@odla-ai/cli 0.13.1 → 0.14.0

package/dist/index.cjs

@@ -33,6 +33,8 @@ var index_exports = {};
 __export(index_exports, {
   AGENT_HARNESSES: () => AGENT_HARNESSES,
   CAPABILITIES: () => CAPABILITIES,
+  CODE_BUILD_RECIPES: () => CODE_BUILD_RECIPES,
+  CODE_PI_IMAGE: () => CODE_PI_IMAGE,
   GOOGLE_CALENDAR_EVENTS_SCOPE: () => GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES: () => SYSTEM_AI_PURPOSES,
   adminAi: () => adminAi,
@@ -42,6 +44,7 @@ __export(index_exports, {
   calendarDisconnect: () => calendarDisconnect,
   calendarServiceConfig: () => calendarServiceConfig,
   calendarStatus: () => calendarStatus,
+  codeConnect: () => codeConnect,
   connectGitHubSecuritySource: () => connectGitHubSecuritySource,
   disconnectGitHubSecuritySource: () => disconnectGitHubSecuritySource,
   doctor: () => doctor,
@@ -63,6 +66,7 @@ __export(index_exports, {
   redactSecrets: () => redactSecrets,
   repositoryFromGitRemote: () => repositoryFromGitRemote,
   runCli: () => runCli,
+  runCodeRuntime: () => runCodeRuntime,
   runHostedSecurity: () => runHostedSecurity,
   secretsPush: () => secretsPush,
   secretsSet: () => secretsSet,
@@ -254,7 +258,7 @@ var import_node_process2 = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process2.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve7, reject) => {
+  await new Promise((resolve10, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -262,7 +266,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve7();
+      resolve10();
     });
   });
 }
@@ -495,7 +499,7 @@ function audienceBoundEnvToken(token, platform) {
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
   const tokenFile = options.tokenFile ?? `${import_node_process5.default.cwd()}/.odla/admin-token.local.json`;
-  const cache = readJsonFile(tokenFile);
+  const cache = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached ${scope} grant (${tokenFile})`);
@@ -505,7 +509,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   const { token, expiresAt } = await (0, import_db2.requestToken)({
     endpoint: audience,
     email,
-    label: `odla CLI admin AI (${scope})`,
+    label: options.label ?? `odla CLI admin AI (${scope})`,
     scopes: [scope],
     fetch: doFetch,
     onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
@@ -516,11 +520,15 @@ async function scopedToken(platform, scope, options, doFetch, out) {
       }
     }
   });
-  const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
-  tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs3.existsSync)(`${import_node_process5.default.cwd()}/.git`)) ensureGitignore(import_node_process5.default.cwd(), [tokenFile]);
-  writePrivateJson(tokenFile, { platform: audience, email, tokens });
-  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  if (options.cache !== false) {
+    const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
+    tokens[scope] = { token, expiresAt };
+    if ((0, import_node_fs3.existsSync)(`${import_node_process5.default.cwd()}/.git`)) ensureGitignore(import_node_process5.default.cwd(), [tokenFile]);
+    writePrivateJson(tokenFile, { platform: audience, email, tokens });
+    out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  } else {
+    out.log(`auth: ${scope} grant is in memory only; its credential record remains in odla-ai/db`);
+  }
   return token;
 }
 
@@ -533,11 +541,11 @@ function adminAiAuditQuery(filters) {
   return `?limit=${filters.limit}`;
 }
 async function readAdminAiAudit(request) {
-  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
+  const response2 = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
     headers: request.headers
   });
-  const body = await responseBody(response);
-  if (!response.ok) throw new Error(apiError(response.status, body));
+  const body = await responseBody(response2);
+  if (!response2.ok) throw new Error(apiError(response2.status, body));
   if (request.json) {
     request.stdout.log(JSON.stringify(body, null, 2));
     return;
@@ -547,18 +555,18 @@ async function readAdminAiAudit(request) {
   for (const event of events) {
     const before = isRecord(event.oldPolicy) ? event.oldPolicy : void 0;
     const after = isRecord(event.newPolicy) ? event.newPolicy : void 0;
-    const route = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
+    const route2 = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
     request.stdout.log([
       timestamp(event.createdAt),
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
-      route,
+      route2,
       `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
     ].join("	"));
   }
 }
-async function responseBody(response) {
-  const text = await response.text();
+async function responseBody(response2) {
+  const text = await response2.text();
   if (!text) return {};
   try {
     return JSON.parse(text);
@@ -568,8 +576,8 @@ async function responseBody(response) {
 }
 function apiError(status, body) {
   const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `read System AI admin changes failed (${status}): ${message}`;
+  const message3 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message3}`;
 }
 function timestamp(value) {
   if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
@@ -670,8 +678,8 @@ async function responseBody2(res) {
 }
 function apiError2(action, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
-  const message = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message}`;
+  const message3 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message3}`;
 }
 function isRecord2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -798,9 +806,9 @@ async function adminAi(options) {
         validation: validationUpdate
       })
     });
-    const response2 = await responseBody3(res2);
-    if (!res2.ok) throw new Error(apiError3("update security review routes", res2.status, response2));
-    out.log(options.json ? JSON.stringify(response2, null, 2) : "updated security review discovery and independent validation routes atomically");
+    const response3 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("update security review routes", res2.status, response3));
+    out.log(options.json ? JSON.stringify(response3, null, 2) : "updated security review discovery and independent validation routes atomically");
     return;
   }
   const purpose = requireSystemAiPurpose(options.purpose);
@@ -818,9 +826,9 @@ async function adminAi(options) {
     headers,
     body: JSON.stringify(body)
   });
-  const response = await responseBody3(res);
-  if (!res.ok) throw new Error(apiError3(`update ${purpose}`, res.status, response));
-  const policy = isRecord3(response) && isRecord3(response.policy) ? response.policy : isRecord3(response) ? response : {};
+  const response2 = await responseBody3(res);
+  if (!res.ok) throw new Error(apiError3(`update ${purpose}`, res.status, response2));
+  const policy = isRecord3(response2) && isRecord3(response2.policy) ? response2.policy : isRecord3(response2) ? response2 : {};
   out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? "unchanged")}/${String(policy.model ?? "unchanged")}`);
 }
 function requireProvider(value) {
@@ -851,8 +859,8 @@ async function responseBody3(res) {
 }
 function apiError3(action, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
-  const message = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message}`;
+  const message3 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message3}`;
 }
 function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -1325,6 +1333,93 @@ async function appExport(options) {
   return { file, backup: newest };
 }
 
+// src/app-owners.ts
+var sink = (options) => options.stdout ?? console;
+async function ownersRequest(method, suffix, options, body) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    sink(options)
+  );
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {
+    method,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(
+      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
+    );
+  }
+  return data.owners ?? [];
+}
+function report(options, owners, headline) {
+  const out = sink(options);
+  if (options.json === true) {
+    out.log(JSON.stringify(owners, null, 2));
+    return;
+  }
+  if (headline) out.log(headline);
+  out.log(`owners (${owners.length}):`);
+  for (const o of owners) {
+    out.log(`  ${o.primary ? "\u2605" : "\xB7"} ${o.email ?? o.ownerId}${o.primary ? " (primary)" : ""}`);
+  }
+}
+async function ownersList(options) {
+  report(options, await ownersRequest("GET", "", options));
+}
+async function ownersAdd(email, options) {
+  const owners = await ownersRequest("POST", "", options, { email });
+  report(
+    options,
+    owners,
+    `added ${email} as a co-owner \u2014 they share full access. They can now run \`odla-ai provision\` to mint their own credentials (no secret sharing).`
+  );
+}
+async function ownersRemove(target, options) {
+  let ownerId = target;
+  if (target.includes("@")) {
+    const owners2 = await ownersRequest("GET", "", options);
+    const match = owners2.find((o) => o.email?.toLowerCase() === target.toLowerCase());
+    if (!match) throw new Error(`no co-owner with email ${target}`);
+    if (match.primary) throw new Error("can't remove the primary owner");
+    ownerId = match.ownerId;
+  }
+  const owners = await ownersRequest("DELETE", `/${encodeURIComponent(ownerId)}`, options);
+  report(options, owners, `removed ${target}`);
+}
+async function appOwnersCommand(parsed, dependencies = {}) {
+  const sub = parsed.positionals[2] ?? "list";
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout
+  };
+  const allowed = ["config", "token", "email", "json"];
+  if (sub === "list") {
+    assertArgs(parsed, allowed, 3);
+    await ownersList(options);
+    return;
+  }
+  if (sub === "add" || sub === "remove") {
+    assertArgs(parsed, allowed, 4);
+    const email = parsed.positionals[3];
+    if (!email) throw new Error(`"app owners ${sub}" needs an email \u2014 try "odla-ai app owners ${sub} teammate@example.com".`);
+    await (sub === "add" ? ownersAdd(email, options) : ownersRemove(email, options));
+    return;
+  }
+  throw new Error(
+    `unknown app owners subcommand "${sub}". Try "odla-ai app owners list", "odla-ai app owners add <email>", or "odla-ai app owners remove <email>".`
+  );
+}
+
 // src/app-lifecycle.ts
 async function lifecycleCall(action, options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1367,6 +1462,10 @@ async function appRestore(options) {
 }
 async function appCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[1];
+  if (sub === "owners") {
+    await appOwnersCommand(parsed, dependencies);
+    return;
+  }
   if (sub === "export") {
     assertArgs(parsed, ["config", "env", "token", "email", "fresh", "out", "json"], 2);
     await appExport({
@@ -1384,7 +1483,7 @@ async function appCommand(parsed, dependencies = {}) {
   }
   if (sub !== "archive" && sub !== "restore") {
     throw new Error(
-      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", or "odla-ai app export". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
     );
   }
   assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
@@ -1407,6 +1506,7 @@ var CAPABILITIES = {
     "start an email-bound device request without accepting a password or user session token",
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
+    "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
@@ -1435,13 +1535,13 @@ var CAPABILITIES = {
     "view telemetry and environment state",
     "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
     "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "perform manual credential recovery \u2014 for the primary owner or any co-owner \u2014 when the CLI's local shown-once copy is unavailable",
     "configure system AI purposes and view app/environment/run-attributed usage",
     "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
   ]
 };
-function printCapabilities(json = false, out = console) {
-  if (json) {
+function printCapabilities(json2 = false, out = console) {
+  if (json2) {
     out.log(JSON.stringify(CAPABILITIES, null, 2));
     return;
   }
@@ -1471,8 +1571,8 @@ var CalendarRequestError = class extends Error {
   status;
   /** Machine-readable `error.code` from the response body, when present. */
   code;
-  constructor(message, status, code) {
-    super(message);
+  constructor(message3, status, code) {
+    super(message3);
     this.name = "CalendarRequestError";
     this.status = status;
     if (code !== void 0) this.code = code;
@@ -1625,9 +1725,9 @@ async function calendarJson(ctx, suffix, init) {
   const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/calendar${suffix}`, platform);
   url.searchParams.set("env", env);
   const token = credential(ctx.token);
-  let response;
+  let response2;
   try {
-    response = await (ctx.fetch ?? fetch)(url, {
+    response2 = await (ctx.fetch ?? fetch)(url, {
       ...init,
       redirect: "error",
       credentials: "omit",
@@ -1636,12 +1736,12 @@ async function calendarJson(ctx, suffix, init) {
   } catch (error) {
     throw new Error(`calendar request failed: ${error instanceof Error ? error.message : String(error)}`);
   }
-  const body = await response.json().catch(() => ({}));
-  if (!response.ok) {
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok) {
     const code = textField(body.error?.code, 128);
-    const message = textField(body.error?.message, 500);
-    const detail = `${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`;
-    throw new CalendarRequestError(redactSecrets(`calendar request failed (${response.status})${detail}`), response.status, code);
+    const message3 = textField(body.error?.message, 500);
+    const detail = `${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`;
+    throw new CalendarRequestError(redactSecrets(`calendar request failed (${response2.status})${detail}`), response2.status, code);
   }
   return body;
 }
@@ -1699,8 +1799,8 @@ function credential(value) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve7, reject) => {
-    const timer = setTimeout(resolve7, milliseconds);
+  await new Promise((resolve10, reject) => {
+    const timer = setTimeout(resolve10, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -1802,7 +1902,7 @@ async function continueConnectedCalendar(ctx, current, options) {
   if (current.status !== "authorizing") return null;
   const now = options.now ?? Date.now;
   const deadline = now() + pollTimeout(options.pollTimeoutMs);
-  const wait = options.wait ?? waitForCalendarPoll;
+  const wait2 = options.wait ?? waitForCalendarPoll;
   let prior = "";
   while (now() < deadline) {
     if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
@@ -1818,7 +1918,7 @@ async function continueConnectedCalendar(ctx, current, options) {
       throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
     }
     if (status.status !== "authorizing") return null;
-    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+    await wait2(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
   throw new Error('Existing Google Calendar authorization timed out; run "odla-ai calendar status" and retry');
 }
@@ -1833,7 +1933,7 @@ async function connectWithContext(ctx, options) {
   const now = options.now ?? Date.now;
   const timeout = pollTimeout(options.pollTimeoutMs);
   const deadline = Math.min(attempt.expiresAt, now() + timeout);
-  const wait = options.wait ?? waitForCalendarPoll;
+  const wait2 = options.wait ?? waitForCalendarPoll;
   let prior = "";
   while (now() < deadline) {
     if (options.signal?.aborted) throw options.signal.reason ?? new Error("calendar connection aborted");
@@ -1850,7 +1950,7 @@ async function connectWithContext(ctx, options) {
       const reason = status.error?.message ?? status.error?.code;
       throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
     }
-    await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
+    await wait2(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
   throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
@@ -1876,8 +1976,8 @@ function pollTimeout(value = 10 * 6e4) {
 function productionConsent(env, yes, action) {
   if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
 }
-function printStatus(status, json, out) {
-  if (json) {
+function printStatus(status, json2, out) {
+  if (json2) {
     out.log(JSON.stringify(status, null, 2));
     return;
   }
@@ -1889,192 +1989,3169 @@ function printStatus(status, json, out) {
   if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
 }
 
-// src/doctor-checks.ts
-var import_node_child_process3 = require("child_process");
+// src/code-connect.ts
 var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
-
-// src/wrangler.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs6 = require("fs");
+var import_node_os = require("os");
 var import_node_path4 = require("path");
-var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
-  let stdout = "";
-  let stderr = "";
-  child.stdout.on("data", (chunk) => stdout += chunk.toString());
-  child.stderr.on("data", (chunk) => stderr += chunk.toString());
-  child.on("error", reject);
-  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
-  child.stdin.end(opts?.input ?? "");
-});
-var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
-function findWranglerConfig(rootDir) {
-  for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path4.join)(rootDir, name);
-    if ((0, import_node_fs6.existsSync)(path)) return path;
+
+// ../harness/dist/chunk-UG5XHNFB.js
+var HARNESS_PROTOCOL_VERSION = 1;
+
+// ../harness/dist/chunk-QALIIZRJ.js
+var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
+var HarnessProtocolError = class extends Error {
+  name = "HarnessProtocolError";
+};
+function record2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function boundedText(value, label, max) {
+  if (typeof value !== "string" || !value || value.length > max || CONTROL.test(value)) {
+    throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);
   }
-  return null;
+  return value;
 }
-function readWranglerConfig(path) {
-  if (path.endsWith(".toml")) return null;
+function parseAgentOutput(line) {
+  if (Buffer.byteLength(line, "utf8") > 1e6) throw new HarnessProtocolError("agent message exceeds 1 MB");
+  let value;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs6.readFileSync)(path, "utf8")));
+    value = JSON.parse(line);
   } catch {
-    return null;
+    throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-}
-function stripJsonComments(text) {
-  let result = "";
-  let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    if (inString) {
-      result += ch;
-      if (ch === "\\") {
-        result += text[i + 1] ?? "";
-        i++;
-      } else if (ch === '"') {
-        inString = false;
-      }
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      result += ch;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
-      result += "\n";
-      continue;
+  const message3 = record2(value);
+  if (!message3 || message3.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
+    throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
+  }
+  if (message3.type === "event") {
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "event",
+      kind: boundedText(message3.kind, "event.kind", 120),
+      ...message3.payload === void 0 ? {} : { payload: message3.payload }
+    };
+  }
+  if (message3.type === "inference.request") {
+    const call = record2(message3.call);
+    if (!call || !Array.isArray(call.messages) || !Number.isSafeInteger(call.maxTokens)) {
+      throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
-    if (ch === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
-      i++;
-      continue;
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "inference.request",
+      requestId: boundedText(message3.requestId, "requestId", 180),
+      call
+    };
+  }
+  if (message3.type === "tool.request") {
+    const input = record2(message3.input);
+    const tool = String(message3.tool);
+    if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
+      throw new HarnessProtocolError("tool.request requires a registered tool and object input");
     }
-    result += ch;
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "tool.request",
+      requestId: boundedText(message3.requestId, "requestId", 180),
+      tool,
+      input
+    };
   }
-  return result;
-}
-async function wranglerLoggedIn(run, cwd) {
-  try {
-    const result = await run("npx", ["wrangler", "whoami"], { cwd });
-    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
-  } catch {
-    return false;
+  if (message3.type === "attempt.complete") {
+    if (!(/* @__PURE__ */ new Set(["completed", "failed", "cancelled"])).has(String(message3.status))) {
+      throw new HarnessProtocolError("attempt.complete.status is invalid");
+    }
+    return {
+      protocolVersion: HARNESS_PROTOCOL_VERSION,
+      type: "attempt.complete",
+      status: message3.status,
+      ...message3.result === void 0 ? {} : { result: message3.result }
+    };
   }
+  throw new HarnessProtocolError("agent message type is unsupported");
 }
-function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
-  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+function encodeAgentInput(message3) {
+  return `${JSON.stringify(message3)}
+`;
 }
 
-// src/doctor-checks.ts
-function lintRules(rules, entities, publicRead) {
-  const warnings = [];
-  if (!rules) return warnings;
-  for (const [ns, actions] of Object.entries(rules)) {
-    for (const [action, expr] of Object.entries(actions)) {
-      if (typeof expr !== "string" || expr.trim() !== "true") continue;
-      if (action === "view" && publicRead.includes(ns)) continue;
-      warnings.push(
-        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
-      );
+// ../harness/dist/chunk-FNYUIJUN.js
+var import_child_process = require("child_process");
+var import_fs = require("fs");
+var import_promises2 = require("fs/promises");
+var import_path = require("path");
+var import_process = require("process");
+var import_promises3 = require("fs/promises");
+var import_os = require("os");
+var import_path2 = require("path");
+var import_child_process2 = require("child_process");
+var DIGEST_IMAGE = /^[a-z0-9][a-z0-9._/-]*(?::[a-zA-Z0-9._-]+)?@sha256:[0-9a-f]{64}$/;
+function assertPinnedImage(image) {
+  if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
+}
+async function commandAvailable(engine) {
+  for (const directory of (process.env.PATH ?? "").split(import_path.delimiter).filter(Boolean)) {
+    try {
+      await (0, import_promises2.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
+      return true;
+    } catch {
     }
   }
-  for (const entity of entities) {
-    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
-  }
-  return warnings;
+  return false;
 }
-var defaultExec = (cmd, args, cwd) => (0, import_node_child_process3.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
-  let output;
-  try {
-    const custom = localPaths.map((path) => gitignoreEntry(rootDir, path)).filter((path) => !!path);
-    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla", ...custom], rootDir);
-  } catch {
-    return [];
+async function selectContainerEngine(requested = "auto", options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof import_process.getuid === "function" ? (0, import_process.getuid)() : 1e3);
+  const available = options.available ?? commandAvailable;
+  const validate3 = async (engine) => {
+    if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+      throw new TypeError("Apple container requires Apple Silicon macOS");
+    }
+    if (engine === "podman" && platform === "linux" && uid === 0) {
+      throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+    }
+    if (!await available(engine)) throw new TypeError(`${engine} is not installed or executable`);
+    return engine;
+  };
+  if (requested !== "auto") return validate3(requested);
+  const candidates = platform === "darwin" ? arch === "arm64" ? ["container", "podman"] : ["podman"] : platform === "linux" ? ["podman"] : [];
+  for (const engine of candidates) {
+    if (await available(engine)) return validate3(engine);
+  }
+  if (platform === "linux") {
+    throw new TypeError("no rootless Podman found; install Podman or explicitly choose --engine docker after reviewing its daemon boundary");
+  }
+  if (platform === "darwin") {
+    throw new TypeError("no Apple container or Podman Machine found; install one or explicitly choose --engine docker");
+  }
+  throw new TypeError("no supported container engine found");
+}
+function inspectRootlessPodman() {
+  return new Promise((resolve23, reject) => {
+    (0, import_child_process.execFile)(
+      "podman",
+      ["info", "--format", "{{.Host.Security.Rootless}}"],
+      { encoding: "utf8", maxBuffer: 16 * 1024, timeout: 1e4 },
+      (error, stdout) => {
+        if (error) {
+          reject(new TypeError("could not verify that the active Podman service is rootless"));
+          return;
+        }
+        resolve23(stdout.trim() === "true");
+      }
+    );
+  });
+}
+async function verifyContainerEngineBoundary(engine, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const uid = options.uid ?? (typeof import_process.getuid === "function" ? (0, import_process.getuid)() : 1e3);
+  if (engine === "container" && (platform !== "darwin" || arch !== "arm64")) {
+    throw new TypeError("Apple container requires Apple Silicon macOS");
+  }
+  if (engine !== "podman" || platform !== "linux") return;
+  if (uid === 0) throw new TypeError("the Linux harness requires rootless Podman; do not run the runner as root");
+  const rootless = await (options.podmanRootless ?? inspectRootlessPodman)();
+  if (!rootless) throw new TypeError("the active Podman service is not rootless; refusing to run the harness");
+}
+function buildContainerRunArgs(options) {
+  if (!options.allowUnpinnedImage) assertPinnedImage(options.image);
+  if (/[,\r\n]/.test(options.workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof import_process.getuid === "function" ? (0, import_process.getuid)() : 1e3;
+  const gid = typeof import_process.getgid === "function" ? (0, import_process.getgid)() : 1e3;
+  const safeAttempt = options.task.attemptId.toLowerCase().replace(/[^a-z0-9_.-]/g, "-").slice(0, 40);
+  const name = `odla-harness-${safeAttempt}-${crypto.randomUUID().slice(0, 8)}`;
+  const limits = options.limits ?? {};
+  const access2 = options.workspaceAccess ?? "read-write";
+  const appleMount = access2 === "none" ? [] : [`--mount=type=bind,source=${options.workspaceDir},target=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  const ociMount = access2 === "none" ? [] : [`--mount=type=bind,src=${options.workspaceDir},dst=/workspace${access2 === "read-only" ? ",readonly" : ""}`];
+  if (options.engine === "container") {
+    return [
+      "run",
+      "--rm",
+      "--interactive",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory ?? "1g"}`,
+      `--cpus=${limits.cpus ?? 1}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      ...appleMount,
+      "--workdir=/workspace",
+      `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+      `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+      options.image
+    ];
   }
-  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+  return [
+    "run",
+    "--rm",
+    "--interactive",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids ?? 256}`,
+    `--memory=${limits.memory ?? "1g"}`,
+    `--cpus=${limits.cpus ?? 1}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfsBytes ?? 64 * 1024 * 1024}`,
+    ...ociMount,
+    "--workdir=/workspace",
+    `--env=ODLA_HARNESS_PROTOCOL=${HARNESS_PROTOCOL_VERSION}`,
+    `--label=ai.odla.harness.attempt=${options.task.attemptId}`,
+    options.image
+  ];
 }
-function wranglerWarnings(rootDir) {
-  const configPath = findWranglerConfig(rootDir);
-  if (!configPath) return [];
-  const config = readWranglerConfig(configPath);
-  if (!config) return [];
-  const warnings = [];
-  const blocks = [{ label: "", block: config }];
-  const envs = config.env;
-  if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+function containerName(args) {
+  return args.find((arg) => arg.startsWith("--name=")).slice("--name=".length);
+}
+async function runContainerAttempt(options) {
+  if (options.signal?.aborted) return { exitCode: 1, status: "cancelled", stderr: "" };
+  await verifyContainerEngineBoundary(options.engine);
+  const args = buildContainerRunArgs(options);
+  const name = containerName(args);
+  const child = (0, import_child_process.spawn)(options.engine, args, { stdio: ["pipe", "pipe", "pipe"], shell: false });
+  let stderr = "";
+  let outputBytes = 0;
+  let complete = null;
+  let stopped = false;
+  let exited = false;
+  child.stderr.setEncoding("utf8");
+  child.stderr.on("data", (text) => {
+    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  });
+  const stop = (reason) => {
+    if (stopped || exited) return;
+    stopped = true;
+    if (!child.stdin.destroyed) {
+      const cancel = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "attempt.cancel", reason };
+      child.stdin.write(encodeAgentInput(cancel));
     }
-  }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
-    if (assets?.directory) {
-      const dir = (0, import_node_path5.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path5.resolve)(rootDir)) {
-        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs7.existsSync)((0, import_node_path5.join)(dir, "node_modules"))) {
-        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+    const removeArgs = options.engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+    const killer = (0, import_child_process.spawn)(options.engine, removeArgs, { stdio: "ignore", shell: false });
+    killer.unref();
+  };
+  const abort = () => stop("runner_cancelled");
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timeout = setTimeout(() => stop("timeout"), options.task.policy.timeoutMs);
+  const start = { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "task.start", task: options.task };
+  if (!stopped && !options.signal?.aborted) child.stdin.write(encodeAgentInput(start));
+  const consume = (async () => {
+    let pending = Buffer.alloc(0);
+    const handleLine = async (raw) => {
+      const bytes = raw.at(-1) === 13 ? raw.subarray(0, -1) : raw;
+      if (bytes.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
+      const line = bytes.toString("utf8");
+      if (!line.trim()) return;
+      const message3 = parseAgentOutput(line);
+      if (message3.type === "attempt.complete") complete = message3;
+      const response2 = await options.onMessage(message3);
+      if (response2 && !child.stdin.destroyed) child.stdin.write(encodeAgentInput(response2));
+    };
+    try {
+      for await (const raw of child.stdout) {
+        const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
+        outputBytes += chunk.byteLength;
+        if (outputBytes > options.task.policy.maxOutputBytes) {
+          throw new Error(`agent output exceeds ${options.task.policy.maxOutputBytes} bytes`);
+        }
+        pending = Buffer.concat([pending, chunk]);
+        let newline = pending.indexOf(10);
+        while (newline >= 0) {
+          await handleLine(pending.subarray(0, newline));
+          pending = pending.subarray(newline + 1);
+          newline = pending.indexOf(10);
+        }
+        if (pending.byteLength > 1e6) throw new Error("agent message exceeds 1 MB");
       }
+      if (pending.byteLength) await handleLine(pending);
+    } catch (error) {
+      stop("protocol_error");
+      throw error;
     }
-    const vars = block.vars;
-    if (vars && typeof vars === "object") {
-      for (const [name, value] of Object.entries(vars)) {
-        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
-          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
-        }
+  })();
+  const exit = new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code) => {
+      exited = true;
+      accept(code ?? 1);
+    });
+  });
+  try {
+    const [exitCode] = await Promise.all([exit, consume]);
+    if (stderr && options.onStderr) await options.onStderr(stderr);
+    if (options.signal?.aborted) return { exitCode, status: "cancelled", stderr };
+    const terminal = complete;
+    if (!terminal) return { exitCode, status: "failed", result: { error: "agent exited without completion" }, stderr };
+    return { exitCode, status: exitCode === 0 ? terminal.status : "failed", result: terminal.result, stderr };
+  } catch (error) {
+    stop("runner_error");
+    await exit.catch(() => 1);
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abort);
+  }
+}
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET_FILE = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+async function sourceFiles(sourceDir, maxFiles, maxBytes) {
+  const files = [];
+  let bytes = 0;
+  const walk = async (dir) => {
+    for (const entry of await (0, import_promises3.readdir)(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
+      if (!entry.isDirectory() && SECRET_FILE.test(entry.name)) continue;
+      const path = (0, import_path2.join)(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        await walk(path);
+        continue;
       }
+      if (!entry.isFile()) continue;
+      const metadata2 = await (0, import_promises3.stat)(path);
+      bytes += metadata2.size;
+      if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
+      if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
+      files.push({
+        source: path,
+        relativePath: (0, import_path2.relative)(sourceDir, path),
+        mode: metadata2.mode & 511,
+        bytes: metadata2.size
+      });
     }
+  };
+  await walk(sourceDir);
+  return files.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+async function copyTree(files, destination) {
+  for (const file of files) {
+    const target = (0, import_path2.join)(destination, file.relativePath);
+    await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises3.copyFile)(file.source, target);
+    await (0, import_promises3.chmod)(target, file.mode);
+  }
+}
+async function captureGitDiff(root, maxBytes) {
+  const child = (0, import_child_process2.spawn)("git", [
+    "diff",
+    "--no-index",
+    "--binary",
+    "--no-ext-diff",
+    "--src-prefix=a/",
+    "--dst-prefix=b/",
+    "--",
+    "baseline",
+    "workspace"
+  ], { cwd: root, stdio: ["ignore", "pipe", "pipe"], shell: false });
+  const stdout = [];
+  const stderr = [];
+  let bytes = 0;
+  child.stdout.on("data", (chunk) => {
+    bytes += chunk.byteLength;
+    if (bytes > maxBytes) child.kill("SIGKILL");
+    else stdout.push(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+  });
+  const code = await new Promise((accept, reject) => {
+    child.once("error", reject);
+    child.once("exit", accept);
+  });
+  if (bytes > maxBytes) throw new Error(`patch exceeds ${maxBytes} bytes`);
+  if (code !== 0 && code !== 1) {
+    throw new Error(`git diff failed: ${Buffer.concat(stderr).toString("utf8").slice(0, 1e3)}`);
+  }
+  return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
+}
+async function stageWorkspace(source, options = {}) {
+  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
+  const sourceStat = await (0, import_promises3.stat)(sourceDir);
+  if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
+  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-harness-"));
+  const baselineDir = (0, import_path2.join)(root, "baseline");
+  const workspaceDir = (0, import_path2.join)(root, "workspace");
+  await Promise.all([(0, import_promises3.mkdir)(baselineDir), (0, import_promises3.mkdir)(workspaceDir)]);
+  try {
+    const files = await sourceFiles(sourceDir, options.maxFiles ?? 2e4, options.maxBytes ?? 512 * 1024 * 1024);
+    await Promise.all([copyTree(files, baselineDir), copyTree(files, workspaceDir)]);
+    return {
+      root,
+      baselineDir,
+      workspaceDir,
+      fileCount: files.length,
+      byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
+      patch: (maxBytes) => captureGitDiff(root, maxBytes),
+      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
+    };
+  } catch (error) {
+    await (0, import_promises3.rm)(root, { recursive: true, force: true });
+    throw error;
   }
-  const pkg = readPackageJson(rootDir);
-  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
-    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
-  }
-  return warnings;
 }
-function o11yProjectWarnings(rootDir) {
-  const warnings = [];
-  const pkg = readPackageJson(rootDir);
-  const dependencies = pkg?.dependencies;
-  const devDependencies = pkg?.devDependencies;
-  if (!dependencies?.["@odla-ai/o11y"]) {
-    warnings.push(
-      devDependencies?.["@odla-ai/o11y"] ? "@odla-ai/o11y is a devDependency \u2014 move it to dependencies so the Worker can import it" : 'Worker instrumentation is missing @odla-ai/o11y \u2014 install it and wrap the handler with "withObservability"'
-    );
+
+// ../camel/dist/chunk-7FHPOQVP.js
+var CamelError = class extends Error {
+  code;
+  safeMessage;
+  constructor(code, safeMessage, options) {
+    super(safeMessage, options);
+    this.name = "CamelError";
+    this.code = code;
+    this.safeMessage = safeMessage;
   }
-  const configPath = findWranglerConfig(rootDir);
-  const config = configPath ? readWranglerConfig(configPath) : null;
-  if (!configPath || !config) {
-    warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
-    return warnings;
+};
+
+// ../camel/dist/chunk-L5DYU2E2.js
+function canonicalJson(value) {
+  return JSON.stringify(normalize(value));
+}
+async function sha256Hex(value) {
+  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+  const digest2 = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
+  return [...new Uint8Array(digest2)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function utf8Length(value) {
+  if (typeof value === "string") return new TextEncoder().encode(value).byteLength;
+  if (value instanceof Uint8Array) return value.byteLength;
+  try {
+    return new TextEncoder().encode(canonicalJson(value)).byteLength;
+  } catch {
+    throw new CamelError("conversion_rejected", "Unsafe input could not be canonically measured.");
   }
-  const main = typeof config.main === "string" ? (0, import_node_path5.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs7.existsSync)(main)) {
-    warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
-  } else {
-    let source = "";
-    try {
-      source = (0, import_node_fs7.readFileSync)(main, "utf8");
-    } catch {
-    }
-    if (!/\bwithObservability\b/.test(source)) {
-      warnings.push(`wrangler entrypoint ${config.main} does not reference withObservability`);
-    }
+}
+function normalize(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new CamelError("state_conflict", "Canonical JSON rejects non-finite numbers.");
+    return value;
   }
-  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];
-  if (!flags.includes("nodejs_compat")) {
-    warnings.push('wrangler compatibility_flags is missing "nodejs_compat" required by @odla-ai/o11y');
+  if (Array.isArray(value)) return value.map(normalize);
+  if (value instanceof Uint8Array) return { $bytes: [...value] };
+  if (typeof value === "object") {
+    const record5 = value;
+    return Object.fromEntries(Object.keys(record5).filter((key) => record5[key] !== void 0).sort().map((key) => [key, normalize(record5[key])]));
   }
-  return warnings;
+  throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
-function calendarProjectWarnings(rootDir) {
+function canRead(readers, readerId) {
+  return readers.kind === "public" || readers.principalIds.includes(readerId);
+}
+function dependenciesOf(values, influence = "data") {
+  const result = [];
+  for (const value of values) {
+    result.push(...value.label.dependencies);
+    for (const ref of value.label.provenance) {
+      result.push({ ref, influence, promptSafetyAtUse: value.label.promptSafety });
+    }
+  }
+  const unique3 = /* @__PURE__ */ new Map();
+  for (const dep of result) unique3.set(`${dep.ref.kind}\0${dep.ref.id}\0${dep.influence}\0${dep.promptSafetyAtUse}`, dep);
+  return [...unique3.values()];
+}
+
+// ../camel/dist/chunk-S7EVNA2U.js
+var camelValueBrand = /* @__PURE__ */ Symbol("@odla-ai/camel/value");
+var authenticCamelValues = /* @__PURE__ */ new WeakSet();
+function isCamelValue(value) {
+  return typeof value === "object" && value !== null && authenticCamelValues.has(value);
+}
+function isSafe(value) {
+  return isCamelValue(value) && value.label.promptSafety === "safe";
+}
+function isUnsafe(value) {
+  return isCamelValue(value) && value.label.promptSafety === "unsafe";
+}
+function createSafeInternal(value, safeBasis, metadata2) {
+  return createValue(value, {
+    schemaVersion: 1,
+    promptSafety: "safe",
+    safeBasis,
+    ...copyMetadata(metadata2)
+  });
+}
+function createUnsafeInternal(value, metadata2) {
+  return createValue(value, {
+    schemaVersion: 1,
+    promptSafety: "unsafe",
+    ...copyMetadata(metadata2)
+  });
+}
+function createValue(value, label) {
+  const result = { value, label: Object.freeze(label) };
+  Object.defineProperty(result, camelValueBrand, { value: label.promptSafety, enumerable: false });
+  authenticCamelValues.add(result);
+  return Object.freeze(result);
+}
+function copyMetadata(metadata2) {
+  if (metadata2.provenance.length === 0) throw new CamelError("state_conflict", "Label provenance must be non-empty.");
+  const provenance = metadata2.provenance.map(copyRef);
+  const dependencies = (metadata2.dependencies ?? []).map((dependency) => Object.freeze({
+    ref: copyRef(dependency.ref),
+    influence: dependency.influence,
+    promptSafetyAtUse: dependency.promptSafetyAtUse
+  }));
+  return {
+    readers: normalizeReaders(metadata2.readers),
+    provenance: Object.freeze(provenance),
+    dependencies: Object.freeze(dependencies)
+  };
+}
+function copyRef(ref) {
+  if (!ref.id || ref.digest !== void 0 && !ref.digest) throw new CamelError("state_conflict", "Provenance references must have non-empty identities.");
+  return Object.freeze({ kind: ref.kind, id: ref.id, ...ref.digest === void 0 ? {} : { digest: ref.digest } });
+}
+function normalizeReaders(readers) {
+  if (readers.kind === "public") return Object.freeze({ kind: "public" });
+  const principalIds = [...new Set(readers.principalIds)].sort();
+  if (principalIds.some((id) => !id)) throw new CamelError("reader_mismatch", "Reader principal IDs must be non-empty.");
+  return Object.freeze({ kind: "principals", principalIds: Object.freeze(principalIds) });
+}
+
+// ../camel/dist/code.js
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var ID = /^[A-Za-z0-9._:-]{1,160}$/;
+async function digestCodeVerificationReceipt(fields) {
+  validate(fields);
+  const canonical = {
+    schemaVersion: fields.schemaVersion,
+    verificationId: fields.verificationId,
+    trustedBaseCommitSha: fields.trustedBaseCommitSha,
+    trustedBaseDigest: fields.trustedBaseDigest,
+    patchDigest: fields.patchDigest,
+    candidateDigest: fields.candidateDigest,
+    sourceDigest: fields.sourceDigest,
+    policyDigest: fields.policyDigest,
+    recipes: fields.recipes.map((recipe2) => ({
+      recipeId: recipe2.recipeId,
+      recipeDigest: recipe2.recipeDigest,
+      status: recipe2.status,
+      exitCode: recipe2.exitCode,
+      durationMs: recipe2.durationMs,
+      artifacts: recipe2.artifacts.map((artifact) => ({
+        artifactId: artifact.artifactId,
+        status: artifact.status,
+        bytes: artifact.bytes,
+        digest: artifact.digest
+      }))
+    })),
+    changedTestCount: fields.changedTestCount,
+    changedTestSetDigest: fields.changedTestSetDigest,
+    changedTestsRequireReview: fields.changedTestsRequireReview,
+    outcome: fields.outcome
+  };
+  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;
+}
+function validate(fields) {
+  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
+    throw new CamelError("state_conflict", "Code verification receipt is malformed or outside its bounds.");
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const recipe2 of fields.recipes) {
+    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
+      throw new CamelError("state_conflict", "Code verification recipe receipt is malformed or outside its bounds.");
+    }
+    const artifactIds = /* @__PURE__ */ new Set();
+    if (recipe2.artifacts.length > 64) throw new CamelError("state_conflict", "Code verification has too many artifacts.");
+    for (const artifact of recipe2.artifacts) {
+      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
+        throw new CamelError("state_conflict", "Code verification artifact receipt is malformed.");
+      }
+      artifactIds.add(artifact.artifactId);
+    }
+    if (recipe2.status === "passed" && (recipe2.exitCode !== 0 || recipe2.artifacts.some((artifact) => artifact.status !== "verified"))) {
+      throw new CamelError("state_conflict", "A passing recipe must verify every registered artifact.");
+    }
+    ids.add(recipe2.recipeId);
+  }
+  const passed = fields.recipes.every((recipe2) => recipe2.status === "passed");
+  if (fields.outcome === "passed" !== passed) {
+    throw new CamelError("state_conflict", "Code verification outcome does not match its recipe receipts.");
+  }
+}
+var SHA2 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
+var ID2 = /^[A-Za-z0-9._:-]{1,180}$/;
+var MAX_PATCH_BYTES = 256 * 1024;
+var MAX_STATE_BYTES = 64 * 1024;
+async function createCodePortableCheckpoint(input) {
+  const state = normalizeState(input.state);
+  validateBaseAndPatch(input.baseCommitSha, input.patch);
+  const patchDigest = `sha256:${await sha256Hex(input.patch)}`;
+  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state))}`;
+  const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state, stateDigest };
+  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}`;
+  return freeze({ ...fields, patch: input.patch, checkpointDigest });
+}
+async function verifyCodePortableCheckpoint(value) {
+  const input = object(value, "checkpoint");
+  exact2(input, ["schemaVersion", "baseCommitSha", "patch", "patchDigest", "state", "stateDigest", "checkpointDigest"]);
+  if (input.schemaVersion !== 1 || typeof input.baseCommitSha !== "string" || typeof input.patch !== "string" || typeof input.patchDigest !== "string" || typeof input.stateDigest !== "string" || typeof input.checkpointDigest !== "string") {
+    throw invalid2("Portable checkpoint fields are malformed.");
+  }
+  const created = await createCodePortableCheckpoint({
+    baseCommitSha: input.baseCommitSha,
+    patch: input.patch,
+    state: normalizeState(input.state)
+  });
+  if (created.patchDigest !== input.patchDigest || created.stateDigest !== input.stateDigest || created.checkpointDigest !== input.checkpointDigest) {
+    throw invalid2("Portable checkpoint digest does not match its content.");
+  }
+  return created;
+}
+function normalizeState(value) {
+  const state = object(value, "state");
+  exact2(state, [
+    "planCursor",
+    "conversationRefs",
+    "planningInputDigest",
+    "buildPolicyDigest",
+    "dependencyLayerDigest",
+    "verificationDigest",
+    "reviewDigest",
+    "completedEffects",
+    "unresolvedApprovals",
+    "trustStatus"
+  ]);
+  const planCursor = state.planCursor;
+  const conversations = strings(state.conversationRefs, "conversationRefs", ID2, 256, false);
+  const approvals = strings(state.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
+  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state.planningInputDigest !== "string" || !DIGEST2.test(state.planningInputDigest) || typeof state.buildPolicyDigest !== "string" || !DIGEST2.test(state.buildPolicyDigest) || state.dependencyLayerDigest !== null && (typeof state.dependencyLayerDigest !== "string" || !DIGEST2.test(state.dependencyLayerDigest)) || state.verificationDigest !== null && (typeof state.verificationDigest !== "string" || !DIGEST2.test(state.verificationDigest)) || state.reviewDigest !== null && (typeof state.reviewDigest !== "string" || !DIGEST2.test(state.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state.trustStatus)) || !Array.isArray(state.completedEffects) || state.completedEffects.length > 256) {
+    throw invalid2("Portable checkpoint state is malformed or outside its bounds.");
+  }
+  const effects = state.completedEffects.map((item) => {
+    const effect = object(item, "completed effect");
+    exact2(effect, ["effectId", "actionDigest", "receiptDigest"]);
+    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST2.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST2.test(effect.receiptDigest)) {
+      throw invalid2("Portable checkpoint effect receipt is malformed.");
+    }
+    return {
+      effectId: effect.effectId,
+      actionDigest: effect.actionDigest,
+      receiptDigest: effect.receiptDigest
+    };
+  });
+  if (new Set(effects.map((item) => item.effectId)).size !== effects.length) {
+    throw invalid2("Portable checkpoint repeats a completed effect.");
+  }
+  const trustStatus = state.trustStatus;
+  if (trustStatus === "candidate_untrusted" && (state.verificationDigest !== null || state.reviewDigest !== null) || trustStatus === "verified" && (state.verificationDigest === null || state.reviewDigest !== null) || trustStatus === "reviewed" && (state.verificationDigest === null || state.reviewDigest === null)) {
+    throw invalid2("Portable checkpoint trust status does not match its evidence digests.");
+  }
+  const normalized = {
+    planCursor,
+    conversationRefs: conversations,
+    planningInputDigest: state.planningInputDigest,
+    buildPolicyDigest: state.buildPolicyDigest,
+    dependencyLayerDigest: state.dependencyLayerDigest,
+    verificationDigest: state.verificationDigest,
+    reviewDigest: state.reviewDigest,
+    completedEffects: effects,
+    unresolvedApprovals: approvals,
+    trustStatus
+  };
+  if (utf8Length(normalized) > MAX_STATE_BYTES) throw invalid2("Portable checkpoint state exceeds 64 KB.");
+  return normalized;
+}
+function validateBaseAndPatch(baseCommitSha, patch2) {
+  if (!SHA2.test(baseCommitSha) || utf8Length(patch2) > MAX_PATCH_BYTES || patch2.includes("\0")) {
+    throw invalid2("Portable checkpoint base or patch is malformed or outside its bounds.");
+  }
+}
+function strings(value, name, pattern, maximum, sort) {
+  if (!Array.isArray(value) || value.length > maximum || value.some((item) => typeof item !== "string" || !pattern.test(item)) || new Set(value).size !== value.length) {
+    throw invalid2(`Portable checkpoint ${name} is malformed or outside its bounds.`);
+  }
+  const result = [...value];
+  return sort ? result.sort() : result;
+}
+function object(value, name) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid2(`Portable ${name} must be an object.`);
+  return value;
+}
+function exact2(value, keys) {
+  if (Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !(key in value))) {
+    throw invalid2("Portable checkpoint contains missing or unsupported fields.");
+  }
+}
+function freeze(value) {
+  return Object.freeze({
+    ...value,
+    state: Object.freeze({
+      ...value.state,
+      conversationRefs: Object.freeze([...value.state.conversationRefs]),
+      completedEffects: Object.freeze(value.state.completedEffects.map((item) => Object.freeze({ ...item }))),
+      unresolvedApprovals: Object.freeze([...value.state.unresolvedApprovals])
+    })
+  });
+}
+function invalid2(message3) {
+  return new CamelError("state_conflict", message3);
+}
+var SHA4 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var DEFAULT_LIMITS = { maximumFiles: 4e3, maximumBytes: 2 * 1024 * 1024 };
+async function digestCodeRepositorySnapshot(snapshot, limits = DEFAULT_LIMITS) {
+  validateSnapshot(snapshot, limits);
+  const normalized = {
+    repository: snapshot.repository,
+    commitSha: snapshot.commitSha,
+    files: [...snapshot.files].map((file) => ({ path: file.path, content: file.content })).sort((left, right) => left.path.localeCompare(right.path))
+  };
+  return `sha256:${await sha256Hex(canonicalJson(normalized))}`;
+}
+function validateSnapshot(snapshot, limits) {
+  if (!REPOSITORY.test(snapshot.repository) || !SHA4.test(snapshot.commitSha)) {
+    throw new CamelError("state_conflict", "Code snapshot repository or commit is invalid.");
+  }
+  if (!Number.isSafeInteger(limits.maximumFiles) || limits.maximumFiles < 1 || !Number.isSafeInteger(limits.maximumBytes) || limits.maximumBytes < 1 || snapshot.files.length > limits.maximumFiles) {
+    throw new CamelError("limit_exceeded", "Code snapshot exceeds its registered limits.");
+  }
+  const paths = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  for (const file of snapshot.files) {
+    if (!file.path || file.path.startsWith("/") || file.path.includes("\\") || file.path.split("/").some((part) => !part || part === "." || part === "..") || paths.has(file.path) || typeof file.content !== "string") {
+      throw new CamelError("state_conflict", "Code snapshot contains an invalid or duplicate path.");
+    }
+    paths.add(file.path);
+    bytes += utf8Length(file.path) + utf8Length(file.content);
+  }
+  if (bytes > limits.maximumBytes) {
+    throw new CamelError("limit_exceeded", "Code snapshot exceeds its registered limits.");
+  }
+}
+
+// ../harness/dist/chunk-RVUUURK2.js
+var import_child_process3 = require("child_process");
+var import_promises4 = require("fs/promises");
+var import_path3 = require("path");
+var import_child_process4 = require("child_process");
+var import_process2 = require("process");
+var import_crypto = require("crypto");
+var import_crypto2 = require("crypto");
+var import_fs2 = require("fs");
+var import_promises5 = require("fs/promises");
+var import_path4 = require("path");
+var import_crypto3 = require("crypto");
+var import_promises6 = require("fs/promises");
+var import_path5 = require("path");
+var import_promises7 = require("fs/promises");
+var import_os2 = require("os");
+var import_path6 = require("path");
+var import_promises8 = require("fs/promises");
+var import_path7 = require("path");
+
+// ../camel/dist/chunk-LAXU2AVK.js
+function conversionPolicyDigest(policy) {
+  return sha256Hex(canonicalJson(policy));
+}
+function registeredIdRegistryDigest(values) {
+  return sha256Hex(canonicalJson(values));
+}
+async function createConversionRegistry(config) {
+  const policies = /* @__PURE__ */ new Map();
+  for (const policy of config.policies) {
+    validatePolicyShape(policy);
+    if (policies.has(policy.conversionId)) throw new CamelError("state_conflict", "Conversion IDs must be unique.");
+    const { digest: _digest, ...definition } = policy;
+    if (await conversionPolicyDigest(definition) !== policy.digest) throw new CamelError("state_conflict", "Conversion policy digest mismatch.");
+    if (policy.output.kind === "registered_id") {
+      const registry = config.registeredIds?.[policy.output.registryId];
+      const validValues = registry && Object.entries(registry.values).every(([candidate, id]) => candidate.length > 0 && typeof id === "string" && id.length > 0);
+      if (!registry || !validValues || registry.digest !== policy.output.registryDigest || await registeredIdRegistryDigest(registry.values) !== registry.digest) {
+        throw new CamelError("state_conflict", "Registered-ID registry digest mismatch.");
+      }
+    }
+    policies.set(policy.conversionId, Object.freeze(policy));
+  }
+  const outputCounts = /* @__PURE__ */ new Map();
+  const get = (id, kind) => {
+    const policy = policies.get(id);
+    if (!policy || policy.output.kind !== kind) throw new CamelError("conversion_rejected", "Conversion policy is missing or has the wrong output kind.");
+    return policy;
+  };
+  const checked = (source, id, kind) => {
+    const policy = get(id, kind);
+    if (utf8Length(source.value) > policy.maximumSourceBytes) throw new CamelError("limit_exceeded", "Unsafe conversion input exceeds its byte bound.");
+    return policy;
+  };
+  const emit = (source, policy, value) => convert(source, policy, value, outputCounts);
+  const operations = Object.freeze({
+    boolean: async (value, id) => {
+      const policy = checked(value, id, "boolean");
+      return emit(value, policy, requireBoolean(value.value));
+    },
+    integer: async (value, id) => {
+      const policy = checked(value, id, "integer");
+      return emit(value, policy, boundedInteger(value.value, policy.output));
+    },
+    finiteNumber: async (value, id) => {
+      const policy = checked(value, id, "finite_number");
+      return emit(value, policy, boundedNumber(value.value, policy.output));
+    },
+    enum: async (value, id) => {
+      const policy = checked(value, id, "enum");
+      return emit(value, policy, enumMember(value.value, policy.output));
+    },
+    date: async (value, id) => {
+      const policy = checked(value, id, "date");
+      return emit(value, policy, canonicalDate(value.value, policy.output));
+    },
+    registeredId: async (value, id) => {
+      const policy = checked(value, id, "registered_id");
+      const registry = config.registeredIds?.[policy.output.registryId];
+      const output = typeof value.value === "string" ? registry?.values[value.value] : void 0;
+      if (!output) throw new CamelError("conversion_rejected", "Registered-ID conversion rejected the candidate.");
+      return emit(value, policy, output);
+    },
+    digest: async (value, id) => {
+      const policy = checked(value, id, "digest");
+      if (!(value.value instanceof Uint8Array)) throw new CamelError("conversion_rejected", "Digest conversion requires bytes.");
+      return emit(value, policy, await sha256Hex(value.value));
+    },
+    measure: async (value, metric, id) => {
+      const policy = checked(value, id, "integer");
+      const measured = measure(value.value, metric);
+      return emit(value, policy, boundedInteger(measured, policy.output));
+    },
+    test: async (value, predicateId, id) => {
+      const policy = checked(value, id, "boolean");
+      const predicate = config.predicates?.[predicateId];
+      if (!predicate) throw new CamelError("conversion_rejected", "Predicate is not registered.");
+      return emit(value, policy, evaluatePredicate(value.value, predicate, config.registeredIds));
+    }
+  });
+  return Object.freeze({ operations, policy: (id) => policies.get(id) ?? missingPolicy() });
+}
+async function convert(source, policy, value, counts) {
+  const sourceKey = sourceIdentity(source);
+  const countKey = `${policy.conversionId}\0${sourceKey}`;
+  const count = counts.get(countKey) ?? 0;
+  if (count >= policy.maximumOutputsPerArtifact) throw new CamelError("limit_exceeded", "Conversion output count exceeds its per-source bound.");
+  counts.set(countKey, count + 1);
+  return createSafeInternal(value, "atomic_conversion", {
+    readers: source.label.readers,
+    provenance: [...source.label.provenance, { kind: "converter", id: policy.conversionId, digest: policy.digest }],
+    dependencies: dependenciesOf([source])
+  });
+}
+function validatePolicyShape(policy) {
+  if (!policy.conversionId || !Number.isSafeInteger(policy.version) || policy.version < 1 || !policy.digest) throw new CamelError("state_conflict", "Conversion policy identity is invalid.");
+  if (!Number.isSafeInteger(policy.maximumSourceBytes) || policy.maximumSourceBytes < 0 || !Number.isSafeInteger(policy.maximumOutputsPerArtifact) || policy.maximumOutputsPerArtifact < 1) throw new CamelError("state_conflict", "Conversion policy bounds are invalid.");
+  const output = policy.output;
+  if ((output.kind === "integer" || output.kind === "finite_number") && (!Number.isFinite(output.minimum) || !Number.isFinite(output.maximum) || output.minimum > output.maximum)) throw new CamelError("state_conflict", "Numeric conversion bounds are invalid.");
+  if (output.kind === "finite_number" && (!Number.isSafeInteger(output.maximumDecimalPlaces) || output.maximumDecimalPlaces < 0 || output.maximumDecimalPlaces > 15)) throw new CamelError("state_conflict", "Decimal-place bound is invalid.");
+  if (output.kind === "enum" && (output.values.length === 0 || output.values.some((value) => typeof value !== "string" || !value) || new Set(output.values).size !== output.values.length)) throw new CamelError("state_conflict", "Enum conversion members must be unique and non-empty.");
+  if (output.kind === "registered_id" && (!output.registryId || !output.registryDigest)) throw new CamelError("state_conflict", "Registered-ID conversion identity is invalid.");
+  if (output.kind === "date" && output.format !== "date" && output.format !== "rfc3339") throw new CamelError("state_conflict", "Date conversion format is invalid.");
+  if (output.kind === "digest" && output.algorithm !== "sha256") throw new CamelError("state_conflict", "Digest conversion algorithm is invalid.");
+}
+function requireBoolean(value) {
+  if (typeof value !== "boolean") throw new CamelError("conversion_rejected", "Boolean conversion requires a structured boolean.");
+  return value;
+}
+function boundedInteger(value, spec) {
+  if (spec.kind !== "integer" || typeof value !== "number" || !Number.isSafeInteger(value) || value < spec.minimum || value > spec.maximum) throw new CamelError("conversion_rejected", "Integer conversion rejected the structured value.");
+  return value;
+}
+function boundedNumber(value, spec) {
+  if (spec.kind !== "finite_number" || typeof value !== "number" || !Number.isFinite(value) || value < spec.minimum || value > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
+  const text = String(value);
+  if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  return value;
+}
+function enumMember(value, spec) {
+  if (spec.kind !== "enum" || typeof value !== "string") throw new CamelError("conversion_rejected", "Enum conversion requires a structured string member.");
+  const member = spec.caseSensitive ? spec.values.find((item) => item === value) : spec.values.find((item) => item.toLocaleLowerCase("en-US") === value.toLocaleLowerCase("en-US"));
+  if (member === void 0) throw new CamelError("conversion_rejected", "Enum conversion rejected a non-member.");
+  return member;
+}
+function canonicalDate(value, spec) {
+  if (spec.kind !== "date" || typeof value !== "string") throw new CamelError("conversion_rejected", "Date conversion requires a canonical structured string.");
+  const pattern = spec.format === "date" ? /^\d{4}-\d{2}-\d{2}$/ : /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+  const instant = Date.parse(spec.format === "date" ? `${value}T00:00:00Z` : value);
+  if (!pattern.test(value) || !Number.isFinite(instant) || spec.format === "date" && new Date(instant).toISOString().slice(0, 10) !== value) throw new CamelError("conversion_rejected", "Date conversion rejected a non-canonical value.");
+  if (spec.earliest && value < spec.earliest || spec.latest && value > spec.latest) throw new CamelError("conversion_rejected", "Date conversion rejected an out-of-range value.");
+  return value;
+}
+function measure(value, metric) {
+  if (metric === "byte_length" && (typeof value === "string" || value instanceof Uint8Array)) return utf8Length(value);
+  if (metric === "codepoint_length" && typeof value === "string") return [...value].length;
+  if (metric === "item_count" && Array.isArray(value)) return value.length;
+  throw new CamelError("conversion_rejected", "Measurement input does not match the registered metric.");
+}
+function evaluatePredicate(value, predicate, registries) {
+  if (predicate.kind === "has_fields") return typeof value === "object" && value !== null && !Array.isArray(value) && predicate.fields.every((field) => Object.hasOwn(value, field));
+  if (predicate.kind === "registered_id") return typeof value === "string" && registries?.[predicate.registryId]?.values[value] !== void 0;
+  const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+  return actual === predicate.valueType;
+}
+function sourceIdentity(source) {
+  const artifact = [...source.label.provenance, ...source.label.dependencies.map((dependency) => dependency.ref)].find((ref2) => ref2.kind === "artifact");
+  const fallback = source.label.provenance[0];
+  if (!artifact && !fallback) throw new CamelError("conversion_rejected", "Conversion source has no immutable provenance.");
+  const ref = artifact ?? fallback;
+  return `${ref.kind}:${ref.id}:${ref.digest ?? ""}`;
+}
+function missingPolicy() {
+  throw new CamelError("conversion_rejected", "Conversion policy is not registered.");
+}
+
+// ../camel/dist/chunk-P2WQIAG6.js
+function createCamelIngress(constants2 = []) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const item of constants2) {
+    if (!item.id || byId.has(item.id)) throw new CamelError("state_conflict", "Control constant IDs must be unique and non-empty.");
+    assertNoUnsafeConstant(item.value);
+    byId.set(item.id, item);
+  }
+  const ingress = {
+    userInstruction: (value, input) => createSafeInternal(value, "user_instruction", metadata("user_instruction", input.id, input.readers)),
+    systemPolicy: (value, input) => createSafeInternal(value, "system_policy", metadata("system_policy", input.id, input.readers)),
+    control: (id) => {
+      const item = byId.get(id);
+      if (!item) throw new CamelError("permission_denied", "Unknown control constant.");
+      return createSafeInternal(item.value, "harness_constant", metadata("harness", id, item.readers));
+    },
+    external: (value, label) => createUnsafeInternal(value, label),
+    quarantinedOutput: (value, input) => {
+      if (!input.runId) throw new CamelError("state_conflict", "Quarantined run IDs must be non-empty.");
+      return createUnsafeInternal(value, {
+        readers: input.readers,
+        dependencies: input.dependencies,
+        provenance: [{ kind: "quarantined_llm", id: input.runId, digest: input.digest }]
+      });
+    }
+  };
+  return Object.freeze(ingress);
+}
+function assertNoUnsafeConstant(value, seen = /* @__PURE__ */ new WeakSet()) {
+  if (typeof value !== "object" || value === null || seen.has(value)) return;
+  seen.add(value);
+  if (isCamelValue(value)) {
+    if (isUnsafe(value)) throw new CamelError("unsafe_privileged_flow", "Control constants cannot contain Prompt-Unsafe values.");
+    assertNoUnsafeConstant(value.value, seen);
+    return;
+  }
+  for (const child of Object.values(value)) assertNoUnsafeConstant(child, seen);
+}
+function metadata(kind, id, readers) {
+  if (!id) throw new CamelError("state_conflict", "Provenance IDs must be non-empty.");
+  return { readers, provenance: [{ kind, id }] };
+}
+
+// ../camel/dist/policy.js
+function createEffectPolicy(config = {}) {
+  const approvalEffects = new Set(config.approvalEffects ?? ["irreversible_mutation", "external_send", "financial", "secret_read", "code_execution"]);
+  const registries = copyRegistries(config.destinationRegistries ?? {});
+  return Object.freeze({ evaluate: (input) => evaluate(input, registries, approvalEffects) });
+}
+function destinationRegistryDigest(values) {
+  return sha256Hex(canonicalJson([...values].sort()));
+}
+async function evaluate(input, registries, approvals) {
+  const actionDigest = await sha256Hex(canonicalJson(input));
+  const decisionId = `decision_${actionDigest.slice(0, 24)}`;
+  const deny = (reasonCode) => ({ outcome: "deny", decisionId, reasonCode });
+  if (!input.planId || !input.tool.name || !input.tool.policyId || !Number.isSafeInteger(input.tool.version)) return deny("invalid_descriptor");
+  const expectedPaths = Object.keys(input.tool.argumentRoles).sort();
+  const actualPaths = Object.keys(input.args).sort();
+  if (expectedPaths.length !== actualPaths.length || expectedPaths.some((path, index) => path !== actualPaths[index])) return deny("argument_shape_mismatch");
+  const confined = /* @__PURE__ */ new Set();
+  for (const [path, arg] of Object.entries(input.args)) {
+    if (arg.role !== input.tool.argumentRoles[path]) return deny("argument_role_mismatch");
+    const invalid3 = await validateArgument(path, arg, input.tool, registries);
+    if (invalid3) return deny(invalid3);
+    if (arg.role === "selector" && !isSafe(arg.value)) confined.add(arg.value);
+  }
+  if (input.controlDependencies.some((value) => !isSafe(value) && !confined.has(value))) return deny("unsafe_control_dependency");
+  if (confined.size > 0) {
+    const fixed = input.tool.unsafeSelectorPolicy?.fixedProviderIds ?? [];
+    const destinations = Object.values(input.args).filter((arg) => arg.role === "destination");
+    if (destinations.length === 0 || destinations.some((arg) => !fixed.includes(arg.value.value))) return deny("unsafe_selector_provider_mismatch");
+  }
+  const readerValues = input.intendedReaderIds ?? [];
+  if (readerValues.some((reader) => !isSafe(reader) || typeof reader.value !== "string" || !reader.value || !isControlOwned(reader))) return deny("invalid_reader");
+  const readers = readerValues.map((reader) => reader.value);
+  for (const arg of Object.values(input.args)) {
+    if (readers.some((reader) => !canRead(arg.value.label.readers, reader))) return deny("reader_mismatch");
+  }
+  const hasUnsafePayload = Object.values(input.args).some((arg) => arg.role === "payload" && !isSafe(arg.value));
+  if (hasUnsafePayload && input.tool.effect === "external_send" && readers.length === 0) return deny("reader_required");
+  if (approvals.has(input.tool.effect)) return { outcome: "require_approval", decisionId, reasonCode: "effect_requires_approval", actionDigest };
+  return { outcome: "allow", decisionId };
+}
+async function validateArgument(path, arg, tool, registries) {
+  if (arg.role === "instruction" && !isSafe(arg.value)) return "unsafe_instruction_argument";
+  if (arg.role === "authority") {
+    if (!isSafe(arg.value)) return "unsafe_authority_argument";
+    if (!isControlOwned(arg.value)) return "authority_not_control_owned";
+  }
+  if (arg.role === "destination") {
+    if (!isSafe(arg.value)) return "unsafe_destination_argument";
+    if (!isControlOwned(arg.value)) return "destination_not_control_owned";
+    const registry = registries[arg.registryId];
+    const validValues = registry && registry.values.length > 0 && registry.values.every((value) => typeof value === "string" && value.length > 0) && new Set(registry.values).size === registry.values.length;
+    if (!registry || !validValues || registry.digest !== arg.registryDigest || await destinationRegistryDigest(registry.values) !== registry.digest || !registry.values.includes(arg.value.value)) return "destination_not_registered";
+  }
+  if (arg.role === "selector" && !isSafe(arg.value)) return validateUnsafeSelector(path, arg.value, tool);
+  return void 0;
+}
+function isControlOwned(value) {
+  return value.label.safeBasis === "system_policy" || value.label.safeBasis === "harness_constant";
+}
+function copyRegistries(registries) {
+  return Object.freeze(Object.fromEntries(Object.entries(registries).map(([id, registry]) => [id, Object.freeze({ digest: registry.digest, values: Object.freeze([...registry.values]) })])));
+}
+function validateUnsafeSelector(path, value, tool) {
+  const policy = tool.unsafeSelectorPolicy;
+  if (!policy || policy.effect !== tool.effect || !policy.selectorPaths.includes(path)) return "unsafe_selector_not_confined";
+  if (!policy.fixedDestination || !policy.unsafeOutput || policy.fixedProviderIds.length === 0) return "unsafe_selector_not_confined";
+  if (![policy.maximumCalls, policy.maximumResultsPerCall, policy.maximumOutputBytes, policy.maximumSelectorBytes].every((bound) => Number.isSafeInteger(bound) && bound > 0)) return "unsafe_selector_not_confined";
+  if (utf8Length(value.value) > policy.maximumSelectorBytes) return "unsafe_selector_too_large";
+  if (typeof value.value === "string" && looksLikeDestination(value.value)) return "unsafe_selector_is_destination";
+  return void 0;
+}
+function looksLikeDestination(value) {
+  const text = value.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
+}
+
+// ../harness/dist/chunk-RVUUURK2.js
+var import_crypto4 = require("crypto");
+var CODE_RUNTIME_PROTOCOL_VERSION = 1;
+async function runCodeRuntimeHeartbeatLoop(options) {
+  const heartbeatMs = options.heartbeatMs ?? 15e3;
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new TypeError("heartbeatMs must be an integer from 1000 to 300000");
+  }
+  let retryMs = 1e3;
+  do {
+    if (options.signal?.aborted) return;
+    try {
+      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);
+      await options.onSnapshot?.(snapshot);
+      retryMs = 1e3;
+      if (options.once) return;
+      await wait(heartbeatMs, options.signal);
+    } catch (error) {
+      if (options.signal?.aborted) return;
+      if (options.once || !retryableControlFailure(error)) throw error;
+      await options.onRetry?.(error, retryMs);
+      await wait(retryMs, options.signal);
+      retryMs = Math.min(retryMs * 2, 3e4);
+    }
+  } while (!options.signal?.aborted);
+}
+var CodeRuntimeReconciler = class {
+  constructor(control, engine) {
+    this.control = control;
+    this.engine = engine;
+  }
+  control;
+  engine;
+  results = /* @__PURE__ */ new Map();
+  async reconcile(snapshot) {
+    for (const command of snapshot.commands) {
+      let completed = this.results.get(command.commandId);
+      if (!completed) {
+        let result;
+        try {
+          result = await this.engine.execute(command);
+        } catch (error) {
+          result = { status: "failed", message: (error instanceof Error ? error.message : String(error)).slice(0, 2e3) };
+        }
+        completed = { result, notified: false };
+        this.results.set(command.commandId, completed);
+        if (this.results.size > 1024) this.results.delete(this.results.keys().next().value);
+      }
+      await this.control.acknowledge(command.commandId, completed.result);
+      if (!completed.notified) {
+        await this.engine.acknowledged?.(command, completed.result);
+        completed.notified = true;
+      }
+    }
+  }
+};
+function retryableControlFailure(value) {
+  if (!value || typeof value !== "object") return false;
+  const failure = value;
+  if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
+  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
+}
+function wait(ms, signal) {
+  return new Promise((resolve52) => {
+    if (signal?.aborted) return resolve52();
+    const timer = setTimeout(resolve52, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve52();
+    }, { once: true });
+  });
+}
+var CodeRuntimeControlError = class extends Error {
+  constructor(message3, status, code = "control_error") {
+    super(message3);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+  name = "CodeRuntimeControlError";
+};
+function createCodeRuntimeControlClient(options) {
+  const endpoint = validatedEndpoint(options.endpoint);
+  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
+  const requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
+    throw new TypeError("requestTimeoutMs must be an integer from 1000 to 120000");
+  }
+  const request = options.fetch ?? fetch;
+  const call = async (path, body) => {
+    const timeout = AbortSignal.timeout(requestTimeoutMs);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    let response2;
+    try {
+      response2 = await request(`${endpoint}${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal
+      });
+    } catch (cause) {
+      if (options.signal?.aborted) throw cause;
+      throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
+    }
+    const value = await response2.json().catch(() => null);
+    if (!response2.ok) {
+      const problem = record3(record3(value)?.error);
+      throw new CodeRuntimeControlError(
+        typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
+        response2.status,
+        typeof problem?.code === "string" ? problem.code : void 0
+      );
+    }
+    return value;
+  };
+  return {
+    heartbeat: async (version, capabilities) => {
+      validateHeartbeat(version, capabilities);
+      return parseSnapshot(await call("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+    },
+    acknowledge: async (commandId, result) => {
+      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
+      await call(`/registry/code/runtime/commands/${commandId}/ack`, result);
+    },
+    source: async (sessionId) => parseSource(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+    ),
+    infer: async (sessionId, inference) => {
+      const value = record3(await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`, inference));
+      if (!value || value.requestId !== inference.requestId || !record3(value.response) || !record3(value.receipt)) {
+        throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
+      }
+      return value;
+    },
+    review: async (sessionId, review) => parseReview(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review)
+    ),
+    submitCandidate: async (sessionId, checkpointId, verification) => {
+      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
+      return parseCandidate(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
+        { checkpointId, verification }
+      ));
+    },
+    appendSessionEvent: async (sessionId, eventId, event) => {
+      const serialized = JSON.stringify(event);
+      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
+        throw new TypeError("invalid Code session event");
+      }
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+    },
+    reportSessionFailure: async (sessionId, message3) => {
+      if (!message3.trim() || message3.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message3 });
+    }
+  };
+}
+function validatedEndpoint(value) {
+  const endpoint = value.replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(endpoint);
+  } catch {
+    throw new TypeError("endpoint must be an HTTPS URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.username || url.password || url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new TypeError("endpoint must use HTTPS (HTTP is allowed only for loopback testing)");
+  }
+  return endpoint;
+}
+function validSessionId(value) {
+  if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code session id");
+  return value;
+}
+function validateHeartbeat(version, capabilities) {
+  if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
+  if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError("unsupported Code runtime protocol version");
+  if (capabilities.platform !== "macos" && capabilities.platform !== "linux") throw new TypeError("invalid runtime platform");
+  if (!capabilities.arch || !capabilities.engines.length || !capabilities.engines.every((engine) => ["container", "podman", "docker"].includes(engine))) {
+    throw new TypeError("runtime arch and supported engine are required");
+  }
+  if (!Number.isSafeInteger(capabilities.cpuCount) || capabilities.cpuCount < 1 || !Number.isSafeInteger(capabilities.memoryBytes) || capabilities.memoryBytes < 1) {
+    throw new TypeError("runtime resources must be positive integers");
+  }
+}
+function parseSnapshot(value) {
+  const root = record3(value);
+  const host = record3(root?.host);
+  if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
+  const bindingIds = /* @__PURE__ */ new Set();
+  const bindings = root.bindings.map((item) => {
+    const binding = record3(item);
+    if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
+      throw invalid("binding");
+    }
+    bindingIds.add(binding.bindingId);
+    return binding;
+  });
+  const commandIds = /* @__PURE__ */ new Set();
+  const commandSequences = /* @__PURE__ */ new Set();
+  const commands = root.commands.map((item) => {
+    const command = record3(item);
+    const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
+    const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record3(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    commandIds.add(command.commandId);
+    commandSequences.add(sequenceKey);
+    return command;
+  });
+  return { host, bindings, commands };
+}
+async function parseSource(value) {
+  const snapshot = record3(record3(value)?.snapshot);
+  if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
+  const files = snapshot.files.map((value2) => {
+    const file = record3(value2);
+    if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
+    return { path: file.path, content: file.content };
+  });
+  const source = { repository: snapshot.repository, commitSha: snapshot.commitSha, files };
+  const digest2 = await digestCodeRepositorySnapshot(source, { maximumFiles: 1e4, maximumBytes: 16 * 1024 * 1024 });
+  if (digest2 !== snapshot.treeDigest) throw invalid("source digest");
+  return { ...source, treeDigest: digest2 };
+}
+function parseReview(value) {
+  const review = record3(record3(value)?.review);
+  if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
+  return review;
+}
+function parseCandidate(value) {
+  const candidate = record3(record3(value)?.candidate);
+  if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
+    throw invalid("candidate");
+  }
+  return { candidateId: candidate.candidateId, status: candidate.status };
+}
+var record3 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
+var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+var PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;
+function validateCodePatch(patch2, maxBytes) {
+  if (!patch2 || Buffer.byteLength(patch2) > maxBytes || patch2.includes("\0") || patch2.includes("\r")) {
+    throw new TypeError("patch is empty, malformed, or exceeds its byte limit");
+  }
+  if (FORBIDDEN.test(patch2) || /(?:old|new)(?: file)? mode 120000/.test(patch2)) {
+    throw new TypeError("patch uses a forbidden binary, link, mode, rename, or copy operation");
+  }
+  const paths = [];
+  const lines = patch2.split("\n");
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!line.startsWith("diff --git ")) continue;
+    const match = /^diff --git a\/(\S+) b\/(\S+)$/.exec(line);
+    const path = match?.[1];
+    if (!path || !match?.[2] || path !== match[2]) throw new TypeError("patch must use one unquoted relative path per diff");
+    validateRelativePath(path);
+    const header = lines.slice(index + 1).findIndex((candidate) => candidate.startsWith("diff --git "));
+    const section = lines.slice(index + 1, header < 0 ? lines.length : index + 1 + header);
+    const oldPath = section.find((candidate) => candidate.startsWith("--- "))?.slice(4);
+    const newPath = section.find((candidate) => candidate.startsWith("+++ "))?.slice(4);
+    if (!validHeaderPath(oldPath, path, "a") || !validHeaderPath(newPath, path, "b")) {
+      throw new TypeError("patch file headers do not match the declared path");
+    }
+    paths.push(path);
+  }
+  if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
+  return paths;
+}
+function validHeaderPath(value, path, prefix) {
+  return value === "/dev/null" || value === `${prefix}/${path}`;
+}
+function validateRelativePath(path) {
+  const parts = path.split("/");
+  if (!PATH.test(path) || parts.some((part) => part === "." || part === ".." || RESERVED.has(part)) || parts.some((part) => SECRET.test(part))) {
+    throw new TypeError("path is outside the allowed staged source tree");
+  }
+}
+function resolveCodePath(workspaceDir, path) {
+  validateRelativePath(path);
+  const root = (0, import_path3.resolve)(workspaceDir);
+  const target = (0, import_path3.resolve)(root, path);
+  if (target !== root && !target.startsWith(`${root}${import_path3.sep}`)) throw new TypeError("path escapes the staged workspace");
+  return target;
+}
+async function applyCodePatch(workspaceDir, patch2, paths) {
+  await gitApply(workspaceDir, patch2, true);
+  await gitApply(workspaceDir, patch2, false);
+  for (const path of paths) {
+    try {
+      const info = await (0, import_promises4.lstat)(resolveCodePath(workspaceDir, path));
+      if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
+        throw new TypeError("patch created a non-regular workspace entry");
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+    }
+  }
+}
+function gitApply(cwd, patch2, check) {
+  return new Promise((accept, reject) => {
+    const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
+    const child = (0, import_child_process3.spawn)("git", args, {
+      cwd,
+      shell: false,
+      stdio: ["pipe", "ignore", "pipe"],
+      env: { PATH: process.env.PATH ?? "", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null" }
+    });
+    let stderr = "";
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (text) => {
+      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
+    child.stdin.end(patch2);
+  });
+}
+async function createCodeWorkspaceCheckpoint(input) {
+  const maximum = input.maximumPatchBytes ?? 256 * 1024;
+  if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 256 * 1024) {
+    throw new TypeError("checkpoint patch bound must be from 1 to 262144 bytes");
+  }
+  const patch2 = await input.workspace.patch(maximum);
+  if (patch2) validateCodePatch(patch2, maximum);
+  return createCodePortableCheckpoint({ baseCommitSha: input.baseCommitSha, patch: patch2, state: input.state });
+}
+async function restoreCodeWorkspaceCheckpoint(input) {
+  const checkpoint = await verifyCodePortableCheckpoint(input.checkpoint);
+  if (checkpoint.baseCommitSha !== input.trustedBaseCommitSha) {
+    throw new TypeError("checkpoint trusted base does not match the fetched commit");
+  }
+  const workspace = await stageWorkspace(input.trustedBaseDir, input.stage);
+  try {
+    if (checkpoint.patch) {
+      const paths = validateCodePatch(checkpoint.patch, 256 * 1024);
+      await applyCodePatch(workspace.workspaceDir, checkpoint.patch, paths);
+    }
+    return { workspace, checkpoint };
+  } catch (error) {
+    await workspace.cleanup();
+    throw error;
+  }
+}
+var ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
+var PRIVATE_ARTIFACT_PART = /^(?:\.git|\.odla|\.wrangler|\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json)$/i;
+function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_crypto.randomUUID)().slice(0, 12)}`) {
+  assertCodeBuildRecipe(recipe2);
+  if (/[,\r\n]/.test(workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
+  const uid = typeof import_process2.getuid === "function" ? (0, import_process2.getuid)() : 1e3;
+  const gid = typeof import_process2.getgid === "function" ? (0, import_process2.getgid)() : 1e3;
+  const limits = {
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfs: recipe2.tmpfsBytes ?? 64 * 1024 * 1024
+  };
+  if (engine === "container") {
+    return [
+      "run",
+      "--rm",
+      `--name=${name}`,
+      "--network=none",
+      "--read-only",
+      "--cap-drop=ALL",
+      `--memory=${limits.memory}`,
+      `--cpus=${limits.cpus}`,
+      `--user=${uid}:${gid}`,
+      "--tmpfs=/tmp",
+      `--mount=type=bind,source=${workspaceDir},target=/workspace`,
+      "--workdir=/workspace",
+      "--env=CI=1",
+      recipe2.image,
+      ...recipe2.command
+    ];
+  }
+  return [
+    "run",
+    "--rm",
+    `--name=${name}`,
+    "--pull=never",
+    "--network=none",
+    "--read-only",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--pids-limit=${limits.pids}`,
+    `--memory=${limits.memory}`,
+    `--cpus=${limits.cpus}`,
+    `--user=${uid}:${gid}`,
+    `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfs}`,
+    `--mount=type=bind,src=${workspaceDir},dst=/workspace`,
+    "--workdir=/workspace",
+    "--env=CI=1",
+    recipe2.image,
+    ...recipe2.command
+  ];
+}
+function createContainerRecipeExecutor(engine) {
+  return {
+    async run(input) {
+      await verifyContainerEngineBoundary(engine);
+      const name = `odla-recipe-${(0, import_crypto.randomUUID)().slice(0, 12)}`;
+      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);
+      return execute(engine, args, name, input.recipe, input.signal);
+    }
+  };
+}
+function assertCodeBuildRecipe(recipe2) {
+  const memoryBytes = parseMemory(recipe2.memory ?? "1g");
+  const tmpfsBytes = recipe2.tmpfsBytes ?? 64 * 1024 * 1024;
+  const artifacts = recipe2.expectedArtifacts ?? [];
+  assertPinnedImage(recipe2.image);
+  if (!/^[A-Za-z0-9._:-]{1,120}$/.test(recipe2.id) || recipe2.command.length < 1 || recipe2.command.length > 64 || recipe2.command.some((part) => !part || part.length > 4096 || /[\0\r\n]/.test(part)) || !Number.isSafeInteger(recipe2.timeoutMs) || recipe2.timeoutMs < 1 || recipe2.timeoutMs > 30 * 6e4 || !Number.isSafeInteger(recipe2.maxOutputBytes) || recipe2.maxOutputBytes < 1 || recipe2.maxOutputBytes > 16 * 1024 * 1024 || !Number.isFinite(recipe2.cpus ?? 1) || (recipe2.cpus ?? 1) < 0.1 || (recipe2.cpus ?? 1) > 32 || memoryBytes < 64 * 1024 * 1024 || memoryBytes > 32 * 1024 * 1024 * 1024 || !Number.isSafeInteger(recipe2.pids ?? 256) || (recipe2.pids ?? 256) < 16 || (recipe2.pids ?? 256) > 4096 || !Number.isSafeInteger(tmpfsBytes) || tmpfsBytes < 1024 * 1024 || tmpfsBytes > 1024 * 1024 * 1024 || artifacts.length > 64 || new Set(artifacts.map((item) => item.id)).size !== artifacts.length || artifacts.some((item) => !/^[A-Za-z0-9._:-]{1,120}$/.test(item.id) || !ARTIFACT_PATH.test(item.path) || item.path.split("/").some((part) => PRIVATE_ARTIFACT_PART.test(part)) || !Number.isSafeInteger(item.maximumBytes) || item.maximumBytes < 1 || item.maximumBytes > 512 * 1024 * 1024)) {
+    throw new TypeError("build recipe is malformed or exceeds its control bounds");
+  }
+}
+function parseMemory(value) {
+  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value.toLowerCase());
+  if (!match?.[1] || !match[2]) return 0;
+  const scale = match[2] === "k" ? 1024 : match[2] === "m" ? 1024 ** 2 : 1024 ** 3;
+  return Number(match[1]) * scale;
+}
+function execute(engine, args, name, recipe2, signal) {
+  return new Promise((accept, reject) => {
+    const started = Date.now();
+    const child = (0, import_child_process4.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    let bytes = 0;
+    let outputLimitExceeded = false;
+    let timedOut = false;
+    let stopping = false;
+    const stop = (reason) => {
+      if (stopping) return;
+      stopping = true;
+      timedOut = reason === "timeout";
+      outputLimitExceeded = reason === "output";
+      const remove = engine === "container" ? ["delete", "--force", name] : ["rm", "-f", name];
+      const killer = (0, import_child_process4.spawn)(engine, remove, { shell: false, stdio: "ignore" });
+      killer.unref();
+      child.kill("SIGTERM");
+    };
+    const collect = (target) => (chunk) => {
+      bytes += chunk.byteLength;
+      if (bytes > recipe2.maxOutputBytes) stop("output");
+      else target.push(chunk);
+    };
+    child.stdout.on("data", collect(stdout));
+    child.stderr.on("data", collect(stderr));
+    const abort = () => stop("abort");
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) abort();
+    const timer = setTimeout(() => stop("timeout"), recipe2.timeoutMs);
+    child.once("error", (error) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      reject(error);
+    });
+    child.once("exit", (code) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      accept({
+        exitCode: code ?? 1,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        durationMs: Date.now() - started,
+        outputLimitExceeded,
+        timedOut
+      });
+    });
+  });
+}
+async function digestStagedWorkspace(root, limits) {
+  const files = [];
+  const walk = async (directory) => {
+    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
+      const target = (0, import_path5.resolve)(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        files.push({ path: (0, import_path5.relative)(root, target).split("\\").join("/"), target });
+        if (files.length > limits.maxFiles) throw new TypeError("workspace digest exceeds its file bound");
+      }
+    }
+  };
+  await walk((0, import_path5.resolve)(root));
+  const hash = (0, import_crypto3.createHash)("sha256");
+  let bytes = 0;
+  for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
+    const content = await (0, import_promises6.readFile)(file.target);
+    bytes += Buffer.byteLength(file.path) + content.byteLength;
+    if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
+    hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content.byteLength}:`);
+    hash.update(content);
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+var SHA3 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+var DIGEST3 = /^sha256:[0-9a-f]{64}$/;
+var ID3 = /^[A-Za-z0-9._:-]{1,160}$/;
+var RULE = /^[A-Za-z0-9_@+.,/-]{1,160}$/;
+var DEFAULT_PREFIXES = ["test/", "tests/", "__tests__/"];
+var DEFAULT_SUFFIXES = [".test.js", ".test.ts", ".test.tsx", ".spec.js", ".spec.ts", ".spec.tsx"];
+async function verifyCodeCandidate(input) {
+  const policy = validate2(input);
+  const limits = { maxFiles: policy.maximumFiles, maxBytes: policy.maximumBytes };
+  const staged = await stageWorkspace(input.trustedBaseDir, limits);
+  try {
+    const baseDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    if (baseDigest !== input.trustedBaseDigest) throw new TypeError("trusted base does not match its registered digest");
+    const paths = validateCodePatch(input.candidatePatch, policy.maximumPatchBytes);
+    await applyCodePatch(staged.workspaceDir, input.candidatePatch, paths);
+    const sourceDigest = await digestStagedWorkspace(staged.workspaceDir, limits);
+    const policyDigest = digestPolicy(policy);
+    const patchDigest = digestBytes(input.candidatePatch);
+    const candidateDigest = digestJson({
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest
+    });
+    const changedTests = changedTestPaths(paths, policy);
+    if (changedTests.length > policy.maximumChangedTests) throw new TypeError("candidate changes too many test files");
+    const recipes = [];
+    const logs = [];
+    for (const recipe2 of policy.recipes) {
+      const clean = await stageWorkspace(staged.workspaceDir, limits);
+      try {
+        if (await digestStagedWorkspace(clean.workspaceDir, limits) !== sourceDigest) {
+          throw new TypeError("clean verifier source changed before execution");
+        }
+        const result = checkedResult(await input.recipeExecutor.run({
+          workspaceDir: clean.workspaceDir,
+          recipe: recipe2,
+          signal: input.signal
+        }), recipe2.maxOutputBytes);
+        const artifacts = await inspectArtifacts(clean.workspaceDir, recipe2);
+        recipes.push(recipeReceipt(recipe2, result, artifacts));
+        logs.push({ recipeId: recipe2.id, ...boundedLogs(result, recipe2.maxOutputBytes) });
+      } finally {
+        await clean.cleanup();
+      }
+    }
+    const fields = {
+      schemaVersion: 1,
+      verificationId: input.verificationId ?? `verify-${(0, import_crypto2.randomUUID)()}`,
+      trustedBaseCommitSha: input.trustedBaseCommitSha,
+      trustedBaseDigest: input.trustedBaseDigest,
+      patchDigest,
+      candidateDigest,
+      sourceDigest,
+      policyDigest,
+      recipes,
+      changedTestCount: changedTests.length,
+      changedTestSetDigest: digestJson(changedTests),
+      changedTestsRequireReview: changedTests.length > 0,
+      outcome: recipes.every((recipe2) => recipe2.status === "passed") ? "passed" : "failed"
+    };
+    return {
+      receipt: { ...fields, receiptDigest: await digestCodeVerificationReceipt(fields) },
+      changedTests: Object.freeze(changedTests),
+      logs: Object.freeze(logs)
+    };
+  } finally {
+    await staged.cleanup();
+  }
+}
+function validate2(input) {
+  const policy = input.policy;
+  if (!SHA3.test(input.trustedBaseCommitSha) || !DIGEST3.test(input.trustedBaseDigest) || !ID3.test(input.verificationId ?? "verify-generated") || !ID3.test(policy.policyId) || policy.recipes.length < 1 || policy.recipes.length > 64 || new Set(policy.recipes.map((recipe2) => recipe2.id)).size !== policy.recipes.length) {
+    throw new TypeError("clean verification input is malformed");
+  }
+  for (const recipe2 of policy.recipes) assertCodeBuildRecipe(recipe2);
+  const result = {
+    policyId: policy.policyId,
+    recipes: policy.recipes,
+    testPathPrefixes: policy.testPathPrefixes ?? DEFAULT_PREFIXES,
+    testPathSuffixes: policy.testPathSuffixes ?? DEFAULT_SUFFIXES,
+    maximumChangedTests: policy.maximumChangedTests ?? 1e3,
+    maximumPatchBytes: policy.maximumPatchBytes ?? 256 * 1024,
+    maximumFiles: policy.maximumFiles ?? 2e4,
+    maximumBytes: policy.maximumBytes ?? 512 * 1024 * 1024
+  };
+  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule)) || !integer(result.maximumChangedTests, 0, 1e4) || !integer(result.maximumPatchBytes, 1, 4 * 1024 * 1024) || !integer(result.maximumFiles, 1, 1e5) || !integer(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {
+    throw new TypeError("clean verification policy exceeds its bounds");
+  }
+  return result;
+}
+function changedTestPaths(paths, policy) {
+  return paths.filter((path) => policy.testPathSuffixes.some((suffix) => path.endsWith(suffix)) || policy.testPathPrefixes.some((prefix) => path.startsWith(prefix) || path.includes(`/${prefix}`))).sort();
+}
+function recipeReceipt(recipe2, result, artifacts) {
+  const status = result.timedOut ? "timed_out" : result.outputLimitExceeded ? "output_limited" : result.exitCode === 0 && artifacts.every((item) => item.status === "verified") ? "passed" : "failed";
+  return {
+    recipeId: recipe2.id,
+    recipeDigest: digestRecipe(recipe2),
+    status,
+    exitCode: result.exitCode,
+    durationMs: result.durationMs,
+    artifacts
+  };
+}
+async function inspectArtifacts(workspaceDir, recipe2) {
+  const receipts = [];
+  for (const artifact of recipe2.expectedArtifacts ?? []) {
+    try {
+      const path = (0, import_path4.join)(workspaceDir, artifact.path);
+      const info = await (0, import_promises5.lstat)(path);
+      if (!info.isFile() || info.isSymbolicLink()) {
+        receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
+      } else if (info.size > artifact.maximumBytes) {
+        receipts.push({ artifactId: artifact.id, status: "too_large", bytes: info.size, digest: null });
+      } else {
+        receipts.push({ artifactId: artifact.id, status: "verified", bytes: info.size, digest: await hashFile(path) });
+      }
+    } catch (reason) {
+      if (reason.code !== "ENOENT") throw reason;
+      receipts.push({ artifactId: artifact.id, status: "missing", bytes: null, digest: null });
+    }
+  }
+  return receipts;
+}
+function hashFile(path) {
+  return new Promise((accept, reject) => {
+    const hash = (0, import_crypto2.createHash)("sha256");
+    const stream = (0, import_fs2.createReadStream)(path);
+    stream.on("data", (chunk) => {
+      hash.update(chunk);
+    });
+    stream.once("error", reject);
+    stream.once("end", () => accept(`sha256:${hash.digest("hex")}`));
+  });
+}
+function checkedResult(result, maximumOutputBytes) {
+  if (!integer(result.exitCode, 0, 255) || !integer(result.durationMs, 0, 30 * 6e4) || typeof result.stdout !== "string" || typeof result.stderr !== "string" || typeof result.outputLimitExceeded !== "boolean" || typeof result.timedOut !== "boolean") {
+    throw new TypeError("recipe executor returned an invalid result");
+  }
+  const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
+  return bytes > maximumOutputBytes ? { ...result, outputLimitExceeded: true } : result;
+}
+function boundedLogs(result, maximum) {
+  const stdout = Buffer.from(result.stdout);
+  const stderr = Buffer.from(result.stderr);
+  const first = stdout.subarray(0, maximum);
+  return {
+    stdout: first.toString("utf8"),
+    stderr: stderr.subarray(0, Math.max(0, maximum - first.byteLength)).toString("utf8")
+  };
+}
+function digestPolicy(policy) {
+  return digestJson({
+    policyId: policy.policyId,
+    recipes: policy.recipes.map((recipe2) => normalizedRecipe(recipe2)),
+    testPathPrefixes: [...policy.testPathPrefixes].sort(),
+    testPathSuffixes: [...policy.testPathSuffixes].sort(),
+    maximumChangedTests: policy.maximumChangedTests,
+    maximumPatchBytes: policy.maximumPatchBytes,
+    maximumFiles: policy.maximumFiles,
+    maximumBytes: policy.maximumBytes
+  });
+}
+function digestRecipe(recipe2) {
+  return digestJson(normalizedRecipe(recipe2));
+}
+function normalizedRecipe(recipe2) {
+  return {
+    id: recipe2.id,
+    image: recipe2.image,
+    command: [...recipe2.command],
+    timeoutMs: recipe2.timeoutMs,
+    maxOutputBytes: recipe2.maxOutputBytes,
+    cpus: recipe2.cpus ?? 1,
+    memory: recipe2.memory ?? "1g",
+    pids: recipe2.pids ?? 256,
+    tmpfsBytes: recipe2.tmpfsBytes ?? 64 * 1024 * 1024,
+    expectedArtifacts: [...recipe2.expectedArtifacts ?? []].sort((left, right) => left.id.localeCompare(right.id)).map((artifact) => ({ id: artifact.id, path: artifact.path, maximumBytes: artifact.maximumBytes }))
+  };
+}
+function digestJson(value) {
+  return digestBytes(JSON.stringify(value));
+}
+function digestBytes(value) {
+  return `sha256:${(0, import_crypto2.createHash)("sha256").update(value).digest("hex")}`;
+}
+function integer(value, minimum, maximum) {
+  return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+}
+async function prepareRuntimeCheckpoint(input) {
+  const patch2 = await input.workspace.patch(256 * 1024);
+  let verification = null;
+  let review = null;
+  let note = patch2 ? "Candidate remains untrusted" : "Checkpoint has no source changes";
+  if (patch2 && input.role === "coding") {
+    try {
+      const evidence = await verifyCodeCandidate({
+        verificationId: `verify-${input.sessionId.slice("csess_".length)}`,
+        trustedBaseDir: input.workspace.baselineDir,
+        trustedBaseCommitSha: input.baseCommitSha,
+        trustedBaseDigest: input.trustedBaseDigest,
+        candidatePatch: patch2,
+        policy: {
+          policyId: "code.runtime",
+          recipes: input.recipes,
+          maximumFiles: 1e4,
+          maximumBytes: 16 * 1024 * 1024
+        },
+        recipeExecutor: input.recipeExecutor
+      });
+      if (evidence.receipt.outcome === "passed") {
+        verification = evidence.receipt;
+        review = await input.review(patch2, verification);
+        note = review.verdict === "approved" ? "Clean verification and independent review passed" : "Clean verification passed; independent review rejected the candidate";
+      } else {
+        note = `Clean verification failed: ${evidence.receipt.recipes.filter((recipe2) => recipe2.status !== "passed").map((recipe2) => `${recipe2.recipeId}=${recipe2.status}`).join(", ")}`;
+      }
+    } catch (cause) {
+      note = `Candidate verification or review failed closed: ${message(cause)}`;
+    }
+  }
+  const reviewed = verification && review?.verdict === "approved";
+  const checkpoint = await createCodeWorkspaceCheckpoint({
+    workspace: input.workspace,
+    baseCommitSha: input.baseCommitSha,
+    state: {
+      planCursor: null,
+      conversationRefs: input.conversationRefs,
+      planningInputDigest: input.planningInputDigest,
+      buildPolicyDigest: verification?.policyDigest ?? input.fallbackPolicyDigest,
+      dependencyLayerDigest: null,
+      verificationDigest: verification?.receiptDigest ?? null,
+      reviewDigest: reviewed && review ? review.reviewDigest : null,
+      completedEffects: [],
+      unresolvedApprovals: [],
+      trustStatus: reviewed ? "reviewed" : verification ? "verified" : "candidate_untrusted"
+    }
+  });
+  return { checkpoint, verification, review, note };
+}
+var message = (value) => (value instanceof Error ? value.message : String(value)).slice(0, 500);
+var CodeRuntimeCheckpointManager = class {
+  constructor(options) {
+    this.options = options;
+  }
+  options;
+  #pending = /* @__PURE__ */ new Map();
+  async prepare(command, active) {
+    active.abort.abort("checkpoint_stop");
+    await active.done;
+    const prepared = await prepareRuntimeCheckpoint({
+      sessionId: command.sessionId,
+      role: active.role,
+      workspace: active.workspace,
+      baseCommitSha: active.baseCommitSha,
+      trustedBaseDigest: active.trustedBaseDigest,
+      planningInputDigest: active.planningInputDigest,
+      conversationRefs: active.conversationRefs,
+      fallbackPolicyDigest: this.options.fallbackPolicyDigest,
+      recipes: this.options.recipes,
+      recipeExecutor: this.options.recipeExecutor,
+      review: (patch2, verification) => this.options.control.review(command.sessionId, { patch: patch2, verification })
+    });
+    if (prepared.review?.verdict === "approved" && prepared.verification) {
+      this.#pending.set(command.commandId, { verification: prepared.verification, refs: active.conversationRefs });
+    }
+    await this.options.event(command, { type: "message", actor: "system", body: prepared.note }, active.conversationRefs).catch(() => void 0);
+    await active.workspace.cleanup();
+    await this.options.event(command, { type: "status", status: "checkpointed" }, active.conversationRefs).catch(() => void 0);
+    return { status: "checkpointed", checkpoint: prepared.checkpoint, message: "Pi stopped at a portable checkpoint" };
+  }
+  async acknowledged(command, result) {
+    if (command.kind !== "checkpoint_stop" || result.status !== "checkpointed") return false;
+    const pending = this.#pending.get(command.commandId);
+    if (!pending) return true;
+    const checkpointId = `cpoint_${command.commandId.slice("ccmd_".length)}`;
+    const candidate = await this.options.control.submitCandidate(command.sessionId, checkpointId, pending.verification);
+    await this.options.event(command, {
+      type: "message",
+      actor: "system",
+      body: `Candidate ${candidate.candidateId} is ready for exact owner publication approval`
+    }, pending.refs);
+    this.#pending.delete(command.commandId);
+    return true;
+  }
+};
+var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
+var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
+async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os2.tmpdir)()) {
+  if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
+  const root = await (0, import_promises7.mkdtemp)((0, import_path6.join)(tempRoot, "odla-code-source-"));
+  const sourceDir = (0, import_path6.join)(root, "source");
+  await (0, import_promises7.mkdir)(sourceDir);
+  const seen = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  try {
+    for (const file of snapshot.files) {
+      validatePath(file.path);
+      if (seen.has(file.path)) throw new TypeError("Code source repeats a path");
+      seen.add(file.path);
+      bytes += Buffer.byteLength(file.path) + Buffer.byteLength(file.content);
+      if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
+      const target = (0, import_path6.resolve)(sourceDir, file.path);
+      if (!target.startsWith(`${(0, import_path6.resolve)(sourceDir)}${import_path6.sep}`)) throw new TypeError("Code source path escapes its root");
+      await (0, import_promises7.mkdir)((0, import_path6.dirname)(target), { recursive: true });
+      await (0, import_promises7.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+    }
+    return { sourceDir, cleanup: () => (0, import_promises7.rm)(root, { recursive: true, force: true }) };
+  } catch (cause) {
+    await (0, import_promises7.rm)(root, { recursive: true, force: true });
+    throw cause;
+  }
+}
+function validatePath(path) {
+  const parts = path.split("/");
+  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || parts.some((part) => !part || part === "." || part === ".." || RESERVED2.has(part) || SECRET2.test(part))) {
+    throw new TypeError("Code source contains an unsafe path");
+  }
+}
+var DESTINATIONS = "code-workspaces.v1";
+var READ = descriptor("sandbox.read", "scoped_data_read", {
+  workspace: "destination",
+  authority: "authority",
+  path: "selector",
+  startLine: "selector",
+  endLine: "selector"
+});
+var PATCH = descriptor("sandbox.apply_patch", "reversible_mutation", {
+  workspace: "destination",
+  authority: "authority",
+  patch: "payload"
+});
+var RECIPE = descriptor("sandbox.run_recipe", "code_execution", {
+  workspace: "destination",
+  authority: "authority",
+  recipeId: "selector",
+  sourceDigest: "payload"
+});
+function createCodePolicyGate(options) {
+  return {
+    read: async (input) => {
+      const base = await environment(input, options, "sandbox.read");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.path.v1", "code.paths.v1", input.paths),
+        await conversionPolicy("code.line.v1", { kind: "integer", minimum: 1, maximum: 1e6 })
+      ], { "code.paths.v1": input.paths });
+      const path = await conversions.operations.registeredId(unsafe(base, input.path, "path"), "code.path.v1");
+      const start = await conversions.operations.integer(unsafe(base, input.startLine, "start"), "code.line.v1");
+      const end = await conversions.operations.integer(unsafe(base, input.endLine, "end"), "code.line.v1");
+      if (end.value < start.value) return false;
+      return authorize(input, options, base, READ, {
+        ...base.fixedArgs,
+        path: { role: "selector", value: path },
+        startLine: { role: "selector", value: start },
+        endLine: { role: "selector", value: end }
+      }, [path, start, end]);
+    },
+    patch: async (input) => {
+      const base = await environment(input, options, "sandbox.apply_patch");
+      const patch2 = unsafe(base, input.patch, "patch");
+      return authorize(input, options, base, PATCH, {
+        ...base.fixedArgs,
+        patch: { role: "payload", value: patch2 }
+      }, []);
+    },
+    recipe: async (input) => {
+      const base = await environment(input, options, "sandbox.run_recipe");
+      const conversions = await conversionRegistry([
+        await registeredPolicy("code.recipe.v1", "code.recipes.v1", input.recipeIds)
+      ], { "code.recipes.v1": input.recipeIds });
+      const recipe2 = await conversions.operations.registeredId(unsafe(base, input.recipeId, "recipe"), "code.recipe.v1");
+      const source = unsafe(base, input.sourceDigest, "source");
+      return authorize(input, options, base, RECIPE, {
+        ...base.fixedArgs,
+        recipeId: { role: "selector", value: recipe2 },
+        sourceDigest: { role: "payload", value: source }
+      }, [recipe2]);
+    }
+  };
+}
+function descriptor(name, effect, argumentRoles) {
+  return { name, version: 1, effect, inputSchema: { type: "object" }, argumentRoles, policyId: `odla.code.${name}.v1` };
+}
+async function conversionPolicy(id, output) {
+  const definition = {
+    conversionId: id,
+    version: 1,
+    output,
+    maximumSourceBytes: 1e6,
+    maximumOutputsPerArtifact: 4,
+    presentation: "json_scalar"
+  };
+  return { ...definition, digest: await conversionPolicyDigest(definition) };
+}
+async function registeredPolicy(id, registryId, values) {
+  const mapping = Object.fromEntries(values.map((value) => [value, value]));
+  return conversionPolicy(id, {
+    kind: "registered_id",
+    registryId,
+    registryDigest: await registeredIdRegistryDigest(mapping)
+  });
+}
+async function conversionRegistry(policies, values) {
+  const registeredIds = Object.fromEntries(await Promise.all(Object.entries(values).map(async ([id, entries]) => {
+    const mapping = Object.fromEntries(entries.map((value) => [value, value]));
+    return [id, { values: mapping, digest: await registeredIdRegistryDigest(mapping) }];
+  })));
+  return createConversionRegistry({ policies, registeredIds });
+}
+async function environment(input, options, tool) {
+  const ingress = createCamelIngress([
+    { id: "workspace", value: input.workspaceId, readers: input.readers },
+    { id: "authority", value: `lease:${input.lease.leaseId}`, readers: input.readers },
+    { id: "reader", value: options.readerId, readers: input.readers }
+  ]);
+  const digest2 = await destinationRegistryDigest([input.workspaceId]);
+  const approvals = ["irreversible_mutation", "external_send", "financial", "secret_read"];
+  if (options.recipeAuthorization === "exact_approval") approvals.push("code_execution");
+  const policy = createEffectPolicy({
+    destinationRegistries: { [DESTINATIONS]: { digest: digest2, values: [input.workspaceId] } },
+    approvalEffects: approvals
+  });
+  const fixedArgs = {
+    workspace: { role: "destination", value: ingress.control("workspace"), registryId: DESTINATIONS, registryDigest: digest2 },
+    authority: { role: "authority", value: ingress.control("authority") }
+  };
+  return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
+}
+function unsafe(base, value, field) {
+  return base.ingress.quarantinedOutput(value, {
+    readers: base.reader.label.readers,
+    runId: `${base.runId}:${field}`
+  });
+}
+async function authorize(input, options, base, tool, args, controlDependencies) {
+  const policy = await base.policy.evaluate({
+    planId: input.lease.task.taskId,
+    tool,
+    args,
+    controlDependencies,
+    intendedReaderIds: [base.reader]
+  });
+  let approvalConsumed = false;
+  if (policy.outcome === "require_approval" && options.consumeApproval) {
+    approvalConsumed = await options.consumeApproval(decision(input, policy, false, tool.name, policy.actionDigest));
+  }
+  await options.onDecision?.(decision(input, policy, approvalConsumed, tool.name));
+  return policy.outcome === "allow" || approvalConsumed;
+}
+function decision(input, policy, approvalConsumed, tool, actionDigest) {
+  return {
+    lease: input.lease,
+    request: input.request,
+    tool,
+    policy,
+    approvalConsumed,
+    actionDigest: actionDigest ?? (policy.outcome === "require_approval" ? policy.actionDigest : "")
+  };
+}
+function createCodeToolBroker(options) {
+  validateOptions(options);
+  const recipes = new Map(options.recipes.map((recipe2) => [recipe2.id, recipe2]));
+  const policy = createCodePolicyGate(options);
+  let tail = Promise.resolve();
+  return {
+    execute(context, request) {
+      const result = tail.then(() => route(context, request, options, recipes, policy));
+      tail = result.then(() => void 0, () => void 0);
+      return result;
+    }
+  };
+}
+async function route(context, request, options, recipes, policy) {
+  try {
+    if (context.signal?.aborted) throw new TypeError("tool request was cancelled");
+    if (request.tool === "sandbox.read") return await read(context, request, options, policy);
+    if (request.tool === "sandbox.apply_patch") return await patch(context, request, options, policy);
+    return await recipe(context, request, options, recipes, policy);
+  } catch (reason) {
+    return response(request, false, reason instanceof TypeError ? reason.message : "tool failed closed");
+  }
+}
+async function read(context, request, options, policy) {
+  exactKeys(request.input, ["path", "startLine", "endLine"]);
+  const path = stringField(request.input, "path");
+  const startLine = optionalInteger(request.input.startLine) ?? 1;
+  const endLine = optionalInteger(request.input.endLine) ?? startLine + (options.maxReadLines ?? 2e3) - 1;
+  if (endLine < startLine || endLine - startLine + 1 > (options.maxReadLines ?? 2e3)) {
+    throw new TypeError("requested line range exceeds its bound");
+  }
+  const paths = await registeredFiles(context.workspaceDir, 2e4);
+  const allowed = await policy.read(policyContext(context, request, options, { paths, path, startLine, endLine }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const target = resolveCodePath(context.workspaceDir, path);
+  const info = await (0, import_promises8.stat)(target);
+  if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
+    throw new TypeError("file is not a bounded regular source file");
+  }
+  const source = await (0, import_promises8.readFile)(target);
+  if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
+  const lines = source.toString("utf8").split("\n");
+  const content = lines.slice(startLine - 1, endLine).join("\n");
+  if (Buffer.byteLength(content) > (options.maxReadBytes ?? 128 * 1024)) {
+    throw new TypeError("read result exceeds its byte bound");
+  }
+  return response(request, true, content, { path, startLine, endLine: Math.min(endLine, lines.length) });
+}
+async function patch(context, request, options, policy) {
+  exactKeys(request.input, ["patch"]);
+  const value = stringField(request.input, "patch");
+  const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  const allowed = await policy.patch(policyContext(context, request, options, { patch: value }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  await applyCodePatch(context.workspaceDir, value, paths);
+  return response(request, true, `Applied patch to ${paths.length} file(s).`, { paths });
+}
+async function recipe(context, request, options, recipes, policy) {
+  exactKeys(request.input, ["recipeId"]);
+  const recipeId = stringField(request.input, "recipeId");
+  const digestLimits = {
+    maxFiles: options.maxRecipeWorkspaceFiles ?? 2e4,
+    maxBytes: options.maxRecipeWorkspaceBytes ?? 512 * 1024 * 1024
+  };
+  const sourceDigest = await digestStagedWorkspace(context.workspaceDir, digestLimits);
+  const allowed = await policy.recipe(policyContext(context, request, options, {
+    recipeIds: [...recipes.keys()].sort(),
+    recipeId,
+    sourceDigest
+  }));
+  if (!allowed) return response(request, false, "tool denied by CaMeL policy");
+  const selected = recipes.get(recipeId);
+  if (!selected) return response(request, false, "build recipe is not registered");
+  const staged = await stageWorkspace(context.workspaceDir, {
+    maxFiles: digestLimits.maxFiles,
+    maxBytes: digestLimits.maxBytes
+  });
+  try {
+    if (await digestStagedWorkspace(staged.workspaceDir, digestLimits) !== sourceDigest) {
+      throw new TypeError("workspace changed after recipe authorization");
+    }
+    const result = await options.recipeExecutor.run({
+      workspaceDir: staged.workspaceDir,
+      recipe: selected,
+      signal: context.signal
+    });
+    const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+    const ok = result.exitCode === 0 && !result.outputLimitExceeded && !result.timedOut;
+    const status = result.timedOut ? "timed out" : result.outputLimitExceeded ? "exceeded output limit" : ok ? "passed" : `failed with exit ${result.exitCode}`;
+    return response(request, ok, `Recipe ${recipeId} ${status}.${output ? `
+${output}` : ""}`, {
+      recipeId,
+      exitCode: result.exitCode,
+      durationMs: result.durationMs,
+      outputLimitExceeded: result.outputLimitExceeded,
+      timedOut: result.timedOut
+    });
+  } finally {
+    await staged.cleanup();
+  }
+}
+function policyContext(context, request, options, extra) {
+  return {
+    lease: context.lease,
+    request,
+    workspaceId: `workspace:${context.lease.task.attemptId}`,
+    readers: { kind: "principals", principalIds: [options.readerId] },
+    ...extra
+  };
+}
+async function registeredFiles(root, limit) {
+  const paths = [];
+  const walk = async (directory) => {
+    for (const entry of await (0, import_promises8.readdir)(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
+      const target = (0, import_path7.resolve)(directory, entry.name);
+      if (entry.isDirectory()) await walk(target);
+      else if (entry.isFile()) {
+        const path = (0, import_path7.relative)(root, target).split("\\").join("/");
+        try {
+          validateRelativePath(path);
+        } catch {
+          continue;
+        }
+        paths.push(path);
+        if (paths.length > limit) throw new TypeError("workspace file registry exceeds its bound");
+      }
+    }
+  };
+  await walk((0, import_path7.resolve)(root));
+  return paths.sort();
+}
+function validateOptions(options) {
+  if (!options.readerId || !options.recipes.length || new Set(options.recipes.map((item) => item.id)).size !== options.recipes.length) {
+    throw new TypeError("Code tool broker requires a reader and unique registered recipes");
+  }
+  for (const recipe2 of options.recipes) assertCodeBuildRecipe(recipe2);
+}
+function exactKeys(input, allowed) {
+  if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
+}
+function stringField(input, name) {
+  const value = input[name];
+  if (typeof value !== "string" || !value) throw new TypeError(`${name} must be a non-empty string`);
+  return value;
+}
+function optionalInteger(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 1) throw new TypeError("line bounds must be positive integers");
+  return value;
+}
+function response(request, ok, content, details) {
+  return { requestId: request.requestId, ok, content, ...details ? { details } : {} };
+}
+function codeCommandMetadata(payload, resume) {
+  const trusted = record22(payload.trustedBase);
+  const role = payload.role;
+  const title = payload.title;
+  const prompt = payload.prompt;
+  if (role !== "coding" && role !== "review" || typeof title !== "string" || typeof prompt !== "string") {
+    throw new TypeError(`invalid Code ${resume ? "resume" : "start"} metadata`);
+  }
+  const planning = trusted?.planningInputDigest;
+  const attestation = trusted?.attestationDigest;
+  return {
+    role,
+    title,
+    prompt,
+    planningInputDigest: typeof planning === "string" && /^sha256:[0-9a-f]{64}$/.test(planning) ? planning : null,
+    attestationDigest: typeof attestation === "string" ? attestation : "resume"
+  };
+}
+function codeCheckpointPayload(payload) {
+  const value = payload.checkpoint;
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
+  return value;
+}
+function fakeCodeLease(command, metadata2) {
+  return {
+    protocolVersion: HARNESS_PROTOCOL_VERSION,
+    leaseId: `code:${command.commandId}`,
+    generation: command.bindingGeneration,
+    expiresAt: Date.now() + 24 * 60 * 6e4,
+    task: {
+      taskId: command.sessionId,
+      attemptId: command.instanceId,
+      title: metadata2.title,
+      prompt: metadata2.prompt,
+      workspace: command.appId,
+      aiRoute: metadata2.role,
+      policy: {
+        network: "none",
+        timeoutMs: 30 * 6e4,
+        maxOutputBytes: 4 * 1024 * 1024,
+        maxPatchBytes: 256 * 1024
+      }
+    }
+  };
+}
+var record22 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var CodePiRuntimeEngine = class {
+  constructor(options) {
+    this.options = options;
+    this.#run = options.runAttempt ?? runContainerAttempt;
+    this.#buildPolicyDigest = digest(JSON.stringify(options.recipes));
+    this.#checkpoints = new CodeRuntimeCheckpointManager({
+      control: options.control,
+      recipes: options.recipes,
+      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine),
+      fallbackPolicyDigest: this.#buildPolicyDigest,
+      event: (command, event, refs) => this.#event(command, event, refs)
+    });
+  }
+  options;
+  #active = /* @__PURE__ */ new Map();
+  #run;
+  #buildPolicyDigest;
+  #checkpoints;
+  execute(command) {
+    if (command.kind === "checkpoint_stop") return this.#checkpoint(command);
+    if (command.kind === "prompt") return this.#prompt(command);
+    return this.#start(command, command.kind === "resume");
+  }
+  async acknowledged(command, result) {
+    if (await this.#checkpoints.acknowledged(command, result)) return;
+    const active = this.#active.get(command.sessionId);
+    if (!active || result.status !== "running") return;
+    active.acknowledged = true;
+    if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+  }
+  async close() {
+    const sessions = [...this.#active.values()];
+    for (const session of sessions) session.abort.abort("runtime_shutdown");
+    await Promise.allSettled(sessions.map((session) => session.done));
+    await Promise.allSettled(sessions.map((session) => session.workspace.cleanup()));
+    this.#active.clear();
+  }
+  async #start(command, resume) {
+    if (this.#active.has(command.sessionId)) throw new TypeError("Code session is already active on this runtime");
+    const source = await this.options.control.source(command.sessionId);
+    const materialized = await materializeCodeRuntimeSource(source);
+    let workspace;
+    try {
+      workspace = resume ? (await restoreCodeWorkspaceCheckpoint({
+        trustedBaseDir: materialized.sourceDir,
+        trustedBaseCommitSha: source.commitSha,
+        checkpoint: codeCheckpointPayload(command.payload)
+      })).workspace : await stageWorkspace(materialized.sourceDir);
+    } finally {
+      await materialized.cleanup();
+    }
+    const metadata2 = codeCommandMetadata(command.payload, resume);
+    const abort = new AbortController();
+    const conversationRefs = [];
+    const active = {
+      workspace,
+      abort,
+      conversationRefs,
+      acknowledged: false,
+      role: metadata2.role,
+      title: metadata2.title,
+      baseCommitSha: source.commitSha,
+      trustedBaseDigest: await digestStagedWorkspace(workspace.baselineDir, {
+        maxFiles: 1e4,
+        maxBytes: 16 * 1024 * 1024
+      }),
+      planningInputDigest: metadata2.planningInputDigest ?? digest(
+        JSON.stringify({ attestation: metadata2.attestationDigest, prompt: metadata2.prompt, tree: source.treeDigest })
+      ),
+      done: Promise.resolve(null)
+    };
+    this.#active.set(command.sessionId, active);
+    active.done = this.#runAttempt(command, metadata2, active).catch(async (cause) => {
+      await this.#event(command, { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` }, conversationRefs).catch(() => void 0);
+      await this.#event(command, { type: "status", status: "failed" }, conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, message2(cause));
+      return null;
+    });
+    return { status: "running", message: resume ? "Pi resumed from a portable checkpoint" : "Pi started" };
+  }
+  async #prompt(command) {
+    const active = this.#active.get(command.sessionId);
+    const prompt = command.payload.prompt;
+    if (!active || typeof prompt !== "string" || !prompt.trim() || prompt.length > 2e4) {
+      throw new TypeError("prompt requires an active Code session and bounded text");
+    }
+    await active.done;
+    active.abort = new AbortController();
+    active.acknowledged = false;
+    active.failure = void 0;
+    active.done = this.#runAttempt(command, {
+      role: active.role,
+      title: active.title,
+      prompt,
+      planningInputDigest: active.planningInputDigest,
+      attestationDigest: "follow-up"
+    }, active).catch(async (cause) => {
+      await this.#event(
+        command,
+        { type: "message", actor: "system", body: `Pi failed: ${message2(cause)}` },
+        active.conversationRefs
+      ).catch(() => void 0);
+      await this.#event(command, { type: "status", status: "failed" }, active.conversationRefs).catch(() => void 0);
+      await this.#failure(command, active, message2(cause));
+      return null;
+    });
+    return { status: "running", message: "Pi accepted the owner prompt" };
+  }
+  async #runAttempt(command, metadata2, active) {
+    const lease = fakeCodeLease(command, metadata2);
+    const broker = this.#toolBroker(lease, metadata2.role);
+    const startedAt = Date.now();
+    let completionSeen = false;
+    const result = await this.#run({
+      engine: this.options.engine,
+      image: this.options.image,
+      workspaceDir: active.workspace.workspaceDir,
+      workspaceAccess: "none",
+      task: lease.task,
+      limits: this.options.limits,
+      signal: active.abort.signal,
+      onStderr: (text) => this.#event(command, {
+        type: "message",
+        actor: "system",
+        body: text.slice(0, 4e3)
+      }, active.conversationRefs),
+      onMessage: async (output) => {
+        if (output.type === "inference.request") {
+          const inferenceStarted = Date.now();
+          const response2 = await this.options.control.infer(command.sessionId, {
+            requestId: output.requestId,
+            call: output.call
+          });
+          await this.#event(command, {
+            type: "usage",
+            provider: response2.receipt.provider,
+            model: response2.receipt.model,
+            inputTokens: response2.receipt.inputTokens,
+            outputTokens: response2.receipt.outputTokens,
+            durationMs: Date.now() - inferenceStarted
+          }, active.conversationRefs).catch(() => void 0);
+          return {
+            protocolVersion: HARNESS_PROTOCOL_VERSION,
+            type: "inference.response",
+            requestId: output.requestId,
+            response: response2.response
+          };
+        }
+        if (output.type === "tool.request") {
+          const toolStarted = Date.now();
+          await this.#event(
+            command,
+            { type: "tool", phase: "started", tool: output.tool },
+            active.conversationRefs
+          ).catch(() => void 0);
+          const response2 = await broker.execute({
+            lease,
+            workspaceDir: active.workspace.workspaceDir,
+            signal: active.abort.signal
+          }, output);
+          await this.#event(command, {
+            type: "tool",
+            phase: "completed",
+            tool: output.tool,
+            ok: response2.ok,
+            durationMs: Date.now() - toolStarted
+          }, active.conversationRefs).catch(() => void 0);
+          return { protocolVersion: HARNESS_PROTOCOL_VERSION, type: "tool.response", ...response2 };
+        }
+        if (output.type === "event") {
+          const payload = object2(output.payload);
+          if (output.kind === "pi.started") {
+            await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
+          } else if (output.kind === "pi.thinking" && payload?.available === true && Number.isSafeInteger(payload.durationMs) && Number(payload.durationMs) >= 0) {
+            await this.#event(command, {
+              type: "thinking",
+              available: true,
+              durationMs: Math.min(Number(payload.durationMs), 864e5)
+            }, active.conversationRefs);
+          } else {
+            await this.#event(command, {
+              type: "message",
+              actor: "system",
+              body: `${output.kind}${output.payload === void 0 ? "" : ` ${json(output.payload)}`}`
+            }, active.conversationRefs);
+          }
+        } else if (output.type === "attempt.complete") {
+          completionSeen = true;
+          const body = resultText(output.result) ?? `Pi ${output.status}.`;
+          await this.#event(command, {
+            type: "message",
+            actor: output.status === "completed" ? "agent" : "system",
+            body
+          }, active.conversationRefs);
+          await this.#event(command, {
+            type: "status",
+            status: output.status === "completed" ? "idle" : "failed",
+            durationMs: Date.now() - startedAt
+          }, active.conversationRefs);
+        }
+      }
+    });
+    if (result.status === "failed" && result.stderr) {
+      await this.#event(command, { type: "message", actor: "system", body: result.stderr.slice(0, 4e3) }, active.conversationRefs);
+    }
+    if (!completionSeen) await this.#event(command, {
+      type: "status",
+      status: result.status === "completed" ? "idle" : "failed",
+      durationMs: Date.now() - startedAt
+    }, active.conversationRefs).catch(() => void 0);
+    if (result.status === "failed") {
+      await this.#failure(command, active, result.stderr || "Pi container failed");
+    }
+    return result;
+  }
+  #toolBroker(lease, role) {
+    const broker = createCodeToolBroker({
+      recipes: this.options.recipes,
+      recipeExecutor: createContainerRecipeExecutor(this.options.engine),
+      recipeAuthorization: this.options.recipeAuthorization ?? "registered_recipe",
+      readerId: `code-session:${lease.task.taskId}`
+    });
+    return role === "coding" ? broker : { execute: (context, request) => request.tool === "sandbox.read" ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+  }
+  async #checkpoint(command) {
+    const active = this.#active.get(command.sessionId);
+    if (!active) throw new TypeError("Code session workspace is not active on this runtime");
+    const result = await this.#checkpoints.prepare(command, active);
+    this.#active.delete(command.sessionId);
+    return result;
+  }
+  async #failure(command, active, value) {
+    active.failure = value.slice(0, 2e3);
+    if (active.acknowledged) {
+      await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
+    }
+  }
+  async #event(command, event, refs) {
+    const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+    refs.push(eventId);
+    const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
+    await this.options.control.appendSessionEvent(command.sessionId, eventId, bounded);
+  }
+};
+var object2 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var digest = (value) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value).digest("hex")}`;
+var message2 = (value) => value instanceof Error ? value.message : String(value);
+var json = (value) => {
+  try {
+    return JSON.stringify(value).slice(0, 1e4);
+  } catch {
+    return "[event]";
+  }
+};
+function resultText(value) {
+  const record32 = object2(value);
+  return record32 && typeof record32.text === "string" ? record32.text.slice(0, 2e4) : null;
+}
+
+// src/help.ts
+var import_node_fs6 = require("fs");
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs6.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners add <email> [--email <odla-account>] [--json]
+  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai capabilities [--json]
+  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
+  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security plan [--env dev] [--json]
+  odla-ai security sources [--env dev] [--json]
+  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
+  odla-ai security status <job-id> [--follow] [--json]
+  odla-ai security report <job-id> [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, export, or manage the
+               co-owners of the app. Archiving takes every environment's data
+               plane down until restored; permanent deletion has NO CLI \u2014 it
+               requires a signed-in owner in Studio, and no machine or agent
+               credential can purge. "app export" downloads a portable
+               gzipped-JSONL snapshot of one environment's database (--fresh
+               takes a new snapshot first) \u2014 your data is always yours to take.
+               "app owners add <email>" grants a signed-up odla member the SAME
+               full access as you; they then run their own "provision" to mint
+               their own credentials for the shared db (prod included) \u2014 no
+               secret is ever copied between people.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
+  Run Code from a GitHub checkout already connected to an app in Studio; an
+  odla.config.mjs may select the app explicitly but is not required. Code host
+  approval and credential hashes live in odla-ai/db. The host
+  credential is never written under .odla/; it exists only in the foreground
+  "code connect" process and is rotated by the next approved connection.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
+  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
+  for a PAT or provider key. GitHub read access is separate from the explicit
+  --ack-redacted-source consent and the exact --plan-digest printed by security
+  plan are required before bounded snippets reach System AI.
+  Run security plan first to inspect the admin-selected providers, models,
+  per-route bounds, credential readiness, retention, no-execution boundary,
+  and digest that binds consent to that exact plan.
+`);
+}
+
+// src/security-hosted-github.ts
+var import_node_child_process2 = require("child_process");
+var import_node_util = require("util");
+
+// src/security-hosted-request.ts
+async function requestHostedSecurityJson(options, path, init, action) {
+  const platform = platformAudience(options.platform);
+  const token = hostedSecurityCredential(options.token);
+  const requestInit = {
+    ...init,
+    redirect: "error",
+    credentials: "omit",
+    cache: "no-store",
+    signal: options.signal,
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      ...init.headers
+    }
+  };
+  const response2 = await (options.fetch ?? fetch)(new URL(path, platform), requestInit);
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok) {
+    const code = optionalHostedText(body.error?.code, "error code", 128);
+    const message3 = optionalHostedText(body.error?.message, "error message", 300);
+    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message3 ? `: ${message3}` : ""}`);
+  }
+  return body;
+}
+function hostedIdentifier(value, name) {
+  const result = optionalHostedText(value, name, 180);
+  if (!result || !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(result)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return result;
+}
+function positivePolicyVersion(value, name) {
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function optionalHostedText(value, name, maxLength) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${name} is invalid`);
+  }
+  return value;
+}
+function githubRepositoryName(value) {
+  if (typeof value !== "string" || value.length > 201) {
+    throw new Error("repository must be owner/name");
+  }
+  const parts = value.split("/");
+  const owner = parts[0] ?? "";
+  const name = (parts[1] ?? "").replace(/\.git$/i, "");
+  if (parts.length !== 2 || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(name) || name === "." || name === "..") {
+    throw new Error("repository must be owner/name");
+  }
+  return `${owner}/${name}`;
+}
+function trustedGitHubInstallUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("odla.ai returned an invalid GitHub installation URL");
+  }
+  if (url.protocol !== "https:" || url.hostname !== "github.com" || url.username || url.password) {
+    throw new Error("odla.ai returned an untrusted GitHub installation URL");
+  }
+  return url.toString();
+}
+function hostedPollInterval(value = 2e3) {
+  if (!Number.isSafeInteger(value) || value < 100 || value > 3e4) {
+    throw new Error("poll interval must be 100-30000ms");
+  }
+  return value;
+}
+function hostedPollTimeout(value = 10 * 6e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) {
+    throw new Error("poll timeout must be 1000-3600000ms");
+  }
+  return value;
+}
+async function waitForHostedPoll(milliseconds, signal) {
+  if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
+  await new Promise((resolve10, reject) => {
+    const timer = setTimeout(resolve10, milliseconds);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      reject(signal.reason ?? new DOMException("aborted", "AbortError"));
+    }, { once: true });
+  });
+}
+function isValidHostedSecurityPlan(value, env) {
+  if (!value || value.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value.planDigest) || value.consentContract !== "odla.hosted-security-consent.v1" || value.reportProjection !== "odla.hosted-security-report.v1" || value.redactionContract !== "odla.best-effort-credential-pattern-redaction.v1" || typeof value.promptBundle !== "string" || value.promptBundle.length < 1 || value.promptBundle.length > 100 || typeof value.ready !== "boolean" || typeof value.independent !== "boolean" || value.sourceDisclosure !== "redacted" || value.targetExecution !== false || !Number.isSafeInteger(value.reportRetentionDays) || value.reportRetentionDays < 1) return false;
+  const validRoute = (route2, purpose) => !!route2 && route2.purpose === purpose && typeof route2.enabled === "boolean" && typeof route2.credentialReady === "boolean" && typeof route2.provider === "string" && route2.provider.length > 0 && route2.provider.length <= 100 && typeof route2.model === "string" && route2.model.length > 0 && route2.model.length <= 200 && Number.isSafeInteger(route2.policyVersion) && route2.policyVersion >= 1 && Number.isSafeInteger(route2.maxCallsPerRun) && route2.maxCallsPerRun >= 1 && Number.isSafeInteger(route2.maxInputBytes) && route2.maxInputBytes >= 1 && Number.isSafeInteger(route2.maxOutputTokens) && route2.maxOutputTokens >= 1;
+  return validRoute(value.routes?.discovery, "security.discovery") && validRoute(value.routes?.validation, "security.validation");
+}
+function hostedSecurityCredential(value) {
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("Hosted security requires an injected odla developer token");
+  }
+  return value;
+}
+
+// src/security-hosted-github.ts
+async function connectGitHubSecuritySource(options) {
+  const out = options.stdout ?? console;
+  const repository = githubRepositoryName(options.repository);
+  const attempt = await requestHostedSecurityJson(
+    options,
+    "/registry/github/connect",
+    {
+      method: "POST",
+      body: JSON.stringify({
+        appId: hostedIdentifier(options.appId, "appId"),
+        env: hostedIdentifier(options.env, "env"),
+        repository
+      })
+    },
+    "start GitHub connection"
+  );
+  const serverExpiry = Date.parse(attempt?.expiresAt ?? "");
+  if (!attempt?.attemptId || !attempt.installUrl || !Number.isFinite(serverExpiry)) {
+    throw new Error("odla.ai returned an invalid GitHub connection attempt");
+  }
+  const installUrl = trustedGitHubInstallUrl(attempt.installUrl);
+  out.log(`GitHub approval: ${installUrl}`);
+  if (options.open !== false) {
+    await (options.openInstallUrl ?? openUrl)(installUrl);
+    out.log("github: opened installation approval in your browser");
+  }
+  const interval = hostedPollInterval(options.pollIntervalMs);
+  const now = options.now ?? Date.now;
+  const deadline = Math.min(serverExpiry, now() + hostedPollTimeout(options.pollTimeoutMs));
+  const wait2 = options.wait ?? waitForHostedPoll;
+  while (true) {
+    const state = await requestHostedSecurityJson(
+      options,
+      `/registry/github/connect/${encodeURIComponent(attempt.attemptId)}`,
+      {},
+      "check GitHub connection"
+    );
+    if (state.status !== "pending") {
+      if (state.status === "connected") return state;
+      throw new Error(`GitHub connection ${state.status}${state.failureCode ? `: ${state.failureCode}` : ""}`);
+    }
+    if (now() >= deadline) throw new Error("GitHub connection approval timed out");
+    await wait2(Math.min(interval, Math.max(0, deadline - now())), options.signal);
+  }
+}
+async function listGitHubSecuritySources(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const env = hostedIdentifier(options.env, "env");
+  const body = await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/github/sources?env=${encodeURIComponent(env)}`,
+    {},
+    "list GitHub security sources"
+  );
+  return Array.isArray(body.sources) ? body.sources : [];
+}
+async function disconnectGitHubSecuritySource(options) {
+  const appId = hostedIdentifier(options.appId, "appId");
+  const sourceId = hostedIdentifier(options.sourceId, "sourceId");
+  await requestHostedSecurityJson(
+    options,
+    `/registry/apps/${encodeURIComponent(appId)}/github/sources/${encodeURIComponent(sourceId)}`,
+    { method: "DELETE" },
+    "disconnect GitHub security source"
+  );
+}
+function repositoryFromGitRemote(remoteInput) {
+  const remote = remoteInput.trim();
+  const scp = /^git@github\.com:([^/\s]+)\/([^/\s]+?)\/?$/.exec(remote);
+  if (scp) return githubRepositoryName(`${scp[1]}/${scp[2].replace(/\.git$/, "")}`);
+  let url;
+  try {
+    url = new URL(remote);
+  } catch {
+    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
+  }
+  if (url.hostname !== "github.com" || url.protocol !== "https:" && url.protocol !== "ssh:") {
+    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
+  }
+  if (url.password || url.protocol === "https:" && url.username || url.search || url.hash) {
+    throw new Error("credential-bearing GitHub origin URLs are not accepted");
+  }
+  const parts = url.pathname.replace(/^\/+|\/+$/g, "").split("/");
+  if (parts.length !== 2) {
+    throw new Error("origin must identify one GitHub owner/name repository");
+  }
+  return githubRepositoryName(`${parts[0]}/${parts[1].replace(/\.git$/, "")}`);
+}
+async function inferGitHubRepository(cwd = process.cwd(), readOrigin = defaultReadOrigin) {
+  let remote;
+  try {
+    remote = await readOrigin(cwd);
+  } catch {
+    throw new Error("Could not read git origin; pass --repo owner/name");
+  }
+  return repositoryFromGitRemote(remote);
+}
+async function defaultReadOrigin(cwd) {
+  const result = await (0, import_node_util.promisify)(import_node_child_process2.execFile)(
+    "git",
+    ["remote", "get-url", "origin"],
+    { cwd, encoding: "utf8" }
+  );
+  return result.stdout;
+}
+
+// src/code-connect.ts
+var CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
+var CODE_BUILD_RECIPES = Object.freeze([{
+  id: "node-test",
+  image: "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd",
+  command: ["node", "--test"],
+  timeoutMs: 12e4,
+  maxOutputBytes: 1024 * 1024,
+  cpus: 1,
+  memory: "512m",
+  pids: 128
+}]);
+async function codeConnect(options) {
+  const cwd = options.cwd ?? process.cwd();
+  const configPath = (0, import_node_path4.resolve)(cwd, options.configPath);
+  const cfg = (0, import_node_fs7.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const repository = cfg ? null : await inferGitHubRepository(cwd, options.readGitOrigin);
+  const platform = cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai";
+  const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : "dev");
+  if (appEnv !== "dev" && appEnv !== "prod" || cfg && !cfg.envs.includes(appEnv)) {
+    throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod`);
+  }
+  if (process.platform !== "darwin" && process.platform !== "linux") {
+    throw new Error("odla Code hosts require macOS or Linux");
+  }
+  const slots = options.slots ?? 1;
+  if (!Number.isSafeInteger(slots) || slots < 1 || slots > 64) {
+    throw new Error("--slots must be an integer from 1 to 64");
+  }
+  const heartbeatMs = options.heartbeatMs ?? 15e3;
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new Error("--heartbeat-ms must be an integer from 1000 to 300000");
+  }
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
+  const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
+  const hostName = (options.name ?? (0, import_node_os.hostname)()).trim();
+  if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
+  const approval = await (options.getToken ?? getScopedPlatformToken)({
+    platform,
+    scope: "platform:code:host:connect",
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    cache: false,
+    label: `odla CLI Code host for ${cfg?.app.id ?? repository}/${appEnv}`
+  });
+  const target = cfg ? { appId: cfg.app.id } : { repository };
+  const response2 = await doFetch(`${platform}/registry/code/hosts/connect`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${approval}`, "content-type": "application/json" },
+    body: JSON.stringify({ ...target, env: appEnv, name: hostName, platform: hostPlatform, slots }),
+    redirect: "error",
+    signal: options.signal
+  });
+  const raw = await response2.json().catch(() => null);
+  if (!response2.ok) throw new Error(apiFailure("connect Code host", response2.status, raw));
+  const connection = parseConnection(raw, cfg?.app.id, appEnv);
+  const capabilities = {
+    protocolVersion: CODE_RUNTIME_PROTOCOL_VERSION,
+    platform: hostPlatform,
+    arch: process.arch,
+    engines: [engine],
+    cpuCount: (0, import_node_os.cpus)().length,
+    memoryBytes: (0, import_node_os.totalmem)()
+  };
+  out.log(`${connection.resumed ? "reconnected" : "enrolled"}: ${connection.host.name} (${connection.host.hostId})`);
+  out.log(`binding: ${connection.binding.appId}/${connection.binding.env} \xB7 ${connection.offer.slots} slot(s) \xB7 ${engine}`);
+  out.log("credentials: stored in odla-ai/db; host plaintext is memory-only");
+  await (options.runRuntime ?? runCodeRuntime)({
+    endpoint: platform,
+    token: connection.token,
+    engine,
+    capabilities,
+    heartbeatMs,
+    once: options.once === true,
+    signal: options.signal,
+    stdout: out,
+    fetch: doFetch
+  });
+}
+async function runCodeRuntime(input) {
+  const controller = new AbortController();
+  const abort = () => controller.abort(input.signal?.reason ?? "runtime_shutdown");
+  input.signal?.addEventListener("abort", abort, { once: true });
+  const signal = input.signal ? AbortSignal.any([input.signal, controller.signal]) : controller.signal;
+  const handlers = ["SIGINT", "SIGTERM"].map((name) => {
+    const handler = () => controller.abort(name);
+    process.once(name, handler);
+    return [name, handler];
+  });
+  const control = createCodeRuntimeControlClient({
+    endpoint: input.endpoint,
+    token: input.token,
+    signal,
+    fetch: input.fetch
+  });
+  const commandEngine = new CodePiRuntimeEngine({
+    control,
+    engine: input.engine,
+    image: CODE_PI_IMAGE,
+    recipes: CODE_BUILD_RECIPES,
+    recipeAuthorization: "registered_recipe"
+  });
+  const reconciler = new CodeRuntimeReconciler(control, commandEngine);
+  try {
+    await runCodeRuntimeHeartbeatLoop({
+      control,
+      runtimeVersion: `odla-ai-cli/${cliVersion()}`,
+      capabilities: input.capabilities,
+      heartbeatMs: input.heartbeatMs,
+      once: input.once,
+      signal,
+      onSnapshot: async (snapshot) => {
+        input.stdout.log(
+          `online: ${snapshot.host.hostId} \xB7 ${snapshot.bindings.length} binding(s) \xB7 ${snapshot.commands.length} command(s)`
+        );
+        if (input.once && snapshot.commands.length) {
+          throw new Error("--once is diagnostic-only and refuses pending Code commands; run without --once");
+        }
+        await reconciler.reconcile(snapshot);
+      },
+      onRetry: (error, delayMs) => input.stdout.error(
+        `Code control plane unavailable; retrying in ${delayMs}ms \xB7 ${error instanceof Error ? error.message : String(error)}`
+      )
+    });
+  } finally {
+    await commandEngine.close();
+    input.signal?.removeEventListener("abort", abort);
+    for (const [name, handler] of handlers) process.removeListener(name, handler);
+  }
+}
+function parseConnection(value, appId, appEnv) {
+  const root = record4(value);
+  const host = record4(root?.host);
+  const offer = record4(root?.offer);
+  const binding = record4(root?.binding);
+  if (!root || typeof root.token !== "string" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token) || typeof root.resumed !== "boolean" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId)) || typeof host.name !== "string" || !offer || !Number.isSafeInteger(offer.slots) || !binding || typeof binding.appId !== "string" || !binding.appId || appId && binding.appId !== appId || binding.env !== appEnv || !Number.isSafeInteger(binding.generation)) {
+    throw new Error("connect Code host returned an invalid response");
+  }
+  return root;
+}
+function apiFailure(action, status, value) {
+  const message3 = record4(record4(value)?.error)?.message;
+  return `${action} failed (${status})${typeof message3 === "string" ? `: ${message3}` : ""}`;
+}
+function record4(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+
+// src/code-command.ts
+async function codeCommand(parsed, dependencies) {
+  const sub = parsed.positionals[1];
+  if (sub !== "connect") {
+    throw new Error(`unknown code subcommand "${sub ?? ""}". Try "odla-ai code connect --env dev".`);
+  }
+  assertArgs(parsed, [
+    "config",
+    "env",
+    "email",
+    "open",
+    "name",
+    "slots",
+    "engine",
+    "heartbeat-ms",
+    "once"
+  ], 2);
+  const engine = stringOpt(parsed.options.engine) ?? "auto";
+  if (!["auto", "container", "podman", "docker"].includes(engine)) {
+    throw new Error("--engine must be auto, container, podman, or docker");
+  }
+  await (dependencies.codeConnect ?? codeConnect)({
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    env: stringOpt(parsed.options.env),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    name: stringOpt(parsed.options.name),
+    slots: numberOpt(parsed.options.slots, "--slots"),
+    engine,
+    heartbeatMs: numberOpt(parsed.options["heartbeat-ms"], "--heartbeat-ms"),
+    once: parsed.options.once === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout,
+    openApprovalUrl: dependencies.openUrl,
+    readGitOrigin: dependencies.readGitOrigin
+  });
+}
+
+// src/doctor-checks.ts
+var import_node_child_process4 = require("child_process");
+var import_node_fs9 = require("fs");
+var import_node_path6 = require("path");
+
+// src/wrangler.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs8 = require("fs");
+var import_node_path5 = require("path");
+var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
+  const child = (0, import_node_child_process3.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", reject);
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(opts?.input ?? "");
+});
+var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+function findWranglerConfig(rootDir) {
+  for (const name of WRANGLER_CONFIG_FILES) {
+    const path = (0, import_node_path5.join)(rootDir, name);
+    if ((0, import_node_fs8.existsSync)(path)) return path;
+  }
+  return null;
+}
+function readWranglerConfig(path) {
+  if (path.endsWith(".toml")) return null;
+  try {
+    return JSON.parse(stripJsonComments((0, import_node_fs8.readFileSync)(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function stripJsonComments(text) {
+  let result = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      result += ch;
+      if (ch === "\\") {
+        result += text[i + 1] ?? "";
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      result += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      result += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+async function wranglerLoggedIn(run, cwd) {
+  try {
+    const result = await run("npx", ["wrangler", "whoami"], { cwd });
+    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
+  } catch {
+    return false;
+  }
+}
+function wranglerPutSecret(run, opts) {
+  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+}
+
+// src/doctor-checks.ts
+function lintRules(rules, entities, publicRead) {
+  const warnings = [];
+  if (!rules) return warnings;
+  for (const [ns, actions] of Object.entries(rules)) {
+    for (const [action, expr] of Object.entries(actions)) {
+      if (typeof expr !== "string" || expr.trim() !== "true") continue;
+      if (action === "view" && publicRead.includes(ns)) continue;
+      warnings.push(
+        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+      );
+    }
+  }
+  for (const entity of entities) {
+    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
+  }
+  return warnings;
+}
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process4.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
+  let output;
+  try {
+    const custom = localPaths.map((path) => gitignoreEntry(rootDir, path)).filter((path) => !!path);
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla", ...custom], rootDir);
+  } catch {
+    return [];
+  }
+  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+}
+function wranglerWarnings(rootDir) {
+  const configPath = findWranglerConfig(rootDir);
+  if (!configPath) return [];
+  const config = readWranglerConfig(configPath);
+  if (!config) return [];
+  const warnings = [];
+  const blocks = [{ label: "", block: config }];
+  const envs = config.env;
+  if (envs && typeof envs === "object") {
+    for (const [name, block] of Object.entries(envs)) {
+      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    }
+  }
+  for (const { label, block } of blocks) {
+    const assets = block.assets;
+    if (assets?.directory) {
+      const dir = (0, import_node_path6.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path6.resolve)(rootDir)) {
+        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
+      } else if ((0, import_node_fs9.existsSync)((0, import_node_path6.join)(dir, "node_modules"))) {
+        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+      }
+    }
+    const vars = block.vars;
+    if (vars && typeof vars === "object") {
+      for (const [name, value] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
+          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
+        }
+      }
+    }
+  }
+  const pkg = readPackageJson(rootDir);
+  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
+    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
+  }
+  return warnings;
+}
+function o11yProjectWarnings(rootDir) {
+  const warnings = [];
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (!dependencies?.["@odla-ai/o11y"]) {
+    warnings.push(
+      devDependencies?.["@odla-ai/o11y"] ? "@odla-ai/o11y is a devDependency \u2014 move it to dependencies so the Worker can import it" : 'Worker instrumentation is missing @odla-ai/o11y \u2014 install it and wrap the handler with "withObservability"'
+    );
+  }
+  const configPath = findWranglerConfig(rootDir);
+  const config = configPath ? readWranglerConfig(configPath) : null;
+  if (!configPath || !config) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
+    return warnings;
+  }
+  const main = typeof config.main === "string" ? (0, import_node_path6.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs9.existsSync)(main)) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
+  } else {
+    let source = "";
+    try {
+      source = (0, import_node_fs9.readFileSync)(main, "utf8");
+    } catch {
+    }
+    if (!/\bwithObservability\b/.test(source)) {
+      warnings.push(`wrangler entrypoint ${config.main} does not reference withObservability`);
+    }
+  }
+  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];
+  if (!flags.includes("nodejs_compat")) {
+    warnings.push('wrangler compatibility_flags is missing "nodejs_compat" required by @odla-ai/o11y');
+  }
+  return warnings;
+}
+function calendarProjectWarnings(rootDir) {
   const pkg = readPackageJson(rootDir);
   const dependencies = pkg?.dependencies;
   const devDependencies = pkg?.devDependencies;
@@ -2085,14 +5162,14 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path5.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path6.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
 
 // src/integrations.ts
-var import_node_util = require("util");
+var import_node_util2 = require("util");
 async function resolveDatabaseConfig(cfg, options = {}) {
   const integrations = cfg.integrations ?? [];
   if (!cfg.services.includes("db")) return { schema: void 0, rules: void 0, integrations };
@@ -2183,7 +5260,7 @@ function normalizeSchema(value) {
 }
 function mergeMap(target, fragment, label) {
   for (const [name, value] of Object.entries(fragment)) {
-    if (Object.hasOwn(target, name) && !(0, import_node_util.isDeepStrictEqual)(target[name], value)) {
+    if (Object.hasOwn(target, name) && !(0, import_node_util2.isDeepStrictEqual)(target[name], value)) {
       throw new Error(`${label} "${name}" conflicts with an existing definition`);
     }
     target[name] = value;
@@ -2222,150 +5299,48 @@ async function doctor(options) {
   }
   const warnings = [];
   if (schema && entities.length === 0) warnings.push("schema has no entities");
-  if (rules) {
-    for (const ns of Object.keys(rules)) {
-      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
-    }
-  }
-  warnings.push(...integrationWarnings(database.integrations, schema, rules));
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
-  if (cfg.auth?.clerk) {
-    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
-      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
-        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
-      }
-    }
-  }
-  if (cfg.services.includes("ai") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {
-    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
-  }
-  if (cfg.services.includes("o11y")) {
-    const credentials = readCredentials(cfg.local.credentialsFile);
-    for (const env of cfg.envs) {
-      if (!credentials?.envs[env]?.o11yToken) {
-        warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
-      }
-    }
-    warnings.push(...o11yProjectWarnings(cfg.rootDir));
-  }
-  if (cfg.services.includes("calendar")) warnings.push(...calendarProjectWarnings(cfg.rootDir));
-  else if (cfg.calendar) warnings.push('calendar config is present but "calendar" is not in services');
-  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
-  warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
-    cfg.local.tokenFile,
-    cfg.local.credentialsFile,
-    cfg.local.devVarsFile
-  ]));
-  warnings.push(...wranglerWarnings(cfg.rootDir));
-  if (warnings.length) {
-    out.log("");
-    out.log("warnings:");
-    for (const warning of warnings) out.log(`  - ${warning}`);
-  } else {
-    out.log("ok");
-  }
-}
-
-// src/help.ts
-var import_node_fs8 = require("fs");
-function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
-  return pkg.version ?? "unknown";
-}
-function printHelp() {
-  console.log(`odla-ai
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
-  odla-ai capabilities [--json]
-  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
-  odla-ai admin ai credentials [--json]
-  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
-  odla-ai security plan [--env dev] [--json]
-  odla-ai security sources [--env dev] [--json]
-  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
-  odla-ai security status <job-id> [--follow] [--json]
-  odla-ai security report <job-id> [--json]
-  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
-  odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
-
-Commands:
-  setup        Install offline odla runbooks for common coding-agent harnesses.
-  init         Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, or export the app.
-               Archiving takes every environment's data plane down until restored;
-               permanent deletion has NO CLI \u2014 it requires a signed-in owner in
-               Studio, and no machine or agent credential can purge. "app export"
-               downloads a portable gzipped-JSONL snapshot of one environment's
-               database (--fresh takes a new snapshot first) \u2014 your data is
-               always yours to take.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
-  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  provision    Register services, compose integrations, persist credentials, optionally push secrets.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
-  skill        Same installer; --agent accepts all, claude, codex, cursor,
-               copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler
-               stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
-  version      Print the CLI version.
-
-Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page in your browser automatically whenever the
-  machine can show one, including agent-driven runs; only CI, SSH, and
-  display-less hosts skip it. Use --open to force or --no-open to suppress.
-  Browser launch is best-effort: the printed approval URL is authoritative and
-  agents must relay it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
-  default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: relay the URL, wait for approval, and re-run to collect.
-  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
-  The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
-  review the exact code, and finish any current request before claiming another.
-  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
-  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
-  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
-  for a PAT or provider key. GitHub read access is separate from the explicit
-  --ack-redacted-source consent and the exact --plan-digest printed by security
-  plan are required before bounded snippets reach System AI.
-  Run security plan first to inspect the admin-selected providers, models,
-  per-route bounds, credential readiness, retention, no-execution boundary,
-  and digest that binds consent to that exact plan.
-`);
+  if (rules) {
+    for (const ns of Object.keys(rules)) {
+      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
+    }
+  }
+  warnings.push(...integrationWarnings(database.integrations, schema, rules));
+  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.auth?.clerk) {
+    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
+      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
+        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
+      }
+    }
+  }
+  if (cfg.services.includes("ai") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {
+    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  }
+  if (cfg.services.includes("o11y")) {
+    const credentials = readCredentials(cfg.local.credentialsFile);
+    for (const env of cfg.envs) {
+      if (!credentials?.envs[env]?.o11yToken) {
+        warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
+      }
+    }
+    warnings.push(...o11yProjectWarnings(cfg.rootDir));
+  }
+  if (cfg.services.includes("calendar")) warnings.push(...calendarProjectWarnings(cfg.rootDir));
+  else if (cfg.calendar) warnings.push('calendar config is present but "calendar" is not in services');
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
+    cfg.local.tokenFile,
+    cfg.local.credentialsFile,
+    cfg.local.devVarsFile
+  ]));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
+  if (warnings.length) {
+    out.log("");
+    out.log("warnings:");
+    for (const warning of warnings) out.log(`  - ${warning}`);
+  } else {
+    out.log("ok");
+  }
 }
 
 // src/harness-options.ts
@@ -2388,13 +5363,13 @@ function harnessOption(value, flag) {
 }
 
 // src/init.ts
-var import_node_fs9 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path7 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path6.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path6.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs9.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path7.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path7.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs10.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -2404,20 +5379,20 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs9.mkdirSync)((0, import_node_path6.dirname)(configPath), { recursive: true });
-  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs9.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs10.mkdirSync)((0, import_node_path7.dirname)(configPath), { recursive: true });
+  (0, import_node_fs10.mkdirSync)((0, import_node_path7.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs10.mkdirSync)((0, import_node_path7.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs10.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs9.existsSync)(path)) return;
-  (0, import_node_fs9.writeFileSync)(path, text);
+  if ((0, import_node_fs10.existsSync)(path)) return;
+  (0, import_node_fs10.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -2888,10 +5863,10 @@ async function provision(options) {
           stdout: out
         });
       } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message3 = error instanceof Error ? error.message : String(error);
         const consent = env === "prod" || env === "production" ? " --yes" : "";
         throw new Error(
-          `${message}
+          `${message3}
 ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
           { cause: error }
         );
@@ -2954,8 +5929,8 @@ async function readRegistryApp(cfg, token, doFetch) {
   });
   if (res.status === 404) return null;
   if (!res.ok) return null;
-  const json = await res.json();
-  return json.app ?? null;
+  const json2 = await res.json();
+  return json2.app ?? null;
 }
 async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -3042,7 +6017,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security-command-context.ts
-var import_promises2 = require("readline/promises");
+var import_promises9 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -3065,12 +6040,12 @@ async function hostedSecurityContext(parsed, dependencies) {
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message);
+async function interactiveConfirmation(message3, dependencies) {
+  if (dependencies.confirm) return dependencies.confirm(message3);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises9.createInterface)({ input: process.stdin, output: process.stdout });
   try {
-    const answer = await prompt.question(`${message} [y/N] `);
+    const answer = await prompt.question(`${message3} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
   } finally {
     prompt.close();
@@ -3112,9 +6087,9 @@ function printHostedSecurityIntent(out, intent) {
 }
 function assertHostedSecurityPlanReady(plan) {
   const reasons = [];
-  for (const [label, route] of Object.entries(plan.routes)) {
-    if (!route.enabled) reasons.push(`${label} is disabled`);
-    if (!route.credentialReady) reasons.push(`${label} provider credential is unavailable`);
+  for (const [label, route2] of Object.entries(plan.routes)) {
+    if (!route2.enabled) reasons.push(`${label} is disabled`);
+    if (!route2.credentialReady) reasons.push(`${label} provider credential is unavailable`);
   }
   if (!plan.independent) reasons.push("discovery and validation are not independently routed");
   if (plan.ready && reasons.length === 0) return;
@@ -3137,54 +6112,51 @@ function printHostedJob(out, job, platform, appId) {
     out.log(`  findings: confirmed=${job.counts.confirmed} needs_reproduction=${job.counts.needsReproduction} candidates=${job.counts.candidates}`);
   }
   if (job.errorCode) out.log(`  failure: ${job.errorCode}`);
-  const url = new URL("/studio", platform);
-  url.searchParams.set("app", appId);
-  url.searchParams.set("env", job.env);
-  url.searchParams.set("tab", "security");
+  const url = new URL(`/studio/apps/${encodeURIComponent(appId)}/${encodeURIComponent(job.env)}/security`, platform);
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report) {
-  out.log(`security report ${report.jobId}: ${report.repository}@${report.revision}`);
-  out.log(`  coverage: ${report.coverageStatus} cells=${report.metrics.coverageCells} shallow=${report.metrics.shallowCells} blocked=${report.metrics.blockedCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates} rejected=${report.metrics.rejected}`);
-  out.log(`  discovery: ${report.provenance.discovery?.provider ?? "unknown"}/${report.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report.provenance.validation?.provider ?? "unknown"}/${report.provenance.validation?.model ?? "unknown"} independent=${String(report.provenance.independentValidation)}`);
-  for (const finding of report.findings) {
+function printHostedReport(out, report2) {
+  out.log(`security report ${report2.jobId}: ${report2.repository}@${report2.revision}`);
+  out.log(`  coverage: ${report2.coverageStatus} cells=${report2.metrics.coverageCells} shallow=${report2.metrics.shallowCells} blocked=${report2.metrics.blockedCells} unscheduled=${report2.metrics.unscheduledCells} budget_exhausted=${report2.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report2.metrics.confirmed} needs_reproduction=${report2.metrics.needsReproduction} candidates=${report2.metrics.candidates} rejected=${report2.metrics.rejected}`);
+  out.log(`  discovery: ${report2.provenance.discovery?.provider ?? "unknown"}/${report2.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report2.provenance.validation?.provider ?? "unknown"}/${report2.provenance.validation?.model ?? "unknown"} independent=${String(report2.provenance.independentValidation)}`);
+  for (const finding of report2.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report2.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report2, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report2.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report2.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report2.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report2.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report2.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
-function printHostedSecurityPlanRoute(out, label, route) {
-  const readiness = route.enabled && route.credentialReady ? "ready" : [
-    route.enabled ? void 0 : "disabled",
-    route.credentialReady ? void 0 : "credential unavailable"
+function printHostedSecurityPlanRoute(out, label, route2) {
+  const readiness = route2.enabled && route2.credentialReady ? "ready" : [
+    route2.enabled ? void 0 : "disabled",
+    route2.credentialReady ? void 0 : "credential unavailable"
   ].filter(Boolean).join(", ");
-  out.log(`  ${label}: ${route.provider}/${route.model} \xB7 policy v${route.policyVersion} \xB7 ${readiness}`);
-  out.log(`    bounds: ${route.maxCallsPerRun} calls/run \xB7 ${route.maxInputBytes} input bytes/call \xB7 ${route.maxOutputTokens} output tokens/call`);
+  out.log(`  ${label}: ${route2.provider}/${route2.model} \xB7 policy v${route2.policyVersion} \xB7 ${readiness}`);
+  out.log(`    bounds: ${route2.maxCallsPerRun} calls/run \xB7 ${route2.maxInputBytes} input bytes/call \xB7 ${route2.maxOutputTokens} output tokens/call`);
 }
 function printHostedCoverage(out, job) {
   const coverage = job.coverage;
   out.log(`  coverage: ${job.coverageStatus ?? "pending"}${coverage?.completeCells !== void 0 ? ` ${coverage.completeCells}/${coverage.totalCells ?? "?"}` : ""}${coverage?.shallowCells ? ` shallow=${coverage.shallowCells}` : ""}${coverage?.blockedCells ? ` blocked=${coverage.blockedCells}` : ""}${coverage?.unscheduledCells ? ` unscheduled=${coverage.unscheduledCells}` : ""}${coverage?.budgetExhaustedCells ? ` budget_exhausted=${coverage.budgetExhaustedCells}` : ""}`);
 }
-function routeLabel(route) {
-  return `${route.provider}/${route.model}${route.policyVersion ? ` policy v${route.policyVersion}` : ""}`;
+function routeLabel(route2) {
+  return `${route2.provider}/${route2.model}${route2.policyVersion ? ` policy v${route2.policyVersion}` : ""}`;
 }
 var HOSTED_SEVERITIES = ["informational", "low", "medium", "high", "critical"];
 function hostedSeverity(value, flag) {
@@ -3198,9 +6170,9 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_security = require("@odla-ai/security");
-var import_node = require("@odla-ai/security/node");
+var import_node2 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
   if (options.sourceDisclosureAck !== "redacted") {
     throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
@@ -3210,9 +6182,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path7.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path7.resolve)(options.out ?? (0, import_node_path7.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path7.relative)(target, output).split(import_node_path7.sep).join("/");
+  const target = (0, import_node_path8.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path8.resolve)(options.out ?? (0, import_node_path8.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path8.relative)(target, output).split(import_node_path8.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -3223,8 +6195,8 @@ async function runHostedSecurity(options) {
     scope: selfAudit ? "platform:security:self" : null
   };
   const token = await injectedToken(options, tokenRequest);
-  const snapshot = await (0, import_node.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path7.isAbsolute)(outputRelative) ? [outputRelative] : []
+  const snapshot = await (0, import_node2.snapshotDirectory)(target, {
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path8.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -3242,7 +6214,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node.FileRunStore((0, import_node_path7.resolve)(output, "state")),
+    store: new import_node2.FileRunStore((0, import_node_path8.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -3251,22 +6223,22 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node.writeSecurityArtifacts)(output, report);
-  const reportDigest = await (0, import_security.securityFingerprint)(report);
+  const report2 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node2.writeSecurityArtifacts)(output, report2);
+  const reportDigest = await (0, import_security.securityFingerprint)(report2);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report.coverageStatus,
-    confirmed: report.metrics.confirmed,
-    candidates: report.metrics.candidates
+    coverageStatus: report2.coverageStatus,
+    confirmed: report2.metrics.confirmed,
+    candidates: report2.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);
-  return Object.freeze({ report, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report2, output);
+  return Object.freeze({ report: report2, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path7.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path8.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -3287,234 +6259,20 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report, output) {
-  const complete = report.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report2, output) {
+  const complete = report2.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
-  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path7.resolve)(output, "REPORT.md")}`);
+  out.log(`  coverage: ${report2.coverageStatus} ${complete}/${report2.coverage.length} blocked=${report2.metrics.blockedCells} shallow=${report2.metrics.shallowCells} unscheduled=${report2.metrics.unscheduledCells} budget_exhausted=${report2.metrics.budgetExhaustedCells}`);
+  if (report2.callBudget) out.log(`  calls: discovery=${formatBudget(report2.callBudget.discovery)} validation=${formatBudget(report2.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report2.metrics.confirmed} needs_reproduction=${report2.metrics.needsReproduction} candidates=${report2.metrics.candidates}`);
+  out.log(`  report: ${(0, import_node_path8.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
 }
 
-// src/security-hosted-github.ts
-var import_node_child_process4 = require("child_process");
-var import_node_util2 = require("util");
-
-// src/security-hosted-request.ts
-async function requestHostedSecurityJson(options, path, init, action) {
-  const platform = platformAudience(options.platform);
-  const token = hostedSecurityCredential(options.token);
-  const requestInit = {
-    ...init,
-    redirect: "error",
-    credentials: "omit",
-    cache: "no-store",
-    signal: options.signal,
-    headers: {
-      authorization: `Bearer ${token}`,
-      "content-type": "application/json",
-      ...init.headers
-    }
-  };
-  const response = await (options.fetch ?? fetch)(new URL(path, platform), requestInit);
-  const body = await response.json().catch(() => ({}));
-  if (!response.ok) {
-    const code = optionalHostedText(body.error?.code, "error code", 128);
-    const message = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response.status})${code ? ` ${code}` : ""}${message ? `: ${message}` : ""}`);
-  }
-  return body;
-}
-function hostedIdentifier(value, name) {
-  const result = optionalHostedText(value, name, 180);
-  if (!result || !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(result)) {
-    throw new Error(`${name} is invalid`);
-  }
-  return result;
-}
-function positivePolicyVersion(value, name) {
-  if (!Number.isSafeInteger(value) || value < 1) {
-    throw new Error(`${name} is invalid`);
-  }
-  return value;
-}
-function optionalHostedText(value, name, maxLength) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f\u007f]/.test(value)) {
-    throw new Error(`${name} is invalid`);
-  }
-  return value;
-}
-function githubRepositoryName(value) {
-  if (typeof value !== "string" || value.length > 201) {
-    throw new Error("repository must be owner/name");
-  }
-  const parts = value.split("/");
-  const owner = parts[0] ?? "";
-  const name = (parts[1] ?? "").replace(/\.git$/i, "");
-  if (parts.length !== 2 || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(name) || name === "." || name === "..") {
-    throw new Error("repository must be owner/name");
-  }
-  return `${owner}/${name}`;
-}
-function trustedGitHubInstallUrl(value) {
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error("odla.ai returned an invalid GitHub installation URL");
-  }
-  if (url.protocol !== "https:" || url.hostname !== "github.com" || url.username || url.password) {
-    throw new Error("odla.ai returned an untrusted GitHub installation URL");
-  }
-  return url.toString();
-}
-function hostedPollInterval(value = 2e3) {
-  if (!Number.isSafeInteger(value) || value < 100 || value > 3e4) {
-    throw new Error("poll interval must be 100-30000ms");
-  }
-  return value;
-}
-function hostedPollTimeout(value = 10 * 6e4) {
-  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) {
-    throw new Error("poll timeout must be 1000-3600000ms");
-  }
-  return value;
-}
-async function waitForHostedPoll(milliseconds, signal) {
-  if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve7, reject) => {
-    const timer = setTimeout(resolve7, milliseconds);
-    signal?.addEventListener("abort", () => {
-      clearTimeout(timer);
-      reject(signal.reason ?? new DOMException("aborted", "AbortError"));
-    }, { once: true });
-  });
-}
-function isValidHostedSecurityPlan(value, env) {
-  if (!value || value.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value.planDigest) || value.consentContract !== "odla.hosted-security-consent.v1" || value.reportProjection !== "odla.hosted-security-report.v1" || value.redactionContract !== "odla.best-effort-credential-pattern-redaction.v1" || typeof value.promptBundle !== "string" || value.promptBundle.length < 1 || value.promptBundle.length > 100 || typeof value.ready !== "boolean" || typeof value.independent !== "boolean" || value.sourceDisclosure !== "redacted" || value.targetExecution !== false || !Number.isSafeInteger(value.reportRetentionDays) || value.reportRetentionDays < 1) return false;
-  const validRoute = (route, purpose) => !!route && route.purpose === purpose && typeof route.enabled === "boolean" && typeof route.credentialReady === "boolean" && typeof route.provider === "string" && route.provider.length > 0 && route.provider.length <= 100 && typeof route.model === "string" && route.model.length > 0 && route.model.length <= 200 && Number.isSafeInteger(route.policyVersion) && route.policyVersion >= 1 && Number.isSafeInteger(route.maxCallsPerRun) && route.maxCallsPerRun >= 1 && Number.isSafeInteger(route.maxInputBytes) && route.maxInputBytes >= 1 && Number.isSafeInteger(route.maxOutputTokens) && route.maxOutputTokens >= 1;
-  return validRoute(value.routes?.discovery, "security.discovery") && validRoute(value.routes?.validation, "security.validation");
-}
-function hostedSecurityCredential(value) {
-  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
-    throw new Error("Hosted security requires an injected odla developer token");
-  }
-  return value;
-}
-
-// src/security-hosted-github.ts
-async function connectGitHubSecuritySource(options) {
-  const out = options.stdout ?? console;
-  const repository = githubRepositoryName(options.repository);
-  const attempt = await requestHostedSecurityJson(
-    options,
-    "/registry/github/connect",
-    {
-      method: "POST",
-      body: JSON.stringify({
-        appId: hostedIdentifier(options.appId, "appId"),
-        env: hostedIdentifier(options.env, "env"),
-        repository
-      })
-    },
-    "start GitHub connection"
-  );
-  const serverExpiry = Date.parse(attempt?.expiresAt ?? "");
-  if (!attempt?.attemptId || !attempt.installUrl || !Number.isFinite(serverExpiry)) {
-    throw new Error("odla.ai returned an invalid GitHub connection attempt");
-  }
-  const installUrl = trustedGitHubInstallUrl(attempt.installUrl);
-  out.log(`GitHub approval: ${installUrl}`);
-  if (options.open !== false) {
-    await (options.openInstallUrl ?? openUrl)(installUrl);
-    out.log("github: opened installation approval in your browser");
-  }
-  const interval = hostedPollInterval(options.pollIntervalMs);
-  const now = options.now ?? Date.now;
-  const deadline = Math.min(serverExpiry, now() + hostedPollTimeout(options.pollTimeoutMs));
-  const wait = options.wait ?? waitForHostedPoll;
-  while (true) {
-    const state = await requestHostedSecurityJson(
-      options,
-      `/registry/github/connect/${encodeURIComponent(attempt.attemptId)}`,
-      {},
-      "check GitHub connection"
-    );
-    if (state.status !== "pending") {
-      if (state.status === "connected") return state;
-      throw new Error(`GitHub connection ${state.status}${state.failureCode ? `: ${state.failureCode}` : ""}`);
-    }
-    if (now() >= deadline) throw new Error("GitHub connection approval timed out");
-    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);
-  }
-}
-async function listGitHubSecuritySources(options) {
-  const appId = hostedIdentifier(options.appId, "appId");
-  const env = hostedIdentifier(options.env, "env");
-  const body = await requestHostedSecurityJson(
-    options,
-    `/registry/apps/${encodeURIComponent(appId)}/github/sources?env=${encodeURIComponent(env)}`,
-    {},
-    "list GitHub security sources"
-  );
-  return Array.isArray(body.sources) ? body.sources : [];
-}
-async function disconnectGitHubSecuritySource(options) {
-  const appId = hostedIdentifier(options.appId, "appId");
-  const sourceId = hostedIdentifier(options.sourceId, "sourceId");
-  await requestHostedSecurityJson(
-    options,
-    `/registry/apps/${encodeURIComponent(appId)}/github/sources/${encodeURIComponent(sourceId)}`,
-    { method: "DELETE" },
-    "disconnect GitHub security source"
-  );
-}
-function repositoryFromGitRemote(remoteInput) {
-  const remote = remoteInput.trim();
-  const scp = /^git@github\.com:([^/\s]+)\/([^/\s]+?)\/?$/.exec(remote);
-  if (scp) return githubRepositoryName(`${scp[1]}/${scp[2].replace(/\.git$/, "")}`);
-  let url;
-  try {
-    url = new URL(remote);
-  } catch {
-    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
-  }
-  if (url.hostname !== "github.com" || url.protocol !== "https:" && url.protocol !== "ssh:") {
-    throw new Error("origin must be a github.com HTTPS or SSH repository URL");
-  }
-  if (url.password || url.protocol === "https:" && url.username || url.search || url.hash) {
-    throw new Error("credential-bearing GitHub origin URLs are not accepted");
-  }
-  const parts = url.pathname.replace(/^\/+|\/+$/g, "").split("/");
-  if (parts.length !== 2) {
-    throw new Error("origin must identify one GitHub owner/name repository");
-  }
-  return githubRepositoryName(`${parts[0]}/${parts[1].replace(/\.git$/, "")}`);
-}
-async function inferGitHubRepository(cwd = process.cwd(), readOrigin = defaultReadOrigin) {
-  let remote;
-  try {
-    remote = await readOrigin(cwd);
-  } catch {
-    throw new Error("Could not read git origin; pass --repo owner/name");
-  }
-  return repositoryFromGitRemote(remote);
-}
-async function defaultReadOrigin(cwd) {
-  const result = await (0, import_node_util2.promisify)(import_node_child_process4.execFile)(
-    "git",
-    ["remote", "get-url", "origin"],
-    { cwd, encoding: "utf8" }
-  );
-  return result.stdout;
-}
-
 // src/security-hosted-intent.ts
 async function getHostedSecurityIntent(options) {
   const appId = hostedIdentifier(options.appId, "appId");
@@ -3524,19 +6282,19 @@ async function getHostedSecurityIntent(options) {
   const query = new URLSearchParams({ env, sourceId });
   if (ref) query.set("ref", ref);
   if (options.profile) query.set("profile", options.profile);
-  const response = await requestHostedSecurityJson(
+  const response2 = await requestHostedSecurityJson(
     options,
     `/registry/apps/${encodeURIComponent(appId)}/security/intent?${query.toString()}`,
     {},
     "read hosted security execution intent"
   );
-  if (!isValidHostedSecurityPlan(response.plan, env) || !isValidIntent(response.intent, { appId, env, sourceId })) {
+  if (!isValidHostedSecurityPlan(response2.plan, env) || !isValidIntent(response2.intent, { appId, env, sourceId })) {
     throw new Error("odla.ai returned an invalid hosted security execution intent");
   }
-  if (response.intent.planDigest !== response.plan.planDigest) {
+  if (response2.intent.planDigest !== response2.plan.planDigest) {
     throw new Error("odla.ai returned a hosted security intent for a different processing plan");
   }
-  return response;
+  return response2;
 }
 function isValidIntent(value, expected) {
   return !!value && value.executionContract === "odla.hosted-security-execution-consent.v1" && /^sha256:[a-f0-9]{64}$/.test(value.executionDigest) && /^sha256:[a-f0-9]{64}$/.test(value.planDigest) && value.appId === expected.appId && value.env === expected.env && value.sourceId === expected.sourceId && typeof value.repository === "string" && value.repository.length > 2 && value.repository.length <= 201 && typeof value.defaultBranch === "string" && value.defaultBranch.length > 0 && value.defaultBranch.length <= 255 && typeof value.requestedRef === "string" && value.requestedRef.length > 0 && value.requestedRef.length <= 255 && !/[\u0000-\u001f\u007f]/.test(value.requestedRef) && ["odla", "cloudflare-app", "generic"].includes(value.profile) && value.sourceDisclosure === "redacted";
@@ -3599,8 +6357,8 @@ async function startHostedSecurityJob(options) {
       "start hosted security job"
     );
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message)) {
+    const message3 = error instanceof Error ? error.message : String(error);
+    if (/\b(?:plan_conflict|policy_conflict|intent_conflict|security_ai_not_ready)\b/.test(message3)) {
       throw new Error("Hosted security plan or execution intent changed or became unavailable after review; fetch a fresh intent and explicitly acknowledge its digest before enqueueing again", { cause: error });
     }
     throw error;
@@ -3635,7 +6393,7 @@ async function followHostedSecurityJob(options) {
   const interval = hostedPollInterval(options.pollIntervalMs);
   const now = options.now ?? Date.now;
   const deadline = now() + hostedPollTimeout(options.pollTimeoutMs ?? 60 * 6e4);
-  const wait = options.wait ?? waitForHostedPoll;
+  const wait2 = options.wait ?? waitForHostedPoll;
   let prior = "";
   while (true) {
     const job = await getHostedSecurityJob(options);
@@ -3646,7 +6404,7 @@ async function followHostedSecurityJob(options) {
     if (now() >= deadline) {
       throw new Error(`Hosted security job ${job.jobId} did not finish before the polling deadline`);
     }
-    await wait(Math.min(interval, Math.max(0, deadline - now())), options.signal);
+    await wait2(Math.min(interval, Math.max(0, deadline - now())), options.signal);
   }
 }
 async function getHostedSecurityReport(options) {
@@ -3755,13 +6513,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report2 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report2 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report);
+    printHostedReport(context.stdout, report2);
   }
-  enforceHostedReportGate(report, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report2, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -3828,13 +6586,13 @@ async function runLocalSecurityCommand(parsed, dependencies) {
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report, parsed) {
+function enforceLocalGate(report2, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report2, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report2, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report2.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -3873,9 +6631,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report, null, 2));
-    else printHostedReport(context.stdout, report);
+    const report2 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report2, null, 2));
+    else printHostedReport(context.stdout, report2);
     return;
   }
   if (sub !== "run") {
@@ -3958,9 +6716,9 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/skill.ts
-var import_node_fs10 = require("fs");
-var import_node_os = require("os");
-var import_node_path8 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path9 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -4021,8 +6779,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path8.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path8.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const root = (0, import_node_path9.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path9.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -4036,48 +6794,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path8.join)(targetDir2, rel), (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path9.join)(targetDir2, rel), (0, import_node_fs11.readFileSync)((0, import_node_path9.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path8.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path8.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path8.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path9.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path9.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path9.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path8.dirname)((0, import_node_path8.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path9.dirname)((0, import_node_path9.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path8.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path9.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path8.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path9.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path8.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs11.readFileSync)((0, import_node_path9.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path9.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path8.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path9.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path8.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path9.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path8.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path9.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path8.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path9.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -4091,11 +6849,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs10.existsSync)(file.target)) {
+    if (!(0, import_node_fs11.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs10.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs11.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -4112,9 +6870,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs10.existsSync)(file.target) || (0, import_node_fs10.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(file.target), { recursive: true });
-      (0, import_node_fs10.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs11.existsSync)(file.target) || (0, import_node_fs11.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(file.target), { recursive: true });
+      (0, import_node_fs11.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -4133,7 +6891,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path8.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path8.sep}`) && !(0, import_node_path8.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path9.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path9.sep}`) && !(0, import_node_path9.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -4155,9 +6913,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs10.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs11.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs10.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs11.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -4178,15 +6936,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path8.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path8.sep}`) || (0, import_node_path8.isAbsolute)(rel)) {
+  const rel = (0, import_node_path9.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path9.sep}`) || (0, import_node_path9.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path8.sep).filter(Boolean)) {
-    current = (0, import_node_path8.join)(current, part);
+  for (const part of rel.split(import_node_path9.sep).filter(Boolean)) {
+    current = (0, import_node_path9.join)(current, part);
     try {
-      if ((0, import_node_fs10.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs11.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -4197,13 +6955,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs10.existsSync)(dir)) return [];
+  if (!(0, import_node_fs11.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs10.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path8.join)(current, entry.name);
+    for (const entry of (0, import_node_fs11.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path9.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path8.relative)(dir, path));
+      else results.push((0, import_node_path9.relative)(dir, path));
     }
   };
   walk(dir);
@@ -4387,6 +7145,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     printCapabilities(parsed.options.json === true);
     return;
   }
+  if (command === "code") {
+    await codeCommand(parsed, dependencies);
+    return;
+  }
   if (command === "admin") {
     await adminCommand(parsed);
     return;
@@ -4543,6 +7305,8 @@ async function calendarCommand(parsed, dependencies) {
 0 && (module.exports = {
   AGENT_HARNESSES,
   CAPABILITIES,
+  CODE_BUILD_RECIPES,
+  CODE_PI_IMAGE,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   adminAi,
@@ -4552,6 +7316,7 @@ async function calendarCommand(parsed, dependencies) {
   calendarDisconnect,
   calendarServiceConfig,
   calendarStatus,
+  codeConnect,
   connectGitHubSecuritySource,
   disconnectGitHubSecuritySource,
   doctor,
@@ -4573,6 +7338,7 @@ async function calendarCommand(parsed, dependencies) {
   redactSecrets,
   repositoryFromGitRemote,
   runCli,
+  runCodeRuntime,
   runHostedSecurity,
   secretsPush,
   secretsSet,