== head.commitSha) {
-      throw new Error("Downloaded revision bundle does not match the cloud commit.");
-    }
-    const manifest = head.manifest;
-    const expectedProtected = /* @__PURE__ */ new Map();
-    for (const file of [...manifest.secretFiles, ...manifest.quarantinedResources]) {
-      expectedProtected.set(file.path, file);
-    }
-    if (protectedResponse.files.length !== expectedProtected.size) {
-      throw new Error("Cloud protected files do not match the revision manifest.");
-    }
-    const protectedBytes = /* @__PURE__ */ new Map();
-    for (const file of protectedResponse.files) {
-      const expected = expectedProtected.get(file.path);
-      const bytes = Buffer.from(file.contentBase64, "base64");
-      const canonicalBase64 = bytes.toString("base64").replace(/=+$/, "");
-      if (canonicalBase64 !== file.contentBase64.replace(/=+$/, "") || !expected || expected.kind !== file.kind || bytes.byteLength !== expected.size || sha2562(bytes) !== expected.sha256) {
-        throw new Error(`Cloud protected file failed integrity verification: ${file.path}`);
-      }
-      protectedBytes.set(file.path, bytes);
-    }
-    const localTargets = /* @__PURE__ */ new Set([
-      ...manifest.files.map((file) => file.path),
-      ...scan.manifest.secretFiles.map((file) => file.path),
-      ...scan.manifest.quarantinedResources.map((file) => file.path),
-      ...protectedBytes.keys()
-    ]);
-    for (const path of [...localTargets].sort()) await preflightReplacement(root, path);
-    for (const [path, bytes] of protectedBytes) await writeProtected(checkout, path, bytes);
-    if (scan.manifest.git.detected) {
-      git2(root, ["fetch", bundlePath, "refs/heads/main"]);
-      git2(root, ["reset", "--hard", "FETCH_HEAD"]);
-      const cloudFiles = new Set(manifest.files.map((file) => file.path));
-      for (const file of scan.manifest.files) {
-        if (!cloudFiles.has(file.path)) {
-          await rm2(join6(root, ...file.path.split("/")), { force: true });
-        }
-      }
-    } else {
-      for (const file of scan.manifest.files) await rm2(join6(root, ...file.path.split("/")), { force: true });
-      for (const file of manifest.files) {
-        const target = await assertSafeParent(root, file.path);
-        await copyFile2(join6(checkout, ...file.path.split("/")), target);
-        await chmod2(target, file.executable ? 493 : 420);
-      }
-    }
-    for (const old of [...scan.manifest.secretFiles, ...scan.manifest.quarantinedResources]) {
-      if (!protectedBytes.has(old.path)) await rm2(join6(root, ...old.path.split("/")), { force: true });
-    }
-    for (const [path, bytes] of protectedBytes) await writeProtected(root, path, bytes);
-  } finally {
-    await rm2(temporary, { recursive: true, force: true });
-  }
-}
-
-// src/commands/sync-plan.ts
-function describeDivergence(scan, state, cloud) {
-  const cloudFiles = new Map(manifestFiles(cloud.manifest).map((file) => [file.path, file.sha256]));
-  const localFiles = new Map(scan.manifest.files.map((file) => [file.path, file.sha256]));
-  let localOnly = 0;
-  let differing = 0;
-  for (const [path, sha] of localFiles) {
-    const remote = cloudFiles.get(path);
-    if (remote === void 0) localOnly += 1;
-    else if (remote !== sha) differing += 1;
-  }
-  let cloudOnly = 0;
-  for (const path of cloudFiles.keys()) if (!localFiles.has(path)) cloudOnly += 1;
-  return {
-    localChanged: !state.manifestSha256 || scan.manifestSha256 !== state.manifestSha256,
-    cloudChanged: cloud.id !== state.revisionId || cloud.generation !== state.generation,
-    local: { revisionId: state.revisionId, generation: state.generation },
-    cloud: { revisionId: cloud.id, generation: cloud.generation, commitSha: cloud.commitSha },
-    files: { local: localFiles.size, cloud: cloudFiles.size, localOnly, cloudOnly, differing }
-  };
-}
-function plannedAction(kind, divergence, force) {
-  const { localChanged, cloudChanged } = divergence;
-  if (kind === "push") return cloudChanged ? "conflict" : localChanged ? "push" : "none";
-  if (kind === "pull") {
-    if (!cloudChanged) return "none";
-    return localChanged && !force ? "conflict" : "pull";
-  }
-  if (localChanged && cloudChanged) return "conflict";
-  return localChanged ? "push" : cloudChanged ? "pull" : "none";
-}
-function requiresApproval(action, divergence, yes) {
-  return action === "pull" && divergence.localChanged && !yes;
-}
-var PLAN_SUMMARY = {
-  push: {
-    push: "Would push the local changes as a new cloud revision.",
-    pull: "",
-    none: "Nothing to push \u2014 local matches the last synced revision.",
-    conflict: "Would refuse: the cloud changed since this folder's base revision."
-  },
-  pull: {
-    push: "",
-    pull: "Would replace local files with the cloud revision.",
-    none: "Nothing to pull \u2014 the cloud head is the local base revision.",
-    conflict: "Would refuse: local files changed. Re-run with --force to replace them."
-  },
-  sync: {
-    push: "Would push the local changes as a new cloud revision.",
-    pull: "Would pull the cloud revision into this folder.",
-    none: "Already in sync.",
-    conflict: "Would refuse: local and cloud both changed since the last sync."
-  }
-};
-function renderPlan(kind, action, plan, approvalRequired) {
-  const files = plan.files;
-  return [
-    `${kind} --dry-run: ${PLAN_SUMMARY[kind][action]}`,
-    ...approvalRequired ? ["Requires --yes (or interactive approval) to execute."] : [],
-    "",
-    renderFields([
-      ["local", `generation ${plan.local.generation} (${plan.local.revisionId})${plan.localChanged ? " \u2014 modified" : ""}`],
-      ["cloud", `generation ${plan.cloud.generation} (${plan.cloud.revisionId})${plan.cloudChanged ? " \u2014 ahead" : ""}`],
-      ["files", `${files.local} local, ${files.cloud} cloud \u2014 ${files.localOnly} local-only, ${files.cloudOnly} cloud-only, ${files.differing} differing`]
-    ])
-  ].join("\n");
-}
-
-// src/commands/sync.ts
-function pushIdempotency(stateRevisionId, manifestSha256, bundleSha256) {
-  return createHash5("sha256").update(`project-push-v1\0${stateRevisionId}\0${manifestSha256}\0${bundleSha256}`).digest("hex");
-}
-async function binding(cwd) {
-  const found = findProjectBinding(cwd);
-  const state = found ? readProjectState(found.root) : null;
-  if (!found?.config.projectId || !state) {
-    throw new CliError("not_initialized", "This folder is not bound to an imported Hlix project. Run `hlix import .` first.");
-  }
-  return { root: await realpath5(found.root), config: found.config, state };
-}
-async function currentScan(root, environment, historyMode, rootName) {
-  const scan = await scanProject(root, { historyMode, environment, rootName });
-  if (scan.blocking.length > 0) {
-    throw new CliError("scan_blocked", `Project scan blocked sync:
-- ${scan.blocking.join("\n- ")}`);
-  }
-  return scan;
-}
-async function dryRun(ctx, command, kind, root) {
-  const { state, config } = await binding(root);
-  const client = ctx.requireClient();
-  const [scan, headResponse] = await Promise.all([
-    currentScan(root, ctx.env, state.historyMode ?? "preserve", state.rootName),
-    client.revisions.head(config.projectId)
-  ]);
-  const plan = describeDivergence(scan, state, headResponse.revision);
-  const action = plannedAction(kind, plan, ctx.flags.force === true);
-  const approvalRequired = requiresApproval(action, plan, ctx.flags.yes === true);
-  if (ctx.json) {
-    ctx.stdout(renderJson(jsonSuccess(command, { dryRun: true, action, approvalRequired, ...plan })));
-  } else {
-    ctx.stdout(`${renderPlan(kind, action, plan, approvalRequired)}
-`);
-  }
-  return action === "conflict" ? 1 : 0;
-}
-async function confirmForcedReplace(ctx, plan) {
-  if (ctx.flags.yes === true) return;
-  if (ctx.json || !ctx.confirm) {
-    throw new CliError(
-      "approval_required",
-      "`pull --force` replaces local files. Review with `hlix pull --dry-run`, then repeat with `--yes`."
-    );
-  }
-  const prompt = [
-    `hlix pull --force will replace this folder with cloud revision ${plan.cloud.generation}.`,
-    `Local-only files to delete: ${plan.files.localOnly}`,
-    `Files to replace with the cloud copy: ${plan.files.differing}`,
-    "Local changes that were never pushed cannot be recovered by Hlix."
-  ].join("\n");
-  if (!await ctx.confirm(prompt)) throw new CliError("cancelled", "Pull cancelled.");
-}
-async function pushRevision(root, ctx, scan, head) {
-  const { state, config } = await binding(root);
-  const client = ctx.requireClient();
-  const historyMode = state.historyMode ?? "preserve";
-  const current = scan ?? await currentScan(root, ctx.env, historyMode, state.rootName);
-  const cloud = head ?? (await client.revisions.head(config.projectId)).revision;
-  if (cloud.id !== state.revisionId || cloud.generation !== state.generation) {
-    throw new CliError("conflict", "Cloud changed since the local base. Run `hlix pull` or resolve with `hlix sync`.");
-  }
-  if (state.manifestSha256 && current.manifestSha256 === state.manifestSha256) {
-    return { action: "none", revisionId: state.revisionId, generation: state.generation };
-  }
-  const snapshot = await createProjectSnapshot(current);
-  try {
-    const created = await client.revisions.createUpload(config.projectId, {
-      idempotencyKey: pushIdempotency(state.revisionId, current.manifestSha256, snapshot.bundleSha256),
-      expectedRevisionId: state.revisionId,
-      expectedGeneration: state.generation,
-      manifest: current.manifest,
-      manifestSha256: current.manifestSha256,
-      bundleSha256: snapshot.bundleSha256,
-      bundleSize: snapshot.bundleSize,
-      commitSha: snapshot.commitSha
-    });
-    if (created.revisionUpload.status === "pending_upload") {
-      if (!created.upload) throw new Error("Revision upload has no bundle target.");
-      await client.revisions.uploadBundle(
-        created.upload,
-        new Blob([Uint8Array.from(await readFile4(snapshot.bundlePath))]),
-        {
-          onProgress: (uploaded, total) => {
-            if (!ctx.json) ctx.stderr(`Uploading ${uploaded}/${total} bytes\r`);
-          }
-        }
-      );
-    }
-    const finalized = await client.revisions.finalize(config.projectId, created.revisionUpload.id, {
-      secrets: current.secretValues,
-      protectedFiles: current.protectedFiles
-    });
-    if (!finalized.revision) throw new Error("Revision finalized without head metadata.");
-    writeProjectState(root, {
-      schemaVersion: 1,
-      revisionId: finalized.revision.id,
-      generation: finalized.revision.generation,
-      commitSha: finalized.revision.commitSha,
-      manifestSha256: finalized.revision.manifestSha256,
-      historyMode,
-      rootName: state.rootName ?? current.manifest.rootName
-    });
-    return { action: "push", ...finalized.revision };
-  } finally {
-    await snapshot.dispose();
-  }
-}
-async function pullRevision(root, ctx, force, scan, head) {
-  const { state, config } = await binding(root);
-  const client = ctx.requireClient();
-  const historyMode = state.historyMode ?? "preserve";
-  const current = scan ?? await currentScan(root, ctx.env, historyMode, state.rootName);
-  const cloud = head ?? (await client.revisions.head(config.projectId)).revision;
-  if (cloud.id === state.revisionId && cloud.generation === state.generation) {
-    return { action: "none", revisionId: state.revisionId, generation: state.generation };
-  }
-  const localChanged = !state.manifestSha256 || current.manifestSha256 !== state.manifestSha256;
-  if (localChanged && !force) {
-    throw new CliError("conflict", "Local files changed since the last sync. Push them, or use `hlix pull --force` to replace them.");
-  }
-  if (localChanged) await confirmForcedReplace(ctx, describeDivergence(current, state, cloud));
-  const [bundle, protectedFiles] = await Promise.all([
-    client.revisions.downloadBundle(config.projectId, cloud.id),
-    client.revisions.protectedFiles(config.projectId)
-  ]);
-  await applyPull(root, current, cloud, bundle, protectedFiles);
-  const cloudIdentity = manifestIdentity(cloud.manifest);
-  const pulledHistoryMode = cloudIdentity.historyMode ?? historyMode;
-  const pulledRootName = cloudIdentity.rootName ?? state.rootName ?? current.manifest.rootName;
-  const pulled = await currentScan(root, ctx.env, pulledHistoryMode, pulledRootName);
-  writeProjectState(root, {
-    schemaVersion: 1,
-    revisionId: cloud.id,
-    generation: cloud.generation,
-    commitSha: cloud.commitSha,
-    manifestSha256: pulled.manifestSha256,
-    historyMode: pulledHistoryMode,
-    rootName: pulledRootName
-  });
-  return { action: "pull", revisionId: cloud.id, generation: cloud.generation, commitSha: cloud.commitSha };
-}
-function output(ctx, command, result) {
-  if (ctx.json) ctx.stdout(renderJson(jsonSuccess(command, result)));
-  else if ("action" in result && result.action === "none") ctx.stdout("Already in sync.\n");
-  else ctx.stdout(`${String("action" in result ? result.action : "sync")} complete.
-`);
-}
-var pushProject = {
-  name: "push",
-  summary: "Push local changes as an immutable cloud revision",
-  usage: "Usage: hlix push [--dry-run] [--json]",
-  supportsJson: true,
-  options: ["dry-run"],
-  async run(ctx) {
-    if (ctx.args.length) throw new Error("push accepts no positional arguments.");
-    const { root } = await binding(ctx.cwd);
-    if (ctx.flags["dry-run"] === true) return dryRun(ctx, pushProject.name, "push", root);
-    output(ctx, pushProject.name, await pushRevision(root, ctx));
-    return 0;
-  }
-};
-var pullProject = {
-  name: "pull",
-  summary: "Pull the cloud head into the local project",
-  usage: [
-    "Usage: hlix pull [--force] [--yes] [--dry-run] [--json]",
-    "",
-    "  --force     Replace local changes with the cloud revision",
-    "  --yes       Skip the confirmation --force otherwise requires",
-    "  --dry-run   Report the divergence and change nothing"
-  ].join("\n"),
-  supportsJson: true,
-  options: ["force", "yes", "dry-run"],
-  async run(ctx) {
-    if (ctx.args.length) throw new Error("pull accepts no positional arguments.");
-    const { root } = await binding(ctx.cwd);
-    if (ctx.flags["dry-run"] === true) return dryRun(ctx, pullProject.name, "pull", root);
-    output(ctx, pullProject.name, await pullRevision(root, ctx, ctx.flags.force === true));
-    return 0;
-  }
-};
-var syncProject = {
-  name: "sync",
-  summary: "Reconcile local and cloud changes without guessing conflicts",
-  usage: "Usage: hlix sync [--dry-run] [--json]",
-  supportsJson: true,
-  options: ["dry-run"],
-  async run(ctx) {
-    if (ctx.args.length) throw new Error("sync accepts no positional arguments.");
-    const { root, state, config } = await binding(ctx.cwd);
-    if (ctx.flags["dry-run"] === true) return dryRun(ctx, syncProject.name, "sync", root);
-    const client = ctx.requireClient();
-    const [scan, headResponse] = await Promise.all([
-      currentScan(root, ctx.env, state.historyMode ?? "preserve", state.rootName),
-      client.revisions.head(config.projectId)
-    ]);
-    const cloud = headResponse.revision;
-    const plan = describeDivergence(scan, state, cloud);
-    if (plan.localChanged && plan.cloudChanged) {
-      throw new CliError("conflict", "Both local and cloud changed since the last sync. Pull or push explicitly after reviewing the conflict.");
-    }
-    const result = plan.localChanged ? await pushRevision(root, ctx, scan, cloud) : plan.cloudChanged ? await pullRevision(root, ctx, false, scan, cloud) : { action: "none", revisionId: state.revisionId, generation: state.generation };
-    output(ctx, syncProject.name, result);
-    return 0;
-  }
-};
-
-// src/commands/resources.ts
-import { lstat as lstat4, readFile as readFile5, realpath as realpath6 } from "fs/promises";
-import { basename as basename3, dirname as dirname6, extname, join as join7, parse, resolve as resolve8 } from "path";
-function flag2(ctx, name) {
-  const value = ctx.flags[name];
-  return typeof value === "string" && value.trim() ? value.trim() : void 0;
-}
-function requireProjectBinding(cwd) {
-  const binding2 = findProjectBinding(cwd);
-  if (!binding2?.config.projectId) {
-    throw new CliError(
-      "not_initialized",
-      "This folder is not bound to an Hlix project. Run `hlix import .` first."
-    );
-  }
-  return { root: binding2.root, projectId: binding2.config.projectId };
-}
-async function regularFile(path, maxBytes) {
-  const entry = await lstat4(path);
-  if (entry.isSymbolicLink() || !entry.isFile()) {
-    throw new Error(`Refusing to import a non-regular file: ${path}`);
-  }
-  if (entry.size > maxBytes) throw new Error(`Import file exceeds ${maxBytes} bytes: ${path}`);
-  return { path: await realpath6(path), content: await readFile5(path, "utf8") };
-}
-function writeResult(ctx, command, result, human) {
-  if (ctx.json) ctx.stdout(renderJson(jsonSuccess(command, result)));
-  else ctx.stdout(`${human}
-`);
-}
-var importSkill = {
-  name: "skill import",
-  summary: "Activate a local skill for the bound cloud project",
-  usage: "Usage: hlix skill import <SKILL.md|folder> [--name <slug>] [--json]",
-  supportsJson: true,
-  options: ["name"],
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    if (ctx.args.length !== 1) throw new Error("skill import requires one file or folder.");
-    const binding2 = requireProjectBinding(ctx.cwd);
-    const input = resolve8(ctx.cwd, ctx.args[0]);
-    const entry = await lstat4(input);
-    if (entry.isSymbolicLink()) throw new Error(`Refusing to import a symlink: ${input}`);
-    const file = entry.isDirectory() ? join7(input, "SKILL.md") : input;
-    const loaded = await regularFile(file, 2e5);
-    const inferred = entry.isDirectory() ? basename3(input) : basename3(file) === "SKILL.md" ? basename3(dirname6(file)) : parse(file).name;
-    const slug = flag2(ctx, "name") ?? inferred;
-    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(slug)) {
-      throw new Error("Skill name must be a lowercase kebab-case slug.");
-    }
-    const result = await ctx.requireClient().resources.importSkill(binding2.projectId, {
-      slug,
-      content: loaded.content
-    });
-    writeResult(ctx, importSkill.name, result.skill, `Imported skill ${slug}`);
-    return 0;
-  }
-};
-var importAgent = {
-  name: "agent import",
-  summary: "Create a project-scoped agent from a local Markdown brief",
-  usage: "Usage: hlix agent import <markdown-file> [--name <name>] [--runtime <runtime>] [--profile <profile>] [--json]",
-  supportsJson: true,
-  options: ["name", "runtime", "profile"],
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    if (ctx.args.length !== 1) throw new Error("agent import requires one Markdown file.");
-    const binding2 = requireProjectBinding(ctx.cwd);
-    const file = resolve8(ctx.cwd, ctx.args[0]);
-    if (![".md", ".mdx"].includes(extname(file).toLowerCase())) {
-      throw new Error("Agent imports must be Markdown files.");
-    }
-    const loaded = await regularFile(file, 2e4);
-    const runtime = flag2(ctx, "runtime") ?? "hlix";
-    if (!["claude-code", "codex", "cursor-agent", "hlix"].includes(runtime)) {
-      throw new Error("--runtime must be claude-code, codex, cursor-agent, or hlix.");
-    }
-    const profile = flag2(ctx, "profile") ?? "builder";
-    if (!["builder", "desktop", "e2e"].includes(profile)) {
-      throw new Error("--profile must be builder, desktop, or e2e.");
-    }
-    if (runtime === "hlix" && profile !== "builder") {
-      throw new Error(
-        `--profile ${profile} needs a sandbox runtime: pass --runtime claude-code (hlix ignores sandbox profiles).`
-      );
-    }
-    const name = flag2(ctx, "name") ?? parse(file).name.replace(/[-_]+/g, " ");
-    const result = await ctx.requireClient().resources.importAgent(binding2.projectId, {
-      name,
-      instructions: loaded.content,
-      runtimeKind: runtime,
-      sandboxProfile: profile
-    });
-    writeResult(ctx, importAgent.name, result.agent, `Imported agent ${result.agent.name}`);
-    return 0;
-  }
-};
-var importMcp = {
-  name: "mcp import",
-  summary: "Explicitly activate one validated local MCP server",
-  usage: "Usage: hlix mcp import <.mcp.json> [--server <name>] [--allow-stdio] [--json]",
-  supportsJson: true,
-  options: ["server", "allow-stdio"],
-  args: { min: 1, max: 1 },
-  async run(ctx) {
-    if (ctx.args.length !== 1) throw new Error("mcp import requires one MCP JSON file.");
-    const binding2 = requireProjectBinding(ctx.cwd);
-    const loaded = await regularFile(resolve8(ctx.cwd, ctx.args[0]), 2e5);
-    let parsed;
-    try {
-      parsed = JSON.parse(loaded.content);
-    } catch {
-      throw new Error("MCP config is not valid JSON.");
-    }
-    const servers = Object.entries(parsed.mcpServers ?? {});
-    if (servers.length === 0) throw new Error("MCP config contains no servers.");
-    const selectedName = flag2(ctx, "server");
-    if (!selectedName && servers.length > 1) {
-      throw new Error("MCP config contains multiple servers; select one with --server <name>.");
-    }
-    const selected = selectedName ? servers.find(([name2]) => name2 === selectedName) : servers[0];
-    if (!selected) throw new Error(`MCP server not found: ${selectedName}`);
-    const [name, raw] = selected;
-    const transport = raw.type === "http" || raw.type === "sse" ? raw.type : typeof raw.command === "string" ? "stdio" : typeof raw.url === "string" ? "http" : null;
-    if (!transport) throw new Error(`MCP server ${name} has no supported transport.`);
-    if (transport === "stdio" && ctx.flags["allow-stdio"] !== true) {
-      throw new Error("Stdio MCP servers execute a local command in the cloud; repeat with --allow-stdio.");
-    }
-    const env = raw.env && typeof raw.env === "object" && !Array.isArray(raw.env) ? raw.env : {};
-    const headers = raw.headers && typeof raw.headers === "object" && !Array.isArray(raw.headers) ? raw.headers : {};
-    if (Object.values(headers).some((value) => typeof value !== "string")) {
-      throw new Error(`MCP server ${name} headers must be strings.`);
-    }
-    const headerKeys = Object.values(headers).flatMap(
-      (value) => [...value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map(
-        (match2) => match2[1]
-      )
-    );
-    if (Object.keys(headers).length > 0 && headerKeys.length === 0) {
-      throw new Error("MCP remote headers must use ${KEY} placeholders; literal credentials are refused.");
-    }
-    const validHeaderTemplate = /^(?:(?:Bearer|Basic|Token) )?\$\{[A-Za-z_][A-Za-z0-9_]*\}$/i;
-    if (Object.values(headers).some((value) => !validHeaderTemplate.test(value))) {
-      throw new Error("MCP remote headers must be ${KEY} or an approved auth scheme followed by ${KEY}.");
-    }
-    const result = await ctx.requireClient().resources.importMcp(binding2.projectId, {
-      name,
-      transport,
-      ...typeof raw.command === "string" ? { command: raw.command } : {},
-      ...Array.isArray(raw.args) && raw.args.every((arg) => typeof arg === "string") ? { args: raw.args } : {},
-      ...typeof raw.url === "string" ? { url: raw.url } : {},
-      ...Object.keys(headers).length > 0 ? { headers } : {},
-      envKeys: [.../* @__PURE__ */ new Set([...Object.keys(env), ...headerKeys])].sort()
-    });
-    writeResult(ctx, importMcp.name, result.mcpServer, `Imported MCP server ${name}`);
-    return 0;
-  }
-};
-
-// src/index.ts
-import { realpathSync } from "fs";
-import { fileURLToPath } from "url";
-var COMMANDS = [
-  authLogin,
-  authStatus,
-  authLogout,
-  statusCommand,
-  initProject,
-  importProject,
-  syncProject,
-  pullProject,
-  pushProject,
-  importSkill,
-  importAgent,
-  importMcp,
-  projectsList,
-  projectsGet,
-  tasksList,
-  tasksGet,
-  tasksReview,
-  tasksWatch
-];
-function isMainModule() {
-  if (import.meta.main === true) return true;
-  const entry = process.argv[1];
-  if (!entry) return false;
-  try {
-    return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
-  } catch {
-    return false;
-  }
-}
-if (isMainModule()) {
-  const code = await runCli(COMMANDS, process.argv.slice(2), {
-    stdout: (text3) => process.stdout.write(text3),
-    stderr: (text3) => process.stderr.write(text3),
-    env: process.env,
-    readSecret: promptSecret,
-    confirm: promptConfirm
-  });
-  process.exit(code);
-}
-export {
-  COMMANDS,
-  JSON_SCHEMA_VERSION,
-  runCli
-};
+import{b as g,c as y,e as v,f as c,k as o}from"./index-619ayaee.js";import{l as i}from"./index-vfqh17y6.js";import{emitKeypressEvents as w}from"node:readline";import{createInterface as C}from"node:readline/promises";async function u(r){if(!process.stdin.isTTY||!process.stdin.setRawMode)throw Error("Interactive login requires a terminal. Set HLIX_API_KEY for CI.");return process.stderr.write(r),w(process.stdin),process.stdin.setRawMode(!0),process.stdin.resume(),new Promise((e,t)=>{let s="",p=()=>{process.stdin.off("keypress",a),process.stdin.setRawMode(!1),process.stdin.pause(),process.stderr.write(`
+`)},a=(m,n)=>{if(n.ctrl&&n.name==="c"||n.name==="escape"){p(),t(Error("Login cancelled."));return}if(n.name==="return"||n.name==="enter"){p(),e(s);return}if(n.name==="backspace"){s=s.slice(0,-1);return}if(m&&!n.ctrl)s+=m};process.stdin.on("keypress",a)})}async function f(r){if(!process.stdin.isTTY||!process.stderr.isTTY)throw Error("Interactive approval requires a terminal. Review with --dry-run, then pass --yes.");let e=C({input:process.stdin,output:process.stderr});try{let t=(await e.question(`${r}
+Continue? [y/N] `)).trim().toLowerCase();return t==="y"||t==="yes"}finally{e.close()}}import{realpathSync as l}from"node:fs";import{fileURLToPath as x}from"node:url";function h(){if(i.main==i.module===!0)return!0;let r=process.argv[1];if(!r)return!1;try{return l(r)===l(x(import.meta.url))}catch{return!1}}var d={"-h":"--help","-v":"--version"};function M(r){return r.map((e)=>d[e]??e)}function S(r,e=o){let t=r[0];if(t===void 0)return!1;if(t in d||t==="--help"||t==="--version")return!0;return e.some((s)=>s.name.split(" ")[0]===t)}function P(r,e){if(S(r))return e.cli(M(r));return e.code(r[0]==="code"?r.slice(1):r)}if(h()){let r=await P(process.argv.slice(2),{cli:(e)=>c(o,e,{stdout:(t)=>process.stdout.write(t),stderr:(t)=>process.stderr.write(t),env:process.env,readSecret:u,confirm:f}),code:async(e)=>(await import("./main-ct6p55pt.js")).runHlixCode(e)});process.exit(r)}export{o as COMMANDS,g as JSON_SCHEMA_VERSION,v as clientFor,P as dispatch,y as findProjectBinding,S as isCliInvocation,M as normalizeCliArgv,c as runCli};