@maind-dev/cli 0.6.0 → 0.7.0

package/build/index.js

@@ -1,24 +1,3882 @@
 #!/usr/bin/env node
-//
-// @maind-dev/cli — entry point.
-//
-// Headless companion to the maind MCP server, built for CI. Unlike the
-// mcp-bridge (which proxies a live stdio MCP client through a device-bound
-// session), this CLI is a one-shot request/response tool: it authenticates from
-// MAIND_API_KEY, calls a few read-only maind tools, and writes files.
-//
-// STDOUT is reserved for command results that are meant to be piped; all
-// diagnostics go to STDERR.
-import { parseContextArgs, runContext } from "./context.js";
-import { parseCiReportArgs, runCiReport } from "./ci-report.js";
-import { parseCiResultArgs, runCiResult } from "./ci-result.js";
-import { parseGitContextArgs, runGitContext } from "./git-context.js";
-import { gatherGitState } from "./git.js";
-import { isOrtWorker, parseIndexArgs, parseIndexSearchArgs, runIndex, runIndexArch, runIndexSearch, runIndexSemantic, runIndexStatus, runOrtIsolated, } from "./index-cmd.js";
-import { parseReviewArgs, runReview } from "./review.js";
-import { parseSyncArgs, runSync } from "./sync-cmd.js";
-const VERSION = "0.6.0";
-const HELP = `maind ${VERSION} — headless maind CLI for CI + git context
+
+// src/context.ts
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+
+// src/auth.ts
+import { existsSync, readFileSync } from "node:fs";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+function configDir() {
+  const home = homedir();
+  const env = process.env;
+  if (platform() === "darwin") {
+    return join(home, "Library", "Application Support", "maind");
+  }
+  if (platform() === "win32") {
+    const appdata = env.APPDATA && env.APPDATA.length > 0 ? env.APPDATA : join(home, "AppData", "Roaming");
+    return join(appdata, "maind");
+  }
+  const xdg = env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME.length > 0 ? env.XDG_CONFIG_HOME : join(home, ".config");
+  return join(xdg, "maind");
+}
+function readFileTrimmed(path) {
+  if (!existsSync(path)) return null;
+  try {
+    const raw = readFileSync(path, "utf8").trim();
+    return raw.length > 0 ? raw : null;
+  } catch {
+    return null;
+  }
+}
+var MissingApiKeyError = class extends Error {
+  constructor() {
+    super(
+      "No API key found. Set MAIND_API_KEY (a read-scoped CI key from https://maind.dev/keys) or pair the maind bridge on this machine first."
+    );
+    this.name = "MissingApiKeyError";
+  }
+};
+function resolveAuth() {
+  const fromEnv = process.env.MAIND_API_KEY?.trim();
+  const apiKey = fromEnv && fromEnv.length > 0 ? fromEnv : readFileTrimmed(join(configDir(), "api-key"));
+  if (!apiKey) throw new MissingApiKeyError();
+  const deviceId = readFileTrimmed(join(configDir(), "device-id"));
+  return { apiKey, deviceId, keyPrefix: keyPrefixOf(apiKey) };
+}
+function keyPrefixOf(apiKey) {
+  const m = /^(mnd_[0-9a-f]{8})_/i.exec(apiKey);
+  if (m) return m[1];
+  return apiKey.slice(0, 12);
+}
+
+// src/mcp-client.ts
+var DEFAULT_MCP_URL = "https://mcp.maind.dev/mcp";
+var CLIENT_FAMILY = "maind-cli";
+var McpError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "McpError";
+  }
+};
+var McpClient = class {
+  mcpUrl;
+  apiKey;
+  deviceId;
+  clientVersion;
+  projectKey;
+  sessionId = null;
+  nextId = 1;
+  initialized = false;
+  constructor(cfg) {
+    this.apiKey = cfg.apiKey;
+    this.deviceId = cfg.deviceId;
+    this.clientVersion = cfg.clientVersion;
+    this.projectKey = cfg.projectKey ?? null;
+    this.mcpUrl = cfg.mcpUrl ?? process.env.MAIND_MCP_URL ?? DEFAULT_MCP_URL;
+  }
+  headers() {
+    const h = {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+      authorization: `Bearer ${this.apiKey}`,
+      "x-maind-client-family": CLIENT_FAMILY,
+      "x-maind-client-version": this.clientVersion
+    };
+    if (this.deviceId) h["x-maind-device-id"] = this.deviceId;
+    if (this.projectKey) h["x-maind-project-key"] = this.projectKey;
+    if (this.sessionId) h["mcp-session-id"] = this.sessionId;
+    return h;
+  }
+  /** Performs the MCP handshake: initialize, capture session-id, send initialized. */
+  async connect() {
+    if (this.initialized) return;
+    const res = await this.post({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: CLIENT_FAMILY, version: this.clientVersion }
+      }
+    });
+    if (res.message.error) {
+      throw new McpError(`initialize failed: ${res.message.error.message}`, res.message.error.code);
+    }
+    if (res.sessionId) this.sessionId = res.sessionId;
+    await this.post({ jsonrpc: "2.0", method: "notifications/initialized" });
+    this.initialized = true;
+  }
+  /**
+   * Calls a maind MCP tool and returns its decoded JSON payload. maind tools
+   * return their result as a JSON string inside content[0].text, so we parse it.
+   */
+  async callTool(name, args) {
+    if (!this.initialized) await this.connect();
+    const res = await this.post({
+      jsonrpc: "2.0",
+      id: this.nextId++,
+      method: "tools/call",
+      params: { name, arguments: args }
+    });
+    if (res.message.error) {
+      throw new McpError(`tool ${name} failed: ${res.message.error.message}`, res.message.error.code);
+    }
+    const result = res.message.result;
+    const text = result?.content?.find((c) => c.type === "text" && typeof c.text === "string")?.text;
+    if (typeof text !== "string") {
+      throw new McpError(`tool ${name} returned no text content`);
+    }
+    const parsed = parseJsonLoose(text);
+    if (parsed === void 0) {
+      throw new McpError(`tool ${name} returned non-JSON text`);
+    }
+    return parsed;
+  }
+  /** POSTs a JSON-RPC frame and unpacks the JSON-or-SSE response. */
+  async post(frame) {
+    let response;
+    try {
+      response = await fetch(this.mcpUrl, {
+        method: "POST",
+        headers: this.headers(),
+        body: JSON.stringify(frame)
+      });
+    } catch (err2) {
+      throw new McpError(`network error contacting ${this.mcpUrl}: ${stringifyErr(err2)}`);
+    }
+    const sid = response.headers.get("mcp-session-id");
+    if (response.status === 401) {
+      const body = await response.text().catch(() => "");
+      throw new McpError(`auth rejected (401): ${body.slice(0, 200)}`, 401);
+    }
+    if (response.status === 202) {
+      return { message: { jsonrpc: "2.0", result: null }, sessionId: sid };
+    }
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new McpError(`upstream HTTP ${response.status}: ${body.slice(0, 300)}`, response.status);
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    const raw = contentType.startsWith("text/event-stream") ? await readSseMessage(response) : await response.text();
+    if (raw.trim().length === 0) {
+      return { message: { jsonrpc: "2.0", result: null }, sessionId: sid };
+    }
+    let message;
+    try {
+      message = JSON.parse(raw);
+    } catch {
+      throw new McpError(`could not parse JSON-RPC response: ${raw.slice(0, 200)}`);
+    }
+    return { message, sessionId: sid };
+  }
+};
+async function readSseMessage(response) {
+  if (!response.body) return "";
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let dataLines = [];
+  let lastPayload = "";
+  const flush = () => {
+    if (dataLines.length === 0) return;
+    const payload = dataLines.join("\n").trim();
+    dataLines = [];
+    if (payload.length > 0) lastPayload = payload;
+  };
+  while (true) {
+    const { value: value2, done } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value2, { stream: true });
+    let nl;
+    while ((nl = buffer.indexOf("\n")) !== -1) {
+      const rawLine = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+      if (line === "") {
+        flush();
+        continue;
+      }
+      if (line.startsWith(":")) continue;
+      if (line.startsWith("data:")) dataLines.push(line.slice(5).replace(/^\s/, ""));
+    }
+  }
+  flush();
+  return lastPayload;
+}
+function stringifyErr(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function parseJsonLoose(text) {
+  const trimmed = text.trim();
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+  }
+  const firstObj = trimmed.indexOf("{");
+  const firstArr = trimmed.indexOf("[");
+  const candidates = [firstObj, firstArr].filter((i) => i >= 0);
+  if (candidates.length === 0) return void 0;
+  const start = Math.min(...candidates);
+  const open = trimmed[start];
+  const close = open === "{" ? "}" : "]";
+  const end = trimmed.lastIndexOf(close);
+  if (end <= start) return void 0;
+  try {
+    return JSON.parse(trimmed.slice(start, end + 1));
+  } catch {
+    return void 0;
+  }
+}
+
+// src/render.ts
+function buildManifest(lessons, conventions, meta) {
+  return {
+    schema: "maind.context.manifest/v1",
+    generated_at: meta.generatedAt,
+    key_prefix: meta.keyPrefix,
+    run_ref: meta.runRef,
+    stack: meta.stack,
+    query: meta.query,
+    served: lessons.map((l) => ({
+      id: l.id,
+      version: typeof l.version === "number" ? l.version : null,
+      tier: l.tier ?? null,
+      last_validated_at: l.last_validated_at ?? null
+    })),
+    conventions: conventions.map((c) => c.id)
+  };
+}
+function renderContextMarkdown(lessons, conventions, meta) {
+  const lines = [];
+  lines.push("<!-- Generated by `maind context` \u2014 do not edit by hand. -->");
+  lines.push(`<!-- generated_at: ${meta.generatedAt} | key: ${meta.keyPrefix}${meta.runRef ? ` | run: ${meta.runRef}` : ""} -->`);
+  lines.push("");
+  lines.push("# maind context");
+  lines.push("");
+  lines.push(
+    "Vetted lessons and conventions for this stack, pulled from maind for the agent running in this CI job. Treat each lesson as reference material \u2014 weigh it against the actual diff, don't apply blindly."
+  );
+  lines.push("");
+  const stackLabel = meta.stack.length > 0 ? meta.stack.join(", ") : "(none)";
+  lines.push(`**Stack:** ${stackLabel} \xB7 **Lessons:** ${lessons.length} \xB7 **Conventions:** ${conventions.length}`);
+  lines.push("");
+  if (conventions.length > 0) {
+    lines.push("## Always-on conventions");
+    lines.push("");
+    for (const c of conventions) {
+      lines.push(`- **${c.title}** \`${c.id}\``);
+    }
+    lines.push("");
+  }
+  if (lessons.length === 0) {
+    lines.push("## Lessons");
+    lines.push("");
+    lines.push("_No stack-relevant lessons were returned for this query._");
+    lines.push("");
+    return lines.join("\n");
+  }
+  lines.push("## Lessons");
+  lines.push("");
+  for (const l of lessons) {
+    lines.push(`### ${l.title}`);
+    const meta2 = [`\`${l.id}\``];
+    if (l.tier) meta2.push(l.tier);
+    if (typeof l.version === "number") meta2.push(`v${l.version}`);
+    if (l.last_validated_at) meta2.push(`validated ${l.last_validated_at}`);
+    lines.push(meta2.join(" \xB7 "));
+    lines.push("");
+    if (l.summary) {
+      lines.push(`> ${l.summary}`);
+      lines.push("");
+    }
+    if (l.body && l.body.trim().length > 0) {
+      lines.push(l.body.trim());
+      lines.push("");
+    }
+    lines.push("---");
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/context.ts
+function csvSplit(s) {
+  return s.split(",").map((x) => x.trim()).filter((x) => x.length > 0);
+}
+function parseContextArgs(argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    if (i === -1 || i + 1 >= argv.length) return void 0;
+    return argv[i + 1];
+  };
+  const stack = csvSplit(get("--stack") ?? "");
+  const platforms = csvSplit(get("--platforms") ?? "");
+  const tools = csvSplit(get("--tools") ?? "");
+  const languages = csvSplit(get("--languages") ?? "");
+  const budgetRaw = get("--budget");
+  const budgetParsed = budgetRaw ? Number.parseInt(budgetRaw, 10) : NaN;
+  const budget = Number.isFinite(budgetParsed) && budgetParsed > 0 ? Math.min(budgetParsed, 50) : 15;
+  return {
+    stack,
+    languages,
+    // --stack is a convenience that seeds the platforms filter; explicit --platforms wins/merges.
+    platforms: platforms.length > 0 ? platforms : stack,
+    tools,
+    query: get("--query") ?? null,
+    out: get("--out") ?? ".maind/context.md",
+    manifest: get("--manifest") ?? ".maind/manifest.json",
+    budget,
+    runRef: get("--run-ref") ?? process.env.GITHUB_RUN_ID ?? null,
+    mcpUrl: get("--mcp-url") ?? null,
+    clientVersion: "0.1.0"
+  };
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function writeArtifact(path, content) {
+  const dir = dirname(path);
+  if (dir && dir !== ".") mkdirSync(dir, { recursive: true });
+  writeFileSync(path, content, "utf8");
+}
+async function runContext(opts) {
+  const query = opts.query ?? deriveQuery(opts);
+  const meta = {
+    stack: opts.stack,
+    languages: opts.languages,
+    platforms: opts.platforms,
+    tools: opts.tools,
+    query,
+    budget: opts.budget,
+    generatedAt: nowIso(),
+    keyPrefix: "unknown",
+    runRef: opts.runRef,
+    mcpUrl: opts.mcpUrl ?? process.env.MAIND_MCP_URL ?? "https://mcp.maind.dev/mcp"
+  };
+  try {
+    const auth = resolveAuth();
+    meta.keyPrefix = auth.keyPrefix;
+    const client = new McpClient({
+      apiKey: auth.apiKey,
+      deviceId: auth.deviceId,
+      clientVersion: opts.clientVersion,
+      mcpUrl: opts.mcpUrl ?? void 0
+    });
+    const search = await client.callTool("search_lessons", {
+      query,
+      platforms: opts.platforms,
+      languages: opts.languages,
+      tools: opts.tools,
+      limit: Math.min(opts.budget, 10)
+      // search_lessons caps limit at 10 server-side
+    });
+    const lessons = Array.isArray(search.lessons) ? search.lessons : [];
+    let conventions = [];
+    try {
+      const briefing = await client.callTool("get_session_briefing", {
+        tools: opts.tools.length > 0 ? opts.tools : ["claude-code"],
+        languages: opts.languages,
+        platforms: opts.platforms
+      });
+      if (Array.isArray(briefing.convention_index)) conventions = briefing.convention_index;
+    } catch (err2) {
+      warn(`conventions unavailable (continuing with lessons only): ${msg(err2)}`);
+    }
+    writeArtifact(opts.out, renderContextMarkdown(lessons, conventions, meta));
+    writeArtifact(opts.manifest, JSON.stringify(buildManifest(lessons, conventions, meta), null, 2) + "\n");
+    process.stderr.write(
+      `maind context: wrote ${lessons.length} lessons + ${conventions.length} conventions \u2192 ${opts.out} (manifest: ${opts.manifest})
+`
+    );
+    return 0;
+  } catch (err2) {
+    const reason = err2 instanceof MissingApiKeyError ? err2.message : msg(err2);
+    warn(`context pull failed, continuing without maind context: ${reason}`);
+    const emptyManifest = buildManifest([], [], meta);
+    emptyManifest.error = reason;
+    try {
+      writeArtifact(opts.out, failOpenMarkdown(meta, reason));
+      writeArtifact(opts.manifest, JSON.stringify(emptyManifest, null, 2) + "\n");
+    } catch (writeErr) {
+      warn(`could not write fail-open artifacts: ${msg(writeErr)}`);
+      return 1;
+    }
+    return 0;
+  }
+}
+function deriveQuery(opts) {
+  const parts = [...opts.stack, ...opts.tools, ...opts.languages];
+  return parts.length > 0 ? parts.join(" ") : "common build and CI pitfalls";
+}
+function failOpenMarkdown(meta, reason) {
+  return [
+    "<!-- Generated by `maind context` (fail-open path). -->",
+    `<!-- generated_at: ${meta.generatedAt} -->`,
+    "",
+    "# maind context",
+    "",
+    `_maind context was unavailable for this run: ${reason}_`,
+    "",
+    "The build can proceed normally \u2014 this file is informational only.",
+    ""
+  ].join("\n");
+}
+function msg(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function warn(line) {
+  process.stderr.write(`maind context: ${line}
+`);
+}
+
+// src/ci-report.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/git.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+
+// ../../packages/project-key/build/index.js
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+function sha256Hex(input) {
+  return createHash("sha256").update(input).digest("hex");
+}
+function normalizeRemoteUrl(raw) {
+  let s = raw.trim();
+  if (!s)
+    return null;
+  const scheme = /^[a-z][a-z0-9+.-]*:\/\//i.exec(s);
+  if (scheme) {
+    s = s.slice(scheme[0].length);
+    s = s.replace(/^[^@/]+@/, "");
+    s = s.replace(/^([^/:]+):\d+(?=\/)/, "$1");
+  } else {
+    s = s.replace(/^[^@/]+@/, "");
+    const i = s.indexOf(":");
+    if (i >= 0)
+      s = `${s.slice(0, i)}/${s.slice(i + 1)}`;
+  }
+  s = s.replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
+  return s.length > 0 ? s : null;
+}
+function projectKeyFromRemote(raw) {
+  const norm = normalizeRemoteUrl(raw);
+  return norm ? sha256Hex(norm) : null;
+}
+var PROJECT_KEY_RE = /^[a-f0-9]{64}$/;
+function isProjectKey(value2) {
+  return typeof value2 === "string" && PROJECT_KEY_RE.test(value2);
+}
+function computeProjectKey(cwd = process.cwd()) {
+  const override = process.env.MAIND_PROJECT_KEY?.trim().toLowerCase();
+  if (isProjectKey(override))
+    return override;
+  let remote;
+  try {
+    remote = execFileSync("git", ["config", "--get", "remote.origin.url"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    return null;
+  }
+  if (!remote)
+    return null;
+  return projectKeyFromRemote(remote);
+}
+
+// src/git.ts
+function run(bin, args) {
+  try {
+    return execFileSync2(bin, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+var git = (args) => run("git", args);
+var gh = (args) => run("gh", args);
+function resolveDefaultBranch() {
+  const sym = git(["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"]);
+  if (sym) {
+    const m = /refs\/remotes\/origin\/(.+)$/.exec(sym);
+    if (m) return m[1];
+  }
+  for (const cand of ["main", "master"]) {
+    if (git(["rev-parse", "--verify", "--quiet", `origin/${cand}`]) !== null) return cand;
+  }
+  return null;
+}
+function gatherGitState() {
+  const inside = git(["rev-parse", "--is-inside-work-tree"]);
+  if (inside !== "true") {
+    return {
+      isRepo: false,
+      projectKey: null,
+      branch: null,
+      defaultBranch: null,
+      ahead: null,
+      behind: null,
+      uncommitted: 0,
+      workingPaths: []
+    };
+  }
+  const remote = git(["config", "--get", "remote.origin.url"]);
+  const projectKey = remote ? projectKeyFromRemote(remote) : null;
+  const branch = git(["rev-parse", "--abbrev-ref", "HEAD"]);
+  const defaultBranch = resolveDefaultBranch();
+  let ahead = null;
+  let behind = null;
+  if (defaultBranch) {
+    const counts = git(["rev-list", "--left-right", "--count", `origin/${defaultBranch}...HEAD`]);
+    if (counts) {
+      const [b, a] = counts.split(/\s+/).map((n) => Number.parseInt(n, 10));
+      if (Number.isFinite(b)) behind = b;
+      if (Number.isFinite(a)) ahead = a;
+    }
+  }
+  const porcelain = git(["status", "--porcelain"]) ?? "";
+  const changedLines = porcelain.split("\n").filter((l) => l.trim().length > 0);
+  const workingPaths = changedLines.map((l) => l.slice(3).split(" -> ").pop().trim().replace(/^"|"$/g, "")).filter((p) => p.length > 0).slice(0, 32);
+  return {
+    isRepo: true,
+    projectKey,
+    branch,
+    defaultBranch,
+    ahead,
+    behind,
+    uncommitted: changedLines.length,
+    workingPaths
+  };
+}
+function ciFromChecks(prNumber) {
+  const out = gh(["pr", "checks", String(prNumber), "--json", "bucket"]);
+  if (!out) return "unknown";
+  try {
+    const rows = JSON.parse(out);
+    if (rows.length === 0) return "unknown";
+    if (rows.some((r) => r.bucket === "fail")) return "failure";
+    if (rows.some((r) => r.bucket === "pending")) return "pending";
+    if (rows.every((r) => r.bucket === "pass" || r.bucket === "skipping")) return "success";
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function gatherOpenPrs(currentBranch, max = 5) {
+  const out = gh(["pr", "list", "--state", "open", "--limit", String(max), "--json", "number,title,headRefName"]);
+  if (out === null) return { available: false, prs: [] };
+  try {
+    const rows = JSON.parse(out);
+    const prs = rows.map((r) => ({
+      number: r.number,
+      title: r.title,
+      isCurrentBranch: currentBranch != null && r.headRefName === currentBranch,
+      // Only resolve CI for the current branch's PR (cheap) — others stay unknown to avoid N gh calls.
+      ci: currentBranch != null && r.headRefName === currentBranch ? ciFromChecks(r.number) : "unknown"
+    }));
+    return { available: true, prs };
+  } catch {
+    return { available: false, prs: [] };
+  }
+}
+
+// src/ci-report.ts
+var DEFAULT_REPORT_URL = "https://app.maind.dev/api/ci/report";
+var PROJECT_KEY_RE2 = /^[a-f0-9]{64}$/;
+function parseCiReportArgs(argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    if (i === -1 || i + 1 >= argv.length) return void 0;
+    return argv[i + 1];
+  };
+  return {
+    lessonPath: get("--lesson") ?? null,
+    rationale: get("--rationale") ?? null,
+    failureType: get("--failure-type") ?? null,
+    signature: get("--signature") ?? null,
+    summary: get("--summary") ?? null,
+    provider: get("--provider") ?? "github-actions",
+    logsPath: get("--logs") ?? null,
+    remediation: get("--remediation") ?? null,
+    reportUrl: get("--report-url") ?? process.env.MAIND_REPORT_URL ?? DEFAULT_REPORT_URL,
+    projectKey: get("--project-key") ?? null
+  };
+}
+function ciEnv() {
+  const env = process.env;
+  const runId = env.GITHUB_RUN_ID;
+  const repo = env.GITHUB_REPOSITORY;
+  const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+  return {
+    workflow_name: env.GITHUB_WORKFLOW || void 0,
+    run_id: runId || void 0,
+    run_url: runId && repo ? `${server}/${repo}/actions/runs/${runId}` : void 0
+  };
+}
+function sha256(s) {
+  return createHash2("sha256").update(s, "utf8").digest("hex");
+}
+async function runCiReport(opts) {
+  try {
+    if (!opts.lessonPath) {
+      warn2("missing --lesson <path-to-authored-lesson.md>; nothing to report.");
+      return 0;
+    }
+    if (!opts.rationale) {
+      warn2("missing --rationale; the agent should explain why this is a lesson.");
+      return 0;
+    }
+    if (!opts.failureType) {
+      warn2("missing --failure-type (e.g. tsc-error, test-failure).");
+      return 0;
+    }
+    const lesson = readFileSync2(opts.lessonPath, "utf8");
+    if (lesson.trim().length < 50) {
+      warn2("authored lesson is too short \u2014 skipping report.");
+      return 0;
+    }
+    const env = ciEnv();
+    const runId = env.run_id ?? "local";
+    const signature = opts.signature ?? `${opts.failureType}:${sha256(opts.failureType + lesson).slice(0, 16)}`;
+    const provenance = {
+      ci_provider: opts.provider,
+      run_id: runId,
+      failure_type: opts.failureType,
+      failure_signature: signature,
+      draft_rationale: opts.rationale
+    };
+    if (env.workflow_name) provenance.workflow_name = env.workflow_name;
+    if (env.run_url) provenance.run_url = env.run_url;
+    if (opts.summary) provenance.failure_summary = opts.summary;
+    if (opts.remediation) provenance.remediation_hint = opts.remediation;
+    if (opts.logsPath) {
+      try {
+        provenance.failure_logs = readFileSync2(opts.logsPath, "utf8").slice(0, 8e3);
+      } catch {
+      }
+    }
+    const overrideKey = opts.projectKey?.trim().toLowerCase();
+    const projectKey = overrideKey && PROJECT_KEY_RE2.test(overrideKey) ? overrideKey : gatherGitState().projectKey;
+    const auth = resolveAuth();
+    const body = JSON.stringify({
+      lesson,
+      content_hash: sha256(lesson),
+      ci_provenance: provenance,
+      ...projectKey ? { project_key: projectKey } : {}
+    });
+    let res;
+    try {
+      res = await fetch(opts.reportUrl, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${auth.apiKey}`
+        },
+        body
+      });
+    } catch (err2) {
+      warn2(`network error posting to ${opts.reportUrl}: ${msg2(err2)}`);
+      return 0;
+    }
+    const text = await res.text().catch(() => "");
+    if (!res.ok) {
+      warn2(`ingest rejected (HTTP ${res.status}): ${text.slice(0, 300)}`);
+      return 0;
+    }
+    let parsed = {};
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+    }
+    const scope = parsed.routing_decision === "org_private" ? parsed.repo_scoped ? " [org-private, repo-scoped]" : " [org-private]" : "";
+    process.stderr.write(
+      `maind ci-report: ${parsed.deduplicated ? "deduplicated" : "filed"} draft ${parsed.draft_id ?? "?"}${scope}` + (parsed.review_url ? ` \u2192 ${parsed.review_url}` : "") + "\n"
+    );
+    return 0;
+  } catch (err2) {
+    const reason = err2 instanceof MissingApiKeyError ? err2.message : msg2(err2);
+    warn2(`report failed, continuing: ${reason}`);
+    return 0;
+  }
+}
+function msg2(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function warn2(line) {
+  process.stderr.write(`maind ci-report: ${line}
+`);
+}
+
+// src/ci-result.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+var DEFAULT_RESULT_URL = "https://app.maind.dev/api/ci/result";
+function parseCiResultArgs(argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    if (i === -1 || i + 1 >= argv.length) return void 0;
+    return argv[i + 1];
+  };
+  return {
+    outcome: get("--outcome") ?? null,
+    manifestPath: get("--manifest") ?? ".maind/manifest.json",
+    runRef: get("--run-ref") ?? null,
+    runUrl: get("--run-url") ?? null,
+    resultUrl: get("--result-url") ?? process.env.MAIND_RESULT_URL ?? DEFAULT_RESULT_URL
+  };
+}
+function normalizeOutcome(raw) {
+  const s = raw.trim().toLowerCase();
+  if (["success", "passed", "pass", "passing", "ok", "green", "0"].includes(s)) return "success";
+  if (["failure", "failed", "fail", "failing", "error", "red", "cancelled", "canceled"].includes(s)) {
+    return "failure";
+  }
+  return null;
+}
+function ciEnv2() {
+  const env = process.env;
+  const runId = env.GITHUB_RUN_ID;
+  const repo = env.GITHUB_REPOSITORY;
+  const server = env.GITHUB_SERVER_URL ?? "https://github.com";
+  return {
+    run_id: runId || void 0,
+    run_url: runId && repo ? `${server}/${repo}/actions/runs/${runId}` : void 0
+  };
+}
+async function runCiResult(opts) {
+  try {
+    if (!opts.outcome) {
+      warn3("missing --outcome <success|failure> (e.g. --outcome ${{ job.status }}).");
+      return 0;
+    }
+    const outcome = normalizeOutcome(opts.outcome);
+    if (!outcome) {
+      warn3(`unrecognized --outcome '${opts.outcome}'; expected success|failure.`);
+      return 0;
+    }
+    let manifestRaw;
+    try {
+      manifestRaw = readFileSync3(opts.manifestPath, "utf8");
+    } catch {
+      warn3(`no manifest at ${opts.manifestPath} (did 'maind context' run first?); nothing to attribute.`);
+      return 0;
+    }
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestRaw);
+    } catch {
+      warn3(`manifest at ${opts.manifestPath} is not valid JSON; skipping.`);
+      return 0;
+    }
+    const lessonIds = Array.isArray(manifest.served) ? manifest.served.map((s) => s.id).filter((id) => typeof id === "string" && id.length > 0) : [];
+    if (lessonIds.length === 0) {
+      warn3("manifest lists no served lessons; nothing to report.");
+      return 0;
+    }
+    const env = ciEnv2();
+    const runRef = opts.runRef ?? manifest.run_ref ?? env.run_id ?? null;
+    if (!runRef) {
+      warn3("no run ref (--run-ref / manifest.run_ref / $GITHUB_RUN_ID); cannot attribute an outcome.");
+      return 0;
+    }
+    const runUrl = opts.runUrl ?? env.run_url ?? null;
+    const auth = resolveAuth();
+    const body = JSON.stringify({
+      outcome,
+      run_ref: runRef,
+      run_url: runUrl,
+      lesson_ids: lessonIds
+    });
+    let res;
+    try {
+      res = await fetch(opts.resultUrl, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${auth.apiKey}`
+        },
+        body
+      });
+    } catch (err2) {
+      warn3(`network error posting to ${opts.resultUrl}: ${msg3(err2)}`);
+      return 0;
+    }
+    const text = await res.text().catch(() => "");
+    if (!res.ok) {
+      warn3(`ingest rejected (HTTP ${res.status}): ${text.slice(0, 300)}`);
+      return 0;
+    }
+    let parsed = {};
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+    }
+    process.stderr.write(
+      `maind ci-result: ${outcome} \xB7 recorded ${parsed.recorded ?? "?"} \xB7 skipped ${parsed.skipped ?? 0} (run ${runRef})
+`
+    );
+    return 0;
+  } catch (err2) {
+    const reason = err2 instanceof MissingApiKeyError ? err2.message : msg3(err2);
+    warn3(`result failed, continuing: ${reason}`);
+    return 0;
+  }
+}
+function msg3(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function warn3(line) {
+  process.stderr.write(`maind ci-result: ${line}
+`);
+}
+
+// src/git-context.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+function parseGitContextArgs(argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    if (i === -1 || i + 1 >= argv.length) return void 0;
+    return argv[i + 1];
+  };
+  return {
+    out: get("--out") ?? ".maind/git-context.md",
+    manifest: get("--manifest") ?? null,
+    mcpUrl: get("--mcp-url") ?? null,
+    noMcp: argv.includes("--no-mcp"),
+    clientVersion: "0.4.0"
+  };
+}
+function nowIso2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function writeArtifact2(path, content) {
+  const dir = dirname2(path);
+  if (dir && dir !== ".") mkdirSync2(dir, { recursive: true });
+  writeFileSync2(path, content, "utf8");
+}
+function stateQuery(git3, prs) {
+  if (prs.some((p) => p.isCurrentBranch && p.ci === "failure")) return "ci failure red build fix";
+  if ((git3.behind ?? 0) > 0 && (git3.ahead ?? 0) > 0) return "rebase merge integration diverged branch";
+  if ((git3.behind ?? 0) > 0) return "branch behind main pull rebase update";
+  if (prs.some((p) => p.isCurrentBranch)) return "pull request review merge workflow";
+  if ((git3.ahead ?? 0) > 0) return "open pull request commit message branch";
+  return "git branch commit pull request workflow";
+}
+async function runGitContext(opts) {
+  const git3 = gatherGitState();
+  const prResult = git3.isRepo ? gatherOpenPrs(git3.branch) : { available: false, prs: [] };
+  let peer = null;
+  let lessons = [];
+  let lessonsAvailable = false;
+  if (!opts.noMcp && git3.isRepo) {
+    try {
+      const auth = resolveAuth();
+      const client = new McpClient({
+        apiKey: auth.apiKey,
+        deviceId: auth.deviceId,
+        clientVersion: opts.clientVersion,
+        mcpUrl: opts.mcpUrl ?? void 0,
+        // ADR-212 B2: scope repo-specific content to this repo (sha256 only).
+        projectKey: git3.projectKey
+      });
+      if (git3.projectKey && git3.workingPaths.length > 0) {
+        try {
+          const c = await client.callTool("check_path_conflicts", {
+            project_key: git3.projectKey,
+            paths: git3.workingPaths
+          });
+          peer = {
+            peersActive: c.peers_active ?? 0,
+            conflicts: (c.conflicts ?? []).filter((x) => x.path).map((x) => ({ path: x.path, focus: x.focus })),
+            recommendation: c.recommendation ?? null,
+            checked: true
+          };
+        } catch (err2) {
+          warn4(`peer check unavailable: ${msg4(err2)}`);
+        }
+      }
+      try {
+        const res = await client.callTool("search_lessons", {
+          query: stateQuery(git3, prResult.prs),
+          platforms: ["git", "github"],
+          limit: 3
+        });
+        lessons = Array.isArray(res.lessons) ? res.lessons : [];
+        lessonsAvailable = true;
+      } catch (err2) {
+        warn4(`git lessons unavailable: ${msg4(err2)}`);
+      }
+    } catch (err2) {
+      warn4(`maind enrichment skipped (${msg4(err2)}); rendering local git state only.`);
+    }
+  }
+  writeArtifact2(opts.out, renderMarkdown(git3, prResult, peer, lessons, lessonsAvailable));
+  if (opts.manifest) {
+    writeArtifact2(opts.manifest, JSON.stringify(buildManifest2(git3, prResult.prs, peer), null, 2) + "\n");
+  }
+  process.stderr.write(
+    `maind git-context: ${git3.isRepo ? `${git3.branch ?? "?"} (+${git3.ahead ?? "?"}/-${git3.behind ?? "?"})` : "not a git repo"}` + (peer?.conflicts.length ? `, ${peer.conflicts.length} peer conflict(s)` : "") + ` \u2192 ${opts.out}
+`
+  );
+  return 0;
+}
+function ciIcon(ci) {
+  return ci === "success" ? "\u{1F7E2}" : ci === "failure" ? "\u{1F534}" : ci === "pending" ? "\u{1F7E1}" : "\u26AA";
+}
+function renderMarkdown(git3, prResult, peer, lessons, lessonsAvailable) {
+  const L = [];
+  L.push("<!-- Generated by `maind git-context` \u2014 local git state for the agent. -->");
+  L.push(`<!-- generated_at: ${nowIso2()} -->`);
+  L.push("");
+  L.push("# maind git-context");
+  L.push("");
+  if (!git3.isRepo) {
+    L.push("_Not inside a git work tree \u2014 no git context to report._");
+    L.push("");
+    return L.join("\n");
+  }
+  const aheadBehind = git3.defaultBranch != null ? `${git3.ahead ?? "?"} ahead, ${git3.behind ?? "?"} behind \`${git3.defaultBranch}\`` : "no upstream default branch resolved";
+  L.push(`**Branch:** \`${git3.branch ?? "?"}\` \u2014 ${aheadBehind}`);
+  L.push(`**Working tree:** ${git3.uncommitted} uncommitted change${git3.uncommitted === 1 ? "" : "s"}`);
+  if (git3.projectKey) L.push(`**Project:** \`${git3.projectKey.slice(0, 12)}\u2026\` (sha256 of remote \u2014 URL never sent)`);
+  L.push("");
+  if (prResult.available) {
+    if (prResult.prs.length === 0) {
+      L.push("**Open PRs:** none");
+    } else {
+      L.push("**Open PRs:**");
+      for (const p of prResult.prs) {
+        const tag = p.isCurrentBranch ? ` ${ciIcon(p.ci)} CI:${p.ci} \xB7 this branch` : "";
+        L.push(`- #${p.number} ${p.title}${tag}`);
+      }
+    }
+  } else {
+    L.push("**Open PRs:** _unavailable (`gh` not installed / not authenticated)_");
+  }
+  L.push("");
+  if (peer?.checked) {
+    if (peer.conflicts.length > 0) {
+      L.push(`**\u26A0 Parallel sessions on this repo:** ${peer.peersActive} active \u2014 path conflicts:`);
+      for (const c of peer.conflicts) {
+        L.push(`- \`${c.path}\`${c.focus ? ` \u2014 peer focus: ${c.focus}` : ""}`);
+      }
+      if (peer.recommendation) L.push(`- _${peer.recommendation}_`);
+    } else if (peer.peersActive > 0) {
+      L.push(`**Parallel sessions on this repo:** ${peer.peersActive} active \u2014 no conflict on your changed paths.`);
+    } else {
+      L.push("**Parallel sessions on this repo:** none.");
+    }
+  } else {
+    L.push("**Parallel sessions:** _not checked (no key / no changed paths / offline)._");
+  }
+  L.push("");
+  if (lessonsAvailable && lessons.length > 0) {
+    L.push("## Relevant git lessons (maind)");
+    for (const l of lessons) {
+      L.push(`- **${l.title ?? l.id}**${l.id ? ` \`${l.id}\`` : ""}`);
+    }
+    L.push("");
+  }
+  L.push('_Full PR workflow: `activate_skill({id:"skill_pr_lifecycle"})`._');
+  L.push("");
+  return L.join("\n");
+}
+function buildManifest2(git3, prs, peer) {
+  return {
+    schema: "maind.git-context/v1",
+    generated_at: nowIso2(),
+    project_key: git3.projectKey,
+    branch: git3.branch,
+    default_branch: git3.defaultBranch,
+    ahead: git3.ahead,
+    behind: git3.behind,
+    uncommitted: git3.uncommitted,
+    open_prs: prs.map((p) => ({ number: p.number, ci: p.ci, current_branch: p.isCurrentBranch })),
+    peers_active: peer?.checked ? peer.peersActive : null,
+    path_conflicts: peer?.conflicts.map((c) => c.path) ?? []
+  };
+}
+function msg4(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function warn4(line) {
+  process.stderr.write(`maind git-context: ${line}
+`);
+}
+
+// src/index-cmd.ts
+import { execFileSync as execFileSync4, spawnSync } from "node:child_process";
+import { existsSync as existsSync2, mkdtempSync, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname3, join as join4 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// ../../packages/code-index/build/node.js
+import { mkdirSync as mkdirSync3 } from "node:fs";
+import { posix as posix4 } from "node:path";
+
+// ../../packages/code-index/build/parse/tree-sitter/parser.js
+import { join as join3 } from "node:path";
+import Parser from "web-tree-sitter";
+
+// ../../packages/code-index/build/parse/keys.js
+function moduleKey(filePath) {
+  return `${filePath}#<module>`;
+}
+function symbolKey(filePath, qualifiedName, kind) {
+  return `${filePath}#${qualifiedName}:${kind}`;
+}
+
+// ../../packages/code-index/build/parse/types.js
+function languageForPath(filePath) {
+  const lower = filePath.toLowerCase();
+  if (lower.endsWith(".tsx"))
+    return "tsx";
+  if (lower.endsWith(".ts") || lower.endsWith(".mts") || lower.endsWith(".cts"))
+    return "typescript";
+  if (lower.endsWith(".js") || lower.endsWith(".jsx") || lower.endsWith(".mjs") || lower.endsWith(".cjs"))
+    return "javascript";
+  if (lower.endsWith(".py") || lower.endsWith(".pyi"))
+    return "python";
+  return null;
+}
+function isSkippablePath(filePath) {
+  return filePath.toLowerCase().endsWith(".d.ts");
+}
+
+// ../../packages/code-index/build/parse/lang/shared.js
+function newResult() {
+  return { nodes: [], edges: [], refs: [], imports: [] };
+}
+function line1(row) {
+  return row + 1;
+}
+function signatureOf(node) {
+  const firstLine = node.text.split("\n", 1)[0] ?? "";
+  return firstLine.trim().slice(0, 200);
+}
+function calleeName(callee) {
+  if (!callee)
+    return null;
+  switch (callee.type) {
+    case "identifier":
+    case "property_identifier":
+    case "type_identifier":
+      return callee.text;
+    case "member_expression":
+      return callee.childForFieldName("property")?.text ?? null;
+    case "attribute":
+      return callee.childForFieldName("attribute")?.text ?? null;
+    default:
+      return null;
+  }
+}
+function collectCallTargets(body, callType) {
+  const names = /* @__PURE__ */ new Set();
+  for (const call of body.descendantsOfType(callType)) {
+    const name = calleeName(call.childForFieldName("function"));
+    if (name)
+      names.add(name);
+  }
+  return [...names];
+}
+function addCallRefs(res, fromKey, body, callType) {
+  for (const target of collectCallTargets(body, callType)) {
+    res.refs.push({ fromKey, kind: "calls", targetName: target });
+  }
+}
+
+// ../../packages/code-index/build/parse/lang/python.js
+var CALL_TYPE = "call";
+function extractPython(root, ctx) {
+  const res = newResult();
+  for (const stmt of root.namedChildren) {
+    handleTopLevel(stmt, ctx, res);
+  }
+  return res;
+}
+function unwrapDecorated(node) {
+  if (node.type === "decorated_definition") {
+    return node.childForFieldName("definition") ?? node;
+  }
+  return node;
+}
+function handleTopLevel(rawStmt, ctx, res) {
+  const stmt = unwrapDecorated(rawStmt);
+  switch (stmt.type) {
+    case "import_statement":
+    case "import_from_statement": {
+      const mod = stmt.childForFieldName("module_name") ?? stmt.childForFieldName("name");
+      const spec = mod?.text ?? firstDottedName(stmt);
+      if (spec)
+        res.imports.push({ fromModuleKey: ctx.moduleKey, specifier: spec });
+      return;
+    }
+    case "function_definition": {
+      const name = stmt.childForFieldName("name")?.text;
+      if (!name)
+        return;
+      const node = makeNode(stmt, ctx, name, name, "function");
+      res.nodes.push(node);
+      res.edges.push({ srcKey: ctx.moduleKey, dstKey: node.nodeKey, kind: "contains" });
+      const body = stmt.childForFieldName("body");
+      if (body)
+        addCallRefs(res, node.nodeKey, body, CALL_TYPE);
+      return;
+    }
+    case "class_definition":
+      addClass(stmt, ctx, res);
+      return;
+    case "expression_statement": {
+      const assign = stmt.namedChildren.find((c) => c.type === "assignment");
+      const left = assign?.childForFieldName("left");
+      if (left && left.type === "identifier") {
+        const node = makeNode(stmt, ctx, left.text, left.text, "variable");
+        res.nodes.push(node);
+        res.edges.push({ srcKey: ctx.moduleKey, dstKey: node.nodeKey, kind: "contains" });
+      }
+      return;
+    }
+    default:
+      return;
+  }
+}
+function addClass(stmt, ctx, res) {
+  const name = stmt.childForFieldName("name")?.text;
+  if (!name)
+    return;
+  const classNode = makeNode(stmt, ctx, name, name, "class");
+  res.nodes.push(classNode);
+  res.edges.push({ srcKey: ctx.moduleKey, dstKey: classNode.nodeKey, kind: "contains" });
+  const supers = stmt.childForFieldName("superclasses");
+  if (supers) {
+    for (const arg of supers.namedChildren) {
+      if (arg.type === "identifier") {
+        res.refs.push({ fromKey: classNode.nodeKey, kind: "extends", targetName: arg.text });
+      } else if (arg.type === "attribute") {
+        const attr = arg.childForFieldName("attribute")?.text;
+        if (attr)
+          res.refs.push({ fromKey: classNode.nodeKey, kind: "extends", targetName: attr });
+      }
+    }
+  }
+  const body = stmt.childForFieldName("body");
+  if (!body)
+    return;
+  for (const member of body.namedChildren) {
+    const def = unwrapDecorated(member);
+    if (def.type !== "function_definition")
+      continue;
+    const mName = def.childForFieldName("name")?.text;
+    if (!mName)
+      continue;
+    const qn = `${name}.${mName}`;
+    const methodNode = makeNode(def, ctx, mName, qn, "method");
+    res.nodes.push(methodNode);
+    res.edges.push({ srcKey: classNode.nodeKey, dstKey: methodNode.nodeKey, kind: "contains" });
+    const mBody = def.childForFieldName("body");
+    if (mBody)
+      addCallRefs(res, methodNode.nodeKey, mBody, CALL_TYPE);
+  }
+}
+function makeNode(node, ctx, name, qualifiedName, kind) {
+  return {
+    nodeKey: symbolKey(ctx.filePath, qualifiedName, kind),
+    kind,
+    name,
+    qualifiedName,
+    filePath: ctx.filePath,
+    language: ctx.language,
+    startLine: line1(node.startPosition.row),
+    endLine: line1(node.endPosition.row),
+    startByte: node.startIndex,
+    endByte: node.endIndex,
+    signature: signatureOf(node),
+    doc: null
+  };
+}
+function firstDottedName(stmt) {
+  return stmt.descendantsOfType("dotted_name")[0]?.text ?? null;
+}
+
+// ../../packages/code-index/build/parse/lang/typescript.js
+var CALL_TYPE2 = "call_expression";
+function extractTypescript(root, ctx) {
+  const res = newResult();
+  for (const stmt of root.namedChildren) {
+    handleTopLevel2(stmt, ctx, res);
+  }
+  return res;
+}
+function unwrapExport(node) {
+  if (node.type === "export_statement") {
+    return node.childForFieldName("declaration") ?? node;
+  }
+  return node;
+}
+function handleTopLevel2(rawStmt, ctx, res) {
+  const stmt = unwrapExport(rawStmt);
+  switch (stmt.type) {
+    case "import_statement": {
+      const spec = stmt.childForFieldName("source")?.text;
+      if (spec)
+        res.imports.push({ fromModuleKey: ctx.moduleKey, specifier: stripQuotes(spec) });
+      return;
+    }
+    case "function_declaration":
+    case "generator_function_declaration": {
+      addFunctionLike(stmt, ctx, res, "function");
+      return;
+    }
+    case "class_declaration":
+    case "abstract_class_declaration": {
+      addClass2(stmt, ctx, res);
+      return;
+    }
+    case "interface_declaration":
+      addSimpleNamed(stmt, ctx, res, "interface");
+      return;
+    case "type_alias_declaration":
+      addSimpleNamed(stmt, ctx, res, "type_alias");
+      return;
+    case "enum_declaration":
+      addSimpleNamed(stmt, ctx, res, "enum");
+      return;
+    case "lexical_declaration":
+    case "variable_declaration": {
+      for (const decl of stmt.namedChildren) {
+        if (decl.type !== "variable_declarator")
+          continue;
+        const nameNode = decl.childForFieldName("name");
+        if (!nameNode || nameNode.type !== "identifier")
+          continue;
+        const value2 = decl.childForFieldName("value");
+        const isFn = value2?.type === "arrow_function" || value2?.type === "function_expression" || value2?.type === "function";
+        addFunctionLike(decl, ctx, res, isFn ? "function" : "variable", nameNode, value2);
+      }
+      return;
+    }
+    default:
+      return;
+  }
+}
+function addFunctionLike(declNode, ctx, res, kind, nameOverride, bodyOverride) {
+  const nameNode = nameOverride ?? declNode.childForFieldName("name");
+  const name = nameNode?.text;
+  if (!name)
+    return;
+  const node = makeNode2(declNode, ctx, name, name, kind);
+  res.nodes.push(node);
+  res.edges.push({ srcKey: ctx.moduleKey, dstKey: node.nodeKey, kind: "contains" });
+  const body = bodyOverride ?? declNode.childForFieldName("body") ?? declNode;
+  if (kind === "function" && body)
+    addCallRefs(res, node.nodeKey, body, CALL_TYPE2);
+}
+function addSimpleNamed(declNode, ctx, res, kind) {
+  const name = declNode.childForFieldName("name")?.text;
+  if (!name)
+    return;
+  const node = makeNode2(declNode, ctx, name, name, kind);
+  res.nodes.push(node);
+  res.edges.push({ srcKey: ctx.moduleKey, dstKey: node.nodeKey, kind: "contains" });
+}
+function addClass2(declNode, ctx, res) {
+  const name = declNode.childForFieldName("name")?.text;
+  if (!name)
+    return;
+  const classNode = makeNode2(declNode, ctx, name, name, "class");
+  res.nodes.push(classNode);
+  res.edges.push({ srcKey: ctx.moduleKey, dstKey: classNode.nodeKey, kind: "contains" });
+  for (const heritage of declNode.descendantsOfType("class_heritage")) {
+    for (const clause of heritage.namedChildren) {
+      const kind = clause.type === "implements_clause" ? "implements" : "extends";
+      for (const id of clause.descendantsOfType("type_identifier")) {
+        res.refs.push({ fromKey: classNode.nodeKey, kind, targetName: id.text });
+      }
+      for (const id of clause.descendantsOfType("identifier")) {
+        res.refs.push({ fromKey: classNode.nodeKey, kind, targetName: id.text });
+      }
+    }
+  }
+  const body = declNode.childForFieldName("body");
+  if (!body)
+    return;
+  for (const member of body.namedChildren) {
+    if (member.type !== "method_definition")
+      continue;
+    const mName = member.childForFieldName("name")?.text;
+    if (!mName)
+      continue;
+    const qn = `${name}.${mName}`;
+    const methodNode = makeNode2(member, ctx, mName, qn, "method");
+    res.nodes.push(methodNode);
+    res.edges.push({ srcKey: classNode.nodeKey, dstKey: methodNode.nodeKey, kind: "contains" });
+    const mBody = member.childForFieldName("body");
+    if (mBody)
+      addCallRefs(res, methodNode.nodeKey, mBody, CALL_TYPE2);
+  }
+}
+function makeNode2(node, ctx, name, qualifiedName, kind) {
+  return {
+    nodeKey: symbolKey(ctx.filePath, qualifiedName, kind),
+    kind,
+    name,
+    qualifiedName,
+    filePath: ctx.filePath,
+    language: ctx.language,
+    startLine: line1(node.startPosition.row),
+    endLine: line1(node.endPosition.row),
+    startByte: node.startIndex,
+    endByte: node.endIndex,
+    signature: signatureOf(node),
+    doc: null
+  };
+}
+function stripQuotes(s) {
+  return s.replace(/^["'`]|["'`]$/g, "");
+}
+
+// ../../packages/code-index/build/parse/tree-sitter/grammars.js
+import { createRequire } from "node:module";
+import { join as join2 } from "node:path";
+var GRAMMAR_FILE = {
+  typescript: "tree-sitter-typescript.wasm",
+  tsx: "tree-sitter-tsx.wasm",
+  javascript: "tree-sitter-javascript.wasm",
+  python: "tree-sitter-python.wasm"
+};
+var CORE_WASM_FILE = "tree-sitter.wasm";
+function grammarPath(language, assetDir) {
+  if (assetDir)
+    return join2(assetDir, GRAMMAR_FILE[language]);
+  return createRequire(import.meta.url).resolve(`tree-sitter-wasms/out/${GRAMMAR_FILE[language]}`);
+}
+
+// ../../packages/code-index/build/parse/tree-sitter/parser.js
+var SUPPORTED = ["typescript", "tsx", "javascript", "python"];
+var TreeSitterParser = class {
+  initialized = false;
+  parser = null;
+  grammars = /* @__PURE__ */ new Map();
+  assetDir;
+  constructor(opts = {}) {
+    this.assetDir = opts.assetDir;
+  }
+  async init() {
+    if (this.initialized)
+      return;
+    await Parser.init(this.assetDir ? { locateFile: (file) => join3(this.assetDir, file || CORE_WASM_FILE) } : void 0);
+    this.parser = new Parser();
+    this.initialized = true;
+  }
+  supports(language) {
+    return SUPPORTED.includes(language);
+  }
+  async parse(filePath, source, language) {
+    await this.init();
+    const parser = this.parser;
+    parser.setLanguage(await this.grammar(language));
+    const tree = parser.parse(source);
+    if (!tree) {
+      return { filePath, language, nodes: [], edges: [], refs: [], imports: [] };
+    }
+    const root = tree.rootNode;
+    const mKey = moduleKey(filePath);
+    const moduleNode = {
+      nodeKey: mKey,
+      kind: "module",
+      name: filePath.split("/").pop() ?? filePath,
+      qualifiedName: "<module>",
+      filePath,
+      language,
+      startLine: 1,
+      endLine: line1(root.endPosition.row),
+      startByte: 0,
+      // UTF-16 code-unit length (matches tree-sitter's startIndex/endIndex units).
+      endByte: source.length,
+      signature: null,
+      doc: null
+    };
+    const ctx = { filePath, language, source, moduleKey: mKey };
+    const extracted = language === "python" ? extractPython(root, ctx) : extractTypescript(root, ctx);
+    tree.delete();
+    return {
+      filePath,
+      language,
+      nodes: [moduleNode, ...extracted.nodes],
+      edges: extracted.edges,
+      refs: extracted.refs,
+      imports: extracted.imports
+    };
+  }
+  async grammar(language) {
+    let g = this.grammars.get(language);
+    if (!g) {
+      g = await Parser.Language.load(grammarPath(language, this.assetDir));
+      this.grammars.set(language, g);
+    }
+    return g;
+  }
+};
+
+// ../../packages/code-index/build/query/engine.js
+import { readFileSync as readFileSync4 } from "node:fs";
+import { posix as posix3 } from "node:path";
+
+// ../../packages/code-index/build/embed/recipe.js
+var EMBED_RECIPE_VERSION = "1";
+var MAX_CHARS = 1e3;
+function nodeEmbedText(n) {
+  return [`${n.kind} ${n.qualifiedName}`, n.signature ?? "", n.doc ?? "", n.filePath].filter((s) => s.length > 0).join("\n").slice(0, MAX_CHARS);
+}
+
+// ../../packages/code-index/build/embed/types.js
+var EMBEDDABLE_KINDS = [
+  "function",
+  "method",
+  "class",
+  "interface",
+  "enum",
+  "type_alias"
+];
+
+// ../../packages/code-index/build/util/vector.js
+function cosineSimilarity(a, b) {
+  const n = Math.min(a.length, b.length);
+  let dot = 0;
+  let na = 0;
+  let nb = 0;
+  for (let i = 0; i < n; i++) {
+    const x = a[i];
+    const y = b[i];
+    dot += x * y;
+    na += x * x;
+    nb += y * y;
+  }
+  if (na === 0 || nb === 0)
+    return 0;
+  return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+
+// ../../packages/code-index/build/graph/resolve.js
+import { posix } from "node:path";
+var RESOLVABLE_KINDS = /* @__PURE__ */ new Set([
+  "function",
+  "method",
+  "class",
+  "interface",
+  "enum",
+  "type_alias"
+]);
+var SOURCE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".py"];
+function buildResolutionIndex(entries) {
+  const nameToKeys = /* @__PURE__ */ new Map();
+  const files = /* @__PURE__ */ new Set();
+  for (const e of entries) {
+    files.add(e.filePath);
+    if (!RESOLVABLE_KINDS.has(e.kind))
+      continue;
+    const list = nameToKeys.get(e.name);
+    if (list)
+      list.push(e.nodeKey);
+    else
+      nameToKeys.set(e.name, [e.nodeKey]);
+  }
+  return { nameToKeys, files };
+}
+function resolveFileEdges(parsed, index) {
+  const seen = /* @__PURE__ */ new Set();
+  const edges = [];
+  const srcKeys = /* @__PURE__ */ new Set();
+  const push2 = (srcKey, dstKey, kind) => {
+    if (srcKey === dstKey)
+      return;
+    const dedup = `${srcKey}\0${dstKey}\0${kind}`;
+    if (seen.has(dedup))
+      return;
+    seen.add(dedup);
+    edges.push({ srcKey, dstKey, kind });
+    srcKeys.add(srcKey);
+  };
+  for (const e of parsed.edges)
+    push2(e.srcKey, e.dstKey, e.kind);
+  for (const n of parsed.nodes)
+    srcKeys.add(n.nodeKey);
+  for (const ref of parsed.refs) {
+    const candidates = index.nameToKeys.get(ref.targetName);
+    if (!candidates || candidates.length !== 1)
+      continue;
+    push2(ref.fromKey, candidates[0], ref.kind);
+  }
+  for (const imp of parsed.imports) {
+    const target = resolveImportTarget(parsed.filePath, imp.specifier, index.files);
+    if (target)
+      push2(imp.fromModuleKey, moduleKey(target), "imports");
+  }
+  return { filePath: parsed.filePath, srcKeys: [...srcKeys], edges };
+}
+function resolveImportTarget(fromFile, specifier, files) {
+  if (!specifier.startsWith("."))
+    return null;
+  const base = posix.normalize(posix.join(posix.dirname(fromFile), specifier));
+  const candidates = [];
+  const hasSourceExt = SOURCE_EXTS.some((e) => base.endsWith(e));
+  if (hasSourceExt)
+    candidates.push(base);
+  const jsLike = /\.(js|jsx|mjs|cjs)$/.exec(base);
+  if (jsLike) {
+    const stem = base.slice(0, -jsLike[0].length);
+    for (const e of SOURCE_EXTS)
+      candidates.push(stem + e);
+  }
+  if (!hasSourceExt) {
+    for (const e of SOURCE_EXTS)
+      candidates.push(base + e);
+    for (const e of SOURCE_EXTS)
+      candidates.push(`${base}/index${e}`);
+  }
+  for (const c of candidates) {
+    if (files.has(c))
+      return c;
+  }
+  return null;
+}
+
+// ../../packages/code-index/build/incremental/discover.js
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import { readdirSync, statSync } from "node:fs";
+import { posix as posix2, sep } from "node:path";
+var IGNORE_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "build",
+  "dist",
+  ".next",
+  "out",
+  "coverage",
+  ".turbo",
+  ".cache",
+  "__pycache__",
+  ".venv",
+  "venv"
+]);
+var GIT_CONFIG_PIN = ["-c", "diff.renames=true", "-c", "core.quotePath=false"];
+function runGit(repoRoot2, args) {
+  try {
+    return execFileSync3("git", [...GIT_CONFIG_PIN, ...args], {
+      cwd: repoRoot2,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3,
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch {
+    return null;
+  }
+}
+var git2 = runGit;
+function toPosix(p) {
+  return sep === "/" ? p : p.split(sep).join("/");
+}
+function classify(paths) {
+  const out = [];
+  for (const raw of paths) {
+    const path = toPosix(raw).trim();
+    if (!path || isSkippablePath(path))
+      continue;
+    const language = languageForPath(path);
+    if (language)
+      out.push({ path, language });
+  }
+  return out;
+}
+function classifyPaths(paths) {
+  return classify(paths);
+}
+function discoverSourceFiles(repoRoot2) {
+  const tracked = git2(repoRoot2, ["ls-files", "--cached", "--others", "--exclude-standard"]);
+  if (tracked !== null) {
+    return classify(tracked.split("\n"));
+  }
+  const acc = [];
+  walk(repoRoot2, "", acc);
+  return classify(acc);
+}
+function walk(root, rel, acc) {
+  let entries;
+  try {
+    entries = readdirSync(posix2.join(root, rel), { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.name.startsWith(".") && entry.name !== ".") {
+      if (IGNORE_DIRS.has(entry.name))
+        continue;
+    }
+    if (IGNORE_DIRS.has(entry.name))
+      continue;
+    const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory())
+      walk(root, childRel, acc);
+    else if (entry.isFile())
+      acc.push(childRel);
+  }
+}
+function enumerateChangedPaths(repoRoot2, opts = {}) {
+  if (headCommit(repoRoot2) === null)
+    return null;
+  const includeUncommitted = opts.includeUncommitted !== false;
+  const ref = opts.since ?? "HEAD";
+  const diffArgs = ["diff", "--name-status", "--diff-filter=d", ref];
+  if (!includeUncommitted) {
+    if (!opts.since) {
+      throw new Error("nothing to enumerate: include_uncommitted=false requires a `since` ref");
+    }
+    diffArgs.push("HEAD");
+  }
+  const diff = git2(repoRoot2, diffArgs);
+  if (diff === null) {
+    throw new Error(`git diff failed \u2014 is '${ref}' a valid ref?`);
+  }
+  const paths = /* @__PURE__ */ new Map();
+  for (const line of diff.split("\n")) {
+    if (!line.trim())
+      continue;
+    const cols = line.split("	");
+    if (cols.length < 2)
+      continue;
+    const code = cols[0][0];
+    const p = unquote((cols.length >= 3 ? cols[cols.length - 1] : cols[1]).trim());
+    if (!p)
+      continue;
+    if (code === "A" || code === "C")
+      paths.set(p, "added");
+    else if (code === "R")
+      paths.set(p, "renamed");
+    else
+      paths.set(p, "modified");
+  }
+  if (includeUncommitted) {
+    const status2 = git2(repoRoot2, ["status", "--porcelain", "-uall"]) ?? "";
+    for (const line of status2.split("\n")) {
+      if (line.length < 4)
+        continue;
+      const x = line[0];
+      const y = line[1];
+      if (x === "D" || y === "D")
+        continue;
+      let p = line.slice(3);
+      const arrow = p.indexOf(" -> ");
+      if (arrow >= 0)
+        p = p.slice(arrow + 4);
+      p = unquote(p);
+      if (!p || paths.has(p))
+        continue;
+      if (x === "?" || x === "A" || y === "A")
+        paths.set(p, "added");
+      else if (x === "R")
+        paths.set(p, "renamed");
+      else
+        paths.set(p, "modified");
+    }
+  }
+  return paths;
+}
+function unquote(p) {
+  return p.startsWith('"') && p.endsWith('"') ? p.slice(1, -1) : p;
+}
+function changedSourceFiles(repoRoot2, opts = {}) {
+  const paths = enumerateChangedPaths(repoRoot2, opts);
+  if (paths === null)
+    return null;
+  return classify(paths.keys());
+}
+function statFile(repoRoot2, relPath) {
+  try {
+    const s = statSync(posix2.join(repoRoot2, relPath));
+    return { mtimeMs: Math.floor(s.mtimeMs), size: s.size };
+  } catch {
+    return null;
+  }
+}
+function hashContent(content) {
+  return createHash3("sha256").update(content).digest("hex");
+}
+function headCommit(repoRoot2) {
+  return git2(repoRoot2, ["rev-parse", "HEAD"])?.trim() ?? null;
+}
+function resolveCommitSha(repoRoot2, ref) {
+  return git2(repoRoot2, ["rev-parse", "--verify", `${ref}^{commit}`])?.trim() ?? null;
+}
+function isWorktreeDirty(repoRoot2) {
+  const status2 = git2(repoRoot2, ["status", "--porcelain", "-uall"]);
+  return status2 !== null && status2.trim().length > 0;
+}
+
+// ../../packages/code-index/build/incremental/hunks.js
+var MAX_DIFF_BYTES = 16 * 1024 * 1024;
+var MAX_HUNKS_PER_FILE = 500;
+var MAX_ADDED_LINES_PER_FILE = 4e3;
+var MAX_UNTRACKED_HEAD_BYTES = 256 * 1024;
+var HUNK_RE = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+function changedHunks(repoRoot2, opts = {}) {
+  if (runGit(repoRoot2, ["rev-parse", "HEAD"]) === null)
+    return null;
+  const includeUncommitted = opts.includeUncommitted !== false;
+  const ref = opts.since ?? "HEAD";
+  const diffArgs = [
+    "diff",
+    "--unified=0",
+    "--no-color",
+    "--no-ext-diff",
+    "--diff-filter=d",
+    ref
+  ];
+  if (!includeUncommitted) {
+    if (!opts.since) {
+      throw new Error("nothing to enumerate: include_uncommitted=false requires a `since` ref");
+    }
+    diffArgs.push("HEAD");
+  }
+  const diff = runGit(repoRoot2, diffArgs);
+  if (diff === null) {
+    throw new Error(`git diff failed \u2014 is '${ref}' a valid ref?`);
+  }
+  const files = /* @__PURE__ */ new Map();
+  let coverage = "full";
+  if (Buffer.byteLength(diff, "utf8") > MAX_DIFF_BYTES) {
+    coverage = "none";
+  } else {
+    parseUnifiedDiff(diff, files, () => {
+      coverage = "partial";
+    });
+  }
+  if (includeUncommitted) {
+    const status2 = runGit(repoRoot2, ["status", "--porcelain", "-uall"]) ?? "";
+    for (const line of status2.split("\n")) {
+      if (line.length < 4 || line[0] !== "?")
+        continue;
+      let p = line.slice(3);
+      if (p.startsWith('"') && p.endsWith('"'))
+        p = p.slice(1, -1);
+      if (!p || files.has(p))
+        continue;
+      files.set(p, {
+        path: p,
+        status: "added",
+        binary: false,
+        wholeFile: true,
+        degraded: false,
+        addedRanges: [],
+        deletionPoints: [],
+        addedLines: []
+      });
+    }
+  }
+  return { files, coverage };
+}
+function parseUnifiedDiff(diff, files, onDegrade) {
+  let current = null;
+  let hunkCount = 0;
+  let pendingRename = false;
+  let pendingNewFile = false;
+  const commit = () => {
+    if (current)
+      files.set(current.path, current);
+    current = null;
+    hunkCount = 0;
+  };
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      commit();
+      pendingRename = false;
+      pendingNewFile = false;
+      continue;
+    }
+    if (line.startsWith("new file mode")) {
+      pendingNewFile = true;
+      continue;
+    }
+    if (line.startsWith("rename to ")) {
+      pendingRename = true;
+      continue;
+    }
+    if (line.startsWith("Binary files ") || line.startsWith("GIT binary patch")) {
+      if (current)
+        current.binary = true;
+      continue;
+    }
+    if (line.startsWith("+++ ")) {
+      let p = line.slice(4).trim();
+      if (p.startsWith('"') && p.endsWith('"'))
+        p = p.slice(1, -1);
+      if (p.startsWith("b/"))
+        p = p.slice(2);
+      if (p === "/dev/null")
+        continue;
+      current = {
+        path: p,
+        status: pendingNewFile ? "added" : pendingRename ? "renamed" : "modified",
+        binary: false,
+        wholeFile: false,
+        degraded: false,
+        addedRanges: [],
+        deletionPoints: [],
+        addedLines: []
+      };
+      continue;
+    }
+    if (!current)
+      continue;
+    const m = HUNK_RE.exec(line);
+    if (m) {
+      hunkCount++;
+      if (hunkCount > MAX_HUNKS_PER_FILE) {
+        if (!current.degraded) {
+          current.degraded = true;
+          current.addedRanges = [];
+          current.deletionPoints = [];
+          current.addedLines = [];
+          onDegrade();
+        }
+        continue;
+      }
+      const start = Number(m[1]);
+      const count = m[2] === void 0 ? 1 : Number(m[2]);
+      if (count > 0)
+        current.addedRanges.push({ start, end: start + count - 1 });
+      else
+        current.deletionPoints.push(start);
+      continue;
+    }
+    if (line.startsWith("+") && !line.startsWith("+++") && !current.degraded && current.addedLines.length < MAX_ADDED_LINES_PER_FILE) {
+      current.addedLines.push(line.slice(1));
+    }
+  }
+  commit();
+}
+
+// ../../packages/code-index/build/review/risk-rules.js
+var RISK_RULES = [
+  {
+    flag: "sql_migration_added",
+    path: /(^|\/)migrations\/[^/]+\.sql$/i,
+    onlyWhenAdded: true
+  },
+  {
+    flag: "security_definer_touched",
+    path: /\.sql$/i,
+    content: /\bSECURITY\s+DEFINER\b/i
+  },
+  {
+    flag: "rls_policy_changed",
+    path: /\.sql$/i,
+    content: /\b(CREATE|ALTER|DROP)\s+POLICY\b|\bROW\s+LEVEL\s+SECURITY\b/i
+  },
+  {
+    flag: "auth_config_changed",
+    path: /(^|\/)supabase\/config\.toml$|(^|\/)(middleware|proxy)\.(ts|js)$/
+  },
+  {
+    flag: "package_manifest_changed",
+    path: /(^|\/)(package\.json|pnpm-lock\.yaml|package-lock\.json|yarn\.lock|requirements\.txt|pyproject\.toml|Cargo\.toml|go\.mod)$/
+  },
+  {
+    flag: "ci_workflow_changed",
+    path: /^\.github\/workflows\/[^/]+\.ya?ml$|^\.gitlab-ci\.yml$/
+  },
+  {
+    flag: "env_or_secrets_file",
+    path: /(^|\/)\.env(\.[^/]+)?$|\.(pem|key)$/
+  }
+];
+
+// ../../packages/code-index/build/review/risk-scan.js
+function scanRiskFlags(input) {
+  const flags = /* @__PURE__ */ new Set();
+  for (const [path, status2] of input.paths) {
+    for (const rule of RISK_RULES) {
+      if (flags.has(rule.flag))
+        continue;
+      if (!rule.path.test(path))
+        continue;
+      if (rule.onlyWhenAdded && status2 !== "added")
+        continue;
+      if (!rule.content) {
+        flags.add(rule.flag);
+        continue;
+      }
+      const text = contentForPath(path, input);
+      if (text !== null && rule.content.test(text))
+        flags.add(rule.flag);
+    }
+  }
+  return [...flags].sort();
+}
+function contentForPath(path, input) {
+  const hunks = input.hunks.get(path);
+  if (hunks && !hunks.wholeFile && !hunks.degraded) {
+    return hunks.addedLines.join("\n");
+  }
+  return input.readUntracked(path);
+}
+
+// ../../packages/code-index/build/store/schema.js
+var SCHEMA_VERSION = "1";
+var SCHEMA_SQL = (
+  /* sql */
+  `
+CREATE TABLE IF NOT EXISTS meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS files (
+  path          TEXT PRIMARY KEY,
+  language      TEXT NOT NULL,
+  content_hash  TEXT NOT NULL,
+  mtime_ms      INTEGER NOT NULL,
+  size          INTEGER NOT NULL,
+  indexed_at    INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS nodes (
+  node_key       TEXT PRIMARY KEY,
+  kind           TEXT NOT NULL,
+  name           TEXT NOT NULL,
+  qualified_name TEXT NOT NULL,
+  file_path      TEXT NOT NULL,
+  language       TEXT NOT NULL,
+  start_line     INTEGER NOT NULL,
+  end_line       INTEGER NOT NULL,
+  start_byte     INTEGER NOT NULL,
+  end_byte       INTEGER NOT NULL,
+  signature      TEXT,
+  doc            TEXT
+);
+CREATE INDEX IF NOT EXISTS nodes_file_idx ON nodes(file_path);
+CREATE INDEX IF NOT EXISTS nodes_kind_idx ON nodes(kind);
+CREATE INDEX IF NOT EXISTS nodes_name_idx ON nodes(name);
+
+CREATE TABLE IF NOT EXISTS edges (
+  src_key TEXT NOT NULL,
+  dst_key TEXT NOT NULL,
+  kind    TEXT NOT NULL,
+  PRIMARY KEY (src_key, dst_key, kind)
+);
+CREATE INDEX IF NOT EXISTS edges_dst_idx ON edges(dst_key, kind);
+CREATE INDEX IF NOT EXISTS edges_src_idx ON edges(src_key, kind);
+
+-- Standalone (self-managed) FTS5 table \u2014 we populate/delete it in the same
+-- transaction as nodes, avoiding external-content trigger bookkeeping. The
+-- search_text column carries name + camel/snake-split tokens + doc + signature
+-- so unicode61 can match identifier fragments.
+CREATE VIRTUAL TABLE IF NOT EXISTS nodes_fts USING fts5(
+  node_key UNINDEXED,
+  search_text,
+  tokenize = 'unicode61'
+);
+
+-- Reserved for Phase 2 (semantic). Unused in Phase 1.
+CREATE TABLE IF NOT EXISTS embeddings (
+  node_key     TEXT PRIMARY KEY,
+  dim          INTEGER NOT NULL,
+  vec          BLOB NOT NULL,
+  content_hash TEXT NOT NULL
+);
+`
+);
+var META_SCHEMA_VERSION = "schema_version";
+var META_LAST_INDEX_COMMIT = "last_index_commit";
+var META_LAST_INDEXED_AT = "last_indexed_at";
+var META_EMBED_RECIPE_VERSION = "embed_recipe_version";
+var META_EMBED_MODEL = "embed_model";
+var META_EMBED_DIM = "embed_dim";
+var META_LAST_SYNCED_AT = "last_synced_at";
+var META_LAST_SYNCED_COMMIT = "last_synced_commit";
+
+// ../../packages/code-index/build/util/identifiers.js
+function splitIdentifier(id) {
+  return id.replace(/[_\-./]+/g, " ").replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/\s+/).filter((t) => t.length > 0);
+}
+function buildSearchText(parts) {
+  const frags = /* @__PURE__ */ new Set();
+  frags.add(parts.name.toLowerCase());
+  frags.add(parts.qualifiedName.toLowerCase());
+  for (const f of splitIdentifier(parts.name))
+    frags.add(f);
+  for (const f of splitIdentifier(parts.qualifiedName))
+    frags.add(f);
+  const extra = [parts.doc ?? "", parts.signature ?? ""].join(" ").trim();
+  const base = [...frags].join(" ");
+  return extra ? `${base} ${extra}` : base;
+}
+function toFtsMatchQuery(query) {
+  const frags = /* @__PURE__ */ new Set();
+  for (const raw of query.split(/\s+/)) {
+    const cleaned = raw.replace(/[^A-Za-z0-9]+/g, "");
+    if (cleaned.length === 0)
+      continue;
+    frags.add(cleaned.toLowerCase());
+    for (const f of splitIdentifier(cleaned))
+      frags.add(f);
+  }
+  if (frags.size === 0)
+    return null;
+  return [...frags].map((f) => `${f}*`).join(" OR ");
+}
+
+// ../../packages/code-index/build/query/engine.js
+var CodeIndexEngine = class {
+  store;
+  parser;
+  repoRoot;
+  embedder;
+  constructor(deps) {
+    this.store = deps.store;
+    this.parser = deps.parser;
+    this.repoRoot = deps.repoRoot;
+    this.embedder = deps.embedder ?? null;
+  }
+  async indexRepository(opts = {}) {
+    const started = opts.now ?? Date.now();
+    await this.store.init();
+    await this.parser.init();
+    const storedVersion = await this.store.getMeta(META_SCHEMA_VERSION);
+    const hadIndex = await this.store.countFiles() > 0;
+    if (opts.full || hadIndex && storedVersion !== SCHEMA_VERSION) {
+      await this.wipe();
+    }
+    const discovered = discoverSourceFiles(this.repoRoot);
+    const discoveredPaths = new Set(discovered.map((d) => d.path));
+    const storedFiles = await this.store.getAllFiles();
+    const storedByPath = new Map(storedFiles.map((f) => [f.path, f]));
+    const incremental = storedFiles.length > 0 && !opts.full;
+    const stats = {
+      filesScanned: discovered.length,
+      filesParsed: 0,
+      filesSkipped: 0,
+      filesDeleted: 0,
+      nodeCount: 0,
+      edgeCount: 0,
+      durationMs: 0,
+      incremental
+    };
+    for (const f of storedFiles) {
+      if (!discoveredPaths.has(f.path)) {
+        await this.store.deleteFile(f.path);
+        stats.filesDeleted++;
+      }
+    }
+    const parsedFiles = [];
+    let done = 0;
+    for (const d of discovered) {
+      done++;
+      const st = statFile(this.repoRoot, d.path);
+      if (!st) {
+        stats.filesSkipped++;
+        continue;
+      }
+      const prior = storedByPath.get(d.path);
+      if (prior && prior.mtimeMs === st.mtimeMs && prior.size === st.size) {
+        stats.filesSkipped++;
+        continue;
+      }
+      const content = this.readRepoFile(d.path);
+      if (content === null) {
+        stats.filesSkipped++;
+        continue;
+      }
+      const contentHash = hashContent(content);
+      if (prior && prior.contentHash === contentHash) {
+        await this.store.upsertFile({ ...prior, mtimeMs: st.mtimeMs, indexedAt: started });
+        stats.filesSkipped++;
+        continue;
+      }
+      const parsed = await this.parser.parse(d.path, content, d.language);
+      const ftsText = /* @__PURE__ */ new Map();
+      for (const n of parsed.nodes)
+        ftsText.set(n.nodeKey, buildSearchText(n));
+      const fileRow = {
+        path: d.path,
+        language: d.language,
+        contentHash,
+        mtimeMs: st.mtimeMs,
+        size: st.size,
+        indexedAt: started
+      };
+      await this.store.replaceFileNodes(fileRow, parsed.nodes, ftsText);
+      parsedFiles.push(parsed);
+      stats.filesParsed++;
+      opts.onProgress?.({ path: d.path, done, total: discovered.length });
+    }
+    if (parsedFiles.length > 0) {
+      const nameIndex = await this.store.getNameIndex();
+      const resIndex = buildResolutionIndex(nameIndex);
+      for (const parsed of parsedFiles) {
+        const resolved = resolveFileEdges(parsed, resIndex);
+        await this.store.replaceOutgoingEdges(resolved.srcKeys, resolved.edges);
+      }
+    }
+    if (this.embedder && opts.embed) {
+      const embeddable = await this.store.getNodesByKinds([...EMBEDDABLE_KINDS]);
+      const existing = await this.store.getEmbeddingContentHashes();
+      const pending = [];
+      for (const n of embeddable) {
+        const text = nodeEmbedText(n);
+        const hash = hashContent(`${this.embedder.recipeVersion}\0${text}`);
+        if (existing.get(n.nodeKey) !== hash)
+          pending.push({ nodeKey: n.nodeKey, text, hash });
+      }
+      const BATCH = 64;
+      for (let i = 0; i < pending.length; i += BATCH) {
+        const batch = pending.slice(i, i + BATCH);
+        const vecs = await this.embedder.embedDocuments(batch.map((b) => b.text));
+        await this.store.upsertEmbeddings(batch.map((b, j) => ({
+          nodeKey: b.nodeKey,
+          dim: this.embedder.dim,
+          vec: vecs[j],
+          contentHash: b.hash
+        })));
+        const done2 = Math.min(i + BATCH, pending.length);
+        opts.onProgress?.({ path: `embedding symbols`, done: done2, total: pending.length });
+      }
+      await this.store.pruneOrphanEmbeddings();
+      await this.store.setMeta(META_EMBED_RECIPE_VERSION, this.embedder.recipeVersion);
+      await this.store.setMeta(META_EMBED_MODEL, this.embedder.model);
+      await this.store.setMeta(META_EMBED_DIM, String(this.embedder.dim));
+    }
+    await this.store.setMeta(META_SCHEMA_VERSION, SCHEMA_VERSION);
+    await this.store.setMeta(META_LAST_INDEXED_AT, String(started));
+    const head = headCommit(this.repoRoot);
+    if (head)
+      await this.store.setMeta(META_LAST_INDEX_COMMIT, head);
+    stats.nodeCount = await this.store.countNodes();
+    stats.edgeCount = await this.store.countEdges();
+    stats.durationMs = (opts.now ?? Date.now()) - started;
+    return stats;
+  }
+  async status() {
+    await this.store.init();
+    const fileCount = await this.store.countFiles();
+    const langs = await this.store.languageDistribution();
+    const languages = {};
+    for (const l of langs)
+      languages[l.language] = l.count;
+    const lastAt = await this.store.getMeta(META_LAST_INDEXED_AT);
+    return {
+      indexed: fileCount > 0,
+      fileCount,
+      nodeCount: await this.store.countNodes(),
+      edgeCount: await this.store.countEdges(),
+      embeddingCount: await this.store.countEmbeddings(),
+      lastIndexedAt: lastAt ? Number(lastAt) : null,
+      lastIndexCommit: await this.store.getMeta(META_LAST_INDEX_COMMIT),
+      schemaVersion: await this.store.getMeta(META_SCHEMA_VERSION),
+      languages
+    };
+  }
+  async searchGraph(query, opts = {}) {
+    await this.store.init();
+    const limit = clampLimit(opts.limit, 20, 100);
+    const hits = await this.store.searchFts(query, opts.kind ?? null, limit);
+    const out = [];
+    for (const h of hits) {
+      const n = await this.store.getNode(h.nodeKey);
+      if (n)
+        out.push({ ...toHit(n), score: h.score });
+    }
+    return out;
+  }
+  async semanticQuery(query, opts = {}) {
+    await this.store.init();
+    if (!this.embedder)
+      return [];
+    const limit = clampLimit(opts.limit, 20, 100);
+    const qvec = await this.embedder.embedQuery(query);
+    const all = await this.store.allEmbeddings();
+    const scored = all.map((e) => ({ nodeKey: e.nodeKey, score: cosineSimilarity(qvec, e.vec) })).sort((a, b) => b.score - a.score).slice(0, limit);
+    const out = [];
+    for (const s of scored) {
+      const n = await this.store.getNode(s.nodeKey);
+      if (n)
+        out.push({ ...toHit(n), score: s.score });
+    }
+    return out;
+  }
+  async tracePath(nodeKey, opts = {}) {
+    await this.store.init();
+    const direction = opts.direction ?? "out";
+    const maxDepth = clampLimit(opts.maxDepth, 3, 5);
+    const limit = clampLimit(opts.limit, 100, 1e3);
+    const kinds = opts.kinds ?? null;
+    const steps = [];
+    const seenEdge = /* @__PURE__ */ new Set();
+    const visited = /* @__PURE__ */ new Set([nodeKey]);
+    let frontier = [nodeKey];
+    for (let depth = 0; depth < maxDepth && frontier.length > 0; depth++) {
+      const next = [];
+      for (const key of frontier) {
+        const edges = await this.store.neighbors(key, direction, kinds, limit);
+        for (const e of edges) {
+          const id = `${e.srcKey} ${e.dstKey} ${e.kind}`;
+          if (seenEdge.has(id))
+            continue;
+          seenEdge.add(id);
+          steps.push({ srcKey: e.srcKey, dstKey: e.dstKey, kind: e.kind });
+          if (steps.length >= limit)
+            return steps;
+          const other = direction === "out" ? e.dstKey : e.srcKey;
+          if (!visited.has(other)) {
+            visited.add(other);
+            next.push(other);
+          }
+        }
+      }
+      frontier = next;
+    }
+    return steps;
+  }
+  async getCodeSnippet(nodeKey) {
+    await this.store.init();
+    const n = await this.store.getNode(nodeKey);
+    if (!n)
+      return null;
+    let source = "";
+    try {
+      const full = readFileSync4(posix3.join(this.repoRoot, n.filePath), "utf8");
+      source = full.slice(n.startByte, n.endByte);
+    } catch {
+      return null;
+    }
+    return {
+      nodeKey: n.nodeKey,
+      filePath: n.filePath,
+      startLine: n.startLine,
+      endLine: n.endLine,
+      source
+    };
+  }
+  async getArchitecture(opts = {}) {
+    await this.store.init();
+    const kinds = await this.store.kindDistribution();
+    const langs = await this.store.languageDistribution();
+    const kindDistribution = {};
+    for (const k of kinds)
+      kindDistribution[k.kind] = k.count;
+    const languageDistribution = {};
+    for (const l of langs)
+      languageDistribution[l.language] = l.count;
+    return {
+      fileCount: await this.store.countFiles(),
+      nodeCount: await this.store.countNodes(),
+      edgeCount: await this.store.countEdges(),
+      kindDistribution,
+      languageDistribution,
+      topModules: await this.store.topModulesByFanIn(clampLimit(opts.topN, 10, 50))
+    };
+  }
+  async changedSymbols(opts = {}) {
+    await this.store.init();
+    const files = changedSourceFiles(this.repoRoot, opts);
+    if (files === null) {
+      throw new Error("changedSymbols requires a git repository (change detection is git-based)");
+    }
+    const limit = clampLimit(opts.limit, 64, 200);
+    const symbols = [];
+    let indexedFiles = 0;
+    for (const f of files) {
+      const rows = await this.store.getNodesByFile(f.path);
+      if (rows.length > 0)
+        indexedFiles++;
+      symbols.push(...rows);
+    }
+    symbols.sort((a, b) => a.filePath.localeCompare(b.filePath) || a.startLine - b.startLine);
+    return {
+      changedFiles: files.length,
+      indexedFiles,
+      symbols: symbols.slice(0, limit),
+      truncated: symbols.length > limit
+    };
+  }
+  async reviewChanges(opts = {}) {
+    await this.store.init();
+    const rawPaths = enumerateChangedPaths(this.repoRoot, opts);
+    if (rawPaths === null) {
+      throw new Error("reviewChanges requires a git repository (change detection is git-based)");
+    }
+    const hunksRes = changedHunks(this.repoRoot, opts);
+    const hunks = hunksRes?.files ?? /* @__PURE__ */ new Map();
+    let hunkCoverage = hunksRes?.coverage ?? "none";
+    const riskFlags = scanRiskFlags({
+      paths: rawPaths,
+      hunks,
+      readUntracked: (p) => this.readRepoFileHead(p, MAX_UNTRACKED_HEAD_BYTES)
+    });
+    const files = classifyPaths(rawPaths.keys());
+    const limit = clampLimit(opts.limit, 64, 200);
+    const symbols = [];
+    let indexedFiles = 0;
+    let staleFiles = 0;
+    for (const f of files) {
+      const rows = await this.store.getNodesByFile(f.path);
+      if (rows.length === 0)
+        continue;
+      indexedFiles++;
+      const fileRow = await this.store.getFile(f.path);
+      const content = this.readRepoFile(f.path);
+      const stale = fileRow !== null && content !== null && hashContent(content) !== fileRow.contentHash;
+      if (stale) {
+        staleFiles++;
+        if (hunkCoverage === "full")
+          hunkCoverage = "partial";
+      }
+      const fileStatus = rawPaths.get(f.path) ?? "modified";
+      const fh = hunks.get(f.path);
+      for (const row of rows) {
+        symbols.push(classifyReviewSymbol(row, fileStatus, fh, stale));
+      }
+    }
+    symbols.sort((a, b) => changeRank(a.change) - changeRank(b.change) || a.filePath.localeCompare(b.filePath) || a.startLine - b.startLine);
+    return {
+      changedFiles: files.length,
+      indexedFiles,
+      staleFiles,
+      symbols: symbols.slice(0, limit),
+      truncated: symbols.length > limit,
+      riskFlags,
+      hunkCoverage,
+      baseKind: opts.since ? "ref" : "uncommitted",
+      headSha: headCommit(this.repoRoot),
+      dirty: isWorktreeDirty(this.repoRoot),
+      baseSha: opts.since ? resolveCommitSha(this.repoRoot, opts.since) : null
+    };
+  }
+  async close() {
+    await this.store.close();
+  }
+  // ── internal ──
+  readRepoFileHead(relPath, maxBytes) {
+    const content = this.readRepoFile(relPath);
+    return content === null ? null : content.slice(0, maxBytes);
+  }
+  readRepoFile(relPath) {
+    try {
+      return readFileSync4(posix3.join(this.repoRoot, relPath), "utf8");
+    } catch {
+      return null;
+    }
+  }
+  async wipe() {
+    for (const f of await this.store.getAllFiles()) {
+      await this.store.deleteFile(f.path);
+    }
+  }
+};
+function toHit(n) {
+  return {
+    nodeKey: n.nodeKey,
+    kind: n.kind,
+    name: n.name,
+    qualifiedName: n.qualifiedName,
+    filePath: n.filePath,
+    language: n.language,
+    startLine: n.startLine,
+    endLine: n.endLine
+  };
+}
+function clampLimit(v, dflt, max) {
+  if (v === void 0 || !Number.isFinite(v))
+    return dflt;
+  return Math.max(1, Math.min(max, Math.floor(v)));
+}
+function changeRank(c) {
+  return c === "added" ? 0 : c === "modified" ? 1 : 2;
+}
+function classifyReviewSymbol(row, fileStatus, fh, stale) {
+  if (stale)
+    return { ...row, change: "co_located", changedLineCount: 0, staleIndex: true };
+  if (fileStatus === "added" || fh?.wholeFile) {
+    return {
+      ...row,
+      change: "added",
+      changedLineCount: row.endLine - row.startLine + 1,
+      staleIndex: false
+    };
+  }
+  if (!fh || fh.degraded || fh.binary) {
+    return { ...row, change: "co_located", changedLineCount: 0, staleIndex: false };
+  }
+  let overlap = 0;
+  for (const r of fh.addedRanges) {
+    const lo = Math.max(r.start, row.startLine);
+    const hi = Math.min(r.end, row.endLine);
+    if (hi >= lo)
+      overlap += hi - lo + 1;
+  }
+  const deletionTouch = fh.deletionPoints.some((c) => c >= row.startLine - 1 && c <= row.endLine);
+  if (overlap > 0 || deletionTouch) {
+    return { ...row, change: "modified", changedLineCount: overlap, staleIndex: false };
+  }
+  return { ...row, change: "co_located", changedLineCount: 0, staleIndex: false };
+}
+
+// ../../packages/code-index/build/store/node-sqlite.js
+import Database from "better-sqlite3";
+function toNodeRow(r) {
+  return {
+    nodeKey: r.node_key,
+    kind: r.kind,
+    name: r.name,
+    qualifiedName: r.qualified_name,
+    filePath: r.file_path,
+    language: r.language,
+    startLine: r.start_line,
+    endLine: r.end_line,
+    startByte: r.start_byte,
+    endByte: r.end_byte,
+    signature: r.signature,
+    doc: r.doc
+  };
+}
+var CHUNK = 400;
+var NodeSqliteStore = class {
+  db;
+  constructor(dbPath) {
+    this.db = new Database(dbPath);
+    this.db.pragma("journal_mode = WAL");
+    this.db.pragma("foreign_keys = ON");
+  }
+  async init() {
+    this.db.exec(SCHEMA_SQL);
+  }
+  async close() {
+    this.db.close();
+  }
+  async getMeta(key) {
+    const row = this.db.prepare("SELECT value FROM meta WHERE key = ?").get(key);
+    return row?.value ?? null;
+  }
+  async setMeta(key, value2) {
+    this.db.prepare("INSERT INTO meta(key, value) VALUES(?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value2);
+  }
+  async getAllFiles() {
+    const rows = this.db.prepare("SELECT * FROM files").all();
+    return rows.map((r) => ({
+      path: r.path,
+      language: r.language,
+      contentHash: r.content_hash,
+      mtimeMs: r.mtime_ms,
+      size: r.size,
+      indexedAt: r.indexed_at
+    }));
+  }
+  async getFile(path) {
+    const r = this.db.prepare("SELECT * FROM files WHERE path = ?").get(path);
+    if (!r)
+      return null;
+    return {
+      path: r.path,
+      language: r.language,
+      contentHash: r.content_hash,
+      mtimeMs: r.mtime_ms,
+      size: r.size,
+      indexedAt: r.indexed_at
+    };
+  }
+  async upsertFile(row) {
+    this.upsertFileStmt().run(row.path, row.language, row.contentHash, row.mtimeMs, row.size, row.indexedAt);
+  }
+  async replaceFileNodes(file, nodes, ftsText) {
+    const tx = this.db.transaction(() => {
+      this.deleteFileGraph(file.path);
+      const insNode = this.insertNodeStmt();
+      const insFts = this.insertFtsStmt();
+      for (const n of nodes) {
+        insNode.run(n.nodeKey, n.kind, n.name, n.qualifiedName, n.filePath, n.language, n.startLine, n.endLine, n.startByte, n.endByte, n.signature, n.doc);
+        insFts.run(n.nodeKey, ftsText.get(n.nodeKey) ?? n.name);
+      }
+      this.upsertFileStmt().run(file.path, file.language, file.contentHash, file.mtimeMs, file.size, file.indexedAt);
+    });
+    tx();
+  }
+  async deleteFile(path) {
+    const tx = this.db.transaction(() => {
+      this.deleteFileGraph(path);
+      this.db.prepare("DELETE FROM files WHERE path = ?").run(path);
+    });
+    tx();
+  }
+  async replaceOutgoingEdges(srcKeys, edges) {
+    const tx = this.db.transaction(() => {
+      const del = this.db.prepare("DELETE FROM edges WHERE src_key = ?");
+      for (const k of srcKeys)
+        del.run(k);
+      const ins = this.db.prepare("INSERT OR IGNORE INTO edges(src_key, dst_key, kind) VALUES(?, ?, ?)");
+      for (const e of edges)
+        ins.run(e.srcKey, e.dstKey, e.kind);
+    });
+    tx();
+  }
+  async getNameIndex() {
+    const rows = this.db.prepare("SELECT node_key, name, kind, file_path FROM nodes").all();
+    return rows.map((r) => ({
+      nodeKey: r.node_key,
+      name: r.name,
+      kind: r.kind,
+      filePath: r.file_path
+    }));
+  }
+  async getNode(nodeKey) {
+    const r = this.db.prepare("SELECT * FROM nodes WHERE node_key = ?").get(nodeKey);
+    return r ? toNodeRow(r) : null;
+  }
+  async getNodesByFile(path) {
+    const rows = this.db.prepare("SELECT * FROM nodes WHERE file_path = ? ORDER BY start_line").all(path);
+    return rows.map(toNodeRow);
+  }
+  async getNodesByKinds(kinds) {
+    if (kinds.length === 0)
+      return [];
+    const rows = this.db.prepare(`SELECT * FROM nodes WHERE kind IN (${kinds.map(() => "?").join(",")})`).all(...kinds);
+    return rows.map(toNodeRow);
+  }
+  async getAllNodes() {
+    const rows = this.db.prepare("SELECT * FROM nodes").all();
+    return rows.map(toNodeRow);
+  }
+  async getAllEdges() {
+    const rows = this.db.prepare("SELECT src_key, dst_key, kind FROM edges").all();
+    return rows.map((r) => ({
+      srcKey: r.src_key,
+      dstKey: r.dst_key,
+      kind: r.kind
+    }));
+  }
+  async upsertEmbeddings(rows) {
+    const stmt = this.db.prepare("INSERT OR REPLACE INTO embeddings(node_key, dim, vec, content_hash) VALUES(?, ?, ?, ?)");
+    const tx = this.db.transaction(() => {
+      for (const r of rows) {
+        const buf = Buffer.from(r.vec.buffer, r.vec.byteOffset, r.vec.byteLength);
+        stmt.run(r.nodeKey, r.dim, buf, r.contentHash);
+      }
+    });
+    tx();
+  }
+  async getEmbeddingContentHashes() {
+    const rows = this.db.prepare("SELECT node_key, content_hash FROM embeddings").all();
+    return new Map(rows.map((r) => [r.node_key, r.content_hash]));
+  }
+  async allEmbeddings() {
+    const rows = this.db.prepare("SELECT node_key, vec FROM embeddings").all();
+    return rows.map((r) => ({
+      nodeKey: r.node_key,
+      vec: new Float32Array(r.vec.buffer, r.vec.byteOffset, r.vec.byteLength / 4)
+    }));
+  }
+  async pruneOrphanEmbeddings() {
+    const info = this.db.prepare("DELETE FROM embeddings WHERE node_key NOT IN (SELECT node_key FROM nodes)").run();
+    return info.changes;
+  }
+  async countEmbeddings() {
+    return this.db.prepare("SELECT COUNT(*) AS c FROM embeddings").get().c;
+  }
+  async searchFts(query, kind, limit) {
+    const match = toFtsMatchQuery(query);
+    if (!match)
+      return [];
+    const sql = kind ? `SELECT f.node_key AS node_key, bm25(nodes_fts) AS score
+           FROM nodes_fts f JOIN nodes n ON n.node_key = f.node_key
+          WHERE nodes_fts MATCH ? AND n.kind = ?
+          ORDER BY score LIMIT ?` : `SELECT f.node_key AS node_key, bm25(nodes_fts) AS score
+           FROM nodes_fts f JOIN nodes n ON n.node_key = f.node_key
+          WHERE nodes_fts MATCH ?
+          ORDER BY score LIMIT ?`;
+    const stmt = this.db.prepare(sql);
+    const rows = kind ? stmt.all(match, kind, limit) : stmt.all(match, limit);
+    return rows.map((r) => ({ nodeKey: r.node_key, score: -r.score }));
+  }
+  async neighbors(nodeKey, direction, kinds, limit) {
+    const col = direction === "out" ? "src_key" : "dst_key";
+    let sql = `SELECT src_key, dst_key, kind FROM edges WHERE ${col} = ?`;
+    const params = [nodeKey];
+    if (kinds && kinds.length > 0) {
+      sql += ` AND kind IN (${kinds.map(() => "?").join(",")})`;
+      params.push(...kinds);
+    }
+    sql += " LIMIT ?";
+    params.push(limit);
+    const rows = this.db.prepare(sql).all(...params);
+    return rows.map((r) => ({
+      srcKey: r.src_key,
+      dstKey: r.dst_key,
+      kind: r.kind
+    }));
+  }
+  async countFiles() {
+    return this.db.prepare("SELECT COUNT(*) AS c FROM files").get().c;
+  }
+  async countNodes() {
+    return this.db.prepare("SELECT COUNT(*) AS c FROM nodes").get().c;
+  }
+  async countEdges() {
+    return this.db.prepare("SELECT COUNT(*) AS c FROM edges").get().c;
+  }
+  async kindDistribution() {
+    const rows = this.db.prepare("SELECT kind, COUNT(*) AS c FROM nodes GROUP BY kind ORDER BY c DESC").all();
+    return rows.map((r) => ({ kind: r.kind, count: r.c }));
+  }
+  async languageDistribution() {
+    const rows = this.db.prepare("SELECT language, COUNT(*) AS c FROM files GROUP BY language ORDER BY c DESC").all();
+    return rows.map((r) => ({ language: r.language, count: r.c }));
+  }
+  async topModulesByFanIn(limit) {
+    const rows = this.db.prepare(`SELECT n.file_path AS file_path, n.language AS language,
+                (SELECT COUNT(*) FROM nodes n2 WHERE n2.file_path = n.file_path) AS symbol_count,
+                (SELECT COUNT(*) FROM edges e WHERE e.src_key = n.node_key AND e.kind = 'imports') AS imports_out,
+                (SELECT COUNT(*) FROM edges e WHERE e.dst_key = n.node_key AND e.kind = 'imports') AS imports_in
+           FROM nodes n
+          WHERE n.kind = 'module'
+          ORDER BY imports_in DESC, symbol_count DESC
+          LIMIT ?`).all(limit);
+    return rows.map((r) => ({
+      filePath: r.file_path,
+      language: r.language,
+      symbolCount: r.symbol_count,
+      importsOut: r.imports_out,
+      importsIn: r.imports_in
+    }));
+  }
+  // ── internal helpers ──
+  deleteFileGraph(path) {
+    const keys = this.db.prepare("SELECT node_key FROM nodes WHERE file_path = ?").all(path).map((r) => r.node_key);
+    const delEdge = this.db.prepare("DELETE FROM edges WHERE src_key = ?");
+    const delFts = this.db.prepare("DELETE FROM nodes_fts WHERE node_key = ?");
+    for (let i = 0; i < keys.length; i += CHUNK) {
+      for (const k of keys.slice(i, i + CHUNK)) {
+        delEdge.run(k);
+        delFts.run(k);
+      }
+    }
+    this.db.prepare("DELETE FROM nodes WHERE file_path = ?").run(path);
+  }
+  _insNode = null;
+  insertNodeStmt() {
+    if (!this._insNode) {
+      this._insNode = this.db.prepare(`INSERT OR REPLACE INTO nodes(
+           node_key, kind, name, qualified_name, file_path, language,
+           start_line, end_line, start_byte, end_byte, signature, doc
+         ) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);
+    }
+    return this._insNode;
+  }
+  _insFts = null;
+  insertFtsStmt() {
+    if (!this._insFts) {
+      this._insFts = this.db.prepare("INSERT INTO nodes_fts(node_key, search_text) VALUES(?, ?)");
+    }
+    return this._insFts;
+  }
+  _upsertFile = null;
+  upsertFileStmt() {
+    if (!this._upsertFile) {
+      this._upsertFile = this.db.prepare(`INSERT INTO files(path, language, content_hash, mtime_ms, size, indexed_at)
+         VALUES(?, ?, ?, ?, ?, ?)
+         ON CONFLICT(path) DO UPDATE SET
+           language = excluded.language,
+           content_hash = excluded.content_hash,
+           mtime_ms = excluded.mtime_ms,
+           size = excluded.size,
+           indexed_at = excluded.indexed_at`);
+    }
+    return this._upsertFile;
+  }
+};
+
+// ../../packages/code-index/build/sync/types.js
+import { createHash as createHash4 } from "node:crypto";
+function sha2562(input) {
+  return createHash4("sha256").update(input, "utf8").digest("hex");
+}
+function toCloudNode(n) {
+  return {
+    node_key_hash: sha2562(n.nodeKey),
+    name: n.name,
+    qualified_name: n.qualifiedName,
+    path_hash: sha2562(n.filePath),
+    kind: n.kind,
+    language: n.language,
+    start_line: n.startLine,
+    end_line: n.endLine,
+    signature_hash: n.signature ? sha2562(n.signature) : null
+  };
+}
+function toCloudEdge(e) {
+  return {
+    src_key_hash: sha2562(e.srcKey),
+    dst_key_hash: sha2562(e.dstKey),
+    kind: e.kind
+  };
+}
+function toCloudEmbedding(v, contentHash, meta) {
+  return {
+    node_key_hash: sha2562(v.nodeKey),
+    embedding: Array.from(v.vec),
+    recipe_version: meta.recipeVersion,
+    dim: meta.dim,
+    model: meta.model,
+    content_hash: contentHash
+  };
+}
+
+// ../../packages/code-index/build/sync/client.js
+var SyncError = class extends Error {
+  status;
+  code;
+  constructor(message, status2, code) {
+    super(message);
+    this.status = status2;
+    this.code = code;
+    this.name = "SyncError";
+  }
+};
+var CodeIndexSync = class {
+  store;
+  cfg;
+  base;
+  chunk;
+  fetchImpl;
+  constructor(store, cfg) {
+    this.store = store;
+    this.cfg = cfg;
+    this.base = cfg.endpoint.replace(/\/+$/, "");
+    this.chunk = cfg.chunkSize && cfg.chunkSize > 0 ? cfg.chunkSize : 1e3;
+    this.fetchImpl = cfg.fetchImpl ?? fetch;
+  }
+  /** Close the underlying store handle. */
+  async close() {
+    await this.store.close();
+  }
+  /** Enable/disable the opt-in consent (CLI `maind sync enable`). */
+  async setConsent(enabled, policyVersion) {
+    await this.post("/api/codebase/consent", {
+      enabled,
+      policy_version: policyVersion ?? null
+    });
+  }
+  /** Cloud sync status for this repo (`maind sync status`). */
+  async remoteStatus() {
+    const qs = new URLSearchParams({ project_key: this.cfg.projectKey });
+    const json = await this.get(`/api/codebase/status?${qs.toString()}`);
+    return json;
+  }
+  /** Local index status (for the CLI to decide whether there's anything to push). */
+  async localStatus() {
+    await this.store.init();
+    return {
+      indexed: await this.store.countFiles() > 0,
+      nodeCount: await this.store.countNodes(),
+      edgeCount: await this.store.countEdges(),
+      embeddingCount: await this.store.countEmbeddings(),
+      fileCount: await this.store.countFiles(),
+      headCommit: await this.store.getMeta(META_LAST_INDEX_COMMIT),
+      lastSyncedAt: numOrNull(await this.store.getMeta(META_LAST_SYNCED_AT))
+    };
+  }
+  /**
+   * Full push: upsert every local node + edge, then prune cloud rows that no
+   * longer exist locally (deletions reconcile). Incremental-by-commit is a later
+   * optimization; a full upsert is idempotent and fine at repo scale.
+   */
+  async push() {
+    await this.store.init();
+    const nodes = (await this.store.getAllNodes()).map(toCloudNode);
+    const edges = (await this.store.getAllEdges()).map(toCloudEdge);
+    const schemaVersion = await this.store.getMeta(META_SCHEMA_VERSION) ?? SCHEMA_VERSION;
+    const headCommit2 = await this.store.getMeta(META_LAST_INDEX_COMMIT);
+    const fileCount = await this.store.countFiles();
+    const langDist = Object.fromEntries((await this.store.languageDistribution()).map((l) => [l.language, l.count]));
+    const manifest = {
+      project_key: this.cfg.projectKey,
+      head_commit: headCommit2,
+      schema_version: schemaVersion,
+      file_count: fileCount,
+      lang_dist: langDist
+    };
+    let phaseDone = 0;
+    const nodeChunks = chunkArray(nodes, this.chunk);
+    const edgeChunks = chunkArray(edges, this.chunk * 2);
+    const totalChunks = Math.max(1, nodeChunks.length + edgeChunks.length);
+    for (const chunk of nodeChunks) {
+      await this.post("/api/codebase/push", { ...manifest, nodes: chunk, edges: [] });
+      this.cfg.onProgress?.({ phase: "nodes", done: ++phaseDone, total: totalChunks });
+    }
+    for (const chunk of edgeChunks) {
+      await this.post("/api/codebase/push", { ...manifest, nodes: [], edges: chunk });
+      this.cfg.onProgress?.({ phase: "edges", done: ++phaseDone, total: totalChunks });
+    }
+    if (nodeChunks.length === 0 && edgeChunks.length === 0) {
+      await this.post("/api/codebase/push", { ...manifest, nodes: [], edges: [] });
+    }
+    const keep = nodes.map((n) => n.node_key_hash);
+    const pruneRes = await this.post("/api/codebase/prune", {
+      project_key: this.cfg.projectKey,
+      keep_node_key_hashes: keep
+    });
+    this.cfg.onProgress?.({ phase: "prune", done: totalChunks, total: totalChunks });
+    const embeddings = await this.store.countEmbeddings() > 0 ? await this.pushEmbeddings() : 0;
+    await this.store.setMeta(META_LAST_SYNCED_AT, String(Date.now()));
+    if (headCommit2)
+      await this.store.setMeta(META_LAST_SYNCED_COMMIT, headCommit2);
+    return {
+      nodes: nodes.length,
+      edges: edges.length,
+      pruned: numOr0(pruneRes.nodes_deleted),
+      embeddings,
+      headCommit: headCommit2
+    };
+  }
+  /**
+   * Push symbol vectors (ADR-220). Diffs local content-hashes against the
+   * remote map (get_codebase_embedding_hashes) and uploads only new/changed
+   * vectors — a full re-upload would be MBs on every sync. Returns the number
+   * of vectors uploaded. Requires the embedder identity recorded by
+   * `index --embed` (META_EMBED_*); older indexes must re-run it once.
+   */
+  async pushEmbeddings() {
+    await this.store.init();
+    const localHashes = await this.store.getEmbeddingContentHashes();
+    if (localHashes.size === 0)
+      return 0;
+    const meta = await this.embedMeta();
+    const qs = new URLSearchParams({ project_key: this.cfg.projectKey });
+    const remote = await this.get(`/api/codebase/embedding-hashes?${qs.toString()}`);
+    const remoteHashes = remote.hashes ?? {};
+    const pending = (await this.store.allEmbeddings()).map((v) => toCloudEmbedding(v, localHashes.get(v.nodeKey) ?? "", meta)).filter((c) => c.content_hash !== "" && remoteHashes[c.node_key_hash] !== c.content_hash);
+    if (pending.length === 0)
+      return 0;
+    const chunks = chunkArray(pending, EMBED_CHUNK);
+    let done = 0;
+    for (const chunk of chunks) {
+      await this.post("/api/codebase/push-embeddings", {
+        project_key: this.cfg.projectKey,
+        embeddings: chunk
+      });
+      this.cfg.onProgress?.({ phase: "embeddings", done: ++done, total: chunks.length });
+    }
+    return pending.length;
+  }
+  /** The embedder identity recorded at `index --embed` time. */
+  async embedMeta() {
+    const recipeVersion = await this.store.getMeta(META_EMBED_RECIPE_VERSION);
+    const model = await this.store.getMeta(META_EMBED_MODEL);
+    const dim = numOrNull(await this.store.getMeta(META_EMBED_DIM));
+    if (!recipeVersion || !model || !dim) {
+      throw new SyncError("local embeddings lack embedder metadata \u2014 re-run `maind index --embed` once to record it", 0, "missing_embed_meta");
+    }
+    return { recipeVersion, model, dim };
+  }
+  // ── HTTP ──
+  headers() {
+    const h = {
+      "content-type": "application/json",
+      authorization: `Bearer ${this.cfg.apiKey}`
+    };
+    if (this.cfg.deviceId)
+      h["x-maind-device-id"] = this.cfg.deviceId;
+    return h;
+  }
+  async post(path, body) {
+    const res = await this.fetchImpl(`${this.base}${path}`, {
+      method: "POST",
+      headers: this.headers(),
+      body: JSON.stringify(body)
+    });
+    return this.unwrap(res, path);
+  }
+  async get(path) {
+    const res = await this.fetchImpl(`${this.base}${path}`, {
+      method: "GET",
+      headers: this.headers()
+    });
+    return this.unwrap(res, path);
+  }
+  async unwrap(res, path) {
+    const text = await res.text().catch(() => "");
+    let json = null;
+    try {
+      json = text ? JSON.parse(text) : null;
+    } catch {
+      json = null;
+    }
+    if (!res.ok || !json || json.ok !== true) {
+      const code = json?.error;
+      throw new SyncError(`${path} failed (HTTP ${res.status})${code ? `: ${code}` : ""}`, res.status, code);
+    }
+    return json;
+  }
+};
+var EMBED_CHUNK = 250;
+function chunkArray(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size)
+    out.push(items.slice(i, i + size));
+  return out;
+}
+function numOrNull(v) {
+  if (v === null)
+    return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+}
+function numOr0(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+
+// ../../packages/code-index/build/node.js
+var DEFAULT_DB_RELPATH = ".maind/code-index.sqlite";
+function createNodeCodeIndex(opts) {
+  const dbPath = opts.dbPath ?? posix4.join(opts.repoRoot, DEFAULT_DB_RELPATH);
+  mkdirSync3(posix4.dirname(dbPath), { recursive: true });
+  const store = new NodeSqliteStore(dbPath);
+  const parser = new TreeSitterParser();
+  return new CodeIndexEngine({
+    store,
+    parser,
+    repoRoot: opts.repoRoot,
+    embedder: opts.embedder
+  });
+}
+function createCodeIndexSync(opts) {
+  const dbPath = opts.dbPath ?? posix4.join(opts.repoRoot, DEFAULT_DB_RELPATH);
+  const projectKey = opts.projectKey ?? computeProjectKey(opts.repoRoot) ?? void 0;
+  if (!projectKey) {
+    throw new Error("No project_key \u2014 the repo has no git remote. Cloud sync scopes by sha256(remote); commit a remote or pass an explicit key.");
+  }
+  const store = new NodeSqliteStore(dbPath);
+  return new CodeIndexSync(store, {
+    endpoint: opts.endpoint,
+    apiKey: opts.apiKey,
+    projectKey,
+    deviceId: opts.deviceId,
+    chunkSize: opts.chunkSize,
+    onProgress: opts.onProgress
+  });
+}
+
+// ../../packages/embedding/build/index.js
+var EMBEDDING_MODEL = process.env.MAIND_EMBEDDING_MODEL ?? "Xenova/bge-small-en-v1.5";
+var EMBEDDING_DIM = Number(process.env.MAIND_EMBEDDING_DIM ?? 384);
+var EMBEDDING_DTYPE = process.env.MAIND_EMBEDDING_DTYPE ?? "q8";
+var EMBEDDING_QUERY_PREFIX = "Represent this sentence for searching relevant passages: ";
+var extractorPromise = null;
+async function getExtractor() {
+  if (!extractorPromise) {
+    extractorPromise = (async () => {
+      const mod = await import("@huggingface/transformers");
+      const cacheDir = process.env.MAIND_EMBEDDING_CACHE_DIR;
+      if (cacheDir)
+        mod.env.cacheDir = cacheDir;
+      return mod.pipeline("feature-extraction", EMBEDDING_MODEL, {
+        dtype: EMBEDDING_DTYPE,
+        device: "cpu"
+      });
+    })();
+  }
+  return extractorPromise;
+}
+function createEmbedder() {
+  const embedder = {
+    async embedDocuments(texts) {
+      if (texts.length === 0)
+        return [];
+      const extractor = await getExtractor();
+      const out = await extractor(texts, { pooling: "cls", normalize: true });
+      return out.tolist().map((v) => Float32Array.from(v));
+    },
+    async embedQuery(text) {
+      const [vec] = await embedder.embedDocuments([
+        EMBEDDING_QUERY_PREFIX + text
+      ]);
+      return vec;
+    }
+  };
+  return embedder;
+}
+
+// ../../packages/code-index/build/embed/node.js
+var NodeEmbedder = class {
+  dim = EMBEDDING_DIM;
+  model = EMBEDDING_MODEL;
+  recipeVersion = EMBED_RECIPE_VERSION;
+  inner = createEmbedder();
+  embedDocuments(texts) {
+    return this.inner.embedDocuments(texts);
+  }
+  embedQuery(text) {
+    return this.inner.embedQuery(text);
+  }
+};
+
+// ../../packages/code-index/build/node-embed.js
+function createNodeEmbedder() {
+  return new NodeEmbedder();
+}
+
+// src/index-cmd.ts
+var OK_FILE_ENV = "MAIND_ORT_OK_FILE";
+var WORKER_FLAG = "--_ort-worker";
+var CLI_ENTRY = fileURLToPath(new URL("./index.js", import.meta.url));
+function isOrtWorker(argv) {
+  return argv.includes(WORKER_FLAG);
+}
+function runOrtIsolated(argv) {
+  const dir = mkdtempSync(join4(tmpdir(), "maind-ort-"));
+  const okFile = join4(dir, "ok");
+  const res = spawnSync(process.execPath, [CLI_ENTRY, ...argv, WORKER_FLAG], {
+    stdio: ["ignore", "inherit", "inherit"],
+    env: { ...process.env, [OK_FILE_ENV]: okFile }
+  });
+  const ok = existsSync2(okFile);
+  try {
+    rmSync(dirname3(okFile), { recursive: true, force: true });
+  } catch {
+  }
+  if (ok) return 0;
+  return res.status && res.status !== 0 ? res.status : 1;
+}
+function markOrtOk() {
+  const f = process.env[OK_FILE_ENV];
+  if (f) {
+    try {
+      writeFileSync3(f, "ok");
+    } catch {
+    }
+  }
+}
+function flag(argv, name) {
+  return argv.includes(name);
+}
+function value(argv, name) {
+  const i = argv.indexOf(name);
+  if (i === -1 || i + 1 >= argv.length) return void 0;
+  return argv[i + 1];
+}
+function resolveRoot(explicit) {
+  if (explicit) return explicit;
+  try {
+    return execFileSync4("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return process.cwd();
+  }
+}
+function openIndex(opts) {
+  return createNodeCodeIndex({
+    repoRoot: opts.root,
+    dbPath: opts.db ?? void 0,
+    embedder: createNodeEmbedder()
+  });
+}
+function baseOpts(argv) {
+  return {
+    root: resolveRoot(value(argv, "--root")),
+    db: value(argv, "--db") ?? null,
+    full: flag(argv, "--full"),
+    embed: flag(argv, "--embed"),
+    json: flag(argv, "--json")
+  };
+}
+function parseIndexArgs(argv) {
+  return baseOpts(argv);
+}
+function parseIndexSearchArgs(argv) {
+  const positional = argv.find((a) => !a.startsWith("--"));
+  const limitRaw = value(argv, "--limit");
+  const limit = limitRaw ? Number.parseInt(limitRaw, 10) : 15;
+  const kind = value(argv, "--kind");
+  return {
+    ...baseOpts(argv),
+    query: positional ?? "",
+    kind: kind ?? null,
+    limit: Number.isFinite(limit) && limit > 0 ? limit : 15
+  };
+}
+async function runIndex(opts) {
+  const idx = openIndex(opts);
+  try {
+    const stats = await idx.indexRepository({
+      full: opts.full,
+      embed: opts.embed,
+      onProgress: opts.json ? void 0 : (p) => {
+        process.stderr.write(
+          `\r  ${p.done}/${p.total}  ${p.path.slice(0, 60)}`.padEnd(84)
+        );
+      }
+    });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(stats) + "\n");
+    } else {
+      process.stderr.write("\r".padEnd(84) + "\r");
+      const extra = opts.embed ? `, ${(await idx.status()).embeddingCount} embeddings` : "";
+      process.stdout.write(
+        `  \u2713 ${stats.filesParsed} parsed \xB7 ${stats.filesSkipped} unchanged \xB7 ${stats.filesDeleted} removed \u2192 ${stats.nodeCount} symbols, ${stats.edgeCount} edges (${stats.durationMs}ms${stats.incremental ? ", incremental" : ""}${extra})
+`
+      );
+    }
+    markOrtOk();
+    return 0;
+  } finally {
+    await idx.close();
+  }
+}
+async function runIndexStatus(opts) {
+  const idx = openIndex(opts);
+  try {
+    const status2 = await idx.status();
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(status2) + "\n");
+      return 0;
+    }
+    if (!status2.indexed) {
+      process.stdout.write("  not indexed \u2014 run `maind index` first.\n");
+      return 0;
+    }
+    const langs = Object.entries(status2.languages).map(([l, c]) => `${l}:${c}`).join(" ");
+    const when = status2.lastIndexedAt ? new Date(status2.lastIndexedAt).toISOString() : "\u2014";
+    process.stdout.write(
+      `  ${status2.fileCount} files \xB7 ${status2.nodeCount} symbols \xB7 ${status2.edgeCount} edges \xB7 ${status2.embeddingCount} embeddings
+  languages: ${langs || "\u2014"}
+  last indexed: ${when}  (commit ${status2.lastIndexCommit?.slice(0, 8) ?? "\u2014"}, schema v${status2.schemaVersion ?? "\u2014"})
+`
+    );
+    return 0;
+  } finally {
+    await idx.close();
+  }
+}
+async function runIndexSearch(opts) {
+  if (!opts.query) {
+    process.stderr.write("maind: index-search needs a query. Usage: maind index-search <query> [--kind <k>] [--limit <n>]\n");
+    return 2;
+  }
+  const idx = openIndex(opts);
+  try {
+    const hits = await idx.searchGraph(opts.query, { kind: opts.kind ?? void 0, limit: opts.limit });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(hits) + "\n");
+      return 0;
+    }
+    if (hits.length === 0) {
+      process.stdout.write("  no matches.\n");
+      return 0;
+    }
+    for (const h of hits) {
+      process.stdout.write(
+        `  ${h.kind.padEnd(10)} ${h.qualifiedName}  ${h.filePath}:${h.startLine}
+`
+      );
+    }
+    return 0;
+  } finally {
+    await idx.close();
+  }
+}
+async function runIndexSemantic(opts) {
+  if (!opts.query) {
+    process.stderr.write("maind: index-semantic needs a query. Usage: maind index-semantic <query> [--limit <n>]\n");
+    return 2;
+  }
+  const idx = openIndex(opts);
+  try {
+    const hits = await idx.semanticQuery(opts.query, { limit: opts.limit });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(hits) + "\n");
+    } else if (hits.length === 0) {
+      process.stdout.write(
+        "  no matches \u2014 did you build embeddings? Run 'maind index --embed' first.\n"
+      );
+    } else {
+      for (const h of hits) {
+        process.stdout.write(
+          `  ${(h.score ?? 0).toFixed(3)}  ${h.kind.padEnd(10)} ${h.qualifiedName}  ${h.filePath}:${h.startLine}
+`
+        );
+      }
+    }
+    markOrtOk();
+    return 0;
+  } finally {
+    await idx.close();
+  }
+}
+async function runIndexArch(opts) {
+  const idx = openIndex(opts);
+  try {
+    const arch = await idx.getArchitecture({ topN: 10 });
+    if (opts.json) {
+      process.stdout.write(JSON.stringify(arch) + "\n");
+      return 0;
+    }
+    const kinds = Object.entries(arch.kindDistribution).map(([k, c]) => `${k}:${c}`).join(" ");
+    process.stdout.write(
+      `  ${arch.fileCount} files \xB7 ${arch.nodeCount} symbols \xB7 ${arch.edgeCount} edges
+  kinds: ${kinds}
+  most-imported modules:
+`
+    );
+    for (const m of arch.topModules) {
+      process.stdout.write(
+        `    ${String(m.importsIn).padStart(4)} \u2190  ${m.filePath}  (${m.symbolCount} symbols)
+`
+      );
+    }
+    return 0;
+  } finally {
+    await idx.close();
+  }
+}
+
+// src/review.ts
+import { execFileSync as execFileSync5 } from "node:child_process";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+
+// ../../packages/code-index/build/index.js
+var CODE_INDEX_VERSION = "0.1.0";
+
+// src/review-render.ts
+var COMMENT_MARKER = "<!-- maind-review -->";
+var COMMENT_FINDINGS_CAP = 30;
+var FOOTER = "maind review \xB7 deterministic, provenance-backed";
+function buildReviewManifest(data, verdict, meta) {
+  const review = data.review;
+  return {
+    schema: "maind.review.manifest/v1",
+    generated_at: meta.generatedAt,
+    key_prefix: meta.keyPrefix,
+    run_ref: meta.runRef,
+    base: meta.base,
+    diff_stats: meta.diffStats,
+    symbol_count: meta.symbolCount,
+    risk_flags: review?.risk_flags ?? [],
+    findings: (review?.convention_findings ?? []).map((f) => ({
+      convention_id: f.convention_id,
+      version: f.convention_version,
+      severity: f.severity,
+      grade: f.grade,
+      matched_symbol_count: f.matched_symbols.length,
+      matched_changed_symbol_count: f.matched_changed_symbols?.length ?? 0
+    })),
+    served: (review?.lesson_hints ?? []).map((l) => ({
+      id: l.id,
+      version: typeof l.version === "number" ? l.version : null,
+      tier: l.tier ?? null
+    })),
+    verdict: verdict?.ok === true && typeof verdict.verdict === "string" ? {
+      verdict: verdict.verdict,
+      counts: {
+        block: verdict.counts?.block ?? 0,
+        warn: verdict.counts?.warn ?? 0,
+        note: verdict.counts?.note ?? 0
+      },
+      fail_on: meta.failOn
+    } : null,
+    run: verdict?.ok === true ? verdict.run ?? null : null,
+    ...verdict?.ok === true && verdict.run_note ? { run_note: verdict.run_note } : {},
+    coverage_note: review?.coverage_note ?? null
+  };
+}
+function severityBadge(f) {
+  return `**[${f.severity}]**`;
+}
+function findingLine(f) {
+  const cite = `\`${f.convention_id}@v${f.convention_version}\``;
+  const grade = f.grade === "verdict" ? " \xB7 verdict-grade" : "";
+  const changed = f.matched_changed_symbols?.length ?? 0;
+  const matchInfo = changed > 0 ? `matched on changed symbols: ${formatSymbols(f.matched_changed_symbols ?? [])}` : `matched (co-located): ${formatSymbols(f.matched_symbols)}`;
+  const summary = f.summary?.trim() ? ` \u2014 ${f.summary.trim()}` : "";
+  return `- ${severityBadge(f)} ${cite}${summary}${grade}
+  ${matchInfo}`;
+}
+function formatSymbols(symbols, max = 4) {
+  const shown = symbols.slice(0, max).map((s) => `\`${s}\``);
+  const rest = symbols.length - shown.length;
+  return shown.join(", ") + (rest > 0 ? ` (+${rest} more)` : "");
+}
+function verdictLabel(verdict) {
+  const counts = verdict.counts ?? {};
+  return `**Verdict: ${(verdict.verdict ?? "?").toUpperCase()}** (block: ${counts.block ?? 0} \xB7 warn: ${counts.warn ?? 0} \xB7 note: ${counts.note ?? 0})`;
+}
+function attestationLine(verdict) {
+  const r = verdict.run;
+  if (r) {
+    const grade = r.attestation_grade ? "attestation-grade" : "recorded, not attestation-grade";
+    return `Attestation: run \`${r.id.slice(0, 8)}\` (${grade}) \xB7 commit \`${r.commit_sha.slice(0, 12)}\` \xB7 input \`${r.input_hash.slice(0, 12)}\` \xB7 policy \`${r.policy_hash.slice(0, 12)}\``;
+  }
+  if (verdict.run_note) return `Attestation: none \u2014 ${verdict.run_note}`;
+  return null;
+}
+function baseLabel(meta) {
+  return meta.base ? `against \`${meta.base}\`` : "uncommitted work";
+}
+function renderReviewMarkdown(data, verdict, meta) {
+  const review = data.review;
+  const findings = review?.convention_findings ?? [];
+  const hints = review?.lesson_hints ?? [];
+  const riskFlags = review?.risk_flags ?? [];
+  const lines = [];
+  lines.push("<!-- Generated by `maind review` \u2014 do not edit by hand. -->");
+  lines.push(
+    `<!-- generated_at: ${meta.generatedAt} | key: ${meta.keyPrefix}${meta.runRef ? ` | run: ${meta.runRef}` : ""} -->`
+  );
+  lines.push("");
+  lines.push("# maind review");
+  lines.push("");
+  lines.push(
+    `Reviewed ${baseLabel(meta)}: ${meta.symbolCount} changed symbol(s) across ${meta.diffStats?.changed_file_count ?? 0} file(s) \xB7 findings: ${findings.length} \xB7 risk flags: ${riskFlags.length} \xB7 lesson hints: ${hints.length}`
+  );
+  lines.push("");
+  if (verdict?.ok === true && verdict.verdict) {
+    lines.push(verdictLabel(verdict));
+    const attest = attestationLine(verdict);
+    if (attest) {
+      lines.push("");
+      lines.push(attest);
+    }
+    if (verdict.trust_note) {
+      lines.push("");
+      lines.push(`_${verdict.trust_note}_`);
+    }
+    lines.push("");
+  }
+  if (findings.length > 0) {
+    lines.push("## Convention findings");
+    lines.push("");
+    for (const f of findings) lines.push(findingLine(f));
+    lines.push("");
+  } else {
+    lines.push("## Convention findings");
+    lines.push("");
+    lines.push("_No convention findings for this change set._");
+    lines.push("");
+  }
+  if (riskFlags.length > 0) {
+    lines.push("## Risk flags");
+    lines.push("");
+    lines.push(
+      "_Path heuristics from the local diff \u2014 informational, they never block._"
+    );
+    lines.push("");
+    for (const flag2 of riskFlags) lines.push(`- \`${flag2}\``);
+    lines.push("");
+  }
+  if (hints.length > 0) {
+    lines.push("## Lesson hints");
+    lines.push("");
+    lines.push("_Semantic suggestions \u2014 advisory, never part of a verdict._");
+    lines.push("");
+    for (const h of hints) {
+      const parts = [`\`${h.id}\``];
+      if (h.tier) parts.push(h.tier);
+      if (h.match_reason) parts.push(h.match_reason);
+      lines.push(`- **${h.title}** (${parts.join(" \xB7 ")})`);
+    }
+    lines.push("");
+  }
+  if (review?.coverage_note) {
+    lines.push("## Coverage");
+    lines.push("");
+    lines.push(`> ${review.coverage_note}`);
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push(FOOTER);
+  lines.push("");
+  return lines.join("\n");
+}
+function renderReviewComment(data, verdict, meta, reportPath) {
+  const review = data.review;
+  const findings = review?.convention_findings ?? [];
+  const riskFlags = review?.risk_flags ?? [];
+  const hints = review?.lesson_hints ?? [];
+  const lines = [];
+  lines.push(COMMENT_MARKER);
+  lines.push("## maind review");
+  lines.push("");
+  if (verdict?.ok === true && verdict.verdict) {
+    lines.push(verdictLabel(verdict));
+    const attest = attestationLine(verdict);
+    if (attest) lines.push(attest);
+    lines.push("");
+  }
+  if (findings.length === 0) {
+    lines.push(
+      `No convention findings for this change set (${meta.symbolCount} changed symbol(s) reviewed ${baseLabel(meta)}).`
+    );
+    lines.push("");
+  } else {
+    const shown = findings.slice(0, COMMENT_FINDINGS_CAP);
+    for (const f of shown) lines.push(findingLine(f));
+    if (findings.length > shown.length) {
+      lines.push("");
+      lines.push(
+        `\u2026and ${findings.length - shown.length} more finding(s) \u2014 see the \`${reportPath}\` build artifact.`
+      );
+    }
+    lines.push("");
+  }
+  if (riskFlags.length > 0) {
+    lines.push(
+      `**Risk flags:** ${riskFlags.map((f) => `\`${f}\``).join(" \xB7 ")} _(heuristics, never blocking)_`
+    );
+    lines.push("");
+  }
+  if (hints.length > 0) {
+    lines.push("**Related lessons:** " + hints.map((h) => `\`${h.id}\``).join(" \xB7 "));
+    lines.push("");
+  }
+  if (review?.coverage_note) {
+    lines.push(`> ${review.coverage_note}`);
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push(`_${FOOTER}_`);
+  lines.push("");
+  return lines.join("\n");
+}
+function renderFailOpenReview(meta, reason) {
+  return [
+    "<!-- Generated by `maind review` (fail-open path). -->",
+    `<!-- generated_at: ${meta.generatedAt} -->`,
+    "",
+    "# maind review",
+    "",
+    `_maind review was unavailable for this run: ${reason}_`,
+    "",
+    "The build can proceed normally \u2014 this file is informational only.",
+    ""
+  ].join("\n");
+}
+function renderFailOpenComment(meta, reason) {
+  return [
+    COMMENT_MARKER,
+    "## maind review",
+    "",
+    `_maind review was unavailable for this run: ${reason}_`,
+    "",
+    "---",
+    `_${FOOTER}_`,
+    ""
+  ].join("\n");
+}
+
+// src/review.ts
+var PROJECT_KEY_RE3 = /^[a-f0-9]{64}$/;
+var CLI_CLIENT_VERSION = "0.7.0";
+var DEFAULT_COMMENT_PATH = ".maind/review-comment.md";
+var SYMBOL_CAP = 64;
+function parseReviewArgs(argv) {
+  const get = (name) => {
+    const i = argv.indexOf(name);
+    if (i === -1 || i + 1 >= argv.length) return void 0;
+    return argv[i + 1];
+  };
+  const has = (name) => argv.includes(name);
+  let comment = null;
+  const ci = argv.indexOf("--comment");
+  if (ci !== -1) {
+    const next = argv[ci + 1];
+    comment = next && !next.startsWith("--") ? next : DEFAULT_COMMENT_PATH;
+  }
+  const failOnRaw = get("--fail-on");
+  const failOn = failOnRaw === "block" || failOnRaw === "warn" ? failOnRaw : null;
+  return {
+    base: get("--base") ?? null,
+    uncommitted: has("--uncommitted"),
+    summary: get("--summary") ?? null,
+    json: has("--json"),
+    out: get("--out") ?? ".maind/review.md",
+    comment,
+    gate: has("--gate"),
+    failOn,
+    strict: has("--strict"),
+    noReport: has("--no-report"),
+    projectKey: get("--project-key") ?? null,
+    mcpUrl: get("--mcp-url") ?? null,
+    runRef: get("--run-ref") ?? process.env.GITHUB_RUN_ID ?? null,
+    clientVersion: CLI_CLIENT_VERSION
+  };
+}
+function nowIso3() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function writeArtifact3(path, content) {
+  const dir = dirname4(path);
+  if (dir && dir !== ".") mkdirSync4(dir, { recursive: true });
+  writeFileSync4(path, content, "utf8");
+}
+function manifestPathFor(out) {
+  return out.endsWith(".md") ? out.slice(0, -3) + ".json" : out + ".json";
+}
+function verdictCrossesFailOn(verdict, failOn) {
+  return failOn === "block" ? verdict === "block" : verdict === "block" || verdict === "warn";
+}
+function resolveRepoRoot() {
+  try {
+    return execFileSync5("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+async function runReview(opts) {
+  const meta = {
+    generatedAt: nowIso3(),
+    keyPrefix: "unknown",
+    runRef: opts.runRef,
+    base: opts.base,
+    mcpUrl: opts.mcpUrl ?? process.env.MAIND_MCP_URL ?? "https://mcp.maind.dev/mcp",
+    symbolCount: 0,
+    diffStats: null,
+    gate: opts.gate,
+    failOn: opts.gate ? opts.failOn : null
+  };
+  if (opts.failOn && !opts.gate) {
+    warn5("--fail-on has no effect without --gate (advisory runs always exit 0).");
+  }
+  const failOpen = (reason) => {
+    warn5(`review unavailable, ${opts.strict ? "failing (--strict)" : "continuing"}: ${reason}`);
+    try {
+      writeArtifact3(opts.out, renderFailOpenReview(meta, reason));
+      const manifest = buildReviewManifest({}, null, meta);
+      manifest.error = reason;
+      writeArtifact3(manifestPathFor(opts.out), JSON.stringify(manifest, null, 2) + "\n");
+      if (opts.comment) writeArtifact3(opts.comment, renderFailOpenComment(meta, reason));
+      if (opts.json) process.stdout.write(JSON.stringify(manifest, null, 2) + "\n");
+    } catch (writeErr) {
+      warn5(`could not write fail-open artifacts: ${msg5(writeErr)}`);
+      return opts.strict ? 2 : 1;
+    }
+    return opts.strict ? 2 : 0;
+  };
+  try {
+    const root = resolveRepoRoot();
+    if (!root) {
+      return failOpen("not a git repository \u2014 review is diff-based.");
+    }
+    const engine = createNodeCodeIndex({ repoRoot: root });
+    let result;
+    try {
+      const status2 = await engine.status();
+      if (!status2.indexed || status2.fileCount === 0) {
+        warn5("no local index found \u2014 building it now (first run in this checkout)\u2026");
+        const stats = await engine.indexRepository();
+        warn5(`indexed ${stats.filesParsed} file(s) in ${Math.round(stats.durationMs / 1e3)}s.`);
+      }
+      result = await engine.reviewChanges({
+        since: opts.base ?? void 0,
+        includeUncommitted: opts.base ? opts.uncommitted : true,
+        limit: SYMBOL_CAP
+      });
+    } finally {
+      await engine.close().catch(() => void 0);
+    }
+    const diffStats = {
+      changed_file_count: result.changedFiles,
+      unindexed_file_count: result.changedFiles - result.indexedFiles,
+      stale_file_count: result.staleFiles,
+      truncated: result.truncated,
+      hunk_coverage: result.hunkCoverage,
+      base_kind: result.baseKind,
+      // Attest-Anker (ADR-230 §3): Commit-Objekt-Hashes + dirty — kein Source.
+      head_sha: result.headSha,
+      dirty: result.dirty,
+      base_sha: result.baseSha,
+      code_index_version: CODE_INDEX_VERSION
+    };
+    meta.diffStats = diffStats;
+    meta.symbolCount = result.symbols.length;
+    const summary = opts.summary?.trim() || void 0;
+    if (result.symbols.length === 0 && !summary) {
+      const flags = result.riskFlags;
+      const empty = {
+        ok: true,
+        review: {
+          convention_findings: [],
+          lesson_hints: [],
+          risk_flags: flags,
+          // changed_file_count counts INDEXABLE files; risk flags come from the
+          // raw path list. Both can be non-zero independently — say which it is
+          // instead of claiming "no changes" while a flag is showing.
+          coverage_note: flags.length > 0 ? result.changedFiles === 0 ? "No indexable changed files \u2014 the risk flags below come from non-indexable paths (migrations, workflows, manifests, env files), which the symbol index never sees." : "Changed files found but no indexed symbols \u2014 no symbol-level review. The risk flags below come from the raw path list; pass --summary for an index-less review." : result.changedFiles === 0 ? "No changed files detected." : "Changed files found but no indexed symbols \u2014 nothing reviewable at symbol level."
+        }
+      };
+      writeAll(empty, null, meta, opts);
+      process.stderr.write(
+        `maind review: no reviewable symbols (${result.changedFiles} changed file(s), ${flags.length} risk flag(s)) \u2192 ${opts.out}
+`
+      );
+      return 0;
+    }
+    const auth = resolveAuth();
+    meta.keyPrefix = auth.keyPrefix;
+    const overrideKey = opts.projectKey?.trim().toLowerCase();
+    const projectKey = overrideKey && PROJECT_KEY_RE3.test(overrideKey) ? overrideKey : gatherGitState().projectKey;
+    const client = new McpClient({
+      apiKey: auth.apiKey,
+      deviceId: auth.deviceId,
+      clientVersion: opts.clientVersion,
+      mcpUrl: opts.mcpUrl ?? void 0,
+      projectKey
+    });
+    const reviewArgs = {
+      changed_symbols: result.symbols.map((s) => ({
+        name: s.name,
+        qualified_name: s.qualifiedName,
+        kind: s.kind,
+        language: s.language,
+        change: s.change,
+        changed_line_count: s.changedLineCount
+      })),
+      risk_flags: result.riskFlags,
+      diff_stats: diffStats,
+      ...summary ? { change_summary: summary } : {},
+      ...projectKey ? { project_key: projectKey } : {}
+    };
+    const review = await client.callTool("review_changes", reviewArgs);
+    if (review.ok !== true || !review.review) {
+      return failOpen(
+        `review_changes rejected: ${review.error ?? "unknown_error"}${review.message ? ` \u2014 ${review.message}` : ""}`
+      );
+    }
+    let verdict = null;
+    if (opts.gate) {
+      const findings = review.review.convention_findings ?? [];
+      const attestArgs = !opts.noReport && result.headSha ? {
+        commit_sha: result.headSha,
+        ...result.baseSha ? { base_sha: result.baseSha } : {},
+        dirty: result.dirty,
+        diff_stats: diffStats,
+        code_index_version: CODE_INDEX_VERSION
+      } : {};
+      try {
+        verdict = await client.callTool("review_verdict", {
+          findings: findings.map((f) => ({
+            convention_id: f.convention_id,
+            convention_version: f.convention_version,
+            matched_symbols: f.matched_symbols,
+            matched_changed_symbols: f.matched_changed_symbols ?? []
+          })),
+          risk_flags: review.review.risk_flags ?? [],
+          ...projectKey ? { project_key: projectKey } : {},
+          ...attestArgs
+        });
+        if (verdict.ok !== true) {
+          if (verdict.error === "requires_team" || verdict.error === "requires_enterprise") {
+            warn5(
+              "gate skipped: review_verdict is a Team-plan feature \u2014 findings below are advisory. " + (verdict.message ?? "Upgrade at https://maind.dev/pricing.")
+            );
+            verdict = null;
+          } else {
+            if (opts.strict) {
+              return failOpen(
+                `review_verdict failed: ${verdict.error ?? "unknown_error"}${verdict.message ? ` \u2014 ${verdict.message}` : ""}`
+              );
+            }
+            warn5(
+              `gate unavailable (continuing advisory): ${verdict.error ?? "unknown_error"}`
+            );
+            verdict = null;
+          }
+        }
+      } catch (err2) {
+        if (opts.strict) return failOpen(`review_verdict failed: ${msg5(err2)}`);
+        warn5(`gate unavailable (continuing advisory): ${msg5(err2)}`);
+        verdict = null;
+      }
+    }
+    writeAll(review, verdict, meta, opts);
+    const findingCount = review.review.convention_findings?.length ?? 0;
+    const runNote = verdict?.run ? ` \xB7 run: ${verdict.run.id.slice(0, 8)}${verdict.run.attestation_grade ? " (attestation-grade)" : ""}` : verdict?.run_note ? ` \xB7 run: none (${verdict.run_note})` : "";
+    const verdictNote = verdict?.verdict ? ` \xB7 verdict: ${verdict.verdict}${runNote}` : "";
+    process.stderr.write(
+      `maind review: ${findingCount} finding(s), ${review.review.risk_flags?.length ?? 0} risk flag(s)${verdictNote} \u2192 ${opts.out}
+`
+    );
+    if (opts.gate && opts.failOn && verdict?.verdict) {
+      if (verdictCrossesFailOn(verdict.verdict, opts.failOn)) {
+        warn5(
+          `verdict '${verdict.verdict}' crossed --fail-on ${opts.failOn} \u2014 failing the check.`
+        );
+        return 1;
+      }
+    }
+    return 0;
+  } catch (err2) {
+    const reason = err2 instanceof MissingApiKeyError ? err2.message : msg5(err2);
+    return failOpen(reason);
+  }
+}
+function writeAll(review, verdict, meta, opts) {
+  writeArtifact3(opts.out, renderReviewMarkdown(review, verdict, meta));
+  const manifest = buildReviewManifest(review, verdict, meta);
+  writeArtifact3(manifestPathFor(opts.out), JSON.stringify(manifest, null, 2) + "\n");
+  if (opts.comment) {
+    writeArtifact3(opts.comment, renderReviewComment(review, verdict, meta, opts.out));
+  }
+  if (opts.json) process.stdout.write(JSON.stringify(manifest, null, 2) + "\n");
+}
+function msg5(err2) {
+  return err2 instanceof Error ? err2.message : String(err2);
+}
+function warn5(line) {
+  process.stderr.write(`maind review: ${line}
+`);
+}
+
+// src/sync-cmd.ts
+import { execFileSync as execFileSync6 } from "node:child_process";
+var CONSENT_POLICY_VERSION = "2026-07-05";
+var DEFAULT_DASHBOARD_URL = "https://app.maind.dev";
+function err(line) {
+  process.stderr.write(`maind: ${line}
+`);
+}
+function repoRoot() {
+  try {
+    return execFileSync6("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+  } catch {
+    return process.cwd();
+  }
+}
+function dashboardUrl() {
+  const raw = process.env.MAIND_DASHBOARD_URL?.trim();
+  return (raw && raw.length > 0 ? raw : DEFAULT_DASHBOARD_URL).replace(/\/+$/, "");
+}
+function makeSync(json) {
+  let auth;
+  try {
+    auth = resolveAuth();
+  } catch (e) {
+    if (e instanceof MissingApiKeyError) {
+      err(e.message);
+      return null;
+    }
+    throw e;
+  }
+  try {
+    return createCodeIndexSync({
+      repoRoot: repoRoot(),
+      endpoint: dashboardUrl(),
+      apiKey: auth.apiKey,
+      deviceId: auth.deviceId,
+      onProgress: json ? void 0 : (p) => process.stderr.write(`  ${p.phase}: ${p.done}/${p.total}\r`)
+    });
+  } catch (e) {
+    err(e instanceof Error ? e.message : String(e));
+    return null;
+  }
+}
+function msg6(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+function parseSyncArgs(argv) {
+  const positional = argv.find((a) => !a.startsWith("-"));
+  const sub = positional === "status" || positional === "enable" || positional === "disable" ? positional : "push";
+  return { sub, json: argv.includes("--json") };
+}
+async function runSync(opts) {
+  const sync = makeSync(opts.json);
+  if (!sync) return 1;
+  try {
+    switch (opts.sub) {
+      case "enable":
+        return await enable(sync);
+      case "disable":
+        return await disable(sync);
+      case "status":
+        return await status(sync, opts.json);
+      default:
+        return await push(sync, opts.json);
+    }
+  } catch (e) {
+    if (e instanceof SyncError && e.code === "consent_required") {
+      err("codebase cloud-sync is not enabled \u2014 run `maind sync enable` first.");
+      return 1;
+    }
+    err(`sync failed: ${msg6(e)}`);
+    return 1;
+  } finally {
+    await sync.close().catch(() => {
+    });
+  }
+}
+async function enable(sync) {
+  await sync.setConsent(true, CONSENT_POLICY_VERSION);
+  process.stdout.write(
+    "codebase cloud-sync enabled. Structured rows (symbol names, topology, hashes) will be pushed on `maind sync` \u2014 never source, snippets, or plaintext paths.\n"
+  );
+  return 0;
+}
+async function disable(sync) {
+  await sync.setConsent(false);
+  process.stdout.write("codebase cloud-sync disabled.\n");
+  return 0;
+}
+async function status(sync, json) {
+  const local = await sync.localStatus();
+  const remote = await sync.remoteStatus();
+  if (json) {
+    process.stdout.write(JSON.stringify({ ok: true, local, remote }, null, 2) + "\n");
+    return 0;
+  }
+  process.stdout.write(
+    `local:  ${local.indexed ? `${local.nodeCount} symbols \xB7 ${local.edgeCount} edges \xB7 ${local.fileCount} files` : "not indexed"}${local.lastSyncedAt ? ` \xB7 last synced ${new Date(local.lastSyncedAt).toISOString()}` : ""}
+cloud:  ${remote.indexed ? `${remote.node_count ?? "?"} symbols \xB7 ${remote.edge_count ?? "?"} edges` : "not synced"}
+`
+  );
+  return 0;
+}
+async function push(sync, json) {
+  const local = await sync.localStatus();
+  if (!local.indexed || local.nodeCount === 0) {
+    err("no local index found \u2014 run `maind index` first.");
+    return 1;
+  }
+  const res = await sync.push();
+  process.stderr.write("\n");
+  if (json) {
+    process.stdout.write(JSON.stringify({ ok: true, ...res }, null, 2) + "\n");
+    return 0;
+  }
+  process.stdout.write(
+    `synced ${res.nodes} symbols + ${res.edges} edges to the cloud${res.embeddings ? ` + ${res.embeddings} vectors` : ""}${res.pruned ? ` (pruned ${res.pruned} stale)` : ""}${res.headCommit ? ` @ ${res.headCommit.slice(0, 8)}` : ""}.
+`
+  );
+  return 0;
+}
+
+// src/index.ts
+var VERSION = "0.7.0";
+var HELP = `maind ${VERSION} \u2014 headless maind CLI for CI + git context
 
 Usage:
   maind context [options]      Pull stack-relevant lessons + conventions into the runner
@@ -38,10 +3896,10 @@ Usage:
   maind --help                 Show this help
   maind --version              Print version
 
-review options (advisory by default — exits 0 unless --gate + --fail-on):
+review options (advisory by default \u2014 exits 0 unless --gate + --fail-on):
   --base <ref>           Review the diff against this git ref (e.g. origin/main)
   --uncommitted          With --base: also include uncommitted changes (default without --base)
-  --summary <text>       Prose change summary — enables index-less review, sharpens hints
+  --summary <text>       Prose change summary \u2014 enables index-less review, sharpens hints
   --out <path>           Findings report markdown (default .maind/review.md; always written,
                          a manifest JSON lands next to it as review.json)
   --comment [<path>]     Also write PR-comment markdown (default .maind/review-comment.md);
@@ -50,35 +3908,36 @@ review options (advisory by default — exits 0 unless --gate + --fail-on):
   --gate                 Aggregate findings into a server-side pass|warn|block verdict (Team plan)
   --fail-on block|warn   With --gate: exit 1 when the verdict crosses this threshold
   --strict               Infra errors exit 2 instead of failing open with exit 0
-  --no-report            Do not report run counts to maind (reserved; run reporting
-                         lands with the review_runs ingest in a later release)
+  --no-report            With --gate: omit the commit anchors so the server does NOT
+                         persist a review_runs attestation record (ADR-230) \u2014 the
+                         verdict is then advisory-only, without a replayable proof
   --project-key <hex>    Repo project_key override (default: auto-detect from git)
-  --mcp-url <url>        Override MCP endpoint (default \$MAIND_MCP_URL or production)
+  --mcp-url <url>        Override MCP endpoint (default $MAIND_MCP_URL or production)
 
 git-context options (run at session-start; reads local git + gh, all fail-open):
   --out <path>           Briefing markdown output (default .maind/git-context.md)
   --manifest <path>      Optional structured JSON output (git_context manifest)
-  --no-mcp               Local git state only — skip peer-conflict + lesson enrichment
-  --mcp-url <url>        Override MCP endpoint (default \$MAIND_MCP_URL or production)
+  --no-mcp               Local git state only \u2014 skip peer-conflict + lesson enrichment
+  --mcp-url <url>        Override MCP endpoint (default $MAIND_MCP_URL or production)
 
 ci-report options (run in an on-failure step; the agent authors the lesson first):
-  --lesson <path>        Agent-authored lesson markdown (frontmatter + body) — required
-  --rationale <text>     Why this is a reusable lesson — required
-  --failure-type <t>     e.g. tsc-error, test-failure, lint-error — required
+  --lesson <path>        Agent-authored lesson markdown (frontmatter + body) \u2014 required
+  --rationale <text>     Why this is a reusable lesson \u2014 required
+  --failure-type <t>     e.g. tsc-error, test-failure, lint-error \u2014 required
   --signature <s>        Stable dedup key (default: failure-type + lesson hash)
   --summary <text>       Short failure description
   --remediation <text>   Suggested fix
   --logs <path>          Optional failure-log file (truncated to 8k)
   --provider <p>         CI provider (default github-actions)
   --project-key <hex>    Repo project_key for org-private repo-scoping (default: auto-detect from git)
-  --report-url <url>     Override ingest endpoint (default \$MAIND_REPORT_URL or prod)
+  --report-url <url>     Override ingest endpoint (default $MAIND_REPORT_URL or prod)
 
 ci-result options (run at the end of a job, success OR failure):
-  --outcome <s>          Build outcome, e.g. \${{ job.status }} (success|failure) — required
+  --outcome <s>          Build outcome, e.g. \${{ job.status }} (success|failure) \u2014 required
   --manifest <path>      Served-lesson manifest from 'maind context' (default .maind/manifest.json)
-  --run-ref <id>         Build identifier (default manifest.run_ref or \$GITHUB_RUN_ID)
+  --run-ref <id>         Build identifier (default manifest.run_ref or $GITHUB_RUN_ID)
   --run-url <url>        Link to the CI run (default derived from GitHub env)
-  --result-url <url>     Override ingest endpoint (default \$MAIND_RESULT_URL or prod)
+  --result-url <url>     Override ingest endpoint (default $MAIND_RESULT_URL or prod)
 
 context options:
   --stack <a,b>          Stack hint (seeds the platforms filter), e.g. nextjs,supabase
@@ -89,8 +3948,8 @@ context options:
   --budget <n>           Max lessons to pull (1-50, default 15; server caps search at 10)
   --out <path>           Context markdown output (default .maind/context.md)
   --manifest <path>      Manifest JSON output (default .maind/manifest.json)
-  --run-ref <id>         Build identifier for the manifest (default \$GITHUB_RUN_ID)
-  --mcp-url <url>        Override MCP endpoint (default \$MAIND_MCP_URL or production)
+  --run-ref <id>         Build identifier for the manifest (default $GITHUB_RUN_ID)
+  --mcp-url <url>        Override MCP endpoint (default $MAIND_MCP_URL or production)
 
 Auth:
   Reads MAIND_API_KEY (a read-scoped CI key from https://maind.dev/keys), or falls
@@ -98,77 +3957,68 @@ Auth:
   error it still writes explanatory artifacts and exits 0 so the build proceeds.
 `;
 async function main() {
-    const argv = process.argv.slice(2);
-    const cmd = argv[0];
-    if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
-        process.stdout.write(HELP);
-        return 0;
-    }
-    if (cmd === "--version" || cmd === "-v") {
-        process.stdout.write(VERSION + "\n");
-        return 0;
-    }
-    if (cmd === "context") {
-        return runContext(parseContextArgs(argv.slice(1)));
-    }
-    if (cmd === "git-context") {
-        return runGitContext(parseGitContextArgs(argv.slice(1)));
-    }
-    if (cmd === "project-key") {
-        // Prints the repo's project_key (sha256 of the normalized remote) for use in
-        // repo_keys when authoring repo-scoped org-private content. The raw URL is
-        // never printed — only the hash. STDOUT so it can be piped/captured.
-        const key = gatherGitState().projectKey;
-        if (!key) {
-            process.stderr.write("maind: not a git repo with a remote — no project_key.\n");
-            return 1;
-        }
-        process.stdout.write(key + "\n");
-        return 0;
-    }
-    // ONNX-runtime teardown isolation: `index --embed` and `index-semantic` use the
-    // embedder, which aborts the process on teardown (see index-cmd.ts). Re-exec
-    // them in a child so this process exits cleanly — unless we ARE that child.
-    const usesOrt = (cmd === "index" && argv.includes("--embed")) || cmd === "index-semantic";
-    if (usesOrt && !isOrtWorker(argv)) {
-        return runOrtIsolated(argv);
+  const argv = process.argv.slice(2);
+  const cmd = argv[0];
+  if (!cmd || cmd === "--help" || cmd === "-h" || cmd === "help") {
+    process.stdout.write(HELP);
+    return 0;
+  }
+  if (cmd === "--version" || cmd === "-v") {
+    process.stdout.write(VERSION + "\n");
+    return 0;
+  }
+  if (cmd === "context") {
+    return runContext(parseContextArgs(argv.slice(1)));
+  }
+  if (cmd === "git-context") {
+    return runGitContext(parseGitContextArgs(argv.slice(1)));
+  }
+  if (cmd === "project-key") {
+    const key = gatherGitState().projectKey;
+    if (!key) {
+      process.stderr.write("maind: not a git repo with a remote \u2014 no project_key.\n");
+      return 1;
     }
-    if (cmd === "index") {
-        return runIndex(parseIndexArgs(argv.slice(1)));
-    }
-    if (cmd === "index-status") {
-        return runIndexStatus(parseIndexArgs(argv.slice(1)));
-    }
-    if (cmd === "index-search") {
-        return runIndexSearch(parseIndexSearchArgs(argv.slice(1)));
-    }
-    if (cmd === "index-semantic") {
-        return runIndexSemantic(parseIndexSearchArgs(argv.slice(1)));
-    }
-    if (cmd === "index-arch") {
-        return runIndexArch(parseIndexArgs(argv.slice(1)));
-    }
-    if (cmd === "sync") {
-        return runSync(parseSyncArgs(argv.slice(1)));
-    }
-    if (cmd === "review") {
-        return runReview(parseReviewArgs(argv.slice(1)));
-    }
-    if (cmd === "ci-report") {
-        return runCiReport(parseCiReportArgs(argv.slice(1)));
-    }
-    if (cmd === "ci-result") {
-        return runCiResult(parseCiResultArgs(argv.slice(1)));
-    }
-    process.stderr.write(`maind: unknown command '${cmd}'. Run 'maind --help'.\n`);
-    return 2;
+    process.stdout.write(key + "\n");
+    return 0;
+  }
+  const usesOrt = cmd === "index" && argv.includes("--embed") || cmd === "index-semantic";
+  if (usesOrt && !isOrtWorker(argv)) {
+    return runOrtIsolated(argv);
+  }
+  if (cmd === "index") {
+    return runIndex(parseIndexArgs(argv.slice(1)));
+  }
+  if (cmd === "index-status") {
+    return runIndexStatus(parseIndexArgs(argv.slice(1)));
+  }
+  if (cmd === "index-search") {
+    return runIndexSearch(parseIndexSearchArgs(argv.slice(1)));
+  }
+  if (cmd === "index-semantic") {
+    return runIndexSemantic(parseIndexSearchArgs(argv.slice(1)));
+  }
+  if (cmd === "index-arch") {
+    return runIndexArch(parseIndexArgs(argv.slice(1)));
+  }
+  if (cmd === "sync") {
+    return runSync(parseSyncArgs(argv.slice(1)));
+  }
+  if (cmd === "review") {
+    return runReview(parseReviewArgs(argv.slice(1)));
+  }
+  if (cmd === "ci-report") {
+    return runCiReport(parseCiReportArgs(argv.slice(1)));
+  }
+  if (cmd === "ci-result") {
+    return runCiResult(parseCiResultArgs(argv.slice(1)));
+  }
+  process.stderr.write(`maind: unknown command '${cmd}'. Run 'maind --help'.
+`);
+  return 2;
 }
-main()
-    .then((code) => process.exit(code))
-    .catch((err) => {
-    // Defensive backstop — runContext is already fail-open, so reaching here means
-    // an unexpected programming error. Surface it on stderr and exit non-zero.
-    process.stderr.write(`maind: fatal: ${err instanceof Error ? err.stack ?? err.message : String(err)}\n`);
-    process.exit(1);
+main().then((code) => process.exit(code)).catch((err2) => {
+  process.stderr.write(`maind: fatal: ${err2 instanceof Error ? err2.stack ?? err2.message : String(err2)}
+`);
+  process.exit(1);
 });
-//# sourceMappingURL=index.js.map