npm - @odla-ai/cli - Versions diffs - 0.26.1 → 0.27.0 - Mend

@odla-ai/cli 0.26.1 → 0.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (13) hide show

package/README.md +0 -19
package/dist/bin.cjs +348 -351
package/dist/bin.cjs.map +1 -1
package/dist/bin.js +1 -1
package/dist/{chunk-ZAZBUURZ.js → chunk-DS64H4FY.js} +230 -228
package/dist/chunk-DS64H4FY.js.map +1 -0
package/dist/index.cjs +348 -351
package/dist/index.cjs.map +1 -1
package/dist/index.d.cts +1 -1
package/dist/index.d.ts +1 -1
package/dist/index.js +1 -1
package/package.json +2 -1
package/dist/chunk-ZAZBUURZ.js.map +0 -1

package/dist/bin.cjs CHANGED Viewed

@@ -246,7 +246,7 @@ var import_node_process2 = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process2.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -254,7 +254,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve12();
+      resolve13();
     });
   });
 }
@@ -492,7 +492,6 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
-  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
@@ -2176,6 +2175,153 @@ async function appCommand(parsed, dependencies = {}) {
   else await appRestore(options);
 }
+// src/brand-command.ts
+var import_promises2 = require("fs/promises");
+var import_node_path7 = require("path");
+// src/brand-design-unpack.ts
+var import_node_zlib = require("zlib");
+var import_brand = require("@odla-ai/brand");
+var EXTENSIONS = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/svg+xml": "svg",
+  "image/avif": "avif",
+  "font/woff2": "woff2",
+  "font/woff": "woff",
+  "font/ttf": "ttf",
+  "font/otf": "otf",
+  "text/javascript": "js",
+  "application/javascript": "js",
+  "text/css": "css",
+  "text/html": "html",
+  "application/json": "json"
+};
+var encode = (text2) => new TextEncoder().encode(text2);
+function assetFileName(uuid, mime) {
+  const ext = EXTENSIONS[mime.split(";")[0].trim().toLowerCase()] ?? "bin";
+  return `${uuid.replace(/[^a-zA-Z0-9._-]/g, "_")}.${ext}`;
+}
+function decodePayload(data, compressed) {
+  const raw = Buffer.from(data, "base64");
+  return new Uint8Array(compressed ? (0, import_node_zlib.gunzipSync)(raw) : raw);
+}
+function rewriteReferences(template, assetPaths, pagePaths) {
+  let out = template;
+  for (const [uuid, path] of pagePaths) {
+    out = out.split(`about:blank#${uuid}`).join(path);
+  }
+  for (const [uuid, path] of assetPaths) {
+    out = out.split(uuid).join(path);
+  }
+  return out;
+}
+function tokensCss(digest) {
+  if (Object.keys(digest.tokens.light).length === 0) return null;
+  return (0, import_brand.renderTokensCss)(digest.tokens.light, { dark: digest.tokens.dark });
+}
+function unpackDesign(html) {
+  const bundle = (0, import_brand.parseDesignBundle)(html);
+  const manifest = (0, import_brand.readDesignManifest)(html);
+  const digest = (0, import_brand.digestDesignBundle)(bundle);
+  const pageUuids = new Set(bundle.pageOrder);
+  const files = [];
+  const failed = [];
+  const assetPaths = /* @__PURE__ */ new Map();
+  const pagePaths = /* @__PURE__ */ new Map();
+  for (const [uuid, entry] of Object.entries(manifest)) {
+    let bytes;
+    try {
+      bytes = decodePayload(entry.data, entry.compressed);
+    } catch {
+      failed.push(uuid);
+      continue;
+    }
+    if (pageUuids.has(uuid)) {
+      const path2 = `pages/${assetFileName(uuid, "text/html")}`;
+      pagePaths.set(uuid, `./${path2}`);
+      files.push({ path: path2, bytes });
+      continue;
+    }
+    const path = `assets/${assetFileName(uuid, entry.mime)}`;
+    assetPaths.set(uuid, `./${path}`);
+    files.push({ path, bytes });
+  }
+  files.push({
+    path: "index.html",
+    bytes: encode(rewriteReferences(bundle.template, assetPaths, pagePaths))
+  });
+  files.push({ path: "digest.json", bytes: encode(`${JSON.stringify(digest, null, 2)}
+`) });
+  const css = tokensCss(digest);
+  if (css !== null) files.push({ path: "tokens.css", bytes: encode(css) });
+  if (bundle.thumbnailSvg) files.push({ path: "thumbnail.svg", bytes: encode(bundle.thumbnailSvg) });
+  return { files, digest, failed };
+}
+function describeUnpack(result, outDir) {
+  const { digest } = result;
+  const lines = [
+    `Unpacked ${digest.title ? `"${digest.title}"` : "design"} into ${outDir}`,
+    `  index.html    the design, offline-runnable (${digest.templateBytes} bytes)`,
+    `  assets/       ${digest.assetCount} embedded files (${digest.assetBytes} bytes)`,
+    `  digest.json   ${Object.keys(digest.tokens.light).length} --ui-* tokens, ${digest.props.length} props, ${digest.outline.length} headings`
+  ];
+  if (result.files.some((f) => f.path === "tokens.css"))
+    lines.push("  tokens.css    the design's tokens as an @odla-ai/ui theme sheet");
+  if (digest.fonts.length > 0) lines.push(`Typefaces: ${digest.fonts.join(", ")}`);
+  if (result.failed.length > 0)
+    lines.push(`WARNING: ${result.failed.length} embedded asset(s) could not be decoded.`);
+  return lines;
+}
+// src/brand-command.ts
+var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
+async function readBundle(source, deps) {
+  if (source !== "-") return (0, import_promises2.readFile)((0, import_node_path7.resolve)(source), "utf8");
+  const readStdin = deps.readStdin;
+  if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
+  return readStdin();
+}
+async function writeAll(result, outDir) {
+  for (const file of result.files) {
+    const target = (0, import_node_path7.resolve)(outDir, file.path);
+    await (0, import_promises2.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    await (0, import_promises2.writeFile)(target, file.bytes);
+  }
+}
+async function designUnpack(parsed, deps) {
+  assertArgs(parsed, ["out", "json"], 4);
+  const source = parsed.positionals[3];
+  if (!source) throw new Error(USAGE);
+  const outDir = (0, import_node_path7.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const result = unpackDesign(await readBundle(source, deps));
+  await writeAll(result, outDir);
+  const out = deps.stdout ?? console;
+  if (parsed.options.json === true) {
+    out.log(
+      JSON.stringify({
+        outDir,
+        files: result.files.map((f) => f.path),
+        failed: result.failed,
+        digest: result.digest
+      })
+    );
+    return;
+  }
+  for (const line of describeUnpack(result, outDir)) out.log(line);
+}
+async function brandCommand(parsed, deps) {
+  const subject = parsed.positionals[1];
+  const action2 = parsed.positionals[2];
+  if (subject === "design" && action2 === "unpack") {
+    await designUnpack(parsed, deps);
+    return;
+  }
+  throw new Error(USAGE);
+}
 // src/calendar-errors.ts
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
@@ -2449,8 +2595,8 @@ function credential(value2) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve12, reject) => {
-    const timer = setTimeout(resolve12, milliseconds);
+  await new Promise((resolve13, reject) => {
+    const timer = setTimeout(resolve13, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -2704,7 +2850,7 @@ function printGroup(out, heading, items) {
 // src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 // src/version.ts
 var import_node_fs9 = require("fs");
@@ -2743,9 +2889,9 @@ function canonicalValue(value2) {
   }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
-    const record11 = value2;
+    const record10 = value2;
     return Object.fromEntries(
-      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
+      Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, canonicalValue(record10[key])])
     );
   }
   throw new TypeError("canonical JSON rejects unsupported values");
@@ -3083,7 +3229,7 @@ async function configOperationWait(options) {
   assertOperationId(options.operationId);
   const cfg = await loadProjectConfig(options.configPath);
   const client = await operationClient(cfg, options, "wait");
-  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
   const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
   const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
@@ -3114,7 +3260,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3169,7 +3315,7 @@ function record3(value2) {
 // src/config-reconcile-command.ts
 var import_apps8 = require("@odla-ai/apps");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 // src/config-reconcile.ts
 var import_apps7 = require("@odla-ai/apps");
@@ -3465,7 +3611,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3598,12 +3744,12 @@ function quoteArg2(value2) {
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
 var import_node_fs12 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs11 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -3617,7 +3763,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path9.join)(rootDir, name);
+    const path = (0, import_node_path10.join)(rootDir, name);
     if ((0, import_node_fs11.existsSync)(path)) return path;
   }
   return null;
@@ -3730,10 +3876,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path10.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path10.resolve)(rootDir)) {
+      const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path11.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs12.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -3768,7 +3914,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path10.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs12.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -3798,7 +3944,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path10.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4026,12 +4172,12 @@ function harnessOption(value2, flag) {
 // src/init.ts
 var import_node_fs13 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path11.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path11.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -4048,12 +4194,12 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(configPath), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -4294,7 +4440,7 @@ async function resolveVaultWrite(options) {
 // src/skill.ts
 var import_node_fs14 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 var import_node_url2 = require("url");
 // src/skill-adapters.ts
@@ -4373,8 +4519,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path12.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path12.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path13.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path13.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -4388,48 +4534,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path12.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path12.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path12.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path12.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path13.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path13.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path13.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path12.dirname)((0, import_node_path12.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path13.dirname)((0, import_node_path13.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path12.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path13.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path12.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path13.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path12.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path12.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path13.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path12.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path13.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path12.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path13.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path12.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path13.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -4465,7 +4611,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(file.target), { recursive: true });
+      (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
       (0, import_node_fs14.writeFileSync)(file.target, file.content);
     }
   }
@@ -4485,7 +4631,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path12.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path12.sep}`) && !(0, import_node_path12.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path13.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path13.sep}`) && !(0, import_node_path13.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -4530,13 +4676,13 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path12.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path12.sep}`) || (0, import_node_path12.isAbsolute)(rel)) {
+  const rel = (0, import_node_path13.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path13.sep}`) || (0, import_node_path13.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path12.sep).filter(Boolean)) {
-    current = (0, import_node_path12.join)(current, part);
+  for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
+    current = (0, import_node_path13.join)(current, part);
     try {
       if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -4553,9 +4699,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path12.join)(current, entry.name);
+      const path = (0, import_node_path13.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path12.relative)(dir, path));
+      else results.push((0, import_node_path13.relative)(dir, path));
     }
   };
   walk(dir);
@@ -4867,7 +5013,7 @@ async function projectCommand(command, parsed, deps) {
 // src/code-connect.ts
 var import_node_fs15 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -4953,15 +5099,15 @@ function encodeAgentInput(message2) {
 // ../harness/dist/chunk-PHXQH4YM.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_path = require("path");
 var import_process = require("process");
-var import_promises3 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_os = require("os");
 var import_path2 = require("path");
 var import_child_process2 = require("child_process");
 var import_path3 = require("path");
-var import_promises4 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_os2 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -4972,7 +5118,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(import_path.delimiter).filter(Boolean)) {
     try {
-      await (0, import_promises2.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
+      await (0, import_promises3.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
       return true;
     } catch {
     }
@@ -5258,18 +5404,18 @@ async function gitBlobs(cwd, entries, maxBytes) {
 }
 async function materializeGitTree(source, commitSha, options = {}) {
   if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
-  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
+  const sourceDir = await (0, import_promises4.realpath)((0, import_path2.resolve)(source));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record11) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
+  const entries = inventory.flatMap((record10) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record10);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
-  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
   const targetRoot = (0, import_path2.join)(root, "source");
-  await (0, import_promises3.mkdir)(targetRoot);
+  await (0, import_promises4.mkdir)(targetRoot);
   let byteCount = 0;
   try {
     const blobs = await gitBlobs(sourceDir, entries, maxBytes);
@@ -5279,18 +5425,18 @@ async function materializeGitTree(source, commitSha, options = {}) {
       if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       const target = (0, import_path2.resolve)(targetRoot, entry.path);
       if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
-      await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-      await (0, import_promises3.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+      await (0, import_promises4.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+      await (0, import_promises4.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
     }
     return {
       root,
       sourceDir: targetRoot,
       fileCount: entries.length,
       byteCount,
-      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises3.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
@@ -5298,7 +5444,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await (0, import_promises4.readdir)(dir, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises5.readdir)(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
       if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
       const path = (0, import_path4.join)(dir, entry.name);
@@ -5308,7 +5454,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const metadata2 = await (0, import_promises4.stat)(path);
+      const metadata2 = await (0, import_promises5.stat)(path);
       bytes += metadata2.size;
       if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
       if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
@@ -5357,7 +5503,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
     let metadata2;
     try {
-      metadata2 = await (0, import_promises4.lstat)(source);
+      metadata2 = await (0, import_promises5.lstat)(source);
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
@@ -5372,9 +5518,9 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
 async function copyTree(files, destination) {
   for (const file of files) {
     const target = (0, import_path4.join)(destination, file.relativePath);
-    await (0, import_promises4.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
-    await (0, import_promises4.copyFile)(file.source, target);
-    await (0, import_promises4.chmod)(target, file.mode);
+    await (0, import_promises5.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises5.copyFile)(file.source, target);
+    await (0, import_promises5.chmod)(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
@@ -5411,13 +5557,13 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
-  const sourceStat = await (0, import_promises4.stat)(sourceDir);
+  const sourceDir = await (0, import_promises5.realpath)((0, import_path4.resolve)(source));
+  const sourceStat = await (0, import_promises5.stat)(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
   try {
     const maxFiles = options.maxFiles ?? 2e4;
     const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
@@ -5430,26 +5576,26 @@ async function stageWorkspace(source, options = {}) {
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises5.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
-  const baselineDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(baselineSource));
-  const workspaceDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(workspaceSource));
+  const baselineDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(workspaceSource));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const [baselineFiles, workspaceFiles] = await Promise.all([
     sourceFiles(baselineDirSource, maxFiles, maxBytes),
     sourceFiles(workspaceDirSource, maxFiles, maxBytes)
   ]);
-  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
   try {
     await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
     return {
@@ -5459,17 +5605,17 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
       fileCount: workspaceFiles.length,
       byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises5.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_crypto = require("crypto");
-var import_promises5 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_path5 = require("path");
 // ../camel/dist/chunk-7FHPOQVP.js
@@ -5511,8 +5657,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record11 = value2;
-    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
+    const record10 = value2;
+    return Object.fromEntries(Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, normalize(record10[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -5806,19 +5952,19 @@ function validateSnapshot(snapshot, limits) {
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_child_process4 = require("child_process");
-var import_promises6 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_path6 = require("path");
 var import_child_process5 = require("child_process");
 var import_process2 = require("process");
 var import_crypto2 = require("crypto");
 var import_crypto3 = require("crypto");
 var import_fs2 = require("fs");
-var import_promises7 = require("fs/promises");
-var import_path7 = require("path");
 var import_promises8 = require("fs/promises");
+var import_path7 = require("path");
+var import_promises9 = require("fs/promises");
 var import_os3 = require("os");
 var import_path8 = require("path");
-var import_promises9 = require("fs/promises");
+var import_promises10 = require("fs/promises");
 var import_path9 = require("path");
 // ../camel/dist/chunk-LAXU2AVK.js
@@ -6102,7 +6248,7 @@ var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
-    const entries = await (0, import_promises5.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
       const target = (0, import_path5.resolve)(directory, entry.name);
@@ -6117,7 +6263,7 @@ async function digestStagedWorkspace(root, limits) {
   const hash = (0, import_crypto.createHash)("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content2 = await (0, import_promises5.readFile)(file.target);
+    const content2 = await (0, import_promises6.readFile)(file.target);
     bytes += Buffer.byteLength(file.path) + content2.byteLength;
     if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
     hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content2.byteLength}:`);
@@ -6443,7 +6589,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
+      const info = await (0, import_promises7.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -6734,7 +6880,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
       const path = (0, import_path7.join)(workspaceDir, artifact.path);
-      const info = await (0, import_promises7.lstat)(path);
+      const info = await (0, import_promises8.lstat)(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -6915,9 +7061,9 @@ var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_mod
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
 async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.tmpdir)()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await (0, import_promises8.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
+  const root = await (0, import_promises9.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
   const sourceDir = (0, import_path8.join)(root, "source");
-  await (0, import_promises8.mkdir)(sourceDir);
+  await (0, import_promises9.mkdir)(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -6929,8 +7075,8 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = (0, import_path8.resolve)(sourceDir, file.path);
       if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code source path escapes its root");
-      await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-      await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+      await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+      await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
       validateAlias(reference.alias);
@@ -6944,13 +7090,13 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = (0, import_path8.resolve)(sourceDir, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
-    return { sourceDir, cleanup: () => (0, import_promises8.rm)(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => (0, import_promises9.rm)(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await (0, import_promises8.rm)(root, { recursive: true, force: true });
+    await (0, import_promises9.rm)(root, { recursive: true, force: true });
     throw cause;
   }
 }
@@ -6971,8 +7117,8 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = (0, import_path8.resolve)(root, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(root)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
   }
@@ -7158,11 +7304,11 @@ async function read(context, request2, options, policy) {
   const allowed = await policy.read(policyContext(context, request2, options, { paths, path, startLine, endLine }));
   if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
-  const info = await (0, import_promises9.stat)(target);
+  const info = await (0, import_promises10.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
     throw new TypeError("file is not a bounded regular source file");
   }
-  const source = await (0, import_promises9.readFile)(target);
+  const source = await (0, import_promises10.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
   const content2 = lines.slice(startLine - 1, endLine).join("\n");
@@ -7239,7 +7385,7 @@ function policyContext(context, request2, options, extra) {
 async function registeredFiles(root, limit) {
   const paths = [];
   const walk = async (directory) => {
-    for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises10.readdir)(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
       const target = (0, import_path9.resolve)(directory, entry.name);
       if (entry.isDirectory()) await walk(target);
@@ -7838,8 +7984,8 @@ function hostedPollTimeout(value2 = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve12, reject) => {
-    const timer = setTimeout(resolve12, milliseconds);
+  await new Promise((resolve13, reject) => {
+    const timer = setTimeout(resolve13, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -8024,9 +8170,9 @@ function digestText(value2) {
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
 var import_node_crypto3 = require("crypto");
-var import_promises10 = require("fs/promises");
+var import_promises11 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 var import_node_url3 = require("url");
 // src/code-runtime-config.ts
@@ -8106,16 +8252,16 @@ function embeddedPiAssetPath() {
   return (0, import_node_url3.fileURLToPath)(new URL("./runtime/pi-agent.js", importMetaUrl));
 }
 async function embeddedPiImageName() {
-  const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
+  const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path13.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path13.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path13.join)(context, "Dockerfile"), [
+    await (0, import_promises11.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
+    await (0, import_promises11.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -8124,14 +8270,14 @@ async function buildEmbeddedPiImage(engine, image, run) {
     ].join("\n"), { mode: 384 });
     await run(engine, ["build", "--tag", image, context], "inherit");
   } finally {
-    await (0, import_promises10.rm)(context, { recursive: true, force: true });
+    await (0, import_promises11.rm)(context, { recursive: true, force: true });
   }
 }
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path14.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -8500,10 +8646,8 @@ function requireName(parsed) {
   return name;
 }
-// src/help.ts
-function printHelp(output = console) {
-  output.log(`odla-ai
+// src/help-usage.ts
+var USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
                                      runbooks. Ask BEFORE searching the web or
@@ -8537,6 +8681,7 @@ Usage:
   odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app owners add <email> [--email <odla-account>] [--json]
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -8572,7 +8717,6 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -8617,8 +8761,12 @@ Usage:
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
   odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
+  odla-ai version`;
+// src/help.ts
+function printHelp(output = console) {
+  output.log(`odla-ai
+${USAGE_SECTION}
 Commands:
   agent        Inspect durable agent wakeups and explicitly requeue a
                dead-lettered job; JSON output is stable for remote operators.
@@ -9067,7 +9215,7 @@ function jsonl(ctx, parsed, value2) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
@@ -9405,8 +9553,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
+  const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -9451,9 +9599,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record11) => record11.status !== "met"),
-    activeTasks: tasks.filter((record11) => record11.column !== "done"),
-    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
+    unmetGoals: goals.filter((record10) => record10.status !== "met"),
+    activeTasks: tasks.filter((record10) => record10.column !== "done"),
+    openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -9472,10 +9620,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(
+      else for (const record10 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record11
+        record10
       );
     }
   });
@@ -9666,167 +9814,12 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
-// src/platform-chat-credential-command.ts
-var import_node_process10 = __toESM(require("process"), 1);
-async function rotatePlatformChatCredential(parsed, deps) {
-  assertArgs(
-    parsed,
-    [
-      "config",
-      "context",
-      "platform",
-      "token",
-      "email",
-      "open",
-      "json",
-      "yes",
-      "wrangler-config",
-      "expected-version"
-    ],
-    3
-  );
-  if (parsed.options.yes !== true) {
-    throw new Error(
-      "platform chat-credentials rotate changes the production chat secret; pass --yes"
-    );
-  }
-  const context = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const platform = context.platform.value;
-  const doFetch = deps.fetch ?? fetch;
-  const out = deps.stdout ?? console;
-  const run = deps.runner ?? defaultRunner;
-  const cwd = import_node_process10.default.cwd();
-  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
-  if (!await wranglerLoggedIn(run, cwd)) {
-    throw new Error(
-      'Wrangler is not authenticated; run "npx wrangler login" and retry'
-    );
-  }
-  const priorHealth = await doFetch(`${platform}/health/services/chat`);
-  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
-  await priorHealth.body?.cancel().catch(() => {
-  });
-  if (!priorVersion) {
-    throw new Error(
-      "chat health did not identify its current Worker version; refusing to rotate"
-    );
-  }
-  const expectedVersion = stringOpt(parsed.options["expected-version"]);
-  if (expectedVersion && priorVersion !== expectedVersion) {
-    throw new Error(
-      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
-    );
-  }
-  const token = await resolveAdminPlatformToken({
-    platform,
-    scope: "platform:chat:credential:write",
-    token: stringOpt(parsed.options.token),
-    tokenFile: context.credentials.scopedTokenFile,
-    email: stringOpt(parsed.options.email),
-    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    fetch: doFetch,
-    stdout: out,
-    openApprovalUrl: deps.openUrl,
-    label: "odla CLI (rotate built-in Discussion responder)"
-  });
-  const mintedResponse = await doFetch(
-    `${platform}/registry/platform/chat-credentials/rotate`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}` }
-    }
-  );
-  const minted = await mintedResponse.json().catch(() => null);
-  if (!mintedResponse.ok) {
-    throw new Error(
-      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
-    );
-  }
-  if (!isPlatformChatCredential(minted)) {
-    throw new Error(
-      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
-    );
-  }
-  const put = await wranglerPutSecret(run, {
-    name: "ODLA_BOT_TOKENS",
-    value: JSON.stringify({
-      [minted.appId]: { [minted.principalId]: minted.key }
-    }),
-    configPath: wranglerConfig,
-    cwd
-  });
-  if (put.code !== 0) {
-    throw new Error(
-      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
-    );
-  }
-  const version = await waitForRotatedChatHealth({
-    fetch: doFetch,
-    platform,
-    priorVersion,
-    wait: deps.pollWait
-  });
-  const result = {
-    schemaVersion: "odla.platform-chat-credential-rotation/v1",
-    appId: minted.appId,
-    appIncarnation: minted.appIncarnation,
-    principalId: minted.principalId,
-    health: { ok: true, service: "odla-chat-agent", version }
-  };
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(result, null, 2));
-  } else {
-    out.log(
-      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
-    );
-  }
-}
-async function waitForRotatedChatHealth(opts) {
-  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
-  let lastStatus = 0;
-  let lastVersion = null;
-  let lastError = "private_service_unready";
-  for (let attempt = 0; attempt < 60; attempt++) {
-    const response2 = await opts.fetch(
-      `${opts.platform}/health/services/chat`
-    );
-    const body = await response2.json().catch(() => null);
-    const version = response2.headers.get("x-odla-worker-version-id");
-    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
-      return version;
-    }
-    lastStatus = response2.status;
-    lastVersion = version;
-    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
-    if (attempt < 59) await wait2(5e3);
-  }
-  throw new Error(
-    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
-  );
-}
-function isPlatformChatCredential(value2) {
-  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
-}
-function apiMessage(value2) {
-  if (!record7(value2)) return "request failed";
-  const error = record7(value2.error) ? value2.error : value2;
-  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
-}
-function record7(value2) {
-  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
-}
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1];
   if (action2 === "status") {
     return platformStatus(parsed, deps);
   }
-  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
-    return rotatePlatformChatCredential(parsed, deps);
-  }
   throw new Error(
     `unknown platform action "${[
       action2,
@@ -9864,7 +9857,7 @@ async function platformStatus(parsed, deps) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -9877,17 +9870,17 @@ async function platformStatus(parsed, deps) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
+  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage2(value2) {
-  if (!record8(value2)) return "request failed";
-  const error = record8(value2.error) ? value2.error : value2;
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record8(value2) {
+function record7(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
@@ -9928,7 +9921,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -10009,7 +10002,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record9(value2) {
+function record8(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -10037,7 +10030,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -10049,39 +10042,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -10090,17 +10083,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record10(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record10(resources.d1) ? resources.d1 : {};
-  const d1Activity = record10(d1.activity) ? d1.activity : {};
-  const d1Storage = record10(d1.storage) ? d1.storage : {};
-  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record10(resources.r2) ? resources.r2 : {};
-  const r2Operations = record10(r2.operations) ? r2.operations : {};
-  const r2Storage = record10(r2.storage) ? r2.storage : {};
+  const resources = record9(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record9(resources.d1) ? resources.d1 : {};
+  const d1Activity = record9(d1.activity) ? d1.activity : {};
+  const d1Storage = record9(d1.storage) ? d1.storage : {};
+  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record9(resources.r2) ? resources.r2 : {};
+  const r2Operations = record9(r2.operations) ? r2.operations : {};
+  const r2Storage = record9(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -10111,11 +10104,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record10(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record9(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record10(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -10300,7 +10293,7 @@ async function read2(url, headers, doFetch) {
 // src/provision.ts
 var import_apps12 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process10 = __toESM(require("process"), 1);
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -10607,7 +10600,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process11.default.env[cfg.ai.keyEnv];
+      const key = import_node_process10.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -10649,7 +10642,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 // src/record.ts
 var import_node_fs16 = require("fs");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 // src/surface.ts
 var PM_ACTIONS = {
@@ -10694,6 +10687,7 @@ var COMMAND_SURFACE = {
     promote: {},
     owners: { list: {}, add: {}, remove: {} }
   },
+  brand: { design: { unpack: {} } },
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
@@ -10717,8 +10711,7 @@ var COMMAND_SURFACE = {
   o11y: { status: {} },
   operations: { get: {}, wait: {} },
   platform: {
-    status: {},
-    "chat-credentials": { rotate: {} }
+    status: {}
   },
   pm: {
     ...PM_ENTITIES,
@@ -10798,7 +10791,7 @@ function invocationPath(words2) {
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process11.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -10991,7 +10984,7 @@ async function runbookRemove(ctx, slug) {
 // src/runbook-import.ts
 var import_node_fs18 = require("fs");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 function parseRunbook(text2, slug) {
   let rest = text2;
   const meta = {};
@@ -11020,8 +11013,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path15.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path15.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path16.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -11095,7 +11088,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
 var import_node_fs19 = require("fs");
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -11264,7 +11257,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path16.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
     if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
@@ -11334,7 +11327,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path16.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11469,10 +11462,10 @@ async function runbookComment(ctx, slug, body) {
 var import_node_child_process8 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path17 = require("path");
-var import_node_process13 = __toESM(require("process"), 1);
+var import_node_path18 = require("path");
+var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process13.default.env) {
+function resolveEditor(env = import_node_process12.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11486,8 +11479,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process13.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process12.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process12.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -11495,8 +11488,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path17.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path17.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path18.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -11838,7 +11831,7 @@ async function runbookCommand(parsed, deps = {}) {
 }
 // src/security-command-context.ts
-var import_promises11 = require("readline/promises");
+var import_promises12 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -11864,7 +11857,7 @@ async function hostedSecurityContext(parsed, dependencies) {
 async function interactiveConfirmation(message2, dependencies) {
   if (dependencies.confirm) return dependencies.confirm(message2);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises12.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question(`${message2} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
@@ -11991,7 +11984,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 // src/security.ts
-var import_node_path18 = require("path");
+var import_node_path19 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -12003,9 +11996,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path18.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path18.resolve)(options.out ?? (0, import_node_path18.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path18.relative)(target, output).split(import_node_path18.sep).join("/");
+  const target = (0, import_node_path19.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path19.resolve)(options.out ?? (0, import_node_path19.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path19.relative)(target, output).split(import_node_path19.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -12017,7 +12010,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path18.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path19.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -12035,7 +12028,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path18.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path19.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -12059,7 +12052,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path18.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path19.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -12088,7 +12081,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path18.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -12589,6 +12582,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await securityCommand(parsed, runtime);
     return;
   }
+  if (command === "brand") {
+    await brandCommand(parsed, runtime);
+    return;
+  }
   if (command === "pm") {
     await pmCommand(parsed, runtime);
     return;