@mushi-mushi/cli 0.28.0 → 0.29.1

package/dist/index.js

@@ -6,6 +6,7 @@ import {
   FULL_CLI_KEY_SCOPES,
   MCP_CLIENTS,
   MCP_CLIENT_LABEL,
+  MushiCliError,
   SDK_KEY_LABEL,
   SDK_KEY_SCOPES,
   apiCall,
@@ -52,11 +53,11 @@ import {
   setGlobalOutputFormat,
   trySaveKeyToKeychain,
   writeMcpServerEntry
-} from "./chunk-FJETUM25.js";
+} from "./chunk-MDYYLRWB.js";
 import {
   MUSHI_CLI_VERSION,
   MUSHI_MCP_PIN_SPEC
-} from "./chunk-UVO4A2G6.js";
+} from "./chunk-HHOPCVNI.js";
 import {
   FRAMEWORKS,
   detectFramework,
@@ -108,13 +109,13 @@ async function startDeviceAuth(endpoint, clientId) {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(clientId ? { client_id: clientId } : {})
   });
-  const json = await res.json().catch(() => null);
-  if (!res.ok || !json?.ok || !json.data) {
+  const json2 = await res.json().catch(() => null);
+  if (!res.ok || !json2?.ok || !json2.data) {
     throw new Error(
-      json?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`
+      json2?.error?.message ?? `Could not start browser sign-in (HTTP ${res.status}).`
     );
   }
-  return json.data;
+  return json2.data;
 }
 async function pollDeviceToken(endpoint, deviceCode) {
   const base = trimTrailingSlash(endpoint);
@@ -124,11 +125,11 @@ async function pollDeviceToken(endpoint, deviceCode) {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ device_code: deviceCode })
     });
-    const json = await res.json().catch(() => ({}));
-    if (res.ok && json.ok && json.data?.cli_token) {
-      return { status: "approved", cliToken: json.data.cli_token, userId: json.data.user_id };
+    const json2 = await res.json().catch(() => ({}));
+    if (res.ok && json2.ok && json2.data?.cli_token) {
+      return { status: "approved", cliToken: json2.data.cli_token, userId: json2.data.user_id };
     }
-    switch (json.error) {
+    switch (json2.error) {
       case "authorization_pending":
         return { status: "pending" };
       case "slow_down": {
@@ -144,7 +145,7 @@ async function pollDeviceToken(endpoint, deviceCode) {
       default:
         return {
           status: "error",
-          message: json.error_description ?? json.error ?? `HTTP ${res.status}`,
+          message: json2.error_description ?? json2.error ?? `HTTP ${res.status}`,
           // 5xx is a server hiccup the next poll may clear; 408 (gateway
           // timeout) is equally transient. Any other 4xx is a definitive
           // rejection (already claimed / invalid_grant) that won't fix
@@ -249,11 +250,11 @@ async function listProjects(endpoint, cliToken) {
         `Could not reach ${base}/v1/cli/projects: ${err instanceof Error ? err.message : String(err)}`
       );
     }
-    const json = await res.json().catch(() => null);
-    if (res.ok && json?.ok) return json.data?.projects ?? [];
+    const json2 = await res.json().catch(() => null);
+    if (res.ok && json2?.ok) return json2.data?.projects ?? [];
     throw new DeviceAuthRequestError(
       "list_projects",
-      json?.error?.message ?? `Could not list projects (HTTP ${res.status}).`,
+      json2?.error?.message ?? `Could not list projects (HTTP ${res.status}).`,
       res.status
     );
   });
@@ -265,11 +266,11 @@ async function createProject(endpoint, cliToken, name, opts = {}) {
     headers: cliAuthHeaders(cliToken),
     body: JSON.stringify({ name, ...opts.scopes ? { scopes: opts.scopes } : {} })
   });
-  const json = await res.json().catch(() => null);
-  if (!res.ok || !json?.ok || !json.data) {
-    throw new Error(json?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
+  const json2 = await res.json().catch(() => null);
+  if (!res.ok || !json2?.ok || !json2.data) {
+    throw new Error(json2?.error?.message ?? `Could not create project (HTTP ${res.status}).`);
   }
-  const { id, name: created, slug, apiKey } = json.data;
+  const { id, name: created, slug, apiKey } = json2.data;
   return { id, name: created, slug, apiKey: apiKey ?? null };
 }
 async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
@@ -290,11 +291,11 @@ async function mintProjectKey(endpoint, cliToken, projectId, opts = {}) {
       `Could not reach ${base}/v1/cli/projects/\u2026/keys: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const json = await res.json().catch(() => null);
-  if (res.ok && json?.ok && json.data?.key) return json.data.key;
+  const json2 = await res.json().catch(() => null);
+  if (res.ok && json2?.ok && json2.data?.key) return json2.data.key;
   throw new DeviceAuthRequestError(
     "mint_key",
-    json?.error?.message ?? `Could not mint an SDK key (HTTP ${res.status}).`,
+    json2?.error?.message ?? `Could not mint an SDK key (HTTP ${res.status}).`,
     res.status
   );
 }
@@ -317,16 +318,16 @@ async function revokeProjectKey(endpoint, cliToken, projectId, keyPrefix, newKey
       `Could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const json = await res.json().catch(() => null);
-  if (res.ok && json?.ok) {
+  const json2 = await res.json().catch(() => null);
+  if (res.ok && json2?.ok) {
     return {
-      revoked: json.revoked ?? 0,
-      revokedAt: json.revokedAt
+      revoked: json2.revoked ?? 0,
+      revokedAt: json2.revokedAt
     };
   }
   throw new DeviceAuthRequestError(
     "revoke_key",
-    json?.error?.message ?? `Could not revoke key (HTTP ${res.status}).`,
+    json2?.error?.message ?? `Could not revoke key (HTTP ${res.status}).`,
     res.status
   );
 }
@@ -438,9 +439,9 @@ async function resolveProjectChoice(projectsList, ask) {
     console.log(`    ${projectsList.length + 1}. Create a new project`);
     console.log("");
     const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-    const num = parseInt(choice, 10);
-    if (num >= 1 && num <= projectsList.length) {
-      const picked = projectsList[num - 1];
+    const num2 = parseInt(choice, 10);
+    if (num2 >= 1 && num2 <= projectsList.length) {
+      const picked = projectsList[num2 - 1];
       return { kind: "picked", id: picked.id, name: picked.name };
     }
   }
@@ -551,7 +552,7 @@ error: Could not start login session: ${err instanceof Error ? err.message : Str
     if (process.stdin.isTTY) {
       const { createInterface } = await import("readline");
       const rl = createInterface({ input: process.stdin, output: process.stdout });
-      const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+      const ask = (q) => new Promise((resolve7) => rl.question(q, (a) => resolve7(a.trim())));
       choice = await resolveProjectChoice(projectsList, ask);
       rl.close();
     } else {
@@ -867,12 +868,12 @@ async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
         body: JSON.stringify({}),
         signal: AbortSignal.timeout(8e3)
       });
-      const json = await res.json().catch(() => null);
-      const ok = res.ok && json?.ok === true;
+      const json2 = await res.json().catch(() => null);
+      const ok = res.ok && json2?.ok === true;
       checks.push({
         name: "Saved credentials valid",
         ok,
-        detail: ok ? `API key resolves to project "${json?.data?.project_name ?? config.projectId}".` : `${json?.error?.message ?? `whoami \u2192 HTTP ${res.status}`} \u2014 re-run \`npx mushi-mushi\` to sign in again.`
+        detail: ok ? `API key resolves to project "${json2?.data?.project_name ?? config.projectId}".` : `${json2?.error?.message ?? `whoami \u2192 HTTP ${res.status}`} \u2014 re-run \`npx mushi-mushi\` to sign in again.`
       });
     } catch (err) {
       checks.push({
@@ -894,9 +895,9 @@ async function checkCliAuthPath(config, doFetch = globalThis.fetch) {
 async function checkSdkInstall(cwd) {
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
-    const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
+    const { join: join10, resolve: resolve7 } = await import("path");
+    const root = resolve7(cwd);
+    const pkgPath = join10(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const sdks = [
@@ -1106,9 +1107,9 @@ async function checkHostAppWiring(cwd) {
   const checks = [];
   try {
     const { readFile: readFile3, access } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
-    const root = resolve3(cwd);
-    const pkgPath = join5(root, "package.json");
+    const { join: join10, resolve: resolve7 } = await import("path");
+    const root = resolve7(cwd);
+    const pkgPath = join10(root, "package.json");
     const pkg = JSON.parse(await readFile3(pkgPath, "utf8"));
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const isCapHybrid = Boolean(deps["@capacitor/core"] && deps["react"]);
@@ -1116,7 +1117,7 @@ async function checkHostAppWiring(cwd) {
     let envContent = "";
     for (const f of envCandidates) {
       try {
-        envContent = await readFile3(join5(root, f), "utf8");
+        envContent = await readFile3(join10(root, f), "utf8");
         break;
       } catch {
       }
@@ -1131,9 +1132,9 @@ async function checkHostAppWiring(cwd) {
       detail: hasProjectId && hasApiKey ? "VITE_/MUSHI_ project id + API key found" : "Run `mushi connect --write-env` or add VITE_MUSHI_PROJECT_ID + VITE_MUSHI_API_KEY"
     });
     let mcpFound = null;
-    for (const rel of [".mcp.json", join5(".cursor", "mcp.json")]) {
+    for (const rel of [".mcp.json", join10(".cursor", "mcp.json")]) {
       try {
-        await access(join5(root, rel));
+        await access(join10(root, rel));
         mcpFound = rel;
         break;
       } catch {
@@ -1175,9 +1176,9 @@ var HASH_ROUTER_PATTERNS = [
 var HASH_TEMPLATE_PATTERN = /['"`]#\//;
 async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
   const { readdir: readdir2, readFile: readFile3 } = await import("fs/promises");
-  const { join: join5 } = await import("path");
+  const { join: join10 } = await import("path");
   let count = 0;
-  async function walk(d, depth) {
+  async function walk2(d, depth) {
     if (depth > maxDepth || count > maxFiles) return null;
     let entries = [];
     try {
@@ -1187,9 +1188,9 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
     }
     for (const e of entries) {
       if (e.name.startsWith(".") || e.name === "node_modules" || e.name === "dist") continue;
-      const full = join5(d, e.name);
+      const full = join10(d, e.name);
       if (e.isDirectory()) {
-        const found = await walk(full, depth + 1);
+        const found = await walk2(full, depth + 1);
         if (found) return found;
       } else if (/\.[cm]?[jt]sx?$/.test(e.name)) {
         count++;
@@ -1202,12 +1203,12 @@ async function scanDirForPattern(dir, patterns, maxDepth = 6, maxFiles = 2e3) {
     }
     return null;
   }
-  const { resolve: resolve3 } = await import("path");
+  const { resolve: resolve7 } = await import("path");
   for (const sub of ["src", "app", "pages", "lib", "components"]) {
-    const found = await walk(join5(resolve3(dir), sub), 0);
+    const found = await walk2(join10(resolve7(dir), sub), 0);
     if (found) return found;
   }
-  return walk(resolve3(dir), 0);
+  return walk2(resolve7(dir), 0);
 }
 async function checkHashRouterCapture(cwd) {
   const hashFile = await scanDirForPattern(cwd, HASH_ROUTER_PATTERNS);
@@ -1240,13 +1241,13 @@ function normalizeProjectPath(path) {
 }
 async function collectMcpSources(root, home) {
   const { readFile: readFile3 } = await import("fs/promises");
-  const { join: join5 } = await import("path");
+  const { join: join10 } = await import("path");
   const sources = [];
   const invalid = [];
   const plainFiles = [
-    { path: join5(root, ".mcp.json"), claudeCode: true },
-    { path: join5(root, ".cursor", "mcp.json"), claudeCode: false },
-    { path: join5(home, ".cursor", "mcp.json"), claudeCode: false }
+    { path: join10(root, ".mcp.json"), claudeCode: true },
+    { path: join10(root, ".cursor", "mcp.json"), claudeCode: false },
+    { path: join10(home, ".cursor", "mcp.json"), claudeCode: false }
   ];
   for (const file of plainFiles) {
     let raw;
@@ -1263,7 +1264,7 @@ async function collectMcpSources(root, home) {
       invalid.push(file.path);
     }
   }
-  const claudeJsonPath = join5(home, ".claude.json");
+  const claudeJsonPath = join10(home, ".claude.json");
   try {
     const parsed = JSON.parse(await readFile3(claudeJsonPath, "utf8"));
     if (isJsonObject(parsed)) {
@@ -1314,9 +1315,9 @@ function assessMushiEntry(source, name, entry, cliKeySaved) {
 }
 async function checkMcpConfig(config, cwd, doFetch = globalThis.fetch, home) {
   const checks = [];
-  const { resolve: resolve3 } = await import("path");
+  const { resolve: resolve7 } = await import("path");
   const { homedir } = await import("os");
-  const root = resolve3(cwd);
+  const root = resolve7(cwd);
   const { sources, invalid } = await collectMcpSources(root, home ?? homedir());
   if (invalid.length > 0) {
     checks.push({
@@ -1440,12 +1441,12 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join5, resolve: resolve3 } = await import("path");
-    const root = resolve3(cwd);
+    const { join: join10, resolve: resolve7 } = await import("path");
+    const root = resolve7(cwd);
     let envContent = "";
     for (const f of [".env.local", ".env"]) {
       try {
-        envContent = await readFile3(join5(root, f), "utf8");
+        envContent = await readFile3(join10(root, f), "utf8");
         break;
       } catch {
       }
@@ -1511,7 +1512,7 @@ async function checkOnboardingStatus(config, _consoleBase, cwd, doFetch = global
 }
 async function checkVersionDrift(cwd, doFetch) {
   const checks = [];
-  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-VR37VEE4.js");
+  const { MUSHI_CLI_VERSION: MUSHI_CLI_VERSION2 } = await import("./version-FYBMIU3T.js");
   if (MUSHI_CLI_VERSION2 === "0.0.0-dev") return checks;
   const parse2 = (v) => {
     const m = v.replace(/^[~^]/, "").match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -1541,8 +1542,8 @@ async function checkVersionDrift(cwd, doFetch) {
   }
   try {
     const { readFile: readFile3 } = await import("fs/promises");
-    const { join: join5 } = await import("path");
-    const pkg = JSON.parse(await readFile3(join5(cwd, "package.json"), "utf8"));
+    const { join: join10 } = await import("path");
+    const pkg = JSON.parse(await readFile3(join10(cwd, "package.json"), "utf8"));
     const deps = { ...pkg.dependencies, ...pkg.devDependencies };
     const candidates = Object.entries(deps).filter(([name]) => name.startsWith("@mushi-mushi/")).filter(([, v]) => /^[~^]?\d/.test(v));
     const drifted = (await Promise.all(
@@ -2252,7 +2253,7 @@ async function installPackages(pm, packages, cwd) {
 function runCommand(pm, packages, cwd) {
   const verb = pm === "npm" ? "install" : "add";
   const command = process.platform === "win32" ? `${pm}.cmd` : pm;
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve7, reject) => {
     const child = spawn(command, [verb, ...packages], {
       stdio: "inherit",
       shell: false,
@@ -2261,7 +2262,7 @@ function runCommand(pm, packages, cwd) {
     });
     child.on("error", reject);
     child.on("exit", (code) => {
-      if (code === 0) resolve3();
+      if (code === 0) resolve7();
       else reject(new Error(`${pm} exited with code ${code ?? "null"}`));
     });
   });
@@ -2435,7 +2436,7 @@ async function maybeOfferConnect(credentials, options, _consoleBase) {
   if (p.isCancel(answer) || !answer) return;
   const endpoint = resolveCloudEndpoint(options.endpoint);
   try {
-    const { runConnect: runConnect2 } = await import("./connect-63GYZLFM.js");
+    const { runConnect: runConnect2 } = await import("./connect-RIPZ4B5Y.js");
     const saved = loadConfig();
     const result = await runConnect2(
       {
@@ -3342,26 +3343,26 @@ import { join as join3, relative, basename } from "path";
 import * as p2 from "@clack/prompts";
 async function findMapFiles(dir) {
   const results = [];
-  async function walk(current) {
+  async function walk2(current) {
     const entries = await readdir(current, { withFileTypes: true });
     for (const e of entries) {
       const full = join3(current, e.name);
       if (e.isDirectory()) {
-        await walk(full);
+        await walk2(full);
       } else if (e.isFile() && (e.name.endsWith(".js.map") || e.name.endsWith(".css.map"))) {
         results.push(full);
       }
     }
   }
-  await walk(dir);
+  await walk2(dir);
   return results;
 }
 function fileHash(path) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve7, reject) => {
     const hash = createHash("sha256");
     const stream = createReadStream(path);
     stream.on("data", (chunk) => hash.update(chunk));
-    stream.on("end", () => resolve3(hash.digest("hex")));
+    stream.on("end", () => resolve7(hash.digest("hex")));
     stream.on("error", reject);
   });
 }
@@ -3397,8 +3398,8 @@ async function uploadFile(filePath, release, endpoint, apiKey, debugId) {
       { headers: { Authorization: `Bearer ${apiKey}`, "X-Mushi-Api-Key": apiKey } }
     );
     if (checkRes.ok) {
-      const json = await checkRes.json();
-      if (json.exists) return { ok: true, skipped: true };
+      const json2 = await checkRes.json();
+      if (json2.exists) return { ok: true, skipped: true };
     }
   } catch {
   }
@@ -3561,15 +3562,15 @@ Examples:
     const config = requireConfig({ needsProject: true });
     const { readdir: readdir2, readFile: readFile3, stat } = await import("fs/promises");
     const nodePath2 = await import("path");
-    const SKIP = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
+    const SKIP2 = /node_modules|\.git|dist|build|\.next|\.turbo|coverage/;
     const EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs"]);
     const MAX_FILE_BYTES = 5e5;
-    async function* walk(dir) {
+    async function* walk2(dir) {
       const entries = await readdir2(dir, { withFileTypes: true });
       for (const e of entries) {
         const full = nodePath2.join(dir, e.name);
-        if (SKIP.test(full)) continue;
-        if (e.isDirectory()) yield* walk(full);
+        if (SKIP2.test(full)) continue;
+        if (e.isDirectory()) yield* walk2(full);
         else if (EXTS.has(nodePath2.extname(e.name))) yield full;
       }
     }
@@ -3577,7 +3578,7 @@ Examples:
     let bytes = 0;
     let errors = 0;
     const root = nodePath2.resolve(path);
-    for await (const file of walk(root)) {
+    for await (const file of walk2(root)) {
       const lang = nodePath2.extname(file).slice(1);
       if (opts.language && opts.language !== lang) continue;
       const stats = await stat(file);
@@ -3587,24 +3588,24 @@ Examples:
         continue;
       }
       const source = await readFile3(file, "utf8");
-      const relative2 = nodePath2.relative(root, file).replaceAll("\\", "/");
+      const relative4 = nodePath2.relative(root, file).replaceAll("\\", "/");
       count++;
       bytes += source.length;
       if (opts.dryRun) {
-        if (!opts.json) process.stdout.write(`  ${relative2} (${source.length} bytes)
+        if (!opts.json) process.stdout.write(`  ${relative4} (${source.length} bytes)
 `);
         continue;
       }
       const result = await apiCall("/v1/sync/codebase/upload", config, {
         method: "POST",
-        body: JSON.stringify({ projectId: config.projectId, filePath: relative2, source })
+        body: JSON.stringify({ projectId: config.projectId, filePath: relative4, source })
       });
       if (!result.ok) {
         errors++;
-        process.stderr.write(`  FAIL  ${relative2}: ${result.error.message}
+        process.stderr.write(`  FAIL  ${relative4}: ${result.error.message}
 `);
       } else if (!opts.json) {
-        process.stdout.write(`  ok    ${relative2} \u2192 ${result.data.chunks} chunks
+        process.stdout.write(`  ok    ${relative4} \u2192 ${result.data.chunks} chunks
 `);
       }
     }
@@ -3733,7 +3734,7 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
     const projectsList = await listProjects(endpoint, cliToken);
     const { createInterface } = await import("readline");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q) => new Promise((resolve3) => rl.question(q, (a) => resolve3(a.trim())));
+    const ask = (q) => new Promise((resolve7) => rl.question(q, (a) => resolve7(a.trim())));
     let chosen;
     let projectId;
     let projectName;
@@ -3747,9 +3748,9 @@ error: Could not start browser sign-in: ${err instanceof Error ? err.message : S
       console.log(`    ${projectsList.length + 1}. Create a new project`);
       console.log("");
       const choice = await ask(`  Pick a project [1-${projectsList.length + 1}]: `);
-      const num = parseInt(choice, 10);
-      if (num >= 1 && num <= projectsList.length) {
-        chosen = projectsList[num - 1];
+      const num2 = parseInt(choice, 10);
+      if (num2 >= 1 && num2 <= projectsList.length) {
+        chosen = projectsList[num2 - 1];
         projectId = chosen.id;
         projectName = chosen.name;
       }
@@ -4160,7 +4161,7 @@ If you are not signed in yet, setup runs browser sign-in first, then writes the
                 const { createInterface } = await import("readline");
                 const rl = createInterface({ input: process.stdin, output: process.stdout });
                 const answer = await new Promise(
-                  (resolve3) => rl.question("   Upgrade this key now via browser sign-in? [Y/n] ", (a) => resolve3(a.trim().toLowerCase()))
+                  (resolve7) => rl.question("   Upgrade this key now via browser sign-in? [Y/n] ", (a) => resolve7(a.trim().toLowerCase()))
                 );
                 rl.close();
                 if (answer === "" || answer === "y" || answer === "yes") {
@@ -4230,10 +4231,10 @@ Note: ${configRelPath} holds no secrets \u2014 safe to commit and share with you
           const existing = await readFile3(gitignorePath, "utf8").catch(() => "");
           const lines = existing.split(/\r?\n/);
           if (!lines.some((l) => l.trim() === ignoreLine)) {
-            const sep = existing.endsWith("\n") || existing === "" ? "" : "\n";
+            const sep3 = existing.endsWith("\n") || existing === "" ? "" : "\n";
             await writeFile3(
               gitignorePath,
-              `${existing}${sep}# Mushi MCP config holds a plaintext API key
+              `${existing}${sep3}# Mushi MCP config holds a plaintext API key
 ${ignoreLine}
 `,
               "utf8"
@@ -4257,6 +4258,41 @@ Note: ${configRelPath} contains your Mushi API key.`);
 }
 
 // src/commands/fix.ts
+function githubOwnerName(url) {
+  const cleaned = url.trim().replace(/^git@github\.com:/i, "https://github.com/").replace(/\/+$/, "").replace(/\.git$/i, "");
+  const match = cleaned.match(/github\.com\/([^/]+)\/([^/]+)/i);
+  return match ? `${match[1]}/${match[2]}`.toLowerCase() : null;
+}
+async function resolveTargetRepoId(repo, cfg) {
+  if (!repo.includes("/")) return requireUuid(repo, "--repo");
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+    throw new MushiCliError("E_INVALID_INPUT", "--repo must be a repo id or owner/name", "e.g. --repo acme/app-backend");
+  }
+  if (!cfg.projectId) {
+    throw new MushiCliError(
+      "E_INVALID_INPUT",
+      "--repo owner/name needs a project to look the repo up in",
+      "pass --project-id or set MUSHI_PROJECT_ID, or pass the repo id instead"
+    );
+  }
+  const res = await apiCall(
+    `/v1/admin/repo/repos?project_id=${encodeURIComponent(cfg.projectId)}`,
+    cfg
+  );
+  if (!res.ok) {
+    console.error("Error listing linked repos:", res.error.message);
+    process.exit(1);
+  }
+  const linked = res.data ?? [];
+  const matches = linked.filter((r) => githubOwnerName(r.repo_url) === repo.toLowerCase());
+  if (matches.length === 1) return matches[0].id;
+  const names = linked.map((r) => githubOwnerName(r.repo_url) ?? r.repo_url).join(", ") || "none";
+  throw new MushiCliError(
+    "E_INVALID_INPUT",
+    matches.length === 0 ? `${repo} is not linked to this project` : `${repo} matches ${matches.length} linked repos; pass the repo id`,
+    `linked repos: ${names}`
+  );
+}
 function registerFixCommands(program2) {
   const fixCmd = program2.command("fix").description("Dispatch an agentic fix for a report");
   fixCmd.argument("<reportId>", "Report UUID to fix").option(
@@ -4272,12 +4308,18 @@ function registerFixCommands(program2) {
   ).option(
     "--wait",
     "Poll until terminal state and exit non-zero on error/cancelled (CI-friendly)"
+  ).option(
+    "--repo <repoId|owner/name>",
+    "Linked repo to open the fix PR against (a project with several repos). Default: the project's primary repo"
   ).option("-e, --endpoint <url>", "API endpoint (overrides MUSHI_API_ENDPOINT)").option("--api-key <key>", "API key (overrides MUSHI_API_KEY)").option("--project-id <id>", "Project ID (overrides MUSHI_PROJECT_ID)").addHelpText("after", `
 Examples:
   mushi fix abc123 --agent cursor_cloud --wait
   mushi fix abc123 --agent cursor_cloud --model composer-latest --no-auto-pr
   mushi fix abc123 --agent claude_code
 
+  # A project with a frontend and a backend repo: send the fix to the backend
+  mushi fix abc123 --repo acme/app-backend
+
   # CI: fail the pipeline if the fix errors
   mushi fix $REPORT_ID --agent cursor_cloud --wait && echo "Fix PR opened"`).action(async (reportId, opts) => {
     requireUuid(reportId, "reportId");
@@ -4285,6 +4327,7 @@ Examples:
     if (opts.endpoint) cfg.endpoint = opts.endpoint;
     if (opts.apiKey) cfg.apiKey = opts.apiKey;
     if (opts.projectId) cfg.projectId = opts.projectId;
+    const targetRepoId = opts.repo ? await resolveTargetRepoId(opts.repo, cfg) : void 0;
     const isTTY = process.stdout.isTTY;
     const emitEvent = (type, data) => {
       if (isTTY) {
@@ -4294,11 +4337,17 @@ Examples:
         process.stdout.write(JSON.stringify({ type, ...data }) + "\n");
       }
     };
-    emitEvent("dispatch.start", { reportId, agent: opts.agent, model: opts.model ?? null });
+    emitEvent("dispatch.start", {
+      reportId,
+      agent: opts.agent,
+      model: opts.model ?? null,
+      targetRepoId: targetRepoId ?? null
+    });
     const body = {
       reportId,
       projectId: cfg.projectId,
-      agent: opts.agent
+      agent: opts.agent,
+      ...targetRepoId ? { targetRepoId } : {}
     };
     if (opts.agent === "cursor_cloud") {
       if (opts.model) body.cursorModel = opts.model;
@@ -4313,13 +4362,13 @@ Examples:
       console.error("Error dispatching fix:", result.error.message);
       process.exit(1);
     }
-    const { fixId, status, agentId, runId, prUrl } = result.data;
-    emitEvent("dispatch.ok", { fixId, status, agentId, runId, prUrl });
+    const { dispatchId, fixId, status, agentId, runId, prUrl } = result.data;
+    emitEvent("dispatch.ok", { dispatchId, fixId, status, agentId, runId, prUrl });
     if (!opts.wait) {
       process.exit(0);
     }
-    if (!fixId) {
-      console.error("No fixId returned \u2014 cannot poll.");
+    if (!dispatchId) {
+      console.error("No dispatchId returned \u2014 cannot poll.");
       process.exit(1);
     }
     const POLL_MS = 5e3;
@@ -4328,7 +4377,7 @@ Examples:
     for (let i = 0; i < MAX_POLLS; i++) {
       await new Promise((r) => setTimeout(r, POLL_MS));
       const pollResult = await apiCall(
-        `/v1/admin/fixes/${fixId}`,
+        `/v1/admin/fixes/dispatch/${dispatchId}`,
         cfg
       );
       if (!pollResult.ok) {
@@ -5694,9 +5743,108 @@ Recent runs for story ${storyId.slice(0, 8)}\u2026:
   });
 }
 
+// src/command-helpers.ts
+function orgSegment(org) {
+  if (!org || org === "current") return "current";
+  return encodeURIComponent(requireUuid(org, "organization id"));
+}
+function dieOrgError(result) {
+  const { code } = result.error;
+  if (code === "ORG_REQUIRED") {
+    const orgs = Array.isArray(result.error["organizations"]) ? result.error["organizations"] : [];
+    if (orgs.length > 0) {
+      process.stderr.write("\n  Pick one and pass it with --org:\n");
+      for (const o of orgs) {
+        process.stderr.write(`    --org ${String(o.id)}   ${typeof o.name === "string" ? o.name : ""}
+`);
+      }
+      process.stderr.write("\n");
+    }
+  } else if (code.endsWith("_NEEDS_ACCOUNT_KEY")) {
+    process.stderr.write(
+      "\n  Team-wide views need an account-level key, not a key bound to one project.\n  Mint one in the console (Connect \u2192 MCP \u2192 account key), then:\n\n    MUSHI_API_KEY=<account key> mushi <command>\n\n"
+    );
+  }
+  die(result);
+}
+function requireYes(yes, action) {
+  if (yes) return;
+  throw new MushiCliError(
+    "E_INVALID_INPUT",
+    `${action} Re-run with --yes to go ahead.`,
+    "nothing was sent"
+  );
+}
+function resolveProjectId(flag, configured) {
+  const raw = flag ?? configured;
+  if (!raw) {
+    throw new MushiCliError(
+      "E_PROJECT_MISSING",
+      "Project ID not configured.",
+      "pass --project-id <uuid> or run `mushi login --project-id <uuid>`"
+    );
+  }
+  return requireUuid(raw, "project id");
+}
+function oneLine(text2, max = 80) {
+  const flat = String(text2 ?? "").replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+
 // src/commands/audit.ts
+var KNOWN_GATES = [
+  "dead_handler",
+  "mock_leak",
+  "api_contract",
+  "crawl",
+  "status_claim",
+  "spec_drift",
+  "orphan_endpoint",
+  "unknown_call",
+  "schema_drift",
+  "code_health",
+  "design_drift",
+  "ci_drift",
+  "deploy_drift",
+  "env_drift",
+  "portfolio_radar",
+  "portfolio_radar_ci",
+  "store_review"
+];
+var SEVERITIES = ["info", "warn", "error"];
+var AUDIT_TIMEOUT_MS = 3e4;
+function renderGateFindings(data, includeAllowlisted) {
+  const gateOf = new Map(data.runs.map((r) => [r.id, r.gate]));
+  const shown = data.findings.filter((f) => includeAllowlisted || !f.allowlisted);
+  if (data.runs.length === 0) return ["No gate runs yet for this project."];
+  if (shown.length === 0) return [`${data.runs.length} recent run(s), no open findings.`];
+  const lines = [];
+  for (const f of shown) {
+    const where = f.file_path ? `${f.file_path}${f.line ? `:${f.line}` : ""}` : "";
+    lines.push(`  ${f.severity.toUpperCase().padEnd(5)} ${(gateOf.get(f.gate_run_id) ?? "?").padEnd(18)} ${f.rule_id ?? ""}  ${where}`);
+    lines.push(`        ${oneLine(f.message, 110)}  [${f.id}]${f.allowlisted ? " (allowlisted)" : ""}`);
+  }
+  lines.push(`${shown.length} finding(s). Why one fired and how to fix it: mushi audit explain <id>`);
+  return lines;
+}
+function renderExplanation(e) {
+  const lines = [
+    `${e.severity.toUpperCase()} \u2014 ${e.gateLabel}${e.rule ? `: ${e.rule.title}` : e.ruleId ? ` (${e.ruleId})` : ""}`,
+    `  What this checks: ${e.gateMeaning}`
+  ];
+  if (e.rule) lines.push(`  What it prevents: ${e.rule.prevents}`);
+  lines.push(`  Why it fired: ${oneLine(e.reason, 300)}`);
+  const where = e.location.filePath ? `${e.location.filePath}${e.location.line ? `:${e.location.line}` : ""}` : e.location.target;
+  if (where) lines.push(`  Where: ${where}`);
+  if (e.fix.text) lines.push(`  Fix: ${oneLine(e.fix.text, 300)}`);
+  if (e.fix.command) lines.push(`  Run: ${e.fix.command}`);
+  if (e.fix.consolePath) lines.push(`  In the console: ${e.fix.consolePath}`);
+  lines.push(`  State: ${e.state} \u2014 ${e.stateReason}`);
+  lines.push(`  From run: ${e.run.status} ${fmtDate(e.run.completedAt)}${e.run.commitSha ? ` @ ${e.run.commitSha.slice(0, 7)}` : ""}`);
+  return lines;
+}
 function registerAuditCommands(program2) {
-  program2.command("audit").description("Run a full-stack health audit for the current project").option("--json", "Machine-readable JSON output").option("--project-id <id>", "Project ID to audit (defaults to MUSHI_PROJECT_ID from config)").addHelpText("after", `
+  const audit = program2.command("audit").description("Run a full-stack health audit for the current project").option("--json", "Machine-readable JSON output").option("--project-id <id>", "Project ID to audit (defaults to MUSHI_PROJECT_ID from config)").addHelpText("after", `
 Description:
   Fans out to the Mushi backend to run a full-stack health audit:
     \u2022 DB schema + Supabase advisors (requires Supabase PAT in API Keys)
@@ -5714,96 +5862,111 @@ Description:
 Examples:
   mushi audit
   mushi audit --json
-  mushi audit --project-id abc123`).action(async (opts) => {
+  mushi audit --project-id abc123
+  mushi audit findings --gate code_health --severity error
+  mushi audit explain <finding id>`).action(async (opts) => {
     const config = requireConfig();
     const rawProjectId = opts.projectId ?? config.projectId;
     if (!rawProjectId) {
-      process.stderr.write("error: project ID required. Run `mushi login` or pass --project-id\n");
-      process.exit(1);
+      throw new MushiCliError("E_PROJECT_MISSING", "Project ID not configured.", "pass --project-id <id> or run `mushi login --project-id <id>`");
     }
     let endpoint;
     let projectId;
+    let apiKey;
     try {
       endpoint = sanitizeEndpoint(config.endpoint);
       projectId = sanitizeProjectId(rawProjectId);
+      apiKey = sanitizeApiKey(config.apiKey);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(`error: ${msg}
-`);
-      process.exit(2);
-    }
-    const headers = {
-      "Content-Type": "application/json",
-      "X-Mushi-Project-Id": projectId
-    };
-    const apiKey = config.apiKey ?? null;
-    if (apiKey) {
-      headers["X-Mushi-Api-Key"] = sanitizeApiKey(apiKey);
-    } else {
-      process.stderr.write("error: no API key found. Run `mushi login` or set MUSHI_API_KEY.\n");
-      process.exit(1);
+      throw new MushiCliError("E_INVALID_INPUT", err instanceof Error ? err.message : String(err));
     }
-    if (!opts.json) process.stdout.write("Running full-stack audit\u2026 ");
-    try {
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), 3e4);
-      const res = await fetch(
-        `${endpoint}/v1/admin/projects/${projectId}/audit`,
-        { method: "POST", headers, body: "{}", signal: controller.signal }
-      );
-      clearTimeout(timer);
-      const body = await res.json();
-      if (!res.ok || !body.ok) {
-        if (opts.json) {
-          console.log(JSON.stringify(body));
-          process.exit(1);
-        }
-        process.stdout.write("FAIL\n");
-        process.stderr.write(`error: ${body.error?.message ?? `HTTP ${res.status}`}
-`);
+    const json2 = outputIsJson(opts.json);
+    if (!json2) process.stdout.write("Running full-stack audit\u2026 ");
+    const result = await apiCall(
+      `/v1/admin/projects/${projectId}/audit`,
+      { ...config, endpoint, apiKey },
+      { method: "POST", body: "{}", headers: { "X-Mushi-Project-Id": projectId } },
+      { timeoutMs: AUDIT_TIMEOUT_MS }
+    );
+    if (!result.ok) {
+      if (json2) {
+        console.log(JSON.stringify({ ok: false, error: result.error }));
         process.exit(1);
       }
-      if (opts.json) {
-        console.log(JSON.stringify(body.data, null, 2));
-        return;
-      }
-      const data = body.data;
-      const overallLabel = data.summary.overall === "fail" ? "FAIL" : data.summary.overall === "warn" ? "WARN" : "OK";
-      process.stdout.write(`${overallLabel}
+      process.stdout.write("FAIL\n");
+      die(result);
+    }
+    if (json2) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    const data = result.data;
+    const overallLabel = data.summary.overall === "fail" ? "FAIL" : data.summary.overall === "warn" ? "WARN" : "OK";
+    process.stdout.write(`${overallLabel}
 
 `);
-      console.log(`Full-Stack Audit \u2014 ${new Date(data.audit_at).toLocaleString()}`);
-      console.log(`Backend linked: ${data.backend_linked ? "yes" : "no (configure Supabase PAT + project ref)"}`);
-      console.log(`Summary: ${data.summary.error_count} error(s) \xB7 ${data.summary.warn_count} warning(s)
+    console.log(`Full-Stack Audit \u2014 ${new Date(data.audit_at).toLocaleString()}`);
+    console.log(`Backend linked: ${data.backend_linked ? "yes" : "no (configure Supabase PAT + project ref)"}`);
+    console.log(`Summary: ${data.summary.error_count} error(s) \xB7 ${data.summary.warn_count} warning(s)
 `);
-      if (data.findings.length === 0) {
-        console.log("  OK  No findings. Your project looks healthy.");
-      } else {
-        for (const f of data.findings) {
-          const icon = f.severity === "error" ? "FAIL" : f.severity === "warn" ? "WARN" : "INFO";
-          console.log(`  ${icon}  ${f.title}`);
-          console.log(`     ${f.detail.slice(0, 120)}${f.detail.length > 120 ? "\u2026" : ""}`);
-        }
+    if (data.findings.length === 0) {
+      console.log("  OK  No findings. Your project looks healthy.");
+    } else {
+      for (const f of data.findings) {
+        const icon = f.severity === "error" ? "FAIL" : f.severity === "warn" ? "WARN" : "INFO";
+        console.log(`  ${icon}  ${f.title}`);
+        console.log(`     ${f.detail.slice(0, 120)}${f.detail.length > 120 ? "\u2026" : ""}`);
       }
-      if (data.gate_runs.length > 0) {
-        console.log("\nGate Results:");
-        for (const run2 of data.gate_runs) {
-          const g = run2.status === "pass" ? "OK" : run2.status === "fail" ? "FAIL" : "SKIP";
-          console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
-        }
+    }
+    if (data.gate_runs.length > 0) {
+      console.log("\nGate Results:");
+      for (const run2 of data.gate_runs) {
+        const g = run2.status === "pass" ? "OK" : run2.status === "fail" ? "FAIL" : "SKIP";
+        console.log(`  ${g} ${run2.gate.padEnd(22)} ${run2.status}  (${run2.findings_count} finding${run2.findings_count !== 1 ? "s" : ""})`);
       }
-      if (data.summary.overall === "fail") process.exit(1);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      if (opts.json) {
-        console.log(JSON.stringify({ ok: false, error: msg }));
-      } else {
-        process.stdout.write("ERROR\n");
-        process.stderr.write(`error: ${msg}
+    }
+    console.log("\nEach gate finding with its file and line: mushi audit findings");
+    if (data.summary.overall === "fail") process.exit(1);
+  });
+  audit.command("findings").description("Every finding from the recent gate runs, with file and line").option("--gate <gate>", `Only this gate (known: ${KNOWN_GATES.join(", ")})`).option("--severity <level>", "Only this severity: info | warn | error").option("--all", "Include allowlisted findings").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (_local, cmd) => {
+    const opts = cmd.optsWithGlobals();
+    if (opts.gate && !KNOWN_GATES.includes(opts.gate)) {
+      process.stderr.write(`warning: this CLI does not know the gate "${opts.gate}" (known: ${KNOWN_GATES.join(", ")}). Asking the server anyway.
 `);
+    }
+    if (opts.severity && !SEVERITIES.includes(opts.severity)) {
+      throw new MushiCliError("E_INVALID_INPUT", "--severity must be info, warn or error");
+    }
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const qs = new URLSearchParams();
+    if (opts.gate) qs.set("gate", opts.gate);
+    if (opts.severity) qs.set("severity", opts.severity);
+    const suffix = qs.toString() ? `?${qs}` : "";
+    const result = await apiCall(`/v1/admin/inventory/${projectId}/findings${suffix}`, config);
+    if (!result.ok) {
+      if (result.error.code === "feature_not_in_plan") {
+        process.stderr.write("The per-finding list is not on your plan. `mushi audit` (no subcommand) still runs the summary audit.\n");
       }
-      process.exit(1);
+      die(result);
     }
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderGateFindings(result.data, opts.all === true)) console.log(line);
+  });
+  audit.command("explain <findingId>").description("Why one finding fired, what it prevents, and how to fix it").option("--json", "Machine-readable JSON output").action(async (findingId, _local, cmd) => {
+    const opts = cmd.optsWithGlobals();
+    const id = requireUuid(findingId, "finding id");
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/findings/${id}`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderExplanation(result.data)) console.log(line);
   });
 }
 
@@ -6676,6 +6839,3661 @@ function registerProfileCommands(program2) {
   });
 }
 
+// src/commands/radar.ts
+import { execFileSync } from "child_process";
+import { resolve as resolve4 } from "path";
+
+// src/radar/scan.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { isAbsolute, join as join5, relative as relative2, resolve as resolve3, sep } from "path";
+
+// src/radar/repo-scan-core.ts
+var REPO_SCAN_PATHS = [
+  "android/variables.gradle",
+  "android/build.gradle",
+  "android/app/build.gradle",
+  "android/app/build.gradle.kts",
+  "app.json",
+  "app.config.json",
+  "eas.json",
+  "ios/App/App.xcodeproj/project.pbxproj",
+  "ios/App/Podfile",
+  "ios/Podfile",
+  ".github/workflows/"
+];
+function isRepoScanPath(path) {
+  const p3 = normalizePath(path);
+  if (REPO_SCAN_PATHS.includes(p3)) return true;
+  if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(p3)) return true;
+  return /^ios\/(?:[^/]+\/)?[^/]+\.xcodeproj\/project\.pbxproj$/.test(p3);
+}
+function normalizePath(path) {
+  return path.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function uncommentedLines(text2, syntax) {
+  if (!text2) return [];
+  const lines = text2.split(/\r?\n/);
+  const out = [];
+  let inBlock = false;
+  for (const raw of lines) {
+    let line = raw;
+    if (syntax === "gradle" || syntax === "sql" || syntax === "js") {
+      if (inBlock) {
+        const end = line.indexOf("*/");
+        if (end === -1) {
+          out.push("");
+          continue;
+        }
+        line = line.slice(end + 2);
+        inBlock = false;
+      }
+      line = line.replace(/\/\*.*?\*\//g, "");
+      const open = line.indexOf("/*");
+      if (open !== -1) {
+        line = line.slice(0, open);
+        inBlock = true;
+      }
+    }
+    if (syntax === "sql") {
+      const dash = line.indexOf("--");
+      if (dash !== -1 && (line.slice(0, dash).split("'").length - 1) % 2 === 0) line = line.slice(0, dash);
+    }
+    const t = line.trim();
+    const whole = (syntax === "gradle" || syntax === "js") && t.startsWith("//") || syntax === "sql" && (t.startsWith("--") || t.startsWith("//")) || (syntax === "yaml" || syntax === "ruby" || syntax === "py") && t.startsWith("#");
+    out.push(whole ? "" : line);
+  }
+  return out;
+}
+var SCANNED_EXT = /\.(sql|ts|tsx|js|mjs|cjs|py)$/i;
+var STORAGE_OBJECTS = String.raw`(?:"?storage"?\s*\.\s*"?objects"?)`;
+var SQL_DELETE = new RegExp(String.raw`\bdelete\s+from\s+(?:only\s+)?${STORAGE_OBJECTS}(?![\w"])`, "gi");
+var SQL_TRUNCATE = new RegExp(String.raw`\btruncate\s+(?:table\s+)?(?:only\s+)?${STORAGE_OBJECTS}(?![\w"])`, "gi");
+var CLIENT_FROM_OBJECTS = /\.from\(\s*['"`]objects['"`]\s*\)/;
+var CLIENT_SCHEMA_STORAGE = /\.schema\(\s*['"`]storage['"`]\s*\)/;
+var CLIENT_DELETE = /\.delete\(/;
+var STORAGE_FIX = "Delete the file through the Storage API instead: `supabase.storage.from('<bucket>').remove(['<path>'])`. A SQL delete removes the row but leaves the file in the bucket, still billed (https://supabase.com/docs/guides/storage/management/delete-objects). To clean up files already orphaned, list them through the Storage API and remove them there.";
+function syntaxFor(path) {
+  if (/\.sql$/i.test(path)) return "sql";
+  if (/\.py$/i.test(path)) return "py";
+  return "js";
+}
+function lineOfOffset(text2, offset) {
+  let line = 1;
+  for (let i = 0; i < offset; i++) if (text2.charCodeAt(i) === 10) line++;
+  return line;
+}
+function scanStorageSqlDelete(path, text2) {
+  const file = normalizePath(path);
+  if (!SCANNED_EXT.test(file)) return [];
+  const syntax = syntaxFor(file);
+  const lines = uncommentedLines(text2, syntax);
+  const clean = lines.join("\n");
+  const findings = [];
+  const seen = /* @__PURE__ */ new Set();
+  const original = text2.split(/\r?\n/);
+  const add = (line, how) => {
+    if (seen.has(line)) return;
+    seen.add(line);
+    findings.push({
+      ruleId: "storage_sql_delete",
+      severity: "warn",
+      message: `${file}:${line} ${how}. The row goes, but the file stays in the bucket and keeps costing money.`,
+      target: file,
+      filePath: file,
+      line,
+      fix: STORAGE_FIX,
+      evidence: { snippet: (original[line - 1] ?? "").trim().slice(0, 200) }
+    });
+  };
+  for (const re of [SQL_DELETE, SQL_TRUNCATE]) {
+    re.lastIndex = 0;
+    for (const m of clean.matchAll(re)) {
+      add(lineOfOffset(clean, m.index ?? 0), re === SQL_DELETE ? "deletes storage rows with SQL" : "truncates storage.objects with SQL");
+    }
+  }
+  if (syntax !== "sql") {
+    for (let i = 0; i < lines.length; i++) {
+      if (!CLIENT_FROM_OBJECTS.test(lines[i])) continue;
+      const before = lines.slice(Math.max(0, i - 5), i + 1).join("\n");
+      const after = lines.slice(i, i + 4).join("\n");
+      if (CLIENT_SCHEMA_STORAGE.test(before) && CLIENT_DELETE.test(after)) {
+        add(i + 1, "deletes rows from storage.objects through a client pointed at the 'storage' schema");
+      }
+    }
+  }
+  return findings.sort((a, b) => (a.line ?? 0) - (b.line ?? 0));
+}
+
+// src/radar/secret-patterns.ts
+var SECRET_PATTERNS = [
+  { re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/, label: "private key" },
+  { re: /sk-ant-[a-zA-Z0-9_-]{20,}/, label: "Anthropic key" },
+  // Project, service-account and admin keys (sk-proj-, sk-svcacct-, sk-admin-) and the legacy sk-<48>.
+  { re: /sk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|[A-Za-z0-9]{20,})/, label: "OpenAI-style key" },
+  { re: /(?:AKIA|ASIA)[0-9A-Z]{16}/, label: "AWS access key id" },
+  { re: /gh[pousr]_[A-Za-z0-9]{20,}/, label: "GitHub token" },
+  { re: /github_pat_[A-Za-z0-9_]{20,}/, label: "GitHub fine-grained token" },
+  { re: /crsr_[A-Za-z0-9]{32,}/, label: "Cursor API key" },
+  { re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/, label: "JWT" },
+  { re: /postgres(?:ql)?:\/\/[^:\s]+:[^@\s]+@/, label: "database connection string" },
+  { re: /xox[baprs]-[A-Za-z0-9-]{10,}/, label: "Slack token" },
+  { re: /\bmushi_[A-Za-z0-9]{24,}/, label: "Mushi API key" },
+  { re: /\b(?:sk|rk)_live_[A-Za-z0-9]{16,}/, label: "Stripe live key" },
+  // Supabase's secret API key bypasses RLS like service_role; sb_publishable_ is public by design.
+  { re: /\bsb_secret_[A-Za-z0-9_-]{20,}/, label: "Supabase secret key" }
+];
+var WORD = /[A-Za-z0-9_-]/;
+function findSecrets(text2, max = 50) {
+  const out = [];
+  const lineStarts = [0];
+  for (let i = 0; i < text2.length; i++) if (text2.charCodeAt(i) === 10) lineStarts.push(i + 1);
+  const lineOf = (offset) => {
+    let lo = 0;
+    let hi = lineStarts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (lineStarts[mid] <= offset) lo = mid;
+      else hi = mid - 1;
+    }
+    return lo + 1;
+  };
+  const taken = [];
+  for (const { re, label } of SECRET_PATTERNS) {
+    const g = new RegExp(re.source, "g");
+    for (const m of text2.matchAll(g)) {
+      const start = m.index ?? 0;
+      const end = start + m[0].length;
+      if (start > 0 && WORD.test(text2[start - 1]) && WORD.test(m[0][0])) continue;
+      if (taken.some(([s, e]) => start < e && end > s)) continue;
+      taken.push([start, end]);
+      out.push({ label, line: lineOf(start), value: m[0] });
+      if (out.length >= max) return out;
+    }
+  }
+  return out.sort((a, b) => a.line - b.line);
+}
+
+// src/radar/scan.ts
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo", ".expo", "Pods", ".gradle", "DerivedData", ".venv", "venv", "__pycache__"]);
+var MAX_FILES = 2e4;
+var MAX_SCAN_BYTES = 1024 * 1024;
+var MAX_CONFIG_BYTES = 256 * 1024;
+var MAX_CONFIG_FILES = 40;
+function listRepoFiles(root, limit = MAX_FILES) {
+  const out = [];
+  let truncated = false;
+  let unreadable = 0;
+  readdirSync2(root);
+  const walk2 = (dir) => {
+    if (out.length >= limit) {
+      truncated = true;
+      return;
+    }
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      unreadable++;
+      return;
+    }
+    for (const e of entries) {
+      if (out.length >= limit) {
+        truncated = true;
+        return;
+      }
+      if (e.isSymbolicLink()) continue;
+      const full = join5(dir, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) walk2(full);
+      } else if (e.isFile()) {
+        out.push(relative2(root, full).split(sep).join("/"));
+      }
+    }
+  };
+  walk2(root);
+  return { files: out, truncated, unreadable };
+}
+var BUNDLE_DIR_NAMES = /* @__PURE__ */ new Set(["dist", "build", "out", "web-build", "storybook-static"]);
+var DOT_CLIENT_OUTPUTS = {
+  ".next": ["static"],
+  ".output": ["public"],
+  // Nuxt / Nitro
+  ".svelte-kit": ["output/client"],
+  ".vercel": ["output/static"]
+  // Vercel Build Output API
+};
+var BUNDLE_SKIP_DIRS = /* @__PURE__ */ new Set(["server", "node_modules", "intermediates", "tmp", "kotlin", "cache", ".cache"]);
+var BUNDLE_EXT = /\.(?:js|mjs|cjs|html|bundle|jsbundle)$/i;
+var MAX_BUNDLE_FILES = 5e3;
+var MAX_BUNDLE_FILE_BYTES = 5 * 1024 * 1024;
+var MAX_BUNDLE_ROOT_DEPTH = 4;
+function findBundleRoots(root) {
+  const roots = [];
+  const walk2 = (dir, depth) => {
+    if (depth > MAX_BUNDLE_ROOT_DEPTH) return;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (!e.isDirectory() || e.isSymbolicLink()) continue;
+      const full = join5(dir, e.name);
+      const rel = relative2(root, full).split(sep).join("/");
+      if (BUNDLE_DIR_NAMES.has(e.name)) {
+        roots.push(rel);
+        continue;
+      }
+      const clientParts = DOT_CLIENT_OUTPUTS[e.name];
+      if (clientParts) {
+        for (const part of clientParts) {
+          try {
+            if (statSync2(join5(full, part)).isDirectory()) roots.push(`${rel}/${part}`);
+          } catch {
+          }
+        }
+        continue;
+      }
+      if (SKIP_DIRS.has(e.name) || e.name.startsWith(".")) continue;
+      walk2(full, depth + 1);
+    }
+  };
+  walk2(root, 1);
+  return roots.sort();
+}
+function isClientSafeMatch(m) {
+  if (m.label === "Mushi API key") return true;
+  if (m.label !== "JWT") return false;
+  const payload = m.value.split(".")[1] ?? "";
+  try {
+    const json2 = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const role = JSON.parse(json2).role;
+    return typeof role !== "string" || role === "anon" || role === "authenticated";
+  } catch {
+    return true;
+  }
+}
+function bundleRootsFromFlags(root, dirs) {
+  const roots = [];
+  for (const d of dirs) {
+    const full = resolve3(root, d);
+    const rel = relative2(root, full);
+    if (rel === "" || rel.startsWith("..") || isAbsolute(rel)) throw new Error(`--bundle-dir ${d} must be a folder inside ${root}`);
+    if (!statSync2(full).isDirectory()) throw new Error(`--bundle-dir ${d} is not a folder`);
+    roots.push(rel.split(sep).join("/"));
+  }
+  return [...new Set(roots)].sort();
+}
+function scanBuiltBundles(root, readFile3 = (p3) => readFileSync3(p3, "utf8"), bundleDirs) {
+  const roots = bundleDirs && bundleDirs.length > 0 ? bundleRootsFromFlags(root, bundleDirs) : findBundleRoots(root);
+  const out = { roots, scannedFiles: 0, truncated: false, unreadable: 0, findings: [] };
+  const walk2 = (dir) => {
+    if (out.truncated) return;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      out.unreadable++;
+      return;
+    }
+    for (const e of entries) {
+      if (out.scannedFiles >= MAX_BUNDLE_FILES) {
+        out.truncated = true;
+        return;
+      }
+      if (e.isSymbolicLink()) continue;
+      const full = join5(dir, e.name);
+      if (e.isDirectory()) {
+        if (!BUNDLE_SKIP_DIRS.has(e.name)) walk2(full);
+        continue;
+      }
+      if (!e.isFile() || !BUNDLE_EXT.test(e.name)) continue;
+      let text2;
+      try {
+        if (statSync2(full).size > MAX_BUNDLE_FILE_BYTES) {
+          out.unreadable++;
+          continue;
+        }
+        text2 = readFile3(full);
+      } catch {
+        out.unreadable++;
+        continue;
+      }
+      out.scannedFiles++;
+      const rel = relative2(root, full).split(sep).join("/");
+      for (const m of findSecrets(text2)) {
+        if (!isClientSafeMatch(m)) out.findings.push({ filePath: rel, line: m.line, label: m.label });
+      }
+    }
+  };
+  for (const r of roots) walk2(join5(root, r));
+  return out;
+}
+function scanLocalRepo(root, readFile3 = (p3) => readFileSync3(p3, "utf8"), opts = {}) {
+  const { files, truncated, unreadable: unreadableDirs } = listRepoFiles(root);
+  let unreadable = unreadableDirs;
+  const findings = [];
+  const configFiles = {};
+  let scannedFiles = 0;
+  for (const rel of files) {
+    const full = join5(root, rel);
+    let size = 0;
+    try {
+      size = statSync2(full).size;
+    } catch {
+      unreadable++;
+      continue;
+    }
+    const wantConfig = isRepoScanPath(rel) && size <= MAX_CONFIG_BYTES && Object.keys(configFiles).length < MAX_CONFIG_FILES;
+    const wantScan = size <= MAX_SCAN_BYTES && /\.(sql|ts|tsx|js|mjs|cjs|py)$/i.test(rel);
+    if (!wantConfig && !wantScan) continue;
+    let text2;
+    try {
+      text2 = readFile3(full);
+    } catch {
+      unreadable++;
+      continue;
+    }
+    if (wantConfig) configFiles[rel] = text2;
+    if (!wantScan) continue;
+    scannedFiles++;
+    findings.push(...scanStorageSqlDelete(rel, text2));
+  }
+  return { scannedFiles, truncated, unreadable, findings, configFiles, bundle: scanBuiltBundles(root, readFile3, opts.bundleDirs) };
+}
+var MAX_PUSH_FINDINGS = 200;
+var MIN_BUNDLE_FINDINGS = 50;
+function toIngestBody(scan, commitSha) {
+  const scanned = ["storage_sql_delete"];
+  const partial = [];
+  if (scan.truncated || scan.unreadable > 0 || scan.scannedFiles === 0) partial.push("storage_sql_delete");
+  if (scan.bundle.scannedFiles > 0) {
+    scanned.push("key_in_client_bundle");
+    if (scan.bundle.truncated || scan.bundle.unreadable > 0) partial.push("key_in_client_bundle");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const bundle = scan.bundle.findings.filter((f) => {
+    const k = `${f.filePath}\0${f.label}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+  const bundleTake = Math.min(bundle.length, Math.max(MIN_BUNDLE_FINDINGS, MAX_PUSH_FINDINGS - scan.findings.length));
+  const storageTake = Math.min(scan.findings.length, MAX_PUSH_FINDINGS - bundleTake);
+  if (storageTake < scan.findings.length && !partial.includes("storage_sql_delete")) partial.push("storage_sql_delete");
+  if (bundleTake < bundle.length && !partial.includes("key_in_client_bundle")) partial.push("key_in_client_bundle");
+  const findings = [
+    ...scan.findings.slice(0, storageTake).map((f) => ({ ruleId: f.ruleId, filePath: f.filePath, line: f.line })),
+    ...bundle.slice(0, bundleTake).map((f) => ({ ruleId: "key_in_client_bundle", filePath: f.filePath, line: f.line, kind: f.label }))
+  ];
+  return {
+    ...commitSha && /^[0-9a-f]{7,64}$/i.test(commitSha) ? { commitSha } : {},
+    scanned,
+    ...partial.length ? { partial } : {},
+    findings,
+    files: scan.configFiles
+  };
+}
+
+// src/commands/radar.ts
+function headSha(dir) {
+  const env = process.env.GITHUB_SHA ?? process.env.CI_COMMIT_SHA ?? null;
+  if (env) return env;
+  try {
+    return execFileSync("git", ["rev-parse", "HEAD"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return null;
+  }
+}
+function registerRadarCommands(program2) {
+  const radar = program2.command("radar").description("Hole checks that catch problems before a user hits them (store rules, storage, domains)");
+  radar.command("scan").description("Scan this repo and its built app for storage deletes done in SQL and secret keys, and read the build settings the store rules check").option("--dir <path>", "Repo root to scan", ".").option("--bundle-dir <path...>", "Built client folders to scan for secret keys instead of finding them (repeatable; e.g. to leave out a server-side dist)").option("--push", "Send the results to Mushi (run this in your existing CI job, after the build step)").option("--json", "Machine-readable JSON output").addHelpText("after", `
+What it checks here:
+  storage_sql_delete     deleting storage.objects rows with SQL leaves the files in
+                         the bucket, still billed. Delete through the Storage API.
+  key_in_client_bundle   a secret key (OpenAI, Stripe live, Supabase secret, \u2026) in
+                         the built app (dist, build, out, .next/static,
+                         .output/public, .svelte-kit/output/client,
+                         .vercel/output/static, native JS bundles, or the
+                         folders given with --bundle-dir). Anyone who opens
+                         the app can read it. Public keys
+                         by design (Supabase anon key, Mushi SDK key) are not flagged.
+                         Only where and which kind of key is sent, never the key.
+With --push, Mushi also checks your Android target SDK and iOS build settings
+against the current Google Play and App Store rules, from the build files only.
+
+Add one step to your existing CI job, after the build step (no new job needed):
+  - run: npx mushi-mushi radar scan --push
+    env:
+      MUSHI_API_KEY: \${{ secrets.MUSHI_INGEST_KEY }}`).action(async (opts) => {
+    const root = resolve4(opts.dir);
+    let scan;
+    try {
+      scan = scanLocalRepo(root, void 0, { bundleDirs: opts.bundleDir });
+    } catch (err) {
+      process.stderr.write(`error: could not scan ${root}: ${err.message}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const json2 = outputIsJson(opts.json);
+    if (!opts.push) {
+      const b = scan.bundle;
+      if (json2) {
+        console.log(JSON.stringify({ scannedFiles: scan.scannedFiles, truncated: scan.truncated, findings: scan.findings, configFiles: Object.keys(scan.configFiles), bundle: b }, null, 2));
+      } else {
+        console.log(`Scanned ${scan.scannedFiles} files${scan.truncated ? " (stopped at the file limit)" : ""}${scan.unreadable ? ` (${scan.unreadable} could not be read)` : ""}.`);
+        if (scan.findings.length === 0) console.log("No storage deletes done in SQL.");
+        for (const f of scan.findings) console.log(`  WARN  ${f.message}`);
+        if (b.scannedFiles === 0) {
+          console.log("No built app found (dist, build, out, .next/static, .output/public, ...), so secret keys in the bundle were not checked. Run this after your build step, or name the folder with --bundle-dir.");
+        } else {
+          console.log(`Scanned ${b.scannedFiles} built files in ${b.roots.join(", ")}${b.truncated ? " (stopped at the file limit)" : ""}${b.unreadable ? ` (${b.unreadable} could not be read)` : ""}.`);
+          if (b.findings.length === 0) console.log("No secret keys in the built app.");
+          for (const f of b.findings) console.log(`  ERROR ${f.filePath}:${f.line} contains a ${f.label}. Revoke it and move the call behind your server.`);
+        }
+        console.log(`Build files for the store rules: ${Object.keys(scan.configFiles).join(", ") || "none found"}`);
+        console.log("Run with --push to send these to Mushi.");
+      }
+      if (scan.findings.length > 0 || b.findings.length > 0) process.exitCode = 1;
+      return;
+    }
+    const config = requireConfig();
+    const result = await apiCall(
+      "/v1/ingest/radar",
+      config,
+      { method: "POST", body: JSON.stringify(toIngestBody(scan, headSha(root))) }
+    );
+    if (!result.ok) die(result);
+    if (json2) {
+      console.log(JSON.stringify(result.data, null, 2));
+    } else {
+      console.log(`Sent to Mushi (${result.data.status}).`);
+      for (const r of result.data.results) console.log(`  ${r.state.toUpperCase().padEnd(8)} ${r.ruleId}: ${r.reason}`);
+    }
+  });
+  radar.command("show").description("Show every hole check for this project and what each one found").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig({ needsProject: !opts.projectId });
+    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const result = await apiCall(`/v1/admin/projects/${projectId}/radar`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const d of result.data.detectors) {
+      const label = d.state === "ok" ? "OK" : d.state === "finding" ? "FOUND" : d.state === "error" ? "ERROR" : "NOT CHECKED";
+      console.log(`${label.padEnd(12)} ${d.title} \u2014 ${d.reason}`);
+      for (const f of d.findings) console.log(`             ${f.severity.toUpperCase()}: ${f.message}`);
+    }
+  });
+}
+
+// src/commands/recipe.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { writeFileSync as writeFileSync3 } from "fs";
+import { join as join7, resolve as resolve5 } from "path";
+
+// src/recipe/local.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync3, readdirSync as readdirSync3, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
+import { join as join6, relative as relative3, sep as sep2 } from "path";
+
+// src/recipe/engine/design-color.ts
+var clamp01 = (n) => Math.min(1, Math.max(0, n));
+function parseHex(input) {
+  const m = /^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.exec(input.trim());
+  if (!m) return null;
+  let h = m[1];
+  if (h.length <= 4) h = h.split("").map((c) => c + c).join("");
+  const n = (i) => parseInt(h.slice(i, i + 2), 16) / 255;
+  return { r: n(0), g: n(2), b: n(4), a: h.length === 8 ? n(6) : 1 };
+}
+function toHexByte(v) {
+  return Math.round(clamp01(v) * 255).toString(16).padStart(2, "0").toUpperCase();
+}
+function toHex(c) {
+  const base = `#${toHexByte(c.r)}${toHexByte(c.g)}${toHexByte(c.b)}`;
+  return c.a < 1 ? `${base}${toHexByte(c.a)}` : base;
+}
+function num(token, scale) {
+  const t = token.trim();
+  if (t === "none") return 0;
+  const pct = /^(-?[\d.]+)%$/.exec(t);
+  if (pct) return Number(pct[1]) / 100 * scale;
+  const deg = /^(-?[\d.]+)(deg|turn|rad|grad)?$/.exec(t);
+  if (!deg) return null;
+  const v = Number(deg[1]);
+  if (!Number.isFinite(v)) return null;
+  switch (deg[2]) {
+    case "turn":
+      return v * 360;
+    case "rad":
+      return v * 180 / Math.PI;
+    case "grad":
+      return v * 0.9;
+    default:
+      return v;
+  }
+}
+function splitArgs(body) {
+  const [main, alpha] = body.split("/");
+  const parts = main.includes(",") ? main.split(",") : main.trim().split(/\s+/);
+  const cleaned = parts.map((p3) => p3.trim()).filter(Boolean);
+  if (alpha === void 0 && cleaned.length === 4) return { parts: cleaned.slice(0, 3), alpha: cleaned[3] };
+  return { parts: cleaned, alpha: alpha?.trim() ?? null };
+}
+function alphaOf(token) {
+  if (token == null) return 1;
+  const v = num(token, 1);
+  return v == null ? 1 : clamp01(v);
+}
+function hslToRgb(h, s, l) {
+  const k = (n) => (n + h / 30) % 12;
+  const a = s * Math.min(l, 1 - l);
+  const f = (n) => l - a * Math.max(-1, Math.min(k(n) - 3, Math.min(9 - k(n), 1)));
+  return [f(0), f(8), f(4)];
+}
+var linearToSrgb = (x) => x <= 31308e-7 ? 12.92 * x : 1.055 * Math.pow(x, 1 / 2.4) - 0.055;
+var srgbToLinear = (x) => x <= 0.04045 ? x / 12.92 : Math.pow((x + 0.055) / 1.055, 2.4);
+function oklabToRgb(L, A, B) {
+  const l_ = L + 0.3963377774 * A + 0.2158037573 * B;
+  const m_ = L - 0.1055613458 * A - 0.0638541728 * B;
+  const s_ = L - 0.0894841775 * A - 1.291485548 * B;
+  const l = l_ ** 3, m = m_ ** 3, s = s_ ** 3;
+  return [
+    linearToSrgb(4.0767416621 * l - 3.3077115913 * m + 0.2309699292 * s),
+    linearToSrgb(-1.2684380046 * l + 2.6097574011 * m - 0.3413193965 * s),
+    linearToSrgb(-0.0041960863 * l - 0.7034186147 * m + 1.707614701 * s)
+  ];
+}
+function rgbToOklab(c) {
+  const r = srgbToLinear(c.r), g = srgbToLinear(c.g), b = srgbToLinear(c.b);
+  const l = Math.cbrt(0.4122214708 * r + 0.5363325363 * g + 0.0514459929 * b);
+  const m = Math.cbrt(0.2119034982 * r + 0.6806995451 * g + 0.1073969566 * b);
+  const s = Math.cbrt(0.0883024619 * r + 0.2817188376 * g + 0.6299787005 * b);
+  return [
+    0.2104542553 * l + 0.793617785 * m - 0.0040720468 * s,
+    1.9779984951 * l - 2.428592205 * m + 0.4505937099 * s,
+    0.0259040371 * l + 0.7827717662 * m - 0.808675766 * s
+  ];
+}
+function parseCssColor(input) {
+  const s = input.trim().replace(/_/g, " ");
+  if (s.startsWith("#")) return parseHex(s);
+  const fn = /^(rgba?|hsla?|hwb|oklab|oklch)\(\s*([^()]*)\)$/i.exec(s);
+  if (!fn) return null;
+  const kind = fn[1].toLowerCase();
+  const { parts, alpha } = splitArgs(fn[2]);
+  if (parts.length !== 3) return null;
+  const a = alphaOf(alpha);
+  if (kind === "rgb" || kind === "rgba") {
+    const ch = parts.map((p3) => num(p3, 255));
+    if (ch.some((v) => v == null)) return null;
+    const [r2, g2, b2] = ch;
+    return { r: clamp01(r2 / 255), g: clamp01(g2 / 255), b: clamp01(b2 / 255), a };
+  }
+  if (kind === "hsl" || kind === "hsla" || kind === "hwb") {
+    const h = num(parts[0], 360);
+    const x = num(parts[1].endsWith("%") ? parts[1] : `${parts[1]}%`, 1);
+    const y = num(parts[2].endsWith("%") ? parts[2] : `${parts[2]}%`, 1);
+    if (h == null || x == null || y == null) return null;
+    const hue = (h % 360 + 360) % 360;
+    if (kind === "hwb") {
+      const w = clamp01(x), bl = clamp01(y);
+      if (w + bl >= 1) {
+        const grey = w / (w + bl);
+        return { r: grey, g: grey, b: grey, a };
+      }
+      const [r3, g3, b3] = hslToRgb(hue, 1, 0.5).map((v) => v * (1 - w - bl) + w);
+      return { r: r3, g: g3, b: b3, a };
+    }
+    const [r2, g2, b2] = hslToRgb(hue, clamp01(x), clamp01(y));
+    return { r: r2, g: g2, b: b2, a };
+  }
+  const L = num(parts[0], 1);
+  if (L == null) return null;
+  if (kind === "oklab") {
+    const A = num(parts[1], 0.4), B = num(parts[2], 0.4);
+    if (A == null || B == null) return null;
+    const [r2, g2, b2] = oklabToRgb(L, A, B);
+    return { r: clamp01(r2), g: clamp01(g2), b: clamp01(b2), a };
+  }
+  const C = num(parts[1], 0.4), H = num(parts[2], 360);
+  if (C == null || H == null) return null;
+  const rad = H * Math.PI / 180;
+  const [r, g, b] = oklabToRgb(L, C * Math.cos(rad), C * Math.sin(rad));
+  return { r: clamp01(r), g: clamp01(g), b: clamp01(b), a };
+}
+function relativeLuminance(c) {
+  return 0.2126 * srgbToLinear(c.r) + 0.7152 * srgbToLinear(c.g) + 0.0722 * srgbToLinear(c.b);
+}
+function composite(fg, bg) {
+  return {
+    r: fg.r * fg.a + bg.r * (1 - fg.a),
+    g: fg.g * fg.a + bg.g * (1 - fg.a),
+    b: fg.b * fg.a + bg.b * (1 - fg.a),
+    a: 1
+  };
+}
+function contrastRatio(fg, bg) {
+  const f = fg.a < 1 ? composite(fg, { ...bg, a: 1 }) : fg;
+  const L1 = relativeLuminance(f);
+  const L2 = relativeLuminance({ ...bg, a: 1 });
+  const ratio = (Math.max(L1, L2) + 0.05) / (Math.min(L1, L2) + 0.05);
+  return Math.round(ratio * 100) / 100;
+}
+function colorDistance(x, y) {
+  const [l1, a1, b1] = rgbToOklab(x);
+  const [l2, a2, b2] = rgbToOklab(y);
+  const d = Math.sqrt((l1 - l2) ** 2 + (a1 - a2) ** 2 + (b1 - b2) ** 2) * 100;
+  return Math.round((d + Math.abs(x.a - y.a) * 50) * 100) / 100;
+}
+function sameRgb(x, y) {
+  return toHex({ ...x, a: 1 }) === toHex({ ...y, a: 1 });
+}
+
+// src/recipe/engine/dtcg.ts
+var MUSHI_EXTENSION_KEY = "us.kensaur.mushi";
+var ALIAS_RE = /^\{([^{}]+)\}$/;
+var MAX_ISSUES = 200;
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function aliasTarget(v) {
+  if (typeof v === "string") {
+    const m = ALIAS_RE.exec(v.trim());
+    return m ? m[1].trim() : null;
+  }
+  if (isPlainObject(v) && typeof v.$ref === "string" && Object.keys(v).length === 1) {
+    const ref = v.$ref.replace(/^#\/?/, "").replace(/\/\$value$/, "");
+    return ref.split("/").filter(Boolean).join(".") || null;
+  }
+  return null;
+}
+function collect(node, segments, inheritedType, file, out, issues) {
+  const groupType = typeof node.$type === "string" ? node.$type : inheritedType;
+  for (const [key, child] of Object.entries(node)) {
+    if (key.startsWith("$")) continue;
+    if (!isPlainObject(child)) continue;
+    const keySegs = key.split(".").filter((s) => s.length > 0);
+    if (keySegs.length > 1 && issues.length < MAX_ISSUES) {
+      issues.push({ severity: "info", code: "token_nonconformant", message: `"${key}" uses dots in a name (DTCG 2025.10 forbids it); read as ${keySegs.join(" \u203A ")}.`, path: [...segments, ...keySegs].join("."), file: file.path });
+    }
+    const next = [...segments, ...keySegs];
+    if ("$value" in child) {
+      const ext = isPlainObject(child.$extensions) && isPlainObject(child.$extensions[MUSHI_EXTENSION_KEY]) ? child.$extensions[MUSHI_EXTENSION_KEY] : null;
+      out.push({
+        segments: next,
+        path: next.join("."),
+        rawValue: child.$value,
+        type: typeof child.$type === "string" ? child.$type : groupType,
+        description: typeof child.$description === "string" ? child.$description : null,
+        ext,
+        file: file.path,
+        role: file.role
+      });
+    } else {
+      collect(child, next, groupType, file, out, issues);
+    }
+  }
+}
+function inferType(v) {
+  if (typeof v === "string") {
+    if (/^#[0-9a-f]{3,8}$/i.test(v.trim()) || /^(rgba?|hsla?|oklch|oklab|hwb)\(/i.test(v.trim())) return "color";
+    if (/^-?[\d.]+(px|rem|em)$/.test(v.trim())) return "dimension";
+    if (/^-?[\d.]+(ms|s)$/.test(v.trim())) return "duration";
+  }
+  if (typeof v === "number") return "number";
+  if (isPlainObject(v) && "colorSpace" in v) return "color";
+  if (isPlainObject(v) && "unit" in v && "value" in v) return "dimension";
+  return null;
+}
+function fmtNum(n) {
+  return Number.isInteger(n) ? String(n) : String(Math.round(n * 1e3) / 1e3);
+}
+function normalizeColor(v, note2) {
+  if (typeof v === "string") {
+    const s = v.trim();
+    if (/^#([0-9a-f]{3}|[0-9a-f]{4})$/i.test(s)) note2("hex_shorthand", `"${s}" is hex shorthand; read as ${toHex(parseCssColor(s))}.`);
+    const c = parseCssColor(s);
+    if (!c) {
+      note2("color_unparseable", `"${s}" is not a colour Mushi can read.`);
+      return { value: v, display: s, hex: null, px: null };
+    }
+    note2("legacy_color_string", "colour given as a string; DTCG 2025.10 uses {colorSpace, components}.");
+    const hex = toHex(c);
+    return { value: { colorSpace: "srgb", components: [c.r, c.g, c.b], alpha: c.a, hex }, display: hex, hex, px: null };
+  }
+  if (isPlainObject(v)) {
+    const alpha = typeof v.alpha === "number" ? v.alpha : 1;
+    if (typeof v.hex === "string") {
+      const c = parseCssColor(v.hex);
+      if (c) {
+        const hex = toHex({ ...c, a: alpha });
+        return { value: v, display: hex, hex, px: null };
+      }
+    }
+    const comps = Array.isArray(v.components) ? v.components : null;
+    const space = typeof v.colorSpace === "string" ? v.colorSpace.toLowerCase() : "srgb";
+    if (comps && comps.length === 3 && comps.every((x) => typeof x === "number")) {
+      const [a, b, c] = comps;
+      let rgba = null;
+      if (space === "srgb" || space === "display-p3") {
+        if (space === "display-p3") note2("color_space_approximated", "display-p3 shown as sRGB.");
+        rgba = { r: a, g: b, b: c, a: alpha };
+      } else if (space === "oklch") {
+        rgba = parseCssColor(`oklch(${a} ${b} ${c})`);
+      } else if (space === "oklab") {
+        rgba = parseCssColor(`oklab(${a} ${b} ${c})`);
+      } else if (space === "hsl") {
+        rgba = parseCssColor(`hsl(${a} ${b}% ${c}%)`);
+      }
+      if (rgba) {
+        const hex = toHex({ ...rgba, a: alpha });
+        return { value: v, display: hex, hex, px: null };
+      }
+    }
+  }
+  note2("color_unparseable", "colour value is not readable.");
+  return { value: v, display: JSON.stringify(v), hex: null, px: null };
+}
+function normalizeMeasure(v, kind, note2) {
+  let value = null;
+  let unit = null;
+  if (typeof v === "string") {
+    const m = /^(-?[\d.]+)\s*([a-z%]*)$/i.exec(v.trim());
+    if (m) {
+      value = Number(m[1]);
+      unit = m[2] || (kind === "dimension" ? "px" : "ms");
+      note2(kind === "dimension" ? "legacy_dimension_string" : "legacy_duration_string", `"${v}" is a string; DTCG 2025.10 uses {value, unit}.`);
+    }
+  } else if (typeof v === "number") {
+    value = v;
+    unit = kind === "dimension" ? "px" : "ms";
+    note2("unitless_number", `${v} has no unit; read as ${unit}.`);
+  } else if (isPlainObject(v) && typeof v.value === "number" && typeof v.unit === "string") {
+    value = v.value;
+    unit = v.unit;
+  }
+  if (value == null || unit == null || !Number.isFinite(value)) {
+    note2(`${kind}_unparseable`, `${kind} value is not readable.`);
+    return { value: v, display: typeof v === "string" ? v : JSON.stringify(v), hex: null, px: null };
+  }
+  if (kind === "duration" && unit === "s") {
+    value = value * 1e3;
+    unit = "ms";
+  }
+  const px = kind === "dimension" ? unit === "px" ? value : unit === "rem" || unit === "em" ? value * 16 : null : null;
+  return { value: { value, unit }, display: `${fmtNum(value)}${unit}`, hex: null, px };
+}
+function displayOf(v) {
+  if (typeof v === "string") return v;
+  if (typeof v === "number") return fmtNum(v);
+  if (Array.isArray(v)) return v.map(displayOf).join(", ");
+  if (isPlainObject(v)) {
+    if (typeof v.hex === "string") return v.hex;
+    if (typeof v.value === "number" && typeof v.unit === "string") return `${fmtNum(v.value)}${v.unit}`;
+  }
+  return JSON.stringify(v);
+}
+function normalizeByType(type, v, note2) {
+  switch (type) {
+    case "color":
+      return normalizeColor(v, note2);
+    case "dimension":
+      return normalizeMeasure(v, "dimension", note2);
+    case "duration":
+      return normalizeMeasure(v, "duration", note2);
+    case "fontFamily": {
+      const list = Array.isArray(v) ? v.map(String) : typeof v === "string" ? v.split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")) : [];
+      return { value: list, display: list.join(", "), hex: null, px: null };
+    }
+    case "cubicBezier": {
+      const ok = Array.isArray(v) && v.length === 4 && v.every((x) => typeof x === "number");
+      if (!ok) note2("cubicBezier_unparseable", "cubicBezier needs four numbers.");
+      return { value: v, display: ok ? `cubic-bezier(${v.map(fmtNum).join(", ")})` : displayOf(v), hex: null, px: null };
+    }
+    case "typography": {
+      if (isPlainObject(v)) {
+        const fam = displayOf(v.fontFamily);
+        const size = displayOf(v.fontSize);
+        const lh = v.lineHeight != null ? `/${displayOf(v.lineHeight)}` : "";
+        const w = v.fontWeight != null ? ` ${displayOf(v.fontWeight)}` : "";
+        return { value: v, display: `${size}${lh}${w} ${fam}`.trim(), hex: null, px: null };
+      }
+      return { value: v, display: displayOf(v), hex: null, px: null };
+    }
+    default:
+      return { value: v, display: displayOf(v), hex: null, px: null };
+  }
+}
+function normalizeTokenSet(files) {
+  const issues = [];
+  const raws = [];
+  for (const file of files) {
+    let parsed;
+    try {
+      parsed = JSON.parse(file.text);
+    } catch (err) {
+      issues.push({ severity: "error", code: "token_file_invalid_json", message: `not valid JSON: ${String(err).slice(0, 160)}`, file: file.path });
+      continue;
+    }
+    if (!isPlainObject(parsed)) {
+      issues.push({ severity: "error", code: "token_file_not_object", message: "a token file must be a JSON object", file: file.path });
+      continue;
+    }
+    collect(parsed, [], null, file, raws, issues);
+  }
+  const byPath = /* @__PURE__ */ new Map();
+  for (const r of raws) {
+    const prev = byPath.get(r.path);
+    if (prev && issues.length < MAX_ISSUES) {
+      issues.push({ severity: "warn", code: "token_duplicate", message: `${r.path} is defined in ${prev.file} and ${r.file}; the later file wins.`, path: r.path, file: r.file });
+    }
+    byPath.set(r.path, r);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const resolving = /* @__PURE__ */ new Set();
+  const resolveToken = (path, from) => {
+    if (resolved.has(path)) return resolved.get(path);
+    const tok = byPath.get(path);
+    if (!tok) {
+      if (issues.length < MAX_ISSUES) issues.push({ severity: "warn", code: "alias_unresolved", message: `${from.path} points at {${path}}, which does not exist.`, path: from.path, file: from.file });
+      return null;
+    }
+    if (resolving.has(path)) {
+      if (issues.length < MAX_ISSUES) issues.push({ severity: "error", code: "alias_cycle", message: `alias cycle through ${path}.`, path: from.path, file: from.file });
+      return null;
+    }
+    resolving.add(path);
+    const value = resolveValue(tok.rawValue, tok);
+    resolving.delete(path);
+    const targetType = aliasTarget(tok.rawValue) ? resolved.get(aliasTarget(tok.rawValue))?.type ?? null : null;
+    const out = value === void 0 ? null : { value, type: tok.type ?? targetType ?? inferType(value) };
+    resolved.set(path, out);
+    return out;
+  };
+  const resolveValue = (v, owner) => {
+    const target = aliasTarget(v);
+    if (target) {
+      const r = resolveToken(target, owner);
+      return r ? r.value : void 0;
+    }
+    if (Array.isArray(v)) return v.map((x) => resolveValue(x, owner));
+    if (isPlainObject(v)) {
+      const o = {};
+      for (const [k, x] of Object.entries(v)) o[k] = resolveValue(x, owner);
+      return o;
+    }
+    return v;
+  };
+  const tokens = [];
+  for (const tok of byPath.values()) {
+    const r = resolveToken(tok.path, tok);
+    const alias = aliasTarget(tok.rawValue);
+    let type = r?.type ?? tok.type ?? null;
+    if (!tok.type && !alias) {
+      const inferred = inferType(tok.rawValue);
+      if (inferred && issues.length < MAX_ISSUES) {
+        issues.push({ severity: "info", code: "token_missing_type", message: `${tok.path} has no $type; read as ${inferred}.`, path: tok.path, file: tok.file });
+      }
+      type = type ?? inferred;
+    }
+    const noted = /* @__PURE__ */ new Set();
+    const note2 = (code, msg) => {
+      if (alias || noted.has(code) || issues.length >= MAX_ISSUES) return;
+      noted.add(code);
+      issues.push({ severity: code.endsWith("unparseable") ? "warn" : "info", code, message: `${tok.path}: ${msg}`, path: tok.path, file: tok.file });
+    };
+    const norm = r ? normalizeByType(type, r.value, note2) : { value: null, display: alias ? `{${alias}} (unresolved)` : "unresolved", hex: null, px: null };
+    const ext = tok.ext;
+    const str = (k) => ext && typeof ext[k] === "string" ? ext[k] : null;
+    tokens.push({
+      path: tok.path,
+      type,
+      value: norm.value,
+      display: norm.display,
+      hex: norm.hex,
+      px: norm.px,
+      aliasOf: alias,
+      cssVar: str("cssVar"),
+      ts: str("ts"),
+      rn: str("rn"),
+      description: tok.description,
+      file: tok.file,
+      role: tok.role,
+      group: tok.segments[0] ?? ""
+    });
+  }
+  tokens.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return { tokens, issues };
+}
+function declaredFontFamilies(tokens) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (v) => {
+    if (Array.isArray(v)) v.forEach(add);
+    else if (typeof v === "string") v.split(",").forEach((f) => out.add(f.trim().replace(/^['"]|['"]$/g, "").toLowerCase()));
+  };
+  for (const t of tokens) {
+    if (t.type === "fontFamily") add(t.value);
+    else if (t.type === "typography" && isPlainObject(t.value)) add(t.value.fontFamily);
+  }
+  out.delete("");
+  return out;
+}
+
+// src/recipe/engine/recipe-glob.ts
+function normalizeRepoPath(input) {
+  if (typeof input !== "string") return null;
+  const p3 = input.trim();
+  if (p3.length === 0 || p3.length > 512) return null;
+  if (p3.startsWith("/") || p3.startsWith("~")) return null;
+  if (p3.includes("\\") || p3.includes("%")) return null;
+  if (/^[A-Za-z]:/.test(p3)) return null;
+  if (/[\u0000-\u001f\u007f]/.test(p3)) return null;
+  const segments = p3.split("/");
+  for (const seg of segments) {
+    if (seg === "" || seg === "." || seg === "..") return null;
+  }
+  return segments.join("/");
+}
+function escapeRegex(ch) {
+  return /[.+^$()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
+}
+var regexCache = /* @__PURE__ */ new Map();
+function globToRegExp(glob) {
+  const cached = regexCache.get(glob);
+  if (cached) return cached;
+  let out = "";
+  let inBrace = false;
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i];
+    if (ch === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:[^/]+/)*";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else if (ch === "?") {
+      out += "[^/]";
+    } else if (ch === "{") {
+      if (inBrace) throw new Error(`nested braces are not supported: ${glob}`);
+      inBrace = true;
+      out += "(?:";
+    } else if (ch === "}" && inBrace) {
+      inBrace = false;
+      out += ")";
+    } else if (ch === "," && inBrace) {
+      out += "|";
+    } else {
+      out += escapeRegex(ch);
+    }
+  }
+  if (inBrace) throw new Error(`unbalanced brace in glob: ${glob}`);
+  const re = new RegExp(`^${out}$`);
+  regexCache.set(glob, re);
+  return re;
+}
+function matchGlob(path, glob) {
+  try {
+    return globToRegExp(glob).test(path);
+  } catch {
+    return false;
+  }
+}
+function matchAny(path, globs) {
+  return globs.some((g) => matchGlob(path, g));
+}
+
+// src/recipe/engine/design-deviance.ts
+var DEVIANCE_K = 3;
+var SEVERITY_WEIGHT = { error: 3, warn: 2, info: 1 };
+var LITERAL_RULES = [
+  "off_token_color",
+  "off_token_font",
+  "off_scale_spacing",
+  "off_scale_radius",
+  "raw_interactive_element"
+];
+var GENERIC_FAMILIES = /* @__PURE__ */ new Set([
+  "serif",
+  "sans-serif",
+  "monospace",
+  "cursive",
+  "fantasy",
+  "system-ui",
+  "ui-sans-serif",
+  "ui-serif",
+  "ui-monospace",
+  "ui-rounded",
+  "emoji",
+  "math",
+  "fangsong",
+  "-apple-system",
+  "blinkmacsystemfont",
+  "inherit",
+  "initial",
+  "unset",
+  "revert",
+  "revert-layer",
+  "none"
+]);
+var SPACE_GROUP_RE = /^(space|spacing|spacer|gap|gutter|inset)$/i;
+var RADIUS_SEG_RE = /^(radius|radii|rounded|corner|corners|borderradius)$/i;
+function buildDevianceContext(tokens, rules, componentGlobs = []) {
+  const colors = [];
+  const spacing = [];
+  const radius = [];
+  for (const t of tokens) {
+    if (t.type === "color" && t.hex) {
+      const rgba = parseCssColor(t.hex);
+      if (rgba) colors.push({ token: t, rgba });
+    }
+    if (t.type === "dimension" && t.px != null) {
+      const segs = t.path.split(".");
+      if (segs.some((s) => SPACE_GROUP_RE.test(s))) spacing.push({ token: t, px: t.px });
+      if (segs.some((s) => RADIUS_SEG_RE.test(s))) radius.push({ token: t, px: t.px });
+    }
+  }
+  return {
+    rules: new Map(rules.map((r) => [r.id, r])),
+    colors,
+    families: declaredFontFamilies(tokens),
+    spacing,
+    radius,
+    componentGlobs: [...componentGlobs]
+  };
+}
+function ruleApplicable(rule, ctx, declaredPairs = 0) {
+  switch (rule) {
+    case "off_token_color":
+      return ctx.colors.length > 0;
+    case "off_token_font":
+      return ctx.families.size > 0;
+    case "off_scale_spacing":
+      return ctx.spacing.length > 0;
+    case "off_scale_radius":
+      return ctx.radius.length > 0;
+    case "contrast_below_aa":
+      return declaredPairs > 0;
+    case "raw_interactive_element":
+      return true;
+  }
+}
+function langOf(path) {
+  if (/\.(css|scss|sass|less|pcss)$/i.test(path)) return "css";
+  if (/\.(tsx?|jsx?|mjs|cjs|mts|cts|vue|svelte|astro)$/i.test(path)) return "js";
+  return "other";
+}
+function maskComments(text2, lang) {
+  const out = text2.split("");
+  const blank = (from, to) => {
+    for (let k = from; k < to; k++) if (out[k] !== "\n" && out[k] !== "\r") out[k] = " ";
+  };
+  let i = 0;
+  const n = text2.length;
+  while (i < n) {
+    const c = text2[i];
+    const d = text2[i + 1];
+    if (c === "/" && d === "*") {
+      const end = text2.indexOf("*/", i + 2);
+      const stop = end === -1 ? n : end + 2;
+      blank(i, stop);
+      i = stop;
+      continue;
+    }
+    if (lang === "js") {
+      if (c === "/" && d === "/") {
+        let end = text2.indexOf("\n", i);
+        if (end === -1) end = n;
+        blank(i, end);
+        i = end;
+        continue;
+      }
+      if (c === '"' || c === "'" || c === "`") {
+        let j = i + 1;
+        while (j < n && text2[j] !== c) {
+          if (text2[j] === "\\") j++;
+          else if (c !== "`" && text2[j] === "\n") break;
+          j++;
+        }
+        i = j + 1;
+        continue;
+      }
+    }
+    i++;
+  }
+  return out.join("");
+}
+function lineIndex(text2) {
+  const starts = [0];
+  for (let i = 0; i < text2.length; i++) if (text2[i] === "\n") starts.push(i + 1);
+  return starts;
+}
+function position(starts, offset) {
+  let lo = 0, hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  return { line: lo + 1, col: offset - starts[lo] + 1 };
+}
+function toPx(raw) {
+  const m = /^(-?[\d.]+)(px|rem)?$/.exec(raw.trim());
+  if (!m) return null;
+  const v = Math.abs(Number(m[1]));
+  if (!Number.isFinite(v)) return null;
+  return m[2] === "rem" ? v * 16 : v;
+}
+function allowedValue(rule, raw) {
+  const v = raw.trim().toLowerCase();
+  return rule.allowValues.some((a) => a.trim().toLowerCase() === v);
+}
+function nearestScale(scale, px) {
+  let best = null;
+  for (const s of scale) {
+    if (!best || Math.abs(s.px - px) < Math.abs(best.px - px) || Math.abs(s.px - px) === Math.abs(best.px - px) && s.token.path < best.token.path) best = s;
+  }
+  return best ? { token: best.token.path, cssVar: best.token.cssVar, ts: best.token.ts, value: best.token.display, distance: Math.round(Math.abs(best.px - px) * 100) / 100 } : null;
+}
+function nearestColor(ctx, c) {
+  let best = null;
+  const rank = (t) => t.cssVar ? 0 : t.ts ? 1 : 2;
+  for (const { token, rgba } of ctx.colors) {
+    const d = colorDistance({ ...c, a: 1 }, { ...rgba, a: 1 });
+    if (!best || d < best.d - 1e-9 || Math.abs(d - best.d) < 1e-9 && (rank(token) < rank(best.token) || rank(token) === rank(best.token) && token.path < best.token.path)) best = { token, d };
+  }
+  return best ? { token: best.token.path, cssVar: best.token.cssVar, ts: best.token.ts, value: best.token.display, distance: best.d } : null;
+}
+var HEX_RE = /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{3,4})(?![0-9a-zA-Z_-])/g;
+var COLOR_FN_RE = /\b(?:rgba?|hsla?|hwb|oklab|oklch|lab|lch|color)\((?:[^()]|\([^()]*\))*\)/gi;
+var ANCHOR_CONTEXT_RE = /(?:href|to|id|htmlFor|hash|anchor|target|selector|querySelector\(|getElementById\()\s*[=:]?\s*\{?\s*$/i;
+var HEX_PREV_OK = /[\s(\[,:='"`{]/;
+var SHORT_HEX_AFTER = /^(?:solid|dashed|dotted|double|groove|ridge|inset|outset|none|transparent|-?[\d.]+(?:px|rem|em|%)?)$/i;
+function judgeColorLiteral(ctx, rule, literal) {
+  if (allowedValue(rule, literal) || /var\(|\bfrom\b/i.test(literal)) return null;
+  const c = parseCssColor(literal);
+  if (c && ctx.colors.some((t) => sameRgb(t.rgba, c))) return null;
+  return {
+    value: literal,
+    message: c ? `Colour ${literal} is not in your tokens.` : `Colour ${literal} could not be read as sRGB, so it cannot match a token.`,
+    suggestion: c ? nearestColor(ctx, c) : null
+  };
+}
+function judgeFontName(ctx, rule, name) {
+  if (!name || /^\d+$/.test(name) || GENERIC_FAMILIES.has(name.toLowerCase())) return null;
+  if (ctx.families.has(name.toLowerCase()) || allowedValue(rule, name)) return null;
+  const body = [...ctx.families][0] ?? null;
+  return { value: name, message: `Font family "${name}" is not in your tokens.`, suggestion: body ? { token: "font.family", cssVar: null, ts: null, value: body, distance: null } : null };
+}
+function judgeScaleValue(rule, scale, raw, what) {
+  if (allowedValue(rule, raw)) return null;
+  const px = toPx(raw);
+  if (px == null || px === 0) return null;
+  if (scale.some((s) => Math.abs(s.px - px) < 0.01)) return null;
+  if (allowedValue(rule, `${px}px`)) return null;
+  return { value: raw.trim(), message: `${what} ${raw.trim()} is off your ${what.toLowerCase()} scale.`, suggestion: nearestScale(scale, px) };
+}
+function judgeRawElement(rule, tag) {
+  const prim = rule.primitives?.[tag] ?? null;
+  return {
+    value: `<${tag}>`,
+    message: prim ? `Raw <${tag}> bypasses your ${prim} primitive.` : `Raw <${tag}> outside your component primitives.`,
+    suggestion: prim ? { token: prim, cssVar: null, ts: null, value: prim, distance: null } : null
+  };
+}
+function scanSourceFile(path, text2, ctx) {
+  const lang = langOf(path);
+  const lines = text2.length === 0 ? 0 : text2.split("\n").length;
+  if (lang === "other") return { findings: [], lines };
+  const masked = maskComments(text2, lang);
+  const starts = lineIndex(text2);
+  const findings = [];
+  const active = (id) => {
+    const r = ctx.rules.get(id);
+    if (!r || !r.enabled) return null;
+    if (r.allowFiles.length > 0 && matchAny(path, r.allowFiles)) return null;
+    return r;
+  };
+  const push = (rule, offset, verdict) => {
+    if (!verdict) return;
+    const { line, col } = position(starts, offset);
+    findings.push({ rule_id: rule.id, severity: rule.severity, file_path: path, line, col, value: verdict.value, message: verdict.message, suggestion: verdict.suggestion });
+  };
+  const colorRule = active("off_token_color");
+  if (colorRule && ctx.colors.length > 0) {
+    const seen = /* @__PURE__ */ new Set();
+    const judge = (offset, literal) => {
+      if (seen.has(offset)) return;
+      seen.add(offset);
+      push(colorRule, offset, judgeColorLiteral(ctx, colorRule, literal));
+    };
+    const inValue = (at) => {
+      const before = masked.slice(Math.max(0, at - 80), at);
+      if (lang === "js") {
+        if (!/['"`][^'"`\n]*$/.test(before)) return false;
+        return !ANCHOR_CONTEXT_RE.test(before.replace(/['"`][^'"`\n]*$/, ""));
+      }
+      if (/url\(\s*['"]?$/i.test(before)) return false;
+      const lineBefore = before.slice(before.lastIndexOf("\n") + 1);
+      return /[:(,]/.test(lineBefore);
+    };
+    for (const m of masked.matchAll(HEX_RE)) {
+      const at = m.index ?? 0;
+      const prev = at > 0 ? masked[at - 1] : " ";
+      if (!HEX_PREV_OK.test(prev) || !inValue(at)) continue;
+      if (lang === "js" && m[0].length <= 5 && /\s/.test(prev)) {
+        const word = /([\w.%-]+)\s+$/.exec(masked.slice(Math.max(0, at - 30), at))?.[1] ?? "";
+        if (!SHORT_HEX_AFTER.test(word)) continue;
+      }
+      judge(at, m[0]);
+    }
+    for (const m of masked.matchAll(COLOR_FN_RE)) {
+      if (inValue(m.index ?? 0)) judge(m.index ?? 0, m[0]);
+    }
+  }
+  const fontRule = active("off_token_font");
+  if (fontRule && ctx.families.size > 0) {
+    const check = (offset, list) => {
+      if (/var\(|\$\{/.test(list)) return;
+      for (const fam of list.split(",")) {
+        const name = fam.trim().replace(/^['"]|['"]$/g, "").replace(/_/g, " ").trim();
+        push(fontRule, offset, judgeFontName(ctx, fontRule, name));
+      }
+    };
+    const re = lang === "css" ? /font-family\s*:\s*([^;{}]+)/gi : /fontFamily\s*:\s*(['"`])([^'"`]+)\1/g;
+    for (const m of masked.matchAll(re)) check(m.index ?? 0, lang === "css" ? m[1] : m[2]);
+    if (lang === "js") {
+      for (const m of masked.matchAll(/(?<![\w-])font-\[([^\]\s]+)\]/g)) check(m.index ?? 0, m[1].replace(/^['"]|['"]$/g, ""));
+    }
+  }
+  const scaleRule = (id, scale, cssProp, jsProp, twClass, what) => {
+    const rule = active(id);
+    if (!rule || scale.length === 0) return;
+    const judge = (offset, raw) => push(rule, offset, judgeScaleValue(rule, scale, raw, what));
+    if (lang === "css") {
+      for (const m of masked.matchAll(cssProp)) {
+        const valueStart = (m.index ?? 0) + m[0].length - m[m.length - 1].length;
+        let local = 0;
+        for (const part of m[m.length - 1].split(/(\s+)/)) {
+          if (/^-?[\d.]+(px|rem)$/.test(part)) judge(valueStart + local, part);
+          local += part.length;
+        }
+      }
+    } else {
+      for (const m of masked.matchAll(jsProp)) {
+        const raw = m[2];
+        judge((m.index ?? 0) + m[0].length - raw.length, /^-?[\d.]+$/.test(raw) ? `${raw}px` : raw);
+      }
+      for (const m of masked.matchAll(twClass)) judge(m.index ?? 0, m[m.length - 1]);
+    }
+  };
+  scaleRule(
+    "off_scale_spacing",
+    ctx.spacing,
+    /(?<![\w-])(?:padding|margin|gap|row-gap|column-gap)(?:-(?:top|right|bottom|left|inline|block)(?:-start|-end)?)?\s*:\s*([^;{}]+)/gi,
+    /\b(padding|paddingTop|paddingBottom|paddingLeft|paddingRight|paddingHorizontal|paddingVertical|paddingInline|paddingBlock|paddingStart|paddingEnd|margin|marginTop|marginBottom|marginLeft|marginRight|marginHorizontal|marginVertical|marginInline|marginBlock|marginStart|marginEnd|gap|rowGap|columnGap)\s*:\s*['"]?(-?\d+(?:\.\d+)?(?:px|rem)?)(?![\w.%])/g,
+    /(?<![\w-])-?(?:p|px|py|pt|pr|pb|pl|ps|pe|m|mx|my|mt|mr|mb|ml|ms|me|gap|gap-x|gap-y|space-x|space-y)-\[(-?[\d.]+(?:px|rem))\]/g,
+    "Spacing"
+  );
+  scaleRule(
+    "off_scale_radius",
+    ctx.radius,
+    /(?<![\w-])border(?:-(?:top|bottom|start|end)-(?:left|right|start|end))?-radius\s*:\s*([^;{}]+)/gi,
+    /\b(borderRadius|borderTopLeftRadius|borderTopRightRadius|borderBottomLeftRadius|borderBottomRightRadius)\s*:\s*['"]?(\d+(?:\.\d+)?(?:px|rem)?)(?![\w.%])/g,
+    /(?<![\w-])rounded(?:-(?:t|r|b|l|tl|tr|bl|br|s|e|ss|se|es|ee))?-\[([\d.]+(?:px|rem))\]/g,
+    "Radius"
+  );
+  const rawRule = active("raw_interactive_element");
+  if (rawRule && /\.(tsx|jsx)$/i.test(path) && !matchAny(path, ctx.componentGlobs)) {
+    for (const m of masked.matchAll(/<(button|input|select|textarea)\b/g)) push(rawRule, m.index ?? 0, judgeRawElement(rawRule, m[1]));
+  }
+  return { findings, lines };
+}
+function stripBraces(ref) {
+  return ref.trim().replace(/^\{|\}$/g, "");
+}
+function evaluateContrast(tokens, pairs) {
+  const byPath = new Map(tokens.map((t) => [t.path, t]));
+  return pairs.map((p3) => {
+    const fgPath = stripBraces(p3.fg);
+    const bgPath = stripBraces(p3.bg);
+    const min = p3.min ?? (p3.large ? 3 : 4.5);
+    const fg = byPath.get(fgPath);
+    const bg = byPath.get(bgPath);
+    const base = { fg: fgPath, bg: bgPath, min, use: p3.use ?? null };
+    const fc = fg?.hex ? parseCssColor(fg.hex) : null;
+    const bc = bg?.hex ? parseCssColor(bg.hex) : null;
+    if (!fc || !bc) {
+      const missing = !fg ? fgPath : !bg ? bgPath : !fc ? fgPath : bgPath;
+      return { ...base, fgHex: fg?.hex ?? null, bgHex: bg?.hex ?? null, ratio: null, pass: null, problem: `${missing} is not a resolvable colour token` };
+    }
+    const ratio = contrastRatio(fc, bc);
+    return { ...base, fgHex: fg.hex, bgHex: bg.hex, ratio, pass: ratio >= min, problem: null };
+  });
+}
+function contrastFindings(results, tokens, rule) {
+  if (!rule?.enabled) return [];
+  const byPath = new Map(tokens.map((t) => [t.path, t]));
+  return results.filter((r) => r.pass === false).map((r) => ({
+    rule_id: "contrast_below_aa",
+    severity: rule.severity,
+    file_path: byPath.get(r.fg)?.file ?? null,
+    line: null,
+    col: null,
+    value: `${r.fg} on ${r.bg}`,
+    message: `${r.fg} on ${r.bg} is ${r.ratio}:1; it needs ${r.min}:1${r.use ? ` (${r.use})` : ""}.`,
+    suggestion: null
+  }));
+}
+function computeDevianceScore(input) {
+  const kloc = Math.max(1, input.scannedLines / 1e3);
+  let num2 = 0;
+  let den = 0;
+  const breakdown = input.rules.map((r) => {
+    const count = input.counts[r.id] ?? 0;
+    const weight = SEVERITY_WEIGHT[r.severity];
+    let applicable = input.applicable[r.id] ?? false;
+    let density = null;
+    let penalty = 0;
+    if (r.id === "contrast_below_aa") {
+      applicable = applicable && input.contrast.declared > 0;
+      if (applicable) {
+        density = input.contrast.failing / input.contrast.declared;
+        penalty = density;
+      }
+    } else {
+      applicable = applicable && input.scannedFiles > 0;
+      if (applicable) {
+        density = Math.round(count / kloc * 1e3) / 1e3;
+        penalty = 1 - Math.exp(-(count / kloc) / DEVIANCE_K);
+      }
+    }
+    if (r.enabled && applicable) {
+      num2 += weight * penalty;
+      den += weight;
+    }
+    return { rule: r.id, enabled: r.enabled, applicable, severity: r.severity, weight, count, density, penalty: Math.round(penalty * 1e3) / 1e3 };
+  });
+  return { score: den === 0 ? null : Math.round(100 * num2 / den), breakdown };
+}
+var SEVERITY_ORDER = { error: 0, warn: 1, info: 2 };
+function sortFindings(findings) {
+  return findings.sort(
+    (a, b) => SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || (a.file_path ?? "").localeCompare(b.file_path ?? "") || (a.line ?? 0) - (b.line ?? 0) || (a.col ?? 0) - (b.col ?? 0)
+  );
+}
+
+// src/recipe/engine/design-engine-types.ts
+var DESIGN_RULE_IDS = [
+  "off_token_color",
+  "off_token_font",
+  "off_scale_spacing",
+  "off_scale_radius",
+  "contrast_below_aa",
+  "raw_interactive_element"
+];
+
+// src/recipe/engine/design-rules.ts
+var DEFAULT_DESIGN_RULES = {
+  off_token_color: { enabled: true, severity: "warn", allowValues: [] },
+  off_token_font: { enabled: true, severity: "warn", allowValues: [] },
+  off_scale_spacing: { enabled: true, severity: "info", allowValues: ["0", "0px"] },
+  off_scale_radius: { enabled: true, severity: "info", allowValues: ["0", "0px", "50%", "100%"] },
+  contrast_below_aa: { enabled: true, severity: "error", allowValues: [] },
+  raw_interactive_element: { enabled: false, severity: "info", allowValues: [] }
+};
+function effectiveDesignRules(manifest) {
+  const declared = manifest?.design?.rules ?? {};
+  return DESIGN_RULE_IDS.map((id) => {
+    const d = DEFAULT_DESIGN_RULES[id];
+    const m = declared[id];
+    const cfg = {
+      id,
+      enabled: m?.enabled ?? d.enabled,
+      severity: m?.severity ?? d.severity,
+      allowValues: m?.allowValues ?? d.allowValues,
+      allowFiles: m?.allowFiles ?? [],
+      fromManifest: m !== void 0
+    };
+    if (id === "raw_interactive_element") cfg.primitives = m?.primitives ?? {};
+    return cfg;
+  });
+}
+
+// src/recipe/engine/design-set-plan.ts
+var MAX_TOKEN_FILES = 40;
+var MAX_TOKEN_FILE_BYTES = 1024 * 1024;
+var DIRECTION_RE = /^(.*?(?:^|\/)directions\/)([^/]+)\/([^/]+\.json)$/;
+function directionOf(path) {
+  const m = DIRECTION_RE.exec(path);
+  return m ? { base: m[1], name: m[2], file: m[3] } : null;
+}
+function planTokenSets(declared, treePaths, directions = []) {
+  const issues = [];
+  const safe = declared.map((t) => ({ ...t, path: normalizeRepoPath(t.path) })).filter((t) => t.path !== null);
+  const sources = safe.filter((t) => t.role === "source");
+  const exports = safe.filter((t) => t.role === "export");
+  const sets = [];
+  const dirs = sources.map((t) => directionOf(t.path));
+  const sameDirection = sources.length > 0 && dirs.every((d) => d && d.base === dirs[0].base && d.name === dirs[0].name);
+  const declaredActive = directions.find((d) => d.status === "active");
+  const activeName = declaredActive?.name ?? (sameDirection ? dirs[0].name : "default");
+  if (sources.length > 0) {
+    sets.push({
+      name: activeName,
+      kind: sameDirection || declaredActive ? "direction" : "default",
+      active: true,
+      files: sources.map((t) => ({ path: t.path, role: "source", generator: t.generator ?? null })),
+      note: declaredActive?.note ?? null
+    });
+  }
+  if (directions.length > 0) {
+    for (const d of directions) {
+      if (d.status !== "inactive" || d.name === activeName) continue;
+      const files = d.tokens.map((p3) => normalizeRepoPath(p3)).filter((p3) => p3 !== null);
+      sets.push({ name: d.name, kind: "direction", active: false, files: files.map((path) => ({ path, role: "source", generator: null })), note: d.note ?? null });
+    }
+  } else if (sameDirection) {
+    const base = dirs[0].base;
+    const siblings = /* @__PURE__ */ new Map();
+    for (const p3 of treePaths) {
+      if (!p3.startsWith(base)) continue;
+      const d = directionOf(p3);
+      if (!d || d.base !== base || d.name === activeName) continue;
+      if (!/\.tokens\.json$|^tokens\.json$/.test(d.file)) continue;
+      const list = siblings.get(d.name) ?? [];
+      list.push(p3);
+      siblings.set(d.name, list);
+    }
+    for (const name of [...siblings.keys()].sort()) {
+      sets.push({
+        name,
+        kind: "direction",
+        active: false,
+        files: siblings.get(name).sort().map((path) => ({ path, role: "source", generator: null }))
+      });
+    }
+  }
+  if (exports.length > 0) {
+    sets.push({
+      name: "export",
+      kind: "export",
+      active: sources.length === 0,
+      files: exports.map((t) => ({ path: t.path, role: "export", generator: t.generator ?? null }))
+    });
+  }
+  let budget = MAX_TOKEN_FILES;
+  const capped = [];
+  for (const s of sets) {
+    if (s.files.length > budget) {
+      issues.push({ severity: "warn", code: "too_many_token_files", message: `Only ${MAX_TOKEN_FILES} token files are read per refresh; set "${s.name}" was skipped.` });
+      continue;
+    }
+    budget -= s.files.length;
+    capped.push(s);
+  }
+  return { sets: capped, issues };
+}
+function judgingSet(stored) {
+  if (!stored) return null;
+  return stored.sets.find((s) => s.active && s.tokens.length > 0) ?? stored.sets.find((s) => s.kind === "export" && s.tokens.length > 0) ?? null;
+}
+
+// src/recipe/engine/design-scan.ts
+var SCAN_LIMITS = { maxFiles: 1500, maxBytes: 12 * 1024 * 1024, maxFileBytes: 256 * 1024, maxStoredFindings: 500 };
+var DEFAULT_SCAN_GLOBS = ["**/*.{css,scss,ts,tsx,js,jsx}"];
+var ALWAYS_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.next/**",
+  "**/out/**",
+  "**/coverage/**",
+  "**/vendor/**",
+  "**/*.d.ts",
+  "**/*.min.*",
+  "**/*.map",
+  "**/*.generated.*",
+  "**/android/**",
+  "**/ios/**"
+];
+function selectScanFiles(entries, manifest, excludePaths, limits = SCAN_LIMITS) {
+  const declared = manifest?.design?.literalScan?.globs;
+  const globs = declared && declared.length > 0 ? [...declared] : DEFAULT_SCAN_GLOBS;
+  const ignore = [...ALWAYS_IGNORE, ...manifest?.design?.literalScan?.ignore ?? []];
+  const matched = entries.filter((e) => matchAny(e.path, globs) && !matchAny(e.path, ignore) && !excludePaths.includes(e.path) && e.size <= limits.maxFileBytes).sort((a, b) => a.path < b.path ? -1 : 1);
+  const files = [];
+  let bytes = 0;
+  for (const e of matched) {
+    if (files.length >= limits.maxFiles || bytes + e.size > limits.maxBytes) break;
+    files.push(e.path);
+    bytes += e.size;
+  }
+  return { files, matched: matched.length, truncated: files.length < matched.length };
+}
+function tokenFilePaths(tokens) {
+  return (tokens?.sets ?? []).flatMap((s) => s.files.map((f) => f.path));
+}
+function scoreDeviance(input, literal) {
+  const tokens = judgingSet(input.tokens)?.tokens ?? [];
+  const rules = effectiveDesignRules(input.manifest);
+  const ctx = buildDevianceContext(tokens, rules, input.manifest?.design?.components?.globs ?? []);
+  const contrast = evaluateContrast(tokens, input.manifest?.design?.contrast ?? []);
+  const found = contrastFindings(contrast, tokens, rules.find((r) => r.id === "contrast_below_aa"));
+  const counts = {};
+  for (const r of LITERAL_RULES) if (literal.counts[r]) counts[r] = literal.counts[r];
+  if (found.length > 0) counts.contrast_below_aa = found.length;
+  const judged = contrast.filter((c) => c.pass !== null);
+  const applicable = {};
+  for (const r of [...LITERAL_RULES, "contrast_below_aa"]) applicable[r] = ruleApplicable(r, ctx, judged.length);
+  const { score, breakdown } = computeDevianceScore({
+    rules,
+    counts,
+    scannedLines: literal.scannedLines,
+    scannedFiles: literal.scannedFiles,
+    applicable,
+    contrast: { declared: judged.length, failing: judged.filter((c) => c.pass === false).length }
+  });
+  return { contrastFindings: found, counts, score, breakdown };
+}
+function computeDeviance(input, texts) {
+  const tokens = judgingSet(input.tokens)?.tokens ?? [];
+  const rules = effectiveDesignRules(input.manifest);
+  const ctx = buildDevianceContext(tokens, rules, input.manifest?.design?.components?.globs ?? []);
+  const literal = [];
+  let scannedLines = 0;
+  let scannedFiles = 0;
+  for (const [path, text2] of texts) {
+    if (text2 == null) continue;
+    const r = scanSourceFile(path, text2, ctx);
+    scannedLines += r.lines;
+    scannedFiles++;
+    literal.push(...r.findings);
+  }
+  const literalCounts = {};
+  for (const f of literal) literalCounts[f.rule_id] = (literalCounts[f.rule_id] ?? 0) + 1;
+  const scored = scoreDeviance(input, { counts: literalCounts, scannedLines, scannedFiles });
+  return {
+    findings: sortFindings([...literal, ...scored.contrastFindings]),
+    counts: scored.counts,
+    score: scored.score,
+    breakdown: scored.breakdown,
+    scannedLines,
+    scannedFiles
+  };
+}
+function readScanTokens(manifest, treePaths, readFile3) {
+  const plan = planTokenSets(manifest.design?.tokens ?? [], treePaths, manifest.design?.directions ?? []);
+  const issues = [...plan.issues];
+  const sets = [];
+  for (const set of plan.sets) {
+    if (!set.active && set.kind !== "export") {
+      sets.push({ name: set.name, active: set.active, kind: set.kind, files: set.files, tokens: [] });
+      continue;
+    }
+    const files = [];
+    for (const f of set.files) {
+      const file = readFile3(f.path, MAX_TOKEN_FILE_BYTES);
+      if (file.kind === "absent") {
+        issues.push({ severity: set.active ? "error" : "warn", code: "TOKEN_FILE_MISSING", message: `${f.path} is listed but does not exist.`, file: f.path });
+        continue;
+      }
+      if (file.kind === "too_large") {
+        issues.push({ severity: "error", code: "TOKEN_FILE_TOO_LARGE", message: `${f.path} is ${file.size} bytes; the cap is ${MAX_TOKEN_FILE_BYTES}.`, file: f.path });
+        continue;
+      }
+      files.push({ path: f.path, role: f.role, text: file.text });
+    }
+    const norm = normalizeTokenSet(files);
+    issues.push(...norm.issues);
+    sets.push({ name: set.name, active: set.active, kind: set.kind, files: set.files, tokens: norm.tokens });
+  }
+  return { tokens: { sets }, issues };
+}
+
+// src/file-io.ts
+import { closeSync, fstatSync, openSync, readSync, writeFileSync as writeFileSync2 } from "fs";
+var CHUNK_BYTES = 64 * 1024;
+function readTextFileCapped(path, maxBytes) {
+  let fd;
+  try {
+    fd = openSync(path, "r");
+  } catch {
+    return { kind: "absent" };
+  }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile()) return { kind: "absent" };
+    if (stat.size > maxBytes) return { kind: "too_large", size: stat.size };
+    const chunks = [];
+    const chunk = Buffer.alloc(Math.min(CHUNK_BYTES, maxBytes + 1));
+    let total = 0;
+    for (; ; ) {
+      const read = readSync(fd, chunk, 0, chunk.length, null);
+      if (read === 0) break;
+      total += read;
+      if (total > maxBytes) return { kind: "too_large", size: total };
+      chunks.push(Buffer.from(chunk.subarray(0, read)));
+    }
+    return { kind: "file", text: Buffer.concat(chunks).toString("utf8") };
+  } finally {
+    closeSync(fd);
+  }
+}
+function writeUserOutputFile(path, text2, opts) {
+  if (typeof text2 !== "string") {
+    throw new MushiCliError("E_API_ERROR", "The server sent something other than text, so nothing was written.");
+  }
+  if (Buffer.byteLength(text2, "utf8") > opts.maxBytes) {
+    throw new MushiCliError("E_API_ERROR", `The server sent more than ${Math.round(opts.maxBytes / (1024 * 1024))} MB, so nothing was written.`);
+  }
+  try {
+    writeFileSync2(path, text2, { encoding: "utf8", mode: opts.mode ?? 420 });
+  } catch (err) {
+    throw new MushiCliError("E_FILE_PERMISSION", `Could not write ${path}`, "pick a path you can write to", err);
+  }
+}
+
+// src/recipe/manifest-shape.ts
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var isString = (v) => typeof v === "string";
+var isStringList = (v) => Array.isArray(v) && v.every(isString);
+var SEVERITIES2 = ["info", "warn", "error"];
+function readRules(raw, issues, where) {
+  if (raw === void 0) return void 0;
+  if (!isObject(raw)) {
+    issues.push({ severity: "error", message: `${where} must be an object of rule settings.` });
+    return void 0;
+  }
+  const out = {};
+  for (const [id, value] of Object.entries(raw)) {
+    if (!isObject(value)) {
+      issues.push({ severity: "error", message: `${where}.${id} must be an object.` });
+      continue;
+    }
+    const rule = {};
+    if (value.enabled !== void 0) {
+      if (typeof value.enabled === "boolean") rule.enabled = value.enabled;
+      else issues.push({ severity: "error", message: `${where}.${id}.enabled must be true or false.` });
+    }
+    if (value.severity !== void 0) {
+      if (SEVERITIES2.includes(value.severity)) rule.severity = value.severity;
+      else issues.push({ severity: "error", message: `${where}.${id}.severity must be info, warn or error.` });
+    }
+    for (const key of ["allowValues", "allowFiles"]) {
+      if (value[key] === void 0) continue;
+      if (isStringList(value[key])) rule[key] = value[key];
+      else issues.push({ severity: "error", message: `${where}.${id}.${key} must be a list of strings.` });
+    }
+    if (value.primitives !== void 0) {
+      if (isObject(value.primitives) && Object.values(value.primitives).every(isString)) rule.primitives = value.primitives;
+      else issues.push({ severity: "error", message: `${where}.${id}.primitives must map element names to component names.` });
+    }
+    out[id] = rule;
+  }
+  return out;
+}
+function readContrast(raw, issues) {
+  if (raw === void 0) return void 0;
+  if (!Array.isArray(raw)) {
+    issues.push({ severity: "error", message: "design.contrast must be a list of { fg, bg } pairs." });
+    return void 0;
+  }
+  const out = [];
+  raw.forEach((p3, i) => {
+    if (!isObject(p3) || !isString(p3.fg) || !isString(p3.bg) || !p3.fg || !p3.bg) {
+      issues.push({ severity: "error", message: `design.contrast[${i}] needs fg and bg token paths.` });
+      return;
+    }
+    const pair = { fg: p3.fg, bg: p3.bg };
+    if (typeof p3.min === "number" && p3.min >= 1 && p3.min <= 21) pair.min = p3.min;
+    else if (p3.min !== void 0) issues.push({ severity: "error", message: `design.contrast[${i}].min must be a ratio from 1 to 21.` });
+    if (typeof p3.large === "boolean") pair.large = p3.large;
+    if (isString(p3.use)) pair.use = p3.use;
+    out.push(pair);
+  });
+  return out;
+}
+function readScanManifest(manifest) {
+  const issues = [];
+  if (manifest.design === void 0) return { manifest: {}, issues };
+  if (!isObject(manifest.design)) {
+    issues.push({ severity: "error", message: '"design" must be an object.' });
+    return { manifest: {}, issues };
+  }
+  const d = manifest.design;
+  const design = {};
+  if (d.tokens !== void 0) {
+    const tokens = [];
+    if (!Array.isArray(d.tokens)) issues.push({ severity: "error", message: "design.tokens must be a list." });
+    else d.tokens.forEach((t, i) => {
+      if (!isObject(t) || !isString(t.path) || !t.path) {
+        issues.push({ severity: "error", message: `design.tokens[${i}] needs a path.` });
+        return;
+      }
+      if (t.role !== "source" && t.role !== "export") {
+        issues.push({ severity: "error", message: `design.tokens[${i}] (${t.path}) needs "role": "source" or "export".`, path: t.path });
+        return;
+      }
+      tokens.push({ path: t.path, role: t.role, ...isString(t.generator) ? { generator: t.generator } : {} });
+    });
+    design.tokens = tokens;
+  }
+  if (d.directions !== void 0) {
+    const dirs = [];
+    if (!Array.isArray(d.directions)) issues.push({ severity: "error", message: "design.directions must be a list." });
+    else d.directions.forEach((x, i) => {
+      if (!isObject(x) || !isString(x.name) || x.status !== "active" && x.status !== "inactive" || !isStringList(x.tokens) || x.tokens.length === 0) {
+        issues.push({ severity: "error", message: `design.directions[${i}] needs a name, "status": "active" or "inactive", and its token paths.` });
+        return;
+      }
+      dirs.push({ name: x.name, status: x.status, tokens: x.tokens, ...isString(x.note) ? { note: x.note } : {} });
+    });
+    design.directions = dirs;
+  }
+  if (d.components !== void 0) {
+    if (isObject(d.components) && isStringList(d.components.globs)) design.components = { globs: d.components.globs };
+    else issues.push({ severity: "error", message: 'design.components needs "globs": a list of file globs.' });
+  }
+  if (d.literalScan !== void 0) {
+    const ls = d.literalScan;
+    if (!isObject(ls) || ls.globs !== void 0 && !isStringList(ls.globs) || ls.ignore !== void 0 && !isStringList(ls.ignore)) {
+      issues.push({ severity: "error", message: "design.literalScan.globs and .ignore must be lists of file globs." });
+    } else {
+      design.literalScan = { ...ls.globs ? { globs: ls.globs } : {}, ...ls.ignore ? { ignore: ls.ignore } : {} };
+    }
+  }
+  const contrast = readContrast(d.contrast, issues);
+  if (contrast) design.contrast = contrast;
+  const rules = readRules(d.rules, issues, "design.rules");
+  if (rules) design.rules = rules;
+  return { manifest: { design }, issues };
+}
+
+// src/recipe/local.ts
+var MANIFEST = "mushi.recipe.json";
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var PUSH_MAX_FILES = 60;
+var PUSH_MAX_FILE_BYTES = 512 * 1024;
+var PUSH_MAX_TOTAL_BYTES = 4 * 1024 * 1024;
+var SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo", "Pods", ".gradle"]);
+function walk(root, limit = 2e4) {
+  const out = [];
+  const go = (dir) => {
+    if (out.length >= limit) return;
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (out.length >= limit) return;
+      if (e.isSymbolicLink()) continue;
+      const full = join6(dir, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP.has(e.name)) go(full);
+      } else if (e.isFile()) out.push(relative3(root, full).split(sep2).join("/"));
+    }
+  };
+  go(root);
+  return out;
+}
+function listRepoFiles2(root) {
+  let paths;
+  try {
+    const out = execFileSync2("git", ["ls-files", "-z", "--cached"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 });
+    paths = out.split("\0").filter(Boolean);
+  } catch {
+    paths = walk(root);
+  }
+  const entries = [];
+  for (const p3 of paths) {
+    try {
+      const st = statSync3(join6(root, p3));
+      if (st.isFile()) entries.push({ path: p3, size: st.size });
+    } catch {
+    }
+  }
+  return entries;
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var FIXTURE_DIR = /(^|\/)(__tests__|__fixtures__|__mocks__|fixtures|tests?|e2e|examples?)\//;
+function gitDefaultBranch(root) {
+  try {
+    const ref = execFileSync2("git", ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const branch = ref.replace(/^origin\//, "");
+    if (branch) return branch;
+  } catch {
+  }
+  return "main";
+}
+var ENV_EXAMPLES = [".env.example", ".env.local.example", ".env.sample", ".env.template"];
+var ROOT_APP_DIRS = ["app", "src", "components", "features", "lib", "hooks", "pages"];
+var MAX_LITERAL_GLOBS = 30;
+var MAX_READ_BYTES = 512 * 1024;
+var MAX_SCRIPT_FILES = 400;
+var DEPLOY_STEPS = [
+  /upload-google-play/i,
+  /upload-testflight/i,
+  /\baltool\b/i,
+  /app-store-connect/i,
+  /\baws\s+s3\s+sync\b/i,
+  /\bwrangler\s+(pages\s+)?deploy\b/i,
+  /cloudflare\/wrangler-action/i,
+  /\bvercel\s+(deploy|--prod)\b/i,
+  /\bsupabase\s+functions\s+deploy\b/i,
+  /\bcapgo\b/i,
+  /\beas\s+update\b/i,
+  /\b(npm|pnpm|yarn)\s+publish\b/i,
+  /\bchangeset\s+publish\b/i
+];
+var WRITES_FILE = /\b(writeFileSync|writeFile|createWriteStream|outputFileSync|outputFile|outputJsonSync|outputJson|writeJsonSync|writeJson|writeTextFile|write_text)\b/;
+function readCapped(root, path) {
+  const f = readTextFileCapped(join6(root, path), MAX_READ_BYTES);
+  return f.kind === "file" ? f.text : null;
+}
+function workspacePatterns(root, pkg) {
+  const out = [];
+  const ws = pkg?.workspaces;
+  const list = Array.isArray(ws) ? ws : isObject2(ws) && Array.isArray(ws.packages) ? ws.packages : [];
+  for (const p3 of list) if (typeof p3 === "string") out.push(p3);
+  const yaml = readCapped(root, "pnpm-workspace.yaml");
+  if (yaml) {
+    let inPackages = false;
+    for (const line of yaml.split(/\r?\n/)) {
+      if (/^packages\s*:/.test(line)) {
+        inPackages = true;
+        continue;
+      }
+      if (/^\S/.test(line)) inPackages = false;
+      const item = inPackages ? /^\s+-\s*["']?([^"'#]+?)["']?\s*(#.*)?$/.exec(line) : null;
+      if (item) out.push(item[1]);
+    }
+  }
+  return out.map((p3) => p3.trim().replace(/^\.\//, "").replace(/\/+$/, "")).filter(Boolean);
+}
+function scriptRunner(files) {
+  if (files.has("pnpm-lock.yaml")) return "pnpm";
+  if (files.has("yarn.lock")) return "yarn";
+  if (files.has("bun.lockb") || files.has("bun.lock")) return "bun run";
+  return "npm run";
+}
+function tokenOrigin(tokenPath, scripts, scriptFiles, runner) {
+  const isCheck = (name, cmd) => /(^|\s)--check(\s|=|$)/.test(cmd) || /(^|:)check$/.test(name);
+  const namesToken = (file) => {
+    if (file.text.includes(tokenPath)) return true;
+    const pkgDir = file.path.includes("/scripts/") ? file.path.slice(0, file.path.indexOf("/scripts/")) : "";
+    return pkgDir !== "" && tokenPath.startsWith(`${pkgDir}/`) && file.text.includes(tokenPath.slice(pkgDir.length + 1));
+  };
+  const mentioning = scriptFiles.filter(namesToken);
+  const writers = mentioning.filter((f) => WRITES_FILE.test(f.text));
+  const runs = (cmd, file) => cmd.includes(file);
+  let generator;
+  let generated = false;
+  for (const [name, cmd] of scripts) {
+    if (isCheck(name, cmd)) continue;
+    if (cmd.includes(tokenPath) || writers.some((w) => runs(cmd, w.path))) {
+      generated = true;
+      generator ??= `${runner} ${name}`;
+    }
+  }
+  if (writers.length) {
+    generated = true;
+    if (!generator) {
+      const w = writers[0].path;
+      generator = /\.(m?js|cjs)$/.test(w) ? `node ${w}` : w;
+    }
+  }
+  const checked = scripts.some(([name, cmd]) => isCheck(name, cmd) && (cmd.includes(tokenPath) || mentioning.some((f) => runs(cmd, f.path))));
+  if (!generated && !checked) return { role: "source" };
+  return generator && generator.length <= 200 ? { role: "export", generator } : { role: "export" };
+}
+function starterManifest(root) {
+  const tracked = listRepoFiles2(root).map((e) => e.path);
+  const files = tracked.length ? tracked : walk(root);
+  const fileSet = new Set(files);
+  const pkg = readJson(join6(root, "package.json"));
+  const deps = { ...pkg?.dependencies ?? {}, ...pkg?.devDependencies ?? {} };
+  const rootScripts = Object.entries(pkg?.scripts ?? {}).filter((e) => typeof e[1] === "string");
+  const native = files.some((f) => /^capacitor\.config\.(ts|js|json)$/.test(f)) || "expo" in deps || "react-native" in deps || files.some((f) => f.startsWith("android/") || f.startsWith("ios/"));
+  const platforms = ["web", ...files.some((f) => f.startsWith("android/")) || "expo" in deps ? ["android"] : [], ...files.some((f) => f.startsWith("ios/")) || "expo" in deps ? ["ios"] : []];
+  const archived = files.filter((f) => f.endsWith("/ARCHIVED.md")).map((f) => f.slice(0, -"/ARCHIVED.md".length));
+  const isArchived = (f) => archived.some((d) => f.startsWith(`${d}/`));
+  const live = (f) => !FIXTURE_DIR.test(f) && !isArchived(f);
+  const tokenPaths = files.filter((f) => live(f) && (/\.tokens\.json$/.test(f) || /(^|\/)dtcg\/[^/]+\.json$/.test(f))).slice(0, 20);
+  const workflows = files.filter((f) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(f));
+  const hasSource = (dir, ext) => files.some((f) => f.startsWith(`${dir}/`) && live(f) && ext.test(f));
+  const rootIsApp = files.some((f) => /^(next|vite)\.config\.(js|mjs|cjs|ts|mts)$/.test(f)) || "expo" in deps || rootScripts.some(([name]) => name === "dev" || name === "build");
+  const rootDirs = rootIsApp ? ROOT_APP_DIRS.filter((d) => hasSource(d, /\.(ts|tsx|css)$/)) : [];
+  const patterns = workspacePatterns(root, pkg);
+  let packageRoots;
+  if (patterns.length) {
+    const include = patterns.filter((p3) => !p3.startsWith("!"));
+    const exclude = patterns.filter((p3) => p3.startsWith("!")).map((p3) => p3.slice(1));
+    const pkgDirs = [...new Set(files.filter((f) => f.endsWith("/package.json") && !f.includes("node_modules/")).map((f) => f.slice(0, -"/package.json".length)))];
+    packageRoots = pkgDirs.filter((d) => !isArchived(`${d}/`) && include.some((p3) => matchGlob(d, p3)) && !exclude.some((p3) => matchGlob(d, p3))).sort().flatMap((d) => hasSource(`${d}/src`, /\.(tsx|css)$/) ? [`${d}/src`] : hasSource(d, /\.(tsx|css)$/) ? [d] : []);
+  } else {
+    packageRoots = [...new Set(files.filter((f) => live(f) && /^(apps|packages)\/[^/]+\/src\/.+\.(tsx|css)$/.test(f)).map((f) => f.split("/").slice(0, 3).join("/")))];
+  }
+  const scanRoots = [.../* @__PURE__ */ new Set([...rootDirs, ...packageRoots])].slice(0, MAX_LITERAL_GLOBS);
+  const literalGlobs = scanRoots.length ? scanRoots.map((r) => `${r}/**/*.{ts,tsx,css}`) : ["src/**/*.{ts,tsx,css}", "app/**/*.{ts,tsx,css}"];
+  const migrationsDir = files.find((f) => live(f) && /(^|\/)supabase\/migrations\/[^/]+\.sql$/.test(f))?.replace(/\/[^/]+$/, "");
+  const tokens = tokenPaths.length ? (() => {
+    const scriptFiles = files.filter((f) => live(f) && !f.includes("node_modules/") && /(^|\/)scripts\/.+\.(m?[jt]s|c[jt]s|py|sh)$/.test(f)).slice(0, MAX_SCRIPT_FILES).flatMap((path) => {
+      const text2 = readCapped(root, path);
+      return text2 === null ? [] : [{ path, text: text2 }];
+    });
+    const runner = scriptRunner(fileSet);
+    return tokenPaths.map((path) => ({ path, ...tokenOrigin(path, rootScripts, scriptFiles, runner), format: "dtcg-2025.10" }));
+  })() : [];
+  const manifest = {
+    version: 1,
+    app: { name: pkg?.name ?? root.split(/[\\/]/).pop(), kind: native ? "app" : "site", platforms }
+  };
+  if (tokens.length) {
+    manifest.design = { tokens, literalScan: { globs: literalGlobs, ignore: ["**/*.test.*"] } };
+  }
+  if (migrationsDir) manifest.data = { provider: "supabase", migrationsDir };
+  if (workflows.length) {
+    manifest.ci = {
+      provider: "github-actions",
+      defaultBranch: gitDefaultBranch(root),
+      workflows: Object.fromEntries(workflows.map((w) => {
+        const name = w.slice(".github/workflows/".length);
+        const steps = (readCapped(root, w) ?? "").split(/\r?\n/).filter((l) => !/^\s*#/.test(l)).join("\n");
+        const deploys = /^(deploy|publish|release)/.test(name) || DEPLOY_STEPS.some((re) => re.test(steps));
+        return [name, { role: deploys ? "deploy" : "ci" }];
+      }))
+    };
+  }
+  const envExample = ENV_EXAMPLES.find((p3) => existsSync3(join6(root, p3)));
+  if (envExample) manifest.env = { environments: ["production"], required: [], example: envExample };
+  const sourceDirs = tokens.filter((t) => t.role === "source").map((t) => `${t.path.split("/").slice(0, -1).join("/") || "."}/**`);
+  manifest.change = { allowPaths: [MANIFEST, ...new Set(sourceDirs)] };
+  return manifest;
+}
+function asStringList(v) {
+  return Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+}
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function localReader(root) {
+  return (path, maxBytes) => {
+    const safe = normalizeRepoPath(path);
+    if (!safe) return { kind: "absent" };
+    return readTextFileCapped(join6(root, safe), maxBytes);
+  };
+}
+function checkRecipe(root) {
+  const issues = [];
+  const files = {};
+  const path = join6(root, MANIFEST);
+  const fail = (message) => ({ ok: false, manifest: null, issues: [...issues, { severity: "error", message, path: MANIFEST }], tokenCount: 0, findings: [], design: null, files });
+  const manifestRead = readTextFileCapped(path, MAX_MANIFEST_BYTES);
+  if (manifestRead.kind === "absent") return fail(`No ${MANIFEST} at the repo root. Run \`mushi recipe init\` to write one.`);
+  if (manifestRead.kind === "too_large") return fail(`${MANIFEST} is over 64 KB.`);
+  const text2 = manifestRead.text;
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch (err) {
+    return fail(`${MANIFEST} is not valid JSON: ${err.message}`);
+  }
+  if (!isObject2(parsed) || parsed.version !== 1) return fail(`${MANIFEST} needs "version": 1.`);
+  const manifest = parsed;
+  files[MANIFEST] = text2;
+  const change = isObject2(manifest.change) ? manifest.change : {};
+  for (const p3 of asStringList(change.allowPaths)) {
+    if (p3.startsWith(".github") || /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|[^/]*\.lock)$/.test(p3)) {
+      issues.push({ severity: "error", message: `change.allowPaths entry "${p3}" points at files Mushi never writes (workflows, lockfiles).`, path: MANIFEST });
+    }
+    if (/(^|\/)\.env(?!\.example)/.test(p3)) issues.push({ severity: "error", message: `change.allowPaths entry "${p3}" would let a PR touch env files.`, path: MANIFEST });
+  }
+  const shaped = readScanManifest(manifest);
+  issues.push(...shaped.issues);
+  const scanManifest = shaped.manifest;
+  for (const t of scanManifest.design?.tokens ?? []) {
+    if (!normalizeRepoPath(t.path)) issues.push({ severity: "error", message: `A design.tokens path is not a safe repo path: ${t.path}`, path: MANIFEST });
+  }
+  const tree = listRepoFiles2(root);
+  const read = localReader(root);
+  const { tokens, issues: tokenIssues } = readScanTokens(scanManifest, tree.map((e) => e.path), read);
+  for (const i of tokenIssues) issues.push({ severity: i.severity, message: i.message, ...i.file ? { path: i.file } : {} });
+  const judged = judgingSet(tokens);
+  const tokenCount = judged?.tokens.length ?? 0;
+  let pushedBytes = text2.length;
+  const addPush = (p3) => {
+    if (files[p3] !== void 0 || Object.keys(files).length >= PUSH_MAX_FILES) return;
+    const f = read(p3, PUSH_MAX_FILE_BYTES);
+    if (f.kind !== "file" || pushedBytes + f.text.length > PUSH_MAX_TOTAL_BYTES) return;
+    files[p3] = f.text;
+    pushedBytes += f.text.length;
+  };
+  for (const p3 of tokenFilePaths(tokens)) addPush(p3);
+  const design = isObject2(manifest.design) ? manifest.design : {};
+  for (const c of Array.isArray(design.css) ? design.css : []) {
+    const rel = isObject2(c) && typeof c.path === "string" ? normalizeRepoPath(c.path) : null;
+    if (rel) addPush(rel);
+  }
+  let findings = [];
+  let designCheck = null;
+  if (judged) {
+    const pick = selectScanFiles(tree, scanManifest, [...tokenFilePaths(tokens), MANIFEST]);
+    const texts = /* @__PURE__ */ new Map();
+    for (const p3 of pick.files) {
+      const f = read(p3, Number.POSITIVE_INFINITY);
+      texts.set(p3, f.kind === "file" ? f.text : null);
+    }
+    const result = computeDeviance({ manifest: scanManifest, tokens }, texts);
+    findings = result.findings;
+    designCheck = {
+      score: result.score,
+      breakdown: result.breakdown,
+      counts: result.counts,
+      scannedFiles: result.scannedFiles,
+      scannedLines: result.scannedLines,
+      matchedFiles: pick.matched,
+      truncated: pick.truncated,
+      set: judged.name
+    };
+  } else if (scanManifest.design?.tokens?.length) {
+    issues.push({ severity: "info", message: "The token files define no tokens, so there is nothing to judge the code against." });
+  }
+  return { ok: !issues.some((i) => i.severity === "error"), manifest, issues, tokenCount, findings, design: designCheck, files };
+}
+function pushPayload(check, maxFindings = 500) {
+  if (!check.design) return null;
+  const literal = check.findings.filter((f) => f.rule_id !== "contrast_below_aa" && f.file_path !== null && f.line !== null);
+  const counts = { ...check.design.counts };
+  delete counts.contrast_below_aa;
+  return {
+    engine: 1,
+    scannedFiles: check.design.scannedFiles,
+    scannedLines: check.design.scannedLines,
+    matchedFiles: check.design.matchedFiles,
+    truncated: check.design.truncated,
+    counts,
+    score: check.design.score,
+    findings: literal.slice(0, maxFindings).map((f) => ({
+      ruleId: f.rule_id,
+      filePath: f.file_path,
+      line: f.line,
+      col: f.col,
+      value: f.value.slice(0, 200),
+      message: f.message.slice(0, 500),
+      suggestion: f.suggestion
+    }))
+  };
+}
+
+// src/recipe/report.ts
+var SHOWN_FINDINGS = 50;
+function describeCheck(result) {
+  const d = result.design;
+  const scope = d ? `${d.scannedFiles} files scanned${d.truncated ? " (capped)" : ""}` : "no scan";
+  const score = d ? d.score === null ? ", not scored (no rule had anything to judge)" : `, deviance score ${d.score}/100` : "";
+  const lines = [`${result.ok ? "OK" : "FAIL"}  mushi.recipe.json: ${result.tokenCount} tokens${d?.set ? ` (set ${d.set})` : ""}, ${scope}${score}.`];
+  for (const i of result.issues) lines.push(`  ${i.severity.toUpperCase().padEnd(5)} ${i.message}`);
+  for (const f of result.findings.slice(0, SHOWN_FINDINGS)) {
+    const at = f.file_path ? `${f.file_path}${f.line ? `:${f.line}${f.col ? `:${f.col}` : ""}` : ""}` : "tokens";
+    const use = f.suggestion ? ` \u2192 ${f.suggestion.cssVar ?? f.suggestion.ts ?? f.suggestion.token}` : "";
+    lines.push(`  ${f.severity.toUpperCase().padEnd(5)} ${at}  ${f.message}${use}  [${f.rule_id}]`);
+  }
+  if (result.findings.length > SHOWN_FINDINGS) lines.push(`  \u2026 and ${result.findings.length - SHOWN_FINDINGS} more`);
+  return lines;
+}
+function localLimitExceeded(score, maxScore) {
+  return maxScore !== null && score !== null && score > maxScore;
+}
+function pushVerdict(answer, maxScore, localScore) {
+  const lines = [`Sent to Mushi: ${answer.reason}`];
+  const errors = [];
+  let failed = localLimitExceeded(localScore, maxScore);
+  const d = answer.deviance;
+  if (!d) {
+    if (localScore !== null) lines.push("Mushi stored the recipe but did not score the scan (it may be older than this CLI).");
+    return { lines, errors, failed };
+  }
+  if (d.status === "skipped") lines.push(`Not scored: ${d.reason ?? "no design tokens to judge against."}`);
+  else if (d.status === "error") {
+    errors.push(`Mushi could not store the scan: ${d.reason ?? "unknown error"}`);
+    if (d.gate?.enabled) {
+      errors.push("Failing the step: this project's deviance gate is on, and an unstored scan cannot be checked against it.");
+      failed = true;
+    }
+  } else {
+    const refused = d.droppedFindings > 0 ? `, ${d.droppedFindings} refused` : "";
+    lines.push(`Mushi scored ${d.score === null ? "nothing (no rule had anything to judge)" : `${d.score}/100`}: ${d.storedFindings} findings stored${refused}.`);
+  }
+  if (d.clientScore !== null && d.clientScore !== void 0) {
+    errors.push(`This CLI scored ${d.clientScore}, Mushi scored ${d.score}. Update @mushi-mushi/cli so both run the same rules.`);
+  }
+  if (d.gate?.enabled) {
+    if (d.gate.exceeded) {
+      errors.push(`Deviance score ${d.score} is above this project's limit of ${d.gate.failAbove} (console: Design system \u2192 When the score is too high).`);
+      failed = true;
+    } else {
+      lines.push(`Within the project's limit of ${d.gate.failAbove}.`);
+    }
+  }
+  if (d.reason && d.status !== "skipped" && d.status !== "error") errors.push(d.reason);
+  const a = d.action;
+  if (a?.action === "dispatched") lines.push(`Mushi dispatched a fix for ${a.newFindings ?? "the"} new finding${a.newFindings === 1 ? "" : "s"} (report ${a.reportId}).`);
+  else if (a?.action === "dispatch_refused") lines.push(`Design auto-fix did not dispatch: ${a.message ?? a.code ?? "refused"}.`);
+  else if (a?.action === "autofix_disabled") lines.push("Design auto-fix is on, but Autofix is off for this project, so no fix was dispatched.");
+  else if (a?.action === "key_not_trusted") lines.push("Design auto-fix skipped for this push: the key is treated as public (see above).");
+  else if (a?.action === "settings_unavailable" || a?.action === "report_failed") errors.push(`Design auto-fix failed: ${a.error ?? a.action}.`);
+  return { lines, errors, failed };
+}
+
+// src/commands/recipe.ts
+var SOURCE_ELEMENTS = ["gates", "env", "routes"];
+function headSha2(dir) {
+  const env = process.env.GITHUB_SHA ?? process.env.CI_COMMIT_SHA ?? null;
+  if (env) return env;
+  try {
+    return execFileSync3("git", ["rev-parse", "HEAD"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return null;
+  }
+}
+function headBranch(dir) {
+  const env = process.env.GITHUB_REF_NAME ?? process.env.CI_COMMIT_BRANCH ?? null;
+  if (env) return env;
+  try {
+    return execFileSync3("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  } catch {
+    return "main";
+  }
+}
+function registerRecipeCommands(program2) {
+  const recipe = program2.command("recipe").description("Your app's recipe: design tokens, routes, CI, deploy and env, so a fix uses your own system");
+  recipe.command("init").description(`Write a starter ${MANIFEST} from what this repo shows`).option("--dir <path>", "Repo root", ".").option("--force", `Overwrite an existing ${MANIFEST}`).action((opts) => {
+    const root = resolve5(opts.dir);
+    const target = join7(root, MANIFEST);
+    try {
+      writeFileSync3(target, `${JSON.stringify(starterManifest(root), null, 2)}
+`, { flag: opts.force ? "w" : "wx" });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      process.stderr.write(`${MANIFEST} already exists. Use --force to overwrite it.
+`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`Wrote ${MANIFEST}. Check the guesses, then run \`mushi recipe check\`.`);
+  });
+  recipe.command("check").description(`Validate ${MANIFEST} and its token files, and score how far the code is from your design system (the same rules Mushi's scan uses)`).option("--dir <path>", "Repo root", ".").option("--push", "Send the recipe and the scan to Mushi (one extra step in your existing CI job); fails when the score is above the project's limit").option("--max-score <n>", "Also fail when the deviance score (0\u2013100) is above n, without asking Mushi").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const root = resolve5(opts.dir);
+    const maxScore = opts.maxScore === void 0 ? null : Number(opts.maxScore);
+    if (maxScore !== null && (!Number.isInteger(maxScore) || maxScore < 0 || maxScore > 100)) {
+      process.stderr.write("error: --max-score must be a whole number from 0 to 100.\n");
+      process.exitCode = 1;
+      return;
+    }
+    const result = checkRecipe(root);
+    const json2 = outputIsJson(opts.json);
+    const local = { ok: result.ok, issues: result.issues, tokenCount: result.tokenCount, design: result.design, findings: result.findings };
+    if (json2 && !opts.push) console.log(JSON.stringify(local, null, 2));
+    else if (!json2) for (const line of describeCheck(result)) console.log(line);
+    if (!result.ok) {
+      process.exitCode = 1;
+      return;
+    }
+    const overLocal = localLimitExceeded(result.design?.score ?? null, maxScore);
+    if (overLocal) process.stderr.write(`Deviance score ${result.design?.score} is above --max-score ${maxScore}.
+`);
+    if (!opts.push) {
+      if (overLocal) process.exitCode = 1;
+      return;
+    }
+    const sha = headSha2(root);
+    if (!sha || !/^[0-9a-f]{7,64}$/i.test(sha)) {
+      process.stderr.write("error: could not read the commit SHA (set GITHUB_SHA or run inside a git checkout).\n");
+      process.exitCode = 1;
+      return;
+    }
+    const config = requireConfig();
+    const deviance = pushPayload(result);
+    const res = await apiCall("/v1/ingest/recipe", config, {
+      method: "POST",
+      body: JSON.stringify({ commitSha: sha, branch: headBranch(root), files: result.files, ...deviance ? { deviance } : {} })
+    });
+    if (!res.ok) die(res);
+    const verdict = pushVerdict(res.data, maxScore, result.design?.score ?? null);
+    if (json2) console.log(JSON.stringify({ ...res.data, local, failed: verdict.failed }, null, 2));
+    else for (const line of verdict.lines) console.log(line);
+    for (const line of verdict.errors) process.stderr.write(`${line}
+`);
+    if (verdict.failed) process.exitCode = 1;
+  });
+  recipe.command("show").description("Show this project's recipe: each part and its state").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig({ needsProject: !opts.projectId });
+    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe`, config);
+    if (!res.ok) die(res);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(res.data, null, 2));
+      return;
+    }
+    console.log(`Worst: ${res.data.worst}`);
+    for (const e of Object.values(res.data.elements)) console.log(`  ${e.state.padEnd(14)} ${e.label} \u2014 ${e.reason}`);
+  });
+  recipe.command("sources").description("The repo files a recipe change may edit for one element, with the sha to send back as baseSha").requiredOption("--element <element>", SOURCE_ELEMENTS.join(" | ")).option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output (includes each file's content)").action(async (opts) => {
+    if (!SOURCE_ELEMENTS.includes(opts.element)) {
+      throw new MushiCliError("E_INVALID_INPUT", `--element must be one of ${SOURCE_ELEMENTS.join(", ")}`);
+    }
+    const config = requireConfig({ needsProject: !opts.projectId });
+    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe/sources?element=${opts.element}`, config);
+    if (!res.ok) die(res);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(res.data, null, 2));
+      return;
+    }
+    if (!res.data.ok) {
+      console.log(`Nothing editable: ${res.data.reason ?? "unknown reason"}`);
+      return;
+    }
+    console.log(`${res.data.element} on ${res.data.branch ?? "?"} @ ${(res.data.headSha ?? "").slice(0, 7)}`);
+    for (const f of res.data.files) {
+      const state = !f.exists ? "new file" : f.content === null ? "not shown" : `${f.content.length} chars, sha ${(f.sha ?? "").slice(0, 7)}`;
+      console.log(`  ${f.writable ? "writable" : "locked  "} ${f.path}  (${state})${f.reason ? ` \u2014 ${f.reason}` : ""}`);
+    }
+  });
+  recipe.command("change <jobId>").description("One recipe change job: queued, running, pr_opened, rejected or failed").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (jobId, opts) => {
+    const id = requireUuid(jobId, "job id");
+    const config = requireConfig({ needsProject: !opts.projectId });
+    const projectId = requireUuid(opts.projectId ?? config.projectId, "project id");
+    const res = await apiCall(`/v1/admin/projects/${projectId}/recipe/changes/${id}`, config);
+    if (!res.ok) die(res);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(res.data, null, 2));
+      return;
+    }
+    const j = res.data;
+    console.log(`${j.element} change ${j.id}: ${j.status} (started ${fmtDate(j.created_at)}${j.finished_at ? `, finished ${fmtDate(j.finished_at)}` : ""})`);
+    if (j.pr_url) console.log(`  Draft PR: ${j.pr_url}`);
+    if (j.error) console.log(`  ${j.error}`);
+  });
+}
+
+// src/commands/store.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join9, resolve as resolve6 } from "path";
+
+// src/store/pull.ts
+import { createSign, sign as cryptoSign } from "crypto";
+import { mkdirSync, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname2, join as join8 } from "path";
+function b64url(buf) {
+  return Buffer.from(buf).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function ascJwt(keyId, issuerId, privateKeyPem, nowSec) {
+  const head = b64url(JSON.stringify({ alg: "ES256", kid: keyId, typ: "JWT" }));
+  const body = b64url(JSON.stringify({ iss: issuerId, iat: nowSec, exp: nowSec + 1200, aud: "appstoreconnect-v1" }));
+  const sig = cryptoSign("sha256", Buffer.from(`${head}.${body}`), { key: privateKeyPem, dsaEncoding: "ieee-p1363" });
+  return `${head}.${body}.${b64url(sig)}`;
+}
+function googleAssertion(clientEmail, privateKeyPem, nowSec) {
+  const head = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const body = b64url(JSON.stringify({ iss: clientEmail, scope: "https://www.googleapis.com/auth/androidpublisher", aud: "https://oauth2.googleapis.com/token", iat: nowSec, exp: nowSec + 3600 }));
+  const signer = createSign("RSA-SHA256");
+  signer.update(`${head}.${body}`);
+  return `${head}.${body}.${b64url(signer.sign(privateKeyPem))}`;
+}
+async function json(fetchImpl, url, init) {
+  const res = await fetchImpl(url, init);
+  const body = await res.json().catch(() => null);
+  if (!res.ok) {
+    const detail = body?.errors?.[0]?.detail ?? body?.error?.message ?? "";
+    throw new Error(`${new URL(url).host} answered ${res.status}${detail ? `: ${detail}` : ""}`);
+  }
+  return body;
+}
+var IOS_FILES = { name: "name.txt", subtitle: "subtitle.txt", privacyPolicyUrl: "privacy_url.txt", description: "description.txt", keywords: "keywords.txt", promotionalText: "promotional_text.txt", whatsNew: "release_notes.txt" };
+var ANDROID_FILES = { title: "title.txt", shortDescription: "short_description.txt", fullDescription: "full_description.txt", video: "video.txt" };
+async function pullAppStore(fetchImpl, appId, key, nowSec) {
+  const auth = { headers: { Authorization: `Bearer ${ascJwt(key.keyId, key.issuerId, key.privateKey, nowSec)}` } };
+  const base = "https://api.appstoreconnect.apple.com/v1";
+  const out = {};
+  const infos = await json(fetchImpl, `${base}/apps/${appId}/appInfos`, auth);
+  const isLive = (a) => a?.state === "READY_FOR_DISTRIBUTION" || a?.appStoreState === "READY_FOR_SALE";
+  const info = (infos.data ?? []).find((i) => isLive(i.attributes)) ?? infos.data?.[0];
+  if (info) {
+    const locs = await json(fetchImpl, `${base}/appInfos/${info.id}/appInfoLocalizations`, auth);
+    for (const l of locs.data ?? []) {
+      const a = l.attributes ?? {};
+      for (const k of ["name", "subtitle", "privacyPolicyUrl"]) if (typeof a[k] === "string") out[`${a.locale}/${IOS_FILES[k]}`] = a[k];
+    }
+  }
+  const versions = await json(fetchImpl, `${base}/apps/${appId}/appStoreVersions?filter[appVersionState]=READY_FOR_DISTRIBUTION&limit=1`, auth);
+  const version = versions.data?.[0];
+  if (version) {
+    const locs = await json(fetchImpl, `${base}/appStoreVersions/${version.id}/appStoreVersionLocalizations`, auth);
+    for (const l of locs.data ?? []) {
+      const a = l.attributes ?? {};
+      for (const k of ["description", "keywords", "promotionalText", "whatsNew"]) if (typeof a[k] === "string") out[`${a.locale}/${IOS_FILES[k]}`] = a[k];
+    }
+  }
+  return out;
+}
+async function pullPlay(fetchImpl, pkg, sa, nowSec) {
+  const tokenBody = `grant_type=${encodeURIComponent("urn:ietf:params:oauth:grant-type:jwt-bearer")}&assertion=${encodeURIComponent(googleAssertion(sa.client_email, sa.private_key, nowSec))}`;
+  const token = await json(fetchImpl, "https://oauth2.googleapis.com/token", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: tokenBody });
+  const auth = { Authorization: `Bearer ${token.access_token}` };
+  const base = `https://androidpublisher.googleapis.com/androidpublisher/v3/applications/${pkg}`;
+  const edit = await json(fetchImpl, `${base}/edits`, { method: "POST", headers: auth });
+  const out = {};
+  try {
+    const listings = await json(fetchImpl, `${base}/edits/${edit.id}/listings`, { headers: auth });
+    for (const l of listings.listings ?? []) {
+      for (const k of Object.keys(ANDROID_FILES)) if (typeof l[k] === "string" && l[k]) out[`android/${l.language}/${ANDROID_FILES[k]}`] = l[k];
+    }
+  } finally {
+    await fetchImpl(`${base}/edits/${edit.id}`, { method: "DELETE", headers: auth }).catch(() => void 0);
+  }
+  return out;
+}
+function writeListing(root, listingDir, files) {
+  const written = [];
+  for (const [rel, text2] of Object.entries(files)) {
+    if (rel.includes("..")) continue;
+    const path = join8(root, listingDir, rel);
+    mkdirSync(dirname2(path), { recursive: true });
+    writeFileSync4(path, text2.endsWith("\n") ? text2 : `${text2}
+`);
+    written.push(`${listingDir}/${rel}`);
+  }
+  return written.sort();
+}
+
+// src/commands/store.ts
+var PULL_TIMEOUT_MS = 9e4;
+function renderStoreReviews(d) {
+  const s = d.settings;
+  const lines = [`Store reviews as reports: ${s.enabled ? "on" : "off"} \xB7 files reviews of ${s.maxRating} star(s) or fewer`];
+  lines.push(`  Last pull: ${s.lastPulledAt ? `${fmtDate(s.lastPulledAt)} (${s.lastStatus ?? "?"})` : "never"}${s.lastError ? ` \u2014 ${oneLine(s.lastError, 100)}` : ""}`);
+  if (d.sources.length === 0) lines.push("  No App Store or Google Play connector is bound to this app.");
+  for (const src of d.sources) lines.push(`  ${src.store.padEnd(10)} ${oneLine(src.appId, 50)}  ${src.connected ? "key stored" : "key unreadable"}`);
+  if (d.recent.length > 0) {
+    lines.push("Recently seen:");
+    for (const r of d.recent) lines.push(`  ${r.store.padEnd(10)} ${String(r.rating ?? "?")}\u2605  ${r.reportId ? `report ${r.reportId}` : "not filed"}  ${fmtDate(r.seenAt)}`);
+  }
+  if (!s.enabled && d.canManage) lines.push("Turn it on in the console (Recipe \u2192 Store reviews as reports).");
+  return lines;
+}
+function readManifestStore(root) {
+  const path = join9(root, "mushi.recipe.json");
+  if (!existsSync4(path)) return null;
+  try {
+    const m = JSON.parse(readFileSync5(path, "utf8"));
+    return {
+      listingDir: (m.store?.listingDir ?? "fastlane/metadata").replace(/\/+$/, ""),
+      appleId: m.store?.ios?.appleId ?? null,
+      androidPackage: m.store?.android?.package ?? null
+    };
+  } catch {
+    return null;
+  }
+}
+function registerStoreCommands(program2) {
+  const store = program2.command("store").description("Store listings as code");
+  store.command("pull").description("Copy the live App Store and Google Play listings into the repo (fastlane metadata), using your own keys").option("--dir <path>", "Repo root", ".").option("--asc-key-id <id>", "App Store Connect key id (or MUSHI_ASC_KEY_ID)").option("--asc-issuer-id <id>", "App Store Connect issuer id (or MUSHI_ASC_ISSUER_ID)").option("--asc-key-path <path>", "Path to the .p8 key (or MUSHI_ASC_KEY_PATH)").option("--play-key-path <path>", "Path to the Google service account JSON (or GOOGLE_APPLICATION_CREDENTIALS)").addHelpText("after", `
+Runs on your machine with your own store keys. Nothing is sent to Mushi, and
+Mushi never holds a key that can publish. After this, change the listing in
+the repo; your own CI (fastlane deliver / supply, or EAS) publishes it.
+Reads store.listingDir, store.ios.appleId and store.android.package from
+mushi.recipe.json.`).action(async (opts) => {
+    const root = resolve6(opts.dir);
+    const cfg = readManifestStore(root);
+    if (!cfg) {
+      process.stderr.write("error: no readable mushi.recipe.json. Run `mushi recipe init` first.\n");
+      process.exitCode = 1;
+      return;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    const files = {};
+    const keyId = opts.ascKeyId ?? process.env.MUSHI_ASC_KEY_ID;
+    const issuerId = opts.ascIssuerId ?? process.env.MUSHI_ASC_ISSUER_ID;
+    const keyPath = opts.ascKeyPath ?? process.env.MUSHI_ASC_KEY_PATH;
+    if (cfg.appleId && keyId && issuerId && keyPath) {
+      try {
+        const ios = await pullAppStore(fetch, cfg.appleId, { keyId, issuerId, privateKey: readFileSync5(keyPath, "utf8") }, now);
+        if (!Object.keys(ios).some((k) => k.endsWith("/description.txt"))) console.log("App Store: no version is live yet, so only the app name, subtitle and privacy link were pulled.");
+        Object.assign(files, ios);
+      } catch (err) {
+        process.stderr.write(`App Store: ${err.message}
+`);
+        process.exitCode = 1;
+      }
+    } else if (cfg.appleId) {
+      console.log("App Store skipped: set the key id, issuer id and .p8 path.");
+    }
+    const playPath = opts.playKeyPath ?? process.env.GOOGLE_APPLICATION_CREDENTIALS;
+    if (cfg.androidPackage && playPath) {
+      try {
+        Object.assign(files, await pullPlay(fetch, cfg.androidPackage, JSON.parse(readFileSync5(playPath, "utf8")), now));
+      } catch (err) {
+        process.stderr.write(`Google Play: ${err.message}
+`);
+        process.exitCode = 1;
+      }
+    } else if (cfg.androidPackage) {
+      console.log("Google Play skipped: set the service account path.");
+    }
+    const written = writeListing(root, cfg.listingDir, files);
+    console.log(written.length ? `Wrote ${written.length} files under ${cfg.listingDir}/. Review and commit them.` : "Nothing was pulled.");
+  });
+  store.command("reviews").description("Store reviews as reports: whether it is on, the bound stores, and the reviews seen lately").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${pid}/store/reviews`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderStoreReviews(result.data)) console.log(line);
+  });
+  store.command("reviews-pull").description("Pull the latest reviews now and file the low-star ones as reports (once per 10 minutes)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${pid}/store/reviews/pull`, config, { method: "POST" }, { timeoutMs: PULL_TIMEOUT_MS });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Pull ${result.data.status}: filed ${result.data.filed} review(s) as reports.`);
+    for (const line of result.data.stores) console.log(`  ${line.store.padEnd(10)} ${line.status.padEnd(13)} fetched ${line.fetched}, new ${line.newReviews}, filed ${line.filed}${line.detail ? ` \u2014 ${oneLine(line.detail, 100)}` : ""}`);
+  });
+  store.command("reviews-set").description("Turn store review intake off, or change the star threshold while it is on (owners and admins)").option("--off", "Stop filing store reviews as reports").option("--max-rating <n>", "File reviews at or under this many stars (1-5)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Turning intake on decides that public reviews become reports, so it needs a
+signed-in owner or admin in the console (Recipe \u2192 Store reviews as reports).`).action(async (opts) => {
+    let maxRating;
+    if (opts.maxRating !== void 0) {
+      maxRating = Number(opts.maxRating);
+      if (!Number.isInteger(maxRating) || maxRating < 1 || maxRating > 5) throw new MushiCliError("E_INVALID_INPUT", "--max-rating must be a whole number from 1 to 5");
+    }
+    if (!opts.off && maxRating === void 0) throw new MushiCliError("E_INVALID_INPUT", "Nothing to change: pass --off or --max-rating.");
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const body = { enabled: !opts.off, ...maxRating !== void 0 ? { maxRating } : {} };
+    const result = await apiCall(`/v1/admin/projects/${pid}/store/reviews/settings`, config, { method: "PUT", body: JSON.stringify(body) });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Store reviews as reports: ${result.data.enabled ? "on" : "off"} \xB7 files reviews of ${result.data.maxRating} star(s) or fewer.`);
+  });
+}
+
+// src/commands/portfolio.ts
+var MAX_RESOURCE_CSV_BYTES = 256 * 1024;
+function renderPortfolioResources(data) {
+  if (data.resources.length === 0) {
+    return ["No shared resources recorded yet. They come from each app's recipe, or a CSV upload in the console."];
+  }
+  const lines = ["Shared resources (one account, domain or bucket used by several apps):"];
+  for (const r of data.resources) {
+    lines.push(`  ${r.kind.padEnd(14)} ${oneLine(r.externalId, 50)}  used by ${r.uses.length} app(s)`);
+    for (const u of r.uses) lines.push(`      ${u.projectId}  ${oneLine(u.role, 30)} (${u.source})`);
+  }
+  if (data.findings.length > 0) {
+    lines.push("Open findings on shared resources:");
+    for (const f of data.findings) lines.push(`  ${f.severity.toUpperCase().padEnd(5)} ${f.rule_id} \u2014 ${oneLine(f.message, 100)}`);
+  }
+  return lines;
+}
+var ORG_HELP = "--org <id>";
+var ORG_DESC = "Organization UUID (default: your only organization)";
+function sdkLabel(card) {
+  const behind = card.sdk.filter((s) => s.status === "behind");
+  if (behind.length > 0) return `SDK behind (${behind.map((s) => `${s.package} ${s.version}\u2192${s.latest}`).join(", ")})`;
+  if (card.sdk.some((s) => s.status === "current")) return "SDK current";
+  return "SDK unknown";
+}
+function renderPortfolio(data) {
+  const lines = [];
+  const pages = Math.max(1, Math.ceil(data.totalProjects / Math.max(1, data.pageSize)));
+  lines.push(`${data.organizationName ?? data.organizationId} \u2014 ${data.totalProjects} app(s), page ${data.page}/${pages}`);
+  if (data.cards.length === 0) lines.push("  No apps in this team yet.");
+  for (const c of data.cards) {
+    const radar = c.radar.status === "never_run" ? "holes not checked yet" : `holes ${c.radar.open.error} error / ${c.radar.open.warn} warn`;
+    const release = c.latestRelease ? `last release ${c.latestRelease.version}` : "no release yet";
+    lines.push(`  ${c.worst.toUpperCase().padEnd(8)} ${oneLine(c.name, 40)}  (${c.projectId})`);
+    lines.push(`           ${c.openReports} open report(s) \xB7 ${radar} \xB7 ${sdkLabel(c)} \xB7 ${release}`);
+    if (c.error) lines.push(`           recipe could not be read: ${oneLine(c.error)}`);
+  }
+  lines.push(`Repeated problems: ${data.repeatedGroups} \xB7 integration holes: ${data.holes}  (mushi portfolio findings)`);
+  return lines;
+}
+function renderPortfolioFindings(data) {
+  const lines = [];
+  if (data.groups.length === 0 && data.sdkSkew.length === 0 && data.holes.length === 0 && data.crossProject.length === 0) {
+    return ["No repeated problems across your apps."];
+  }
+  if (data.groups.length > 0) {
+    lines.push("Same problem in several apps:");
+    for (const g of data.groups) {
+      lines.push(`  ${g.severity.toUpperCase().padEnd(5)} ${g.ruleId} (${g.gate}) \u2014 ${g.findingCount} finding(s) in ${g.projectIds.length} app(s)`);
+      lines.push(`        ${oneLine(g.sampleMessage, 120)}`);
+    }
+  }
+  const behind = data.sdkSkew.filter((s) => s.status === "behind");
+  if (behind.length > 0) {
+    lines.push("SDK behind latest:");
+    for (const s of behind) lines.push(`  ${s.projectId}  ${s.package} ${s.version} \u2192 ${s.latest}`);
+  }
+  if (data.holes.length > 0) {
+    lines.push("Integration holes (siblings have it, this app does not):");
+    for (const h of data.holes) lines.push(`  ${h.projectId}  ${h.integration} \u2014 ${oneLine(h.reason, 100)}`);
+  }
+  if (data.crossProject.length > 0) {
+    lines.push("Cross-app findings:");
+    for (const f of data.crossProject) lines.push(`  ${(f.severity ?? "info").toUpperCase().padEnd(5)} ${f.ruleId} \u2014 ${oneLine(f.message, 100)}`);
+  }
+  return lines;
+}
+function registerPortfolioCommands(program2) {
+  const portfolio = program2.command("portfolio").description("Every app in your team on one screen (needs an account-level key)");
+  portfolio.command("show").description("Health, open reports, holes, SDK version and last release for each app").option(ORG_HELP, ORG_DESC).option("--page <n>", "Page of apps (25 per page)", "1").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const page = Math.max(1, Number.parseInt(opts.page, 10) || 1);
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/portfolio?page=${page}`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderPortfolio(result.data)) console.log(line);
+  });
+  portfolio.command("findings").description("Problems repeated across your apps, SDK skew and integration holes").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/portfolio/findings`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderPortfolioFindings(result.data)) console.log(line);
+  });
+  portfolio.command("resources").description("Accounts, domains and buckets shared between your apps, and their open findings").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/portfolio/resources`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderPortfolioResources(result.data)) console.log(line);
+  });
+  portfolio.command("import <file>").description("Record shared resources from a CSV: kind,external_id,project[,role] (team owners and admins)").option(ORG_HELP, ORG_DESC).option("--json", "Machine-readable JSON output").action(async (file, opts) => {
+    const read = readTextFileCapped(file, MAX_RESOURCE_CSV_BYTES);
+    if (read.kind === "absent") throw new MushiCliError("E_INVALID_INPUT", `Cannot read ${file}.`);
+    if (read.kind === "too_large") throw new MushiCliError("E_INVALID_INPUT", `${file} is over 256 KB.`, "split it into several files");
+    const csv = read.text;
+    const organizationId = opts.org && opts.org !== "current" ? requireUuid(opts.org, "organization id") : "current";
+    const config = requireConfig();
+    const result = await apiCall(
+      "/v1/ingest/recipe/csv",
+      config,
+      { method: "POST", body: JSON.stringify({ organizationId, csv }) }
+    );
+    if (!result.ok) dieOrgError(result);
+    const r = result.data;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(r, null, 2));
+      return;
+    }
+    console.log(`Imported ${r.imported} row(s); ${r.errorCount} refused.`);
+    for (const e of r.errors) console.log(`  ${oneLine(e, 120)}`);
+    if (r.errorCount > r.errors.length) console.log(`  \u2026 ${r.errorCount - r.errors.length} more`);
+    if (r.skippedOverLimit > 0) console.log(`  ${r.skippedOverLimit} row(s) past the 500-row limit were not read; import them in a second file.`);
+  });
+}
+
+// src/commands/connectors.ts
+function renderConnectorList(data) {
+  const lines = [];
+  if (data.instances.length === 0 && data.legacy.length === 0) {
+    lines.push("No connectors yet. Add one in the console: Portfolio \u2192 Connectors.");
+  }
+  for (const i of data.instances) {
+    const status = (i.status ?? "unknown").toUpperCase();
+    lines.push(`  ${status.padEnd(10)} ${i.kind.padEnd(18)} ${oneLine(i.display_name ?? "", 30).padEnd(30)} ${i.id}`);
+    if (i.status_reason || i.last_error) lines.push(`             ${oneLine(i.status_reason ?? i.last_error, 110)}`);
+  }
+  if (data.legacy.length > 0) {
+    lines.push("Project integrations read as connectors:");
+    for (const l of data.legacy) {
+      lines.push(`  ${(l.ok ? "OK" : "ERROR").padEnd(10)} ${l.kind.padEnd(18)} project ${l.project_id}  (seen ${fmtDate(l.observed_at)})`);
+      if (!l.ok && l.error) lines.push(`             ${oneLine(l.error, 110)}`);
+    }
+  }
+  const unused = data.available.filter((a) => !data.instances.some((i) => i.kind === a.kind));
+  if (unused.length > 0) lines.push(`Available to add: ${unused.map((a) => a.kind).join(", ")}`);
+  return lines;
+}
+function renderConnectorStatus(i) {
+  return [
+    `${i.kind} \u2014 ${oneLine(i.display_name ?? "(no name)", 60)}`,
+    `  id:            ${i.id}`,
+    `  status:        ${i.status ?? "unknown"}${i.status_reason ? ` (${oneLine(i.status_reason, 100)})` : ""}`,
+    `  last probe:    ${fmtDate(i.last_probe_at)}`,
+    `  last OK:       ${fmtDate(i.last_ok_at)}`,
+    `  last error:    ${i.last_error ? oneLine(i.last_error, 100) : "\u2014"}`,
+    `  capabilities:  ${(i.enabled_capabilities ?? []).join(", ") || "\u2014"}`,
+    `  scopes:        ${(i.granted_scopes ?? []).join(", ") || "\u2014"}`,
+    `  bound apps:    ${i.bindings.length ? i.bindings.map((b) => `${b.projectId} (${b.role} ${b.externalId})`).join(", ") : "\u2014"}`
+  ];
+}
+function renderConnectorActions(actions) {
+  if (actions.length === 0) return ["No connector actions requested."];
+  const lines = [];
+  for (const a of actions) {
+    lines.push(`  ${a.status.toUpperCase().padEnd(17)} ${a.action.padEnd(24)} requested ${fmtDate(a.requested_at)}  ${a.id}`);
+    if (a.reason) lines.push(`      why: ${oneLine(a.reason, 100)}`);
+    if (a.error) lines.push(`      error: ${oneLine(a.error, 100)}`);
+  }
+  if (actions.some((a) => a.status === "pending_approval")) lines.push("A team owner or admin approves pending actions in the console.");
+  return lines;
+}
+async function loadConnectors(org) {
+  const config = requireConfig();
+  const result = await apiCall(`/v1/admin/orgs/${orgSegment(org)}/connectors`, config);
+  if (!result.ok) dieOrgError(result);
+  return result.data;
+}
+function registerConnectorsCommands(program2) {
+  const connectors = program2.command("connectors").description("Your team's connectors (read-only; add or edit them in the console)");
+  connectors.command("list").description("Every connector with its status and last error").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const data = await loadConnectors(opts.org);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(data, null, 2));
+      return;
+    }
+    for (const line of renderConnectorList(data)) console.log(line);
+  });
+  connectors.command("status <connectorId>").description("One connector: status, last probe, last error, bound apps").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (connectorId, opts) => {
+    const data = await loadConnectors(opts.org);
+    const exact = data.instances.find((i) => i.id === connectorId);
+    const matches = exact ? [exact] : data.instances.filter((i) => i.id.startsWith(connectorId));
+    if (matches.length !== 1) {
+      throw new MushiCliError(
+        "E_INVALID_INPUT",
+        matches.length === 0 ? `No connector ${connectorId} in this team.` : `${connectorId} matches ${matches.length} connectors.`,
+        "copy the full id from `mushi connectors list`"
+      );
+    }
+    const instance = matches[0];
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(instance, null, 2));
+      return;
+    }
+    for (const line of renderConnectorStatus(instance)) console.log(line);
+  });
+  connectors.command("actions").description("Actions requested on a connector and whether they were approved and run (latest 100)").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/connector-actions`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderConnectorActions(result.data.actions)) console.log(line);
+  });
+}
+
+// src/commands/funnel.ts
+var EVENT_RE = /^[a-z][a-z0-9_]{1,63}$/;
+var WINDOWS = ["1d", "7d", "30d"];
+function parseFunnelSteps(raw) {
+  const steps = raw.split(",").map((s) => s.trim()).filter(Boolean);
+  if (steps.length < 2 || steps.length > 8) {
+    throw new MushiCliError("E_INVALID_INPUT", "A funnel needs 2 to 8 steps.", "e.g. --steps signup,first_report,fix_merged");
+  }
+  const bad = steps.filter((s) => !EVENT_RE.test(s));
+  if (bad.length > 0) {
+    throw new MushiCliError("E_INVALID_INPUT", `Not an event name: ${bad.join(", ")}`, "event names are lowercase letters, digits and _");
+  }
+  if (new Set(steps).size !== steps.length) {
+    throw new MushiCliError("E_INVALID_INPUT", "Each step must be a different event.");
+  }
+  return steps;
+}
+function renderOrgFunnel(data) {
+  if (data.state === "not_set_up" || !data.definition) {
+    return ["No team funnel yet. Set one with: mushi funnel set --steps signup,first_report,fix_merged"];
+  }
+  const d = data.definition;
+  const lines = [`Funnel: ${d.steps.join(" \u2192 ")}  (window ${d.window}, last ${d.lookbackDays} days)`];
+  for (const r of data.rows) {
+    const label = oneLine(r.name, 30).padEnd(30);
+    if (r.state === "off") lines.push(`  ${label} product events are off`);
+    else if (r.state === "error") lines.push(`  ${label} could not be read`);
+    else if (r.state === "no_events") lines.push(`  ${label} nobody entered the first step yet`);
+    else lines.push(`  ${label} ${String(r.overallPct ?? 0).padStart(5)}%  ${r.steps.map((s) => `${s.name} ${s.converted}`).join(" \u2192 ")}`);
+  }
+  return lines;
+}
+function renderGrowthFunnel(data) {
+  const lines = [`Growth funnel (${data.source}) ${data.window_start ?? "\u2014"} \u2192 ${data.window_end ?? "\u2014"}`];
+  if (!data.self_project_configured) lines.push("  Note: the self-analytics project is not configured, so product steps may read zero.");
+  if (data.weeks.length === 0) lines.push("  No weeks in this window.");
+  for (const w of data.weeks) {
+    const week = String(w["week"] ?? w["week_start"] ?? "");
+    const rest = Object.entries(w).filter(([k]) => k !== "week" && k !== "week_start").map(([k, v]) => `${k} ${String(v)}`).join(" \xB7 ");
+    lines.push(`  ${week.padEnd(12)} ${rest}`);
+  }
+  return lines;
+}
+function registerFunnelCommands(program2) {
+  const funnel = program2.command("funnel").description("One funnel across every app in your team (needs an account-level key)");
+  funnel.command("show").description("Conversion per app for the team funnel").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/funnel`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderOrgFunnel(result.data)) console.log(line);
+  });
+  funnel.command("set").description("Set the team funnel's steps (team owners and admins)").requiredOption("--steps <events>", "Comma-separated event names, 2 to 8, in order").option("--window <w>", `Conversion window: ${WINDOWS.join(" | ")}`, "7d").option("--lookback <days>", "Days of history to read (1-365)", "30").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const steps = parseFunnelSteps(opts.steps);
+    if (!WINDOWS.includes(opts.window)) {
+      throw new MushiCliError("E_INVALID_INPUT", `--window must be one of ${WINDOWS.join(", ")}`);
+    }
+    const lookbackDays = Number(opts.lookback);
+    if (!Number.isInteger(lookbackDays) || lookbackDays < 1 || lookbackDays > 365) {
+      throw new MushiCliError("E_INVALID_INPUT", "--lookback must be a whole number of days from 1 to 365");
+    }
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/funnel`,
+      config,
+      { method: "PUT", body: JSON.stringify({ steps, window: opts.window, lookbackDays }) }
+    );
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Saved: ${result.data.steps.join(" \u2192 ")} (window ${result.data.window}, last ${result.data.lookbackDays} days)`);
+  });
+  funnel.command("growth").description("Mushi's own weekly growth funnel (operators only)").option("--weeks <n>", "Weeks to show", "8").option("--source <source>", "Signup source, or all", "all").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const qs = new URLSearchParams({ weeks: opts.weeks, source: opts.source });
+    const result = await apiCall(`/v1/admin/growth/funnel?${qs}`, config);
+    if (!result.ok) {
+      if (result.error.code.endsWith("_NEEDS_ACCOUNT_KEY")) dieOrgError(result);
+      die(result);
+    }
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderGrowthFunnel(result.data)) console.log(line);
+  });
+}
+
+// src/commands/code-health.ts
+function renderCodeHealth(data) {
+  if (!data.latestRunAt) {
+    return [
+      "No code-health run yet. Post one from CI:",
+      "  POST /v1/ingest/metrics with metrics[] (bundle.*, code_health.*) and findings[]"
+    ];
+  }
+  const s = data.summary;
+  const lines = [
+    `Latest run ${fmtDate(data.latestRunAt)} (${data.latestRunStatus ?? "unknown"}): ${s.error_count} error(s), ${s.warn_count} warning(s)${s.max_loc != null ? ` \xB7 largest file ${s.max_loc} lines` : ""}${s.latest_bundle_kb != null ? ` \xB7 bundle ${s.latest_bundle_kb} KB gzip` : ""}`
+  ];
+  for (const f of data.godFiles) {
+    const where = f.file_path ? `${f.file_path}${f.line ? `:${f.line}` : ""}` : "(no file)";
+    lines.push(`  ${f.severity.toUpperCase().padEnd(5)} ${where}`);
+    lines.push(`        ${oneLine(f.message, 110)}  [${f.id}]`);
+  }
+  if (data.godFiles.length > 0) lines.push("Explain one: mushi audit explain <finding id>");
+  return lines;
+}
+function registerCodeHealthCommands(program2) {
+  const codeHealth = program2.command("code-health").description("Oversized files and bundle size from your CI (Code Health page)");
+  codeHealth.command("show").description("Findings from the latest code-health run and the size summary").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--days <n>", "Trend window in days (1-365)", "30").option("--json", "Machine-readable JSON output (includes the trend series)").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const qs = new URLSearchParams({ project_id: projectId, days: opts.days });
+    const result = await apiCall(`/v1/admin/code-health?${qs}`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderCodeHealth(result.data)) console.log(line);
+  });
+  codeHealth.command("stats").description("Counts only: errors, warnings and oversized files").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(
+      `/v1/admin/code-health/stats?${new URLSearchParams({ project_id: projectId })}`,
+      config
+    );
+    if (!result.ok) die(result);
+    const d = result.data;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(d, null, 2));
+      return;
+    }
+    if (!d.hasRun) {
+      console.log("No code-health run yet.");
+      return;
+    }
+    console.log(`${d.projectName ?? projectId}: ${d.errorCount} error(s), ${d.warnCount} warning(s), ${d.godFileCount} oversized file(s) \xB7 last run ${fmtDate(d.latestRunAt)}`);
+    if (d.topPriorityLabel) console.log(`Next: ${d.topPriorityLabel}`);
+  });
+}
+
+// src/commands/releases.ts
+import { readFileSync as readFileSync6 } from "fs";
+var DRAFT_TIMEOUT_MS = 12e4;
+var PUBLISH_TIMEOUT_MS = 6e4;
+function renderReleaseList(rows, total) {
+  if (rows.length === 0) return ["No releases yet. Draft one with: mushi releases draft 1.2.0"];
+  const lines = [`${pad("VERSION", 12)}${pad("STATUS", 11)}${pad("FIXES", 7)}${pad("CREATED", 18)}ID`];
+  for (const r of rows) {
+    lines.push(`${pad(r.version, 12)}${pad(r.status, 11)}${pad(String(r.fixed_report_ids?.length ?? 0), 7)}${pad(fmtDate(r.created_at), 18)}${r.id}`);
+  }
+  if (total > rows.length) lines.push(`\u2026 ${total - rows.length} more (use --limit / --offset)`);
+  return lines;
+}
+function renderPublish(release, delivery, ticketsFulfilled) {
+  const lines = [`Published ${release.version}.`];
+  if (delivery) {
+    lines.push(`  Reports resolved: ${delivery.reports_resolved} of ${delivery.reports_listed}`);
+    lines.push(`  Reporters messaged: ${delivery.reporters_notified}, held for review: ${delivery.reporters_held}, failed: ${delivery.reporters_failed}`);
+    if (delivery.reporters_held > 0) lines.push("  Held messages wait in the outbox: mushi outbox list");
+  }
+  if (ticketsFulfilled) lines.push(`  Support tickets marked shipped: ${ticketsFulfilled}`);
+  return lines;
+}
+function renderCalendar(data) {
+  if (data.rows.length === 0) return ["No apps in this team yet."];
+  const lines = [];
+  for (const r of data.rows) {
+    const live = r.live ? `live ${r.live.version}${r.live.rolloutPct != null && r.live.rolloutPct < 100 ? ` at ${r.live.rolloutPct}%` : ""}` : "not live yet";
+    lines.push(`  ${pad(r.stage, 18)} ${pad(oneLine(r.name, 28), 29)} ${live} \xB7 ${r.mergedNotBuilt} native change(s) to build \xB7 ${r.otaPending} OTA fix(es)`);
+  }
+  if (data.batchSuggestion) lines.push(data.batchSuggestion.note);
+  if (data.note) lines.push(data.note);
+  return lines;
+}
+function readBody(path) {
+  if (!path) return void 0;
+  try {
+    return readFileSync6(path, "utf8");
+  } catch (err) {
+    throw new MushiCliError("E_FILE_NOT_FOUND", `Could not read ${path}`, "pass a Markdown file you can read", err);
+  }
+}
+function registerReleasesCommands(program2) {
+  const releases = program2.command("releases").description("Release notes that credit your reporters and tell them the fix shipped");
+  releases.command("list").description("Drafts and published releases, newest first").option("--status <status>", "draft | published").option("--project-id <id>", "Only this project").option("--limit <n>", "How many (max 100)", "20").option("--offset <n>", "Skip this many", "0").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    if (opts.status && opts.status !== "draft" && opts.status !== "published") {
+      throw new MushiCliError("E_INVALID_INPUT", "--status must be draft or published");
+    }
+    const config = requireConfig();
+    const qs = new URLSearchParams({ limit: opts.limit, offset: opts.offset });
+    if (opts.status) qs.set("status", opts.status);
+    if (opts.projectId) qs.set("project_id", requireUuid(opts.projectId, "project id"));
+    const result = await apiCall(`/v1/admin/releases?${qs}`, config);
+    if (!result.ok) die(result);
+    const total = Number(result.meta?.total ?? result.data.length);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify({ releases: result.data, total }, null, 2));
+      return;
+    }
+    for (const line of renderReleaseList(result.data, total)) console.log(line);
+  });
+  releases.command("stats").description("Drafts, published releases, credited reporters and what to do next").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall("/v1/admin/releases/stats", config);
+    if (!result.ok) die(result);
+    const d = result.data;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(d, null, 2));
+      return;
+    }
+    console.log(`Releases: ${String(d["draftCount"] ?? 0)} draft, ${String(d["publishedCount"] ?? 0)} published \xB7 fixes linked ${String(d["totalFixesLinked"] ?? 0)} \xB7 reporters credited ${String(d["totalCredits"] ?? 0)} (${String(d["creditsPending"] ?? 0)} not told yet)`);
+    if (typeof d["topPriorityLabel"] === "string") console.log(`Next: ${d["topPriorityLabel"]}`);
+  });
+  releases.command("show <releaseId>").description("One release with its notes and credited reporters").option("--json", "Machine-readable JSON output").action(async (releaseId, opts) => {
+    const id = requireUuid(releaseId, "release id");
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/releases/${id}`, config);
+    if (!result.ok) die(result);
+    const r = result.data;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(r, null, 2));
+      return;
+    }
+    console.log(`${r.version} \u2014 ${oneLine(r.title ?? "(untitled)", 80)} [${r.status}${r.published_at ? ` ${fmtDate(r.published_at)}` : ""}]`);
+    console.log(`Fixed reports: ${r.fixed_report_ids?.length ?? 0} \xB7 credited reporters: ${r.credits?.length ?? 0}`);
+    if (r.body_md) console.log(`
+${r.body_md}`);
+  });
+  releases.command("draft <version>").description("Draft notes from the fixes merged in a window (nothing is sent)").option("--title <title>", "Release title").option("--since <iso>", "Window start (ISO date); default: since the last release").option("--until <iso>", "Window end (ISO date); default: now").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (version, opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const body = { project_id: projectId, version };
+    if (opts.title) body["title"] = opts.title;
+    if (opts.since) body["window_start"] = opts.since;
+    if (opts.until) body["window_end"] = opts.until;
+    const result = await apiCall("/v1/admin/releases/draft", config, { method: "POST", body: JSON.stringify(body) }, { timeoutMs: DRAFT_TIMEOUT_MS });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    const r = result.data.release;
+    console.log(`Drafted ${r.version} (${r.id}) from ${result.data.reportCount} fixed report(s), crediting ${result.data.creditCount} reporter(s).`);
+    console.log(`Review it with \`mushi releases show ${r.id}\`, then: mushi releases publish ${r.id} --yes`);
+  });
+  releases.command("edit <releaseId>").description("Change a draft: title, version or notes").option("--title <title>", "New title").option("--set-version <version>", "New version").option("--body-file <path>", "Replace the notes with this Markdown file").option("--json", "Machine-readable JSON output").action(async (releaseId, opts) => {
+    const id = requireUuid(releaseId, "release id");
+    const patch = {};
+    if (opts.title) patch["title"] = opts.title;
+    if (opts.setVersion) patch["version"] = opts.setVersion;
+    const bodyMd = readBody(opts.bodyFile);
+    if (bodyMd !== void 0) patch["body_md"] = bodyMd;
+    if (Object.keys(patch).length === 0) {
+      throw new MushiCliError("E_INVALID_INPUT", "Nothing to change.", "pass --title, --set-version or --body-file");
+    }
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/releases/${id}`, config, { method: "PATCH", body: JSON.stringify(patch) });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Saved draft ${result.data.version}.`);
+  });
+  releases.command("delete <releaseId>").description("Delete a draft (published releases cannot be deleted)").option("--yes", "Confirm the delete").action(async (releaseId, opts) => {
+    const id = requireUuid(releaseId, "release id");
+    requireYes(opts.yes, `This deletes draft release ${id}.`);
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/releases/${id}`, config, { method: "DELETE" });
+    if (!result.ok) die(result);
+    console.log(`Deleted draft ${id}.`);
+  });
+  releases.command("publish <releaseId>").description("Publish a draft: resolves its fixed reports and messages each credited reporter").option("--yes", "Confirm: reporters are messaged (or held for review)").option("--json", "Machine-readable JSON output").action(async (releaseId, opts) => {
+    const id = requireUuid(releaseId, "release id");
+    requireYes(opts.yes, `Publishing ${id} tells every credited reporter their fix shipped.`);
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/releases/${id}/publish`, config, { method: "POST", body: "{}" }, { timeoutMs: PUBLISH_TIMEOUT_MS });
+    if (!result.ok) die(result);
+    const extra = result;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify({ release: extra.data, notified: extra.notified, tickets_fulfilled: extra.tickets_fulfilled, delivery: extra.delivery }, null, 2));
+      return;
+    }
+    for (const line of renderPublish(extra.data, extra.delivery, extra.tickets_fulfilled)) console.log(line);
+  });
+  releases.command("auto-release").description("The automatic draft that blocks auto-release for a project, if any").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/releases/auto-release?project_id=${pid}`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    const d = result.data.blockingDraft;
+    if (!d) {
+      console.log("Nothing blocks auto-release: no automatic draft is waiting.");
+      return;
+    }
+    console.log(`Auto-release is blocked by draft ${d.version} (${d.id}), created ${fmtDate(d.createdAt)}${d.stale ? ", stale" : ""}.`);
+    console.log(`Publish it (mushi releases publish ${d.id} --yes) or delete it (mushi releases delete ${d.id} --yes) to let the next build release.`);
+  });
+  releases.command("calendar").description("What is waiting to ship in each app, and one suggested batch (needs an account-level key)").option("--org <id>", "Organization UUID (default: your only organization)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/releases`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderCalendar(result.data)) console.log(line);
+  });
+}
+
+// src/commands/sentry.ts
+var IMPORT_TIMEOUT_MS = 9e4;
+function buildSentryImportBody(issueIds, flags) {
+  const body = {};
+  if (issueIds.length > 0) {
+    if (issueIds.length > 10) throw new MushiCliError("E_INVALID_INPUT", "Import at most 10 issue ids at a time.");
+    if (flags.query || flags.cursor || flags.sinceDays || flags.sentryProject) {
+      throw new MushiCliError("E_INVALID_INPUT", "Pass issue ids or a search (--query / --since-days / --cursor / --sentry-project), not both.");
+    }
+    body["issueIds"] = issueIds;
+  }
+  if (flags.query) body["query"] = flags.query;
+  if (flags.limit !== void 0) {
+    const n = Number(flags.limit);
+    if (!Number.isInteger(n) || n < 1 || n > 10) throw new MushiCliError("E_INVALID_INPUT", "--limit must be 1 to 10");
+    body["limit"] = n;
+  }
+  if (flags.sinceDays !== void 0) {
+    const n = Number(flags.sinceDays);
+    if (!Number.isInteger(n) || n < 1 || n > 90) throw new MushiCliError("E_INVALID_INPUT", "--since-days must be 1 to 90");
+    body["sinceDays"] = n;
+  }
+  if (flags.cursor) body["cursor"] = flags.cursor;
+  if (flags.sentryProject) body["sentryProject"] = flags.sentryProject;
+  return body;
+}
+function nextPageCommand(flags, cursor) {
+  const parts = ["mushi sentry import"];
+  if (flags.query) parts.push(`--query ${JSON.stringify(flags.query)}`);
+  if (flags.sinceDays) parts.push(`--since-days ${flags.sinceDays}`);
+  if (flags.limit) parts.push(`--limit ${flags.limit}`);
+  if (flags.sentryProject) parts.push(`--sentry-project ${flags.sentryProject}`);
+  parts.push(`--cursor ${cursor}`);
+  return parts.join(" ");
+}
+function renderSentryImport(data, flags = {}) {
+  const lines = [`Sentry project: ${data.sentryProject ?? data.sentryProjects.join(", ")}`];
+  if (data.items.length === 0) lines.push("  No matching issues.");
+  for (const i of data.items) {
+    const label = i.shortId ?? i.issueId ?? i.input;
+    const tail = i.reportId ? ` \u2192 report ${i.reportId}` : i.error ? ` \u2014 ${i.error}` : "";
+    lines.push(`  ${i.outcome.toUpperCase().padEnd(10)} ${label}${tail}`);
+  }
+  lines.push(`New reports: ${data.created.length} \xB7 linked to existing: ${data.linked.length} \xB7 failed: ${data.failed}`);
+  if (data.indexing.queued && data.indexing.paths > 0) lines.push(`Indexing ${data.indexing.paths} file(s) from the stack traces so the fix context can reach them.`);
+  if (data.nextCursor) lines.push(`More issues: ${nextPageCommand(flags, data.nextCursor)}`);
+  return lines;
+}
+function registerSentryCommands(program2) {
+  const sentry = program2.command("sentry").description("Sentry issues in your Mushi queue");
+  sentry.command("import [issueIds...]").description("Import open Sentry issues as reports (by id, by search, or the newest unresolved)").option("--query <q>", 'Sentry search, e.g. "is:unresolved level:error"').option("--limit <n>", "Issues per page, 1-10").option("--since-days <n>", "Only issues seen in the last N days (1-90)").option("--cursor <cursor>", "Next page, from the previous import").option("--sentry-project <slug>", "Which connected Sentry project (default: the primary)").option("--project-id <id>", "Mushi project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").addHelpText("after", `
+Needs the Sentry org slug, project slug and an auth token with event:read and
+project:read (console: Integrations \u2192 Sentry). With no ids and no --query it
+imports the newest unresolved issues.
+
+Examples:
+  mushi sentry import
+  mushi sentry import PROJ-1A2 PROJ-1A3
+  mushi sentry import --query "is:unresolved level:error" --since-days 7`).action(async (issueIds, opts) => {
+    const body = buildSentryImportBody(issueIds, opts);
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(
+      `/v1/admin/projects/${projectId}/sentry/import`,
+      config,
+      { method: "POST", body: JSON.stringify(body) },
+      { timeoutMs: IMPORT_TIMEOUT_MS }
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderSentryImport(result.data, opts)) console.log(line);
+    if (result.data.failed > 0) process.exitCode = 1;
+  });
+}
+
+// src/commands/outbox.ts
+var OUTBOX_TEXT_MAX = 1e3;
+function validateOutboxText(text2) {
+  const trimmed = text2.trim();
+  if (!trimmed || trimmed.length > OUTBOX_TEXT_MAX) {
+    throw new MushiCliError("E_INVALID_INPUT", `The message must be 1 to ${OUTBOX_TEXT_MAX} characters.`);
+  }
+  return trimmed;
+}
+function renderOutbox(messages) {
+  if (messages.length === 0) return ["Nothing held. Every reporter update has gone out."];
+  const lines = [`${messages.length} update(s) waiting for review:`];
+  for (const m of messages) {
+    lines.push(`  ${m.id}  ${m.notification_type}  ${fmtDate(m.created_at)}`);
+    if (m.report_title) lines.push(`      report: ${oneLine(m.report_title, 90)}`);
+    lines.push(`      sends:  ${oneLine(m.body_override ?? m.text, 200)}${m.body_override ? "  (edited)" : ""}`);
+  }
+  lines.push("Send one: mushi outbox release <id> --yes   \xB7   drop one: mushi outbox discard <id> --yes");
+  return lines;
+}
+function renderHeld(verb, d) {
+  return `${verb}: delivered ${d.delivered}, skipped ${d.skipped}, duplicate ${d.duplicate}, failed ${d.failed}.`;
+}
+function registerOutboxCommands(program2) {
+  const outbox = program2.command("outbox").description("Reporter updates held for your review before they are sent");
+  outbox.command("list").description("Updates waiting for review, oldest first").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall("/v1/admin/reporter-outbox", config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderOutbox(result.data.messages)) console.log(line);
+  });
+  outbox.command("edit <messageId> <text>").description("Reword a held update (it stays held)").action(async (messageId, text2) => {
+    const id = requireUuid(messageId, "message id");
+    const body = validateOutboxText(text2);
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/reporter-outbox/${id}`,
+      config,
+      { method: "PATCH", body: JSON.stringify({ body_override: body }) }
+    );
+    if (!result.ok) die(result);
+    console.log(`Saved. Still held; send it with: mushi outbox release ${id} --yes`);
+  });
+  outbox.command("release <messageId>").description("Send a held update to the reporter now").option("--text <text>", "Send this wording instead").option("--yes", "Confirm: the reporter receives it").option("--json", "Machine-readable JSON output").action(async (messageId, opts) => {
+    const id = requireUuid(messageId, "message id");
+    const override = opts.text !== void 0 ? validateOutboxText(opts.text) : void 0;
+    requireYes(opts.yes, `Releasing ${id} sends it to the reporter.`);
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/reporter-outbox/${id}/release`,
+      config,
+      { method: "POST", body: JSON.stringify(override ? { body_override: override } : {}) }
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(renderHeld("Released", result.data));
+    if (result.data.failed > 0) process.exitCode = 1;
+  });
+  outbox.command("discard <messageId>").description("Drop a held update; the reporter never sees it").option("--yes", "Confirm the discard").option("--json", "Machine-readable JSON output").action(async (messageId, opts) => {
+    const id = requireUuid(messageId, "message id");
+    requireYes(opts.yes, `Discarding ${id} means the reporter never gets this update.`);
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/reporter-outbox/${id}/discard`, config, { method: "POST", body: "{}" });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Discarded ${id}.`);
+  });
+}
+
+// src/commands/budgets.ts
+var SPEND_LIMIT_FIELDS = [
+  "monthly_llm_budget_usd",
+  "autofix_max_spend_usd",
+  "autofix_max_dispatches_per_day",
+  "autofix_approval_cost_threshold_usd"
+];
+var LABELS = {
+  monthly_llm_budget_usd: { label: "Monthly AI budget", unit: "usd", none: "no budget" },
+  autofix_max_spend_usd: { label: "Auto-fix spend limit, last 30 days", unit: "usd", none: "no limit" },
+  autofix_max_dispatches_per_day: { label: "Automatic fixes per day", unit: "count", none: "no limit" },
+  autofix_approval_cost_threshold_usd: { label: "Ask before fixes costing more than", unit: "usd", none: "never ask" }
+};
+function numberOrNull(v) {
+  if (v === null || v === void 0 || v === "") return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+}
+function pickLimits(settings) {
+  return Object.fromEntries(SPEND_LIMIT_FIELDS.map((f) => [f, numberOrNull(settings[f])]));
+}
+function renderBudgets(view) {
+  const lines = [`Spend limits for project ${view.projectId}`];
+  for (const f of SPEND_LIMIT_FIELDS) {
+    const meta = LABELS[f];
+    const v = view.limits[f];
+    const shown = v === null ? meta.none : meta.unit === "usd" ? `$${v}` : String(v);
+    lines.push(`  ${meta.label.padEnd(36)} ${shown}`);
+  }
+  lines.push(`  ${"Plan spend cap (per month)".padEnd(36)} ${view.monthlySpendCapUsd == null ? "no cap" : `$${view.monthlySpendCapUsd}`}`);
+  lines.push(`  ${"Auto-fix".padEnd(36)} ${view.autofixEnabled ? "on" : "off"}`);
+  if (view.autofixEnabled && view.limits.autofix_max_spend_usd === null && view.limits.autofix_max_dispatches_per_day === null) {
+    lines.push("  Auto-fix is on with no cap. Set one in the console: Settings \u2192 General \u2192 Spend limits.");
+  }
+  lines.push("Change the plan cap: mushi billing cap <usd>. Change the other limits: console Settings \u2192 General \u2192 Spend limits.");
+  return lines;
+}
+function registerBudgetsCommands(program2) {
+  const budgets = program2.command("budgets").description("What Mushi may spend for a project: AI budget, auto-fix caps, plan spend cap");
+  budgets.command("show").description("Every spend limit and whether auto-fix is on").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const qs = new URLSearchParams({ project_id: projectId });
+    const [settings, billing, autofix] = await Promise.all([
+      apiCall(`/v1/admin/settings?${qs}`, config),
+      apiCall(`/v1/admin/billing/stats?${qs}`, config),
+      apiCall(`/v1/admin/projects/${projectId}/autofix`, config)
+    ]);
+    if (!settings.ok) die(settings);
+    if (!billing.ok) die(billing);
+    if (!autofix.ok) die(autofix);
+    const view = {
+      projectId,
+      limits: pickLimits(settings.data),
+      monthlySpendCapUsd: billing.data.monthlySpendCapUsd ?? null,
+      autofixEnabled: autofix.data.autofix_enabled
+    };
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(view, null, 2));
+      return;
+    }
+    for (const line of renderBudgets(view)) console.log(line);
+  });
+  budgets.command("autofix <state>").description("Turn auto-fix on or off (on | off). Fixes you start yourself always run.").option("--project-id <id>", "Project ID (defaults to the configured project)").action(async (state, opts) => {
+    if (state !== "on" && state !== "off") {
+      throw new MushiCliError("E_INVALID_INPUT", "Pass on or off.", "e.g. mushi budgets autofix off");
+    }
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(
+      `/v1/admin/projects/${projectId}/autofix/toggle`,
+      config,
+      { method: "POST", body: JSON.stringify({ enabled: state === "on" }) }
+    );
+    if (!result.ok) die(result);
+    console.log(`Auto-fix is ${result.data.autofix_enabled ? "on" : "off"} for project ${projectId}.`);
+  });
+}
+
+// src/commands/repo.ts
+var DIGEST_TIMEOUT_MS = 9e4;
+var MAX_DIGEST_FILE_BYTES = 16 * 1024 * 1024;
+var DIAGRAM_TIMEOUT_MS = 12e4;
+var PUBLISH_TIMEOUT_MS2 = 6e4;
+function digestQuery(opts) {
+  const qs = new URLSearchParams();
+  if (opts.report) qs.set("report_id", requireUuid(opts.report, "report id"));
+  if (opts.path) qs.set("path", opts.path);
+  if (opts.ref) qs.set("ref", opts.ref);
+  if (opts.budget) qs.set("budget", opts.budget);
+  if (opts.include) qs.set("include", opts.include);
+  if (opts.exclude) qs.set("exclude", opts.exclude);
+  return qs;
+}
+function digestSummary(d) {
+  const dropped = Object.entries(d.dropped_counts).filter(([, n]) => n > 0).map(([why, n]) => `${n} ${why}`).join(", ");
+  const lines = [
+    `${d.owner}/${d.repo}@${d.sha.slice(0, 7)} (${d.ref}) \u2014 ${d.scope.label}`,
+    `  ${d.files.length} of ${d.eligible_files} files, ~${d.total_tokens} of ${d.budget_tokens} tokens${d.cached ? " (cached)" : ""}`
+  ];
+  if (dropped) lines.push(`  left out: ${dropped}`);
+  if (d.redacted.length > 0) lines.push(`  secrets removed from ${d.redacted.length} file(s)`);
+  if (d.tree_truncated) lines.push("  GitHub returned a partial tree (very large repo): some paths are missing.");
+  return lines;
+}
+function renderDiagram(data) {
+  const d = data.diagram;
+  if (!d) return ["No diagram yet. Make one with: mushi repo diagram generate"];
+  const lines = [`${d.repo_owner}/${d.repo_name}@${d.commit_sha.slice(0, 7)} \u2014 updated ${fmtDate(d.updated_at)}${d.model ? ` by ${d.model}` : ""}`];
+  for (const g of d.graph.groups) {
+    const parts = d.graph.nodes.filter((n) => n.group === g.id);
+    lines.push(`  ${oneLine(g.label, 40)}`);
+    for (const n of parts) lines.push(`    - ${oneLine(n.label, 40)}${n.path ? `  (${n.path})` : ""}`);
+  }
+  lines.push(`  ${d.graph.edges.length} connection(s)`);
+  lines.push(data.publication.published ? `Public page: ${data.publication.url}` : "Not published. Publish it with: mushi repo diagram publish --yes");
+  return lines;
+}
+function registerRepoCommands(program2) {
+  const repo = program2.command("repo").description("Your connected GitHub repo: a digest for an LLM and an architecture diagram");
+  repo.command("digest").description("One token-budgeted text of the repo (tree + the files that matter), secrets removed").option("--report <id>", "Start from the files linked to this report's stack trace and fixes").option("--path <folder>", "Only this folder").option("--ref <ref>", "Branch, tag or commit (default: the default branch)").option("--budget <tokens>", "Token budget").option("--include <globs>", "Comma-separated globs a file must match").option("--exclude <globs>", "Comma-separated globs to leave out").option("--out <file>", "Write the digest text to this file instead of stdout").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output (metadata and text)").action(async (opts) => {
+    const qs = digestQuery(opts);
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const suffix = qs.toString() ? `?${qs}` : "";
+    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/digest${suffix}`, config, {}, { timeoutMs: DIGEST_TIMEOUT_MS });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    if (opts.out) {
+      writeUserOutputFile(opts.out, result.data.text, { maxBytes: MAX_DIGEST_FILE_BYTES });
+      for (const line of digestSummary(result.data)) console.log(line);
+      console.log(`Wrote ${opts.out}.`);
+      return;
+    }
+    for (const line of digestSummary(result.data)) process.stderr.write(`${line}
+`);
+    process.stdout.write(result.data.text.endsWith("\n") ? result.data.text : `${result.data.text}
+`);
+  });
+  const diagram = repo.command("diagram").description("The architecture diagram of your repo");
+  diagram.command("show").description("The latest diagram as an outline, and its public page if published").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderDiagram(result.data)) console.log(line);
+  });
+  diagram.command("generate").description("Draw the diagram for the latest commit (reuses the one for that commit unless --force)").option("--force", "Draw it again even if this commit already has one").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(
+      `/v1/admin/projects/${projectId}/codebase/diagram`,
+      config,
+      { method: "POST", body: JSON.stringify({ force: opts.force === true }) },
+      { timeoutMs: DIAGRAM_TIMEOUT_MS }
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    if (result.data.reused) console.log("This commit already has a diagram (pass --force to draw it again).");
+    for (const line of renderDiagram(result.data)) console.log(line);
+  });
+  diagram.command("publish").description("Publish the latest diagram as a public page (project owners and admins)").option("--yes", "Confirm: the diagram becomes public").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const preview = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram/publish-preview`, config);
+    if (!preview.ok) die(preview);
+    const p3 = preview.data;
+    if (!p3.can_publish) {
+      throw new MushiCliError("E_INVALID_INPUT", p3.publish_blocked_reason ?? "This diagram cannot be published.", "publish it from the console instead");
+    }
+    console.log(`Will publish to ${p3.url}${p3.repo_private ? " (the repo is private on GitHub)" : ""}.`);
+    requireYes(opts.yes, "Publishing makes the diagram public.");
+    const result = await apiCall(
+      `/v1/admin/projects/${projectId}/codebase/diagram/publish`,
+      config,
+      { method: "POST", body: JSON.stringify({ diagram_id: p3.diagram_id, payload_hash: p3.payload_hash }) },
+      { timeoutMs: PUBLISH_TIMEOUT_MS2 }
+    );
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Published: ${result.data.url}`);
+    console.log(`README badge: ${result.data.badge_markdown}`);
+  });
+  diagram.command("unpublish").description("Take the public diagram page down").option("--yes", "Confirm the unpublish").option("--project-id <id>", "Project ID (defaults to the configured project)").action(async (opts) => {
+    requireYes(opts.yes, "This removes the public diagram page.");
+    const config = requireConfig();
+    const projectId = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${projectId}/codebase/diagram/publish`, config, { method: "DELETE" });
+    if (!result.ok) die(result);
+    console.log("The public diagram page is down.");
+  });
+}
+
+// src/commands/accounts.ts
+var MAX_EXPORT_FILE_BYTES = 8 * 1024 * 1024;
+var PROVIDERS = ["apple", "google_play", "aws", "supabase", "vercel", "registrar", "stripe", "github", "cloudflare", "other"];
+var ORG_FLAG = "--org <id>";
+var ORG_DESC2 = "Organization UUID (default: your only organization)";
+var tri = (v) => v === null ? "unknown" : v ? "yes" : "no";
+function parseTri(raw, flag) {
+  const v = raw.trim().toLowerCase();
+  if (v === "yes" || v === "true" || v === "on") return true;
+  if (v === "no" || v === "false" || v === "off") return false;
+  if (v === "unknown" || v === "null") return null;
+  throw new MushiCliError("E_INVALID_INPUT", `${flag} must be yes, no or unknown`);
+}
+function accountBody(opts) {
+  const body = {};
+  if (opts.provider !== void 0) {
+    if (!PROVIDERS.includes(opts.provider)) {
+      throw new MushiCliError("E_INVALID_INPUT", `--provider must be one of ${PROVIDERS.join(", ")}`);
+    }
+    body.provider = opts.provider;
+  }
+  if (opts.name !== void 0) body.displayName = opts.name;
+  if (opts.ownerEmail !== void 0) body.ownerEmail = opts.ownerEmail || null;
+  if (opts.twoFactor !== void 0) body.twoFactorDeclared = parseTri(opts.twoFactor, "--two-factor");
+  if (opts.recoveryContact !== void 0) body.recoveryContact = opts.recoveryContact || null;
+  if (opts.admins !== void 0) {
+    const n = Number(opts.admins);
+    if (!Number.isInteger(n) || n < 1 || n > 100) throw new MushiCliError("E_INVALID_INPUT", "--admins must be a whole number from 1 to 100");
+    body.adminCount = n;
+  }
+  if (opts.autoRenew !== void 0) body.autoRenew = parseTri(opts.autoRenew, "--auto-renew");
+  return body;
+}
+function renderRegister(data) {
+  const lines = [];
+  if (data.accounts.length === 0) lines.push('No accounts recorded yet. Add one with: mushi accounts add --provider apple --name "Your team"');
+  else {
+    lines.push("Accounts:");
+    for (const a of data.accounts) {
+      lines.push(`  ${a.provider.padEnd(12)} ${oneLine(a.name, 36).padEnd(36)} admins ${a.adminCount} \xB7 2FA ${tri(a.twoFactorDeclared)} \xB7 recovery ${a.recoveryContact ? "set" : "none"}  (${a.id})`);
+    }
+  }
+  if (data.domains.length > 0) {
+    lines.push("Domains your apps use:");
+    for (const d of data.domains) lines.push(`  ${oneLine(d.domain, 40).padEnd(40)} auto-renew ${tri(d.autoRenew)}  (${d.id})`);
+  }
+  if (data.findings.length > 0) {
+    lines.push("To fix:");
+    for (const f of data.findings) lines.push(`  ${f.severity.toUpperCase().padEnd(5)} ${f.ruleId} \u2014 ${oneLine(f.message, 110)}`);
+  }
+  if (!data.canEdit) lines.push("Read-only: only team owners and admins change the register.");
+  return lines;
+}
+function registerAccountsCommands(program2) {
+  const accounts = program2.command("accounts").description("The accounts and resilience register: who can get into each store, cloud and registrar account (needs an account-level key)");
+  accounts.command("list").description("Accounts, the domains your apps use, and what to fix").option(ORG_FLAG, ORG_DESC2).option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/accounts`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderRegister(result.data)) console.log(line);
+  });
+  accounts.command("export").description("The register as Markdown, to keep with your recovery notes").option(ORG_FLAG, ORG_DESC2).option("--out <file>", "Write to this file instead of stdout").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/accounts/export`, config, {}, { text: true });
+    if (!result.ok) dieOrgError(result);
+    if (opts.out) {
+      writeUserOutputFile(opts.out, result.data, { maxBytes: MAX_EXPORT_FILE_BYTES, mode: 384 });
+      console.log(`Wrote ${opts.out}.`);
+      return;
+    }
+    process.stdout.write(result.data.endsWith("\n") ? result.data : `${result.data}
+`);
+  });
+  const withAccountFlags = (cmd) => cmd.option("--provider <provider>", PROVIDERS.join(" | ")).option("--name <name>", "The account name, as the provider shows it").option("--owner-email <email>", "Who owns it (empty to clear)").option("--two-factor <state>", "yes | no | unknown").option("--recovery-contact <who>", "A person who can recover it, never a recovery code (empty to clear)").option("--admins <n>", "How many people can sign in as an admin").option("--auto-renew <state>", "yes | no | unknown").option(ORG_FLAG, ORG_DESC2).option("--json", "Machine-readable JSON output");
+  withAccountFlags(accounts.command("add").description("Record an account (team owners and admins)")).action(async (opts) => {
+    if (!opts.provider || !opts.name) throw new MushiCliError("E_INVALID_INPUT", "A new account needs --provider and --name.");
+    const body = accountBody(opts);
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/accounts`, config, { method: "POST", body: JSON.stringify(body) });
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Recorded ${opts.provider} account "${oneLine(opts.name, 60)}" (${result.data.id}).`);
+  });
+  withAccountFlags(accounts.command("edit <accountId>").description("Change a recorded account (team owners and admins)")).action(async (accountId, opts) => {
+    const id = requireUuid(accountId, "account id");
+    const body = accountBody(opts);
+    if (Object.keys(body).length === 0) throw new MushiCliError("E_INVALID_INPUT", "Nothing to change: pass at least one flag, such as --recovery-contact.");
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/accounts/${id}`, config, { method: "PATCH", body: JSON.stringify(body) });
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log(`Saved ${id}.`);
+  });
+  accounts.command("remove <accountId>").description("Take an account off the register (nothing changes at the provider)").option("--yes", "Confirm the removal").option(ORG_FLAG, ORG_DESC2).action(async (accountId, opts) => {
+    const id = requireUuid(accountId, "account id");
+    requireYes(opts.yes, "This removes the account from the register.");
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/accounts/${id}`, config, { method: "DELETE" });
+    if (!result.ok) dieOrgError(result);
+    console.log(`Removed ${id} from the register.`);
+  });
+  accounts.command("domain <domainId>").description("Declare whether a domain renews automatically (what you declare; nothing is checked at the registrar)").requiredOption("--auto-renew <state>", "yes | no | unknown").option(ORG_FLAG, ORG_DESC2).action(async (domainId, opts) => {
+    const id = requireUuid(domainId, "domain id");
+    const autoRenew = parseTri(opts.autoRenew, "--auto-renew");
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/domains/${id}`, config, { method: "PATCH", body: JSON.stringify({ autoRenew }) });
+    if (!result.ok) dieOrgError(result);
+    console.log(`Auto-renew for ${id}: ${tri(autoRenew)}.`);
+  });
+}
+
+// src/commands/spend.ts
+import { basename as basename2 } from "path";
+var VENDORS = ["vercel", "aws", "supabase", "other"];
+var MAX_BILL_CSV_BYTES = 5 * 1024 * 1024;
+var IMPORT_TIMEOUT_MS2 = 6e4;
+var usd = (n) => `$${(n ?? 0).toFixed(2)}`;
+var ORG_FLAG2 = "--org <id>";
+var ORG_DESC3 = "Organization UUID (default: your only organization)";
+function renderLedger(d) {
+  const lines = [`Spend ${d.from.slice(0, 10)} \u2192 ${d.to.slice(0, 10)} (${d.days} days): ${usd(d.totals.totalUsd)}`];
+  lines.push(`  Mushi AI ${usd(d.totals.mushiLlmUsd)} \xB7 provider AI ${usd(d.totals.providerLlmUsd)} \xB7 CI ${usd(d.totals.ciUsd)} \xB7 Supabase ${usd(d.totals.supabaseUsd)} \xB7 bills ${usd(d.totals.billsUsd)}`);
+  for (const a of [...d.apps].sort((x, y) => y.totalUsd - x.totalUsd)) lines.push(`  ${oneLine(a.name, 36).padEnd(36)} ${usd(a.totalUsd).padStart(10)}`);
+  if (d.unattributedProviderUsd) lines.push(`  Provider AI not bound to an app: ${usd(d.unattributedProviderUsd)}`);
+  if (!d.complete) lines.push("  Some sources could not be read; the totals are a floor.");
+  if (d.imports.length > 0) {
+    lines.push("Recent bill imports:");
+    for (const i of d.imports) lines.push(`  ${i.vendor.padEnd(9)} ${usd(i.totalUsd).padStart(10)}  ${i.periodStart ?? "\u2014"} \u2192 ${i.periodEnd ?? "\u2014"}  ${oneLine(i.filename ?? "", 30)}  ${fmtDate(i.createdAt)}  (${i.id})`);
+  }
+  return lines;
+}
+function registerSpendCommands(program2) {
+  const spend = program2.command("spend").description("What each app costs: Mushi AI, provider AI, CI, Supabase and imported bills (needs an account-level key)");
+  spend.command("show").description("The 30-day ledger per app, and the latest bill imports").option(ORG_FLAG2, ORG_DESC3).option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const result = await apiCall(`/v1/admin/orgs/${orgSegment(opts.org)}/spend`, config);
+    if (!result.ok) dieOrgError(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderLedger(result.data)) console.log(line);
+  });
+  spend.command("import <file>").description("Import a bill CSV (FOCUS, AWS CUR, or date,service,cost); a re-import of the same days replaces them").requiredOption("--vendor <vendor>", VENDORS.join(" | ")).option("--project-id <id>", "Put every row on this app (default: match an app column by name or slug)").option(ORG_FLAG2, ORG_DESC3).option("--json", "Machine-readable JSON output").action(async (file, opts) => {
+    if (!VENDORS.includes(opts.vendor)) throw new MushiCliError("E_INVALID_INPUT", `--vendor must be one of ${VENDORS.join(", ")}`);
+    const projectId = opts.projectId ? requireUuid(opts.projectId, "project id") : void 0;
+    const read = readTextFileCapped(file, MAX_BILL_CSV_BYTES);
+    if (read.kind === "absent") throw new MushiCliError("E_INVALID_INPUT", `Cannot read ${file}.`);
+    if (read.kind === "too_large") throw new MushiCliError("E_INVALID_INPUT", `${file} is over 5 MB.`, "export daily rather than hourly rows, or split it by month");
+    const csv = read.text;
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/spend/imports`,
+      config,
+      { method: "POST", body: JSON.stringify({ vendor: opts.vendor, csv, filename: basename2(file), ...projectId ? { projectId } : {} }) },
+      { timeoutMs: IMPORT_TIMEOUT_MS2 }
+    );
+    if (!result.ok) dieOrgError(result);
+    const r = result.data;
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(r, null, 2));
+      return;
+    }
+    console.log(`Imported ${r.rowsImported} of ${r.rowsRead} row(s) (${r.format}), ${usd(r.totalUsd)} for ${r.periodStart ?? "\u2014"} \u2192 ${r.periodEnd ?? "\u2014"}. Import ${r.importId}.`);
+    if (r.unmatchedApps.length > 0) console.log(`  No app matched: ${r.unmatchedApps.map((a) => oneLine(a, 40)).join(", ")}`);
+    for (const reason of r.skipReasons.slice(0, 5)) console.log(`  Skipped: ${oneLine(reason, 120)}`);
+  });
+  spend.command("remove <importId>").description("Remove a bill import; its days go back to the next newest import that has them").option("--yes", "Confirm the removal").option(ORG_FLAG2, ORG_DESC3).action(async (importId, opts) => {
+    const id = requireUuid(importId, "import id");
+    requireYes(opts.yes, "This removes the import and its rows from the ledger.");
+    const config = requireConfig();
+    const result = await apiCall(
+      `/v1/admin/orgs/${orgSegment(opts.org)}/spend/imports/${id}`,
+      config,
+      { method: "DELETE" }
+    );
+    if (!result.ok) dieOrgError(result);
+    console.log(`Removed import ${id}: ${result.data.rowsRemoved} row(s) removed, ${result.data.rowsRestored} restored from ${result.data.restoredFrom} older import(s).`);
+  });
+}
+
+// src/commands/design.ts
+function parseOnOff(raw, flag) {
+  const v = raw.trim().toLowerCase();
+  if (v === "on" || v === "true" || v === "yes") return true;
+  if (v === "off" || v === "false" || v === "no") return false;
+  throw new MushiCliError("E_INVALID_INPUT", `${flag} must be on or off`);
+}
+function renderSettings(s) {
+  const lines = [
+    `Threshold: ${s.threshold} (the actions below fire when the design score is above it)`,
+    `  Fail CI:  ${s.failCi ? "on" : "off"} (mushi recipe check --push exits non-zero above it)`,
+    `  Auto-fix: ${s.autofix ? "on" : "off"}${s.autofix && !s.autofixEnabled ? " (does nothing: the project auto-fix switch is off)" : ""}`
+  ];
+  if (!s.canEdit) lines.push("Read-only: only project owners and admins change these.");
+  return lines;
+}
+function registerDesignCommands(program2) {
+  const design = program2.command("design").description("What the design deviance score may do on its own: fail CI, dispatch a fix");
+  design.command("settings").description("Show the threshold and the actions above it").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${pid}/design/settings`, config);
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    for (const line of renderSettings(result.data)) console.log(line);
+  });
+  design.command("set").description("Change the threshold, fail CI, or turn the design auto-fix off (project owners and admins)").option("--threshold <n>", "Score 0-100 above which the actions fire").option("--fail-ci <state>", "on | off").option("--autofix <state>", "off (turning it on needs the console)").option("--project-id <id>", "Project ID (defaults to the configured project)").option("--json", "Machine-readable JSON output").action(async (opts) => {
+    const body = {};
+    if (opts.threshold !== void 0) {
+      const n = Number(opts.threshold);
+      if (!Number.isInteger(n) || n < 0 || n > 100) throw new MushiCliError("E_INVALID_INPUT", "--threshold must be a whole number from 0 to 100");
+      body.threshold = n;
+    }
+    if (opts.failCi !== void 0) body.failCi = parseOnOff(opts.failCi, "--fail-ci");
+    if (opts.autofix !== void 0) body.autofix = parseOnOff(opts.autofix, "--autofix");
+    if (Object.keys(body).length === 0) throw new MushiCliError("E_INVALID_INPUT", "Nothing to change: pass --threshold, --fail-ci or --autofix.");
+    const config = requireConfig();
+    const pid = resolveProjectId(opts.projectId, config.projectId);
+    const result = await apiCall(`/v1/admin/projects/${pid}/design/settings`, config, { method: "PUT", body: JSON.stringify(body) });
+    if (!result.ok) die(result);
+    if (outputIsJson(opts.json)) {
+      console.log(JSON.stringify(result.data, null, 2));
+      return;
+    }
+    console.log("Saved.");
+    for (const line of renderSettings(result.data)) console.log(line);
+  });
+}
+
 // src/index.ts
 installSignalHandlers();
 var program = new Command().name("mushi").description("Mushi CLI \u2014 set up the SDK, triage a report, fix from your editor").version(MUSHI_CLI_VERSION).option("--profile <name>", "Use a named credential profile for this invocation (or set MUSHI_PROFILE)").option("-o, --output <format>", "Output format: text | json", "text").hook("preAction", (_thisCommand, actionCommand) => {
@@ -6724,6 +10542,21 @@ registerSkillsCommands(program);
 registerBillingCommands(program);
 registerSelfhostCommands(program);
 registerProfileCommands(program);
+registerRadarCommands(program);
+registerRecipeCommands(program);
+registerStoreCommands(program);
+registerPortfolioCommands(program);
+registerConnectorsCommands(program);
+registerFunnelCommands(program);
+registerCodeHealthCommands(program);
+registerReleasesCommands(program);
+registerSentryCommands(program);
+registerOutboxCommands(program);
+registerBudgetsCommands(program);
+registerRepoCommands(program);
+registerAccountsCommands(program);
+registerSpendCommands(program);
+registerDesignCommands(program);
 registerCompletionCommand(program);
 program.parseAsync().catch((err) => {
   printAndExit(err);