@odla-ai/cli 0.26.2 → 0.27.1

package/dist/bin.cjs

@@ -246,7 +246,7 @@ var import_node_process2 = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process2.default.platform);
   const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve12, reject) => {
+  await new Promise((resolve13, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -254,7 +254,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve12();
+      resolve13();
     });
   });
 }
@@ -338,6 +338,7 @@ async function freshHandshake(ctx, waitMs) {
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
       label: `${ctx.cfg.app.id} provisioner`,
+      projectIds: [ctx.cfg.app.id],
       fetch: ctx.doFetch,
       waitMs,
       onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
@@ -2175,6 +2176,153 @@ async function appCommand(parsed, dependencies = {}) {
   else await appRestore(options);
 }
 
+// src/brand-command.ts
+var import_promises2 = require("fs/promises");
+var import_node_path7 = require("path");
+
+// src/brand-design-unpack.ts
+var import_node_zlib = require("zlib");
+var import_brand = require("@odla-ai/brand");
+var EXTENSIONS = {
+  "image/png": "png",
+  "image/jpeg": "jpg",
+  "image/gif": "gif",
+  "image/webp": "webp",
+  "image/svg+xml": "svg",
+  "image/avif": "avif",
+  "font/woff2": "woff2",
+  "font/woff": "woff",
+  "font/ttf": "ttf",
+  "font/otf": "otf",
+  "text/javascript": "js",
+  "application/javascript": "js",
+  "text/css": "css",
+  "text/html": "html",
+  "application/json": "json"
+};
+var encode = (text2) => new TextEncoder().encode(text2);
+function assetFileName(uuid, mime) {
+  const ext = EXTENSIONS[mime.split(";")[0].trim().toLowerCase()] ?? "bin";
+  return `${uuid.replace(/[^a-zA-Z0-9._-]/g, "_")}.${ext}`;
+}
+function decodePayload(data, compressed) {
+  const raw = Buffer.from(data, "base64");
+  return new Uint8Array(compressed ? (0, import_node_zlib.gunzipSync)(raw) : raw);
+}
+function rewriteReferences(template, assetPaths, pagePaths) {
+  let out = template;
+  for (const [uuid, path] of pagePaths) {
+    out = out.split(`about:blank#${uuid}`).join(path);
+  }
+  for (const [uuid, path] of assetPaths) {
+    out = out.split(uuid).join(path);
+  }
+  return out;
+}
+function tokensCss(digest) {
+  if (Object.keys(digest.tokens.light).length === 0) return null;
+  return (0, import_brand.renderTokensCss)(digest.tokens.light, { dark: digest.tokens.dark });
+}
+function unpackDesign(html) {
+  const bundle = (0, import_brand.parseDesignBundle)(html);
+  const manifest = (0, import_brand.readDesignManifest)(html);
+  const digest = (0, import_brand.digestDesignBundle)(bundle);
+  const pageUuids = new Set(bundle.pageOrder);
+  const files = [];
+  const failed = [];
+  const assetPaths = /* @__PURE__ */ new Map();
+  const pagePaths = /* @__PURE__ */ new Map();
+  for (const [uuid, entry] of Object.entries(manifest)) {
+    let bytes;
+    try {
+      bytes = decodePayload(entry.data, entry.compressed);
+    } catch {
+      failed.push(uuid);
+      continue;
+    }
+    if (pageUuids.has(uuid)) {
+      const path2 = `pages/${assetFileName(uuid, "text/html")}`;
+      pagePaths.set(uuid, `./${path2}`);
+      files.push({ path: path2, bytes });
+      continue;
+    }
+    const path = `assets/${assetFileName(uuid, entry.mime)}`;
+    assetPaths.set(uuid, `./${path}`);
+    files.push({ path, bytes });
+  }
+  files.push({
+    path: "index.html",
+    bytes: encode(rewriteReferences(bundle.template, assetPaths, pagePaths))
+  });
+  files.push({ path: "digest.json", bytes: encode(`${JSON.stringify(digest, null, 2)}
+`) });
+  const css = tokensCss(digest);
+  if (css !== null) files.push({ path: "tokens.css", bytes: encode(css) });
+  if (bundle.thumbnailSvg) files.push({ path: "thumbnail.svg", bytes: encode(bundle.thumbnailSvg) });
+  return { files, digest, failed };
+}
+function describeUnpack(result, outDir) {
+  const { digest } = result;
+  const lines = [
+    `Unpacked ${digest.title ? `"${digest.title}"` : "design"} into ${outDir}`,
+    `  index.html    the design, offline-runnable (${digest.templateBytes} bytes)`,
+    `  assets/       ${digest.assetCount} embedded files (${digest.assetBytes} bytes)`,
+    `  digest.json   ${Object.keys(digest.tokens.light).length} --ui-* tokens, ${digest.props.length} props, ${digest.outline.length} headings`
+  ];
+  if (result.files.some((f) => f.path === "tokens.css"))
+    lines.push("  tokens.css    the design's tokens as an @odla-ai/ui theme sheet");
+  if (digest.fonts.length > 0) lines.push(`Typefaces: ${digest.fonts.join(", ")}`);
+  if (result.failed.length > 0)
+    lines.push(`WARNING: ${result.failed.length} embedded asset(s) could not be decoded.`);
+  return lines;
+}
+
+// src/brand-command.ts
+var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
+async function readBundle(source, deps) {
+  if (source !== "-") return (0, import_promises2.readFile)((0, import_node_path7.resolve)(source), "utf8");
+  const readStdin = deps.readStdin;
+  if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
+  return readStdin();
+}
+async function writeAll(result, outDir) {
+  for (const file of result.files) {
+    const target = (0, import_node_path7.resolve)(outDir, file.path);
+    await (0, import_promises2.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    await (0, import_promises2.writeFile)(target, file.bytes);
+  }
+}
+async function designUnpack(parsed, deps) {
+  assertArgs(parsed, ["out", "json"], 4);
+  const source = parsed.positionals[3];
+  if (!source) throw new Error(USAGE);
+  const outDir = (0, import_node_path7.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const result = unpackDesign(await readBundle(source, deps));
+  await writeAll(result, outDir);
+  const out = deps.stdout ?? console;
+  if (parsed.options.json === true) {
+    out.log(
+      JSON.stringify({
+        outDir,
+        files: result.files.map((f) => f.path),
+        failed: result.failed,
+        digest: result.digest
+      })
+    );
+    return;
+  }
+  for (const line of describeUnpack(result, outDir)) out.log(line);
+}
+async function brandCommand(parsed, deps) {
+  const subject = parsed.positionals[1];
+  const action2 = parsed.positionals[2];
+  if (subject === "design" && action2 === "unpack") {
+    await designUnpack(parsed, deps);
+    return;
+  }
+  throw new Error(USAGE);
+}
+
 // src/calendar-errors.ts
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
@@ -2448,8 +2596,8 @@ function credential(value2) {
 // src/calendar-poll.ts
 async function waitForCalendarPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new Error("calendar connection aborted");
-  await new Promise((resolve12, reject) => {
-    const timer = setTimeout(resolve12, milliseconds);
+  await new Promise((resolve13, reject) => {
+    const timer = setTimeout(resolve13, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new Error("calendar connection aborted"));
@@ -2703,7 +2851,7 @@ function printGroup(out, heading, items) {
 
 // src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 
 // src/version.ts
 var import_node_fs9 = require("fs");
@@ -3082,7 +3230,7 @@ async function configOperationWait(options) {
   assertOperationId(options.operationId);
   const cfg = await loadProjectConfig(options.configPath);
   const client = await operationClient(cfg, options, "wait");
-  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
   const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
   const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
   const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
@@ -3113,7 +3261,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3168,7 +3316,7 @@ function record3(value2) {
 
 // src/config-reconcile-command.ts
 var import_apps8 = require("@odla-ai/apps");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/config-reconcile.ts
 var import_apps7 = require("@odla-ai/apps");
@@ -3464,7 +3612,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3597,12 +3745,12 @@ function quoteArg2(value2) {
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
 var import_node_fs12 = require("fs");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs11 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -3616,7 +3764,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path9.join)(rootDir, name);
+    const path = (0, import_node_path10.join)(rootDir, name);
     if ((0, import_node_fs11.existsSync)(path)) return path;
   }
   return null;
@@ -3729,10 +3877,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path10.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path10.resolve)(rootDir)) {
+      const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path11.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs12.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -3767,7 +3915,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path10.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs12.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -3797,7 +3945,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path10.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4025,12 +4173,12 @@ function harnessOption(value2, flag) {
 
 // src/init.ts
 var import_node_fs13 = require("fs");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path11.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path11.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -4047,12 +4195,12 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(configPath), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -4293,7 +4441,7 @@ async function resolveVaultWrite(options) {
 // src/skill.ts
 var import_node_fs14 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -4372,8 +4520,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path12.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path12.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path13.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path13.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -4387,48 +4535,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path12.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path12.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path12.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path12.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path13.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path13.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path13.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path12.dirname)((0, import_node_path12.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path13.dirname)((0, import_node_path13.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path12.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path13.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path12.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path13.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path12.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path12.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path13.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path12.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path13.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path12.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path13.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path12.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path13.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -4464,7 +4612,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(file.target), { recursive: true });
+      (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
       (0, import_node_fs14.writeFileSync)(file.target, file.content);
     }
   }
@@ -4484,7 +4632,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path12.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path12.sep}`) && !(0, import_node_path12.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path13.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path13.sep}`) && !(0, import_node_path13.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -4529,13 +4677,13 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path12.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path12.sep}`) || (0, import_node_path12.isAbsolute)(rel)) {
+  const rel = (0, import_node_path13.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path13.sep}`) || (0, import_node_path13.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path12.sep).filter(Boolean)) {
-    current = (0, import_node_path12.join)(current, part);
+  for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
+    current = (0, import_node_path13.join)(current, part);
     try {
       if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -4552,9 +4700,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path12.join)(current, entry.name);
+      const path = (0, import_node_path13.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path12.relative)(dir, path));
+      else results.push((0, import_node_path13.relative)(dir, path));
     }
   };
   walk(dir);
@@ -4866,7 +5014,7 @@ async function projectCommand(command, parsed, deps) {
 // src/code-connect.ts
 var import_node_fs15 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -4952,15 +5100,15 @@ function encodeAgentInput(message2) {
 // ../harness/dist/chunk-PHXQH4YM.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
-var import_promises2 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_path = require("path");
 var import_process = require("process");
-var import_promises3 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_os = require("os");
 var import_path2 = require("path");
 var import_child_process2 = require("child_process");
 var import_path3 = require("path");
-var import_promises4 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_os2 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -4971,7 +5119,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(import_path.delimiter).filter(Boolean)) {
     try {
-      await (0, import_promises2.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
+      await (0, import_promises3.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
       return true;
     } catch {
     }
@@ -5257,7 +5405,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
 }
 async function materializeGitTree(source, commitSha, options = {}) {
   if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
-  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
+  const sourceDir = await (0, import_promises4.realpath)((0, import_path2.resolve)(source));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
@@ -5266,9 +5414,9 @@ async function materializeGitTree(source, commitSha, options = {}) {
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
-  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
   const targetRoot = (0, import_path2.join)(root, "source");
-  await (0, import_promises3.mkdir)(targetRoot);
+  await (0, import_promises4.mkdir)(targetRoot);
   let byteCount = 0;
   try {
     const blobs = await gitBlobs(sourceDir, entries, maxBytes);
@@ -5278,18 +5426,18 @@ async function materializeGitTree(source, commitSha, options = {}) {
       if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       const target = (0, import_path2.resolve)(targetRoot, entry.path);
       if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
-      await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-      await (0, import_promises3.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+      await (0, import_promises4.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+      await (0, import_promises4.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
     }
     return {
       root,
       sourceDir: targetRoot,
       fileCount: entries.length,
       byteCount,
-      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises3.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
@@ -5297,7 +5445,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await (0, import_promises4.readdir)(dir, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises5.readdir)(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
       if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
       const path = (0, import_path4.join)(dir, entry.name);
@@ -5307,7 +5455,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const metadata2 = await (0, import_promises4.stat)(path);
+      const metadata2 = await (0, import_promises5.stat)(path);
       bytes += metadata2.size;
       if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
       if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
@@ -5356,7 +5504,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
     let metadata2;
     try {
-      metadata2 = await (0, import_promises4.lstat)(source);
+      metadata2 = await (0, import_promises5.lstat)(source);
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
@@ -5371,9 +5519,9 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
 async function copyTree(files, destination) {
   for (const file of files) {
     const target = (0, import_path4.join)(destination, file.relativePath);
-    await (0, import_promises4.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
-    await (0, import_promises4.copyFile)(file.source, target);
-    await (0, import_promises4.chmod)(target, file.mode);
+    await (0, import_promises5.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises5.copyFile)(file.source, target);
+    await (0, import_promises5.chmod)(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
@@ -5410,13 +5558,13 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
-  const sourceStat = await (0, import_promises4.stat)(sourceDir);
+  const sourceDir = await (0, import_promises5.realpath)((0, import_path4.resolve)(source));
+  const sourceStat = await (0, import_promises5.stat)(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
   try {
     const maxFiles = options.maxFiles ?? 2e4;
     const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
@@ -5429,26 +5577,26 @@ async function stageWorkspace(source, options = {}) {
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises5.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
-  const baselineDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(baselineSource));
-  const workspaceDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(workspaceSource));
+  const baselineDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(workspaceSource));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const [baselineFiles, workspaceFiles] = await Promise.all([
     sourceFiles(baselineDirSource, maxFiles, maxBytes),
     sourceFiles(workspaceDirSource, maxFiles, maxBytes)
   ]);
-  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
   try {
     await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
     return {
@@ -5458,17 +5606,17 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
       fileCount: workspaceFiles.length,
       byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises5.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_crypto = require("crypto");
-var import_promises5 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_path5 = require("path");
 
 // ../camel/dist/chunk-7FHPOQVP.js
@@ -5805,19 +5953,19 @@ function validateSnapshot(snapshot, limits) {
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_child_process4 = require("child_process");
-var import_promises6 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_path6 = require("path");
 var import_child_process5 = require("child_process");
 var import_process2 = require("process");
 var import_crypto2 = require("crypto");
 var import_crypto3 = require("crypto");
 var import_fs2 = require("fs");
-var import_promises7 = require("fs/promises");
-var import_path7 = require("path");
 var import_promises8 = require("fs/promises");
+var import_path7 = require("path");
+var import_promises9 = require("fs/promises");
 var import_os3 = require("os");
 var import_path8 = require("path");
-var import_promises9 = require("fs/promises");
+var import_promises10 = require("fs/promises");
 var import_path9 = require("path");
 
 // ../camel/dist/chunk-LAXU2AVK.js
@@ -6101,7 +6249,7 @@ var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
-    const entries = await (0, import_promises5.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
       const target = (0, import_path5.resolve)(directory, entry.name);
@@ -6116,7 +6264,7 @@ async function digestStagedWorkspace(root, limits) {
   const hash = (0, import_crypto.createHash)("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content2 = await (0, import_promises5.readFile)(file.target);
+    const content2 = await (0, import_promises6.readFile)(file.target);
     bytes += Buffer.byteLength(file.path) + content2.byteLength;
     if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
     hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content2.byteLength}:`);
@@ -6442,7 +6590,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
+      const info = await (0, import_promises7.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -6733,7 +6881,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
       const path = (0, import_path7.join)(workspaceDir, artifact.path);
-      const info = await (0, import_promises7.lstat)(path);
+      const info = await (0, import_promises8.lstat)(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -6914,9 +7062,9 @@ var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_mod
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
 async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.tmpdir)()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await (0, import_promises8.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
+  const root = await (0, import_promises9.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
   const sourceDir = (0, import_path8.join)(root, "source");
-  await (0, import_promises8.mkdir)(sourceDir);
+  await (0, import_promises9.mkdir)(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -6928,8 +7076,8 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = (0, import_path8.resolve)(sourceDir, file.path);
       if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code source path escapes its root");
-      await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-      await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+      await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+      await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
       validateAlias(reference.alias);
@@ -6943,13 +7091,13 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = (0, import_path8.resolve)(sourceDir, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
-    return { sourceDir, cleanup: () => (0, import_promises8.rm)(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => (0, import_promises9.rm)(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await (0, import_promises8.rm)(root, { recursive: true, force: true });
+    await (0, import_promises9.rm)(root, { recursive: true, force: true });
     throw cause;
   }
 }
@@ -6970,8 +7118,8 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = (0, import_path8.resolve)(root, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(root)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
   }
@@ -7157,11 +7305,11 @@ async function read(context, request2, options, policy) {
   const allowed = await policy.read(policyContext(context, request2, options, { paths, path, startLine, endLine }));
   if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
-  const info = await (0, import_promises9.stat)(target);
+  const info = await (0, import_promises10.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
     throw new TypeError("file is not a bounded regular source file");
   }
-  const source = await (0, import_promises9.readFile)(target);
+  const source = await (0, import_promises10.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
   const content2 = lines.slice(startLine - 1, endLine).join("\n");
@@ -7238,7 +7386,7 @@ function policyContext(context, request2, options, extra) {
 async function registeredFiles(root, limit) {
   const paths = [];
   const walk = async (directory) => {
-    for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises10.readdir)(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
       const target = (0, import_path9.resolve)(directory, entry.name);
       if (entry.isDirectory()) await walk(target);
@@ -7837,8 +7985,8 @@ function hostedPollTimeout(value2 = 10 * 6e4) {
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
-  await new Promise((resolve12, reject) => {
-    const timer = setTimeout(resolve12, milliseconds);
+  await new Promise((resolve13, reject) => {
+    const timer = setTimeout(resolve13, milliseconds);
     signal?.addEventListener("abort", () => {
       clearTimeout(timer);
       reject(signal.reason ?? new DOMException("aborted", "AbortError"));
@@ -8023,9 +8171,9 @@ function digestText(value2) {
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
 var import_node_crypto3 = require("crypto");
-var import_promises10 = require("fs/promises");
+var import_promises11 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 var import_node_url3 = require("url");
 
 // src/code-runtime-config.ts
@@ -8105,16 +8253,16 @@ function embeddedPiAssetPath() {
   return (0, import_node_url3.fileURLToPath)(new URL("./runtime/pi-agent.js", importMetaUrl));
 }
 async function embeddedPiImageName() {
-  const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
+  const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path13.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path13.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path13.join)(context, "Dockerfile"), [
+    await (0, import_promises11.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
+    await (0, import_promises11.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -8123,14 +8271,14 @@ async function buildEmbeddedPiImage(engine, image, run) {
     ].join("\n"), { mode: 384 });
     await run(engine, ["build", "--tag", image, context], "inherit");
   } finally {
-    await (0, import_promises10.rm)(context, { recursive: true, force: true });
+    await (0, import_promises11.rm)(context, { recursive: true, force: true });
   }
 }
 
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path14.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -8499,10 +8647,8 @@ function requireName(parsed) {
   return name;
 }
 
-// src/help.ts
-function printHelp(output = console) {
-  output.log(`odla-ai
-
+// src/help-usage.ts
+var USAGE_SECTION = `
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
                                      runbooks. Ask BEFORE searching the web or
@@ -8536,6 +8682,7 @@ Usage:
   odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app owners add <email> [--email <odla-account>] [--json]
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -8615,8 +8762,12 @@ Usage:
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
   odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
+  odla-ai version`;
 
+// src/help.ts
+function printHelp(output = console) {
+  output.log(`odla-ai
+${USAGE_SECTION}
 Commands:
   agent        Inspect durable agent wakeups and explicitly requeue a
                dead-lettered job; JSON output is stable for remote operators.
@@ -9065,7 +9216,7 @@ function jsonl(ctx, parsed, value2) {
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
-  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
   const now = ctx.now ?? Date.now;
   const intervalMs = (numberOpt2(parsed, "interval", DEFAULT_INTERVAL_MS / 1e3) ?? DEFAULT_INTERVAL_MS / 1e3) * 1e3;
   const timeoutSeconds = numberOpt2(parsed, "timeout");
@@ -10537,6 +10688,7 @@ var COMMAND_SURFACE = {
     promote: {},
     owners: { list: {}, add: {}, remove: {} }
   },
+  brand: { design: { unpack: {} } },
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
@@ -10833,7 +10985,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 var import_node_fs18 = require("fs");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 function parseRunbook(text2, slug) {
   let rest = text2;
   const meta = {};
@@ -10862,8 +11014,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path15.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path15.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path16.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -10937,7 +11089,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
 var import_node_fs19 = require("fs");
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -11106,7 +11258,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path16.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
     if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
@@ -11176,7 +11328,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path16.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11311,7 +11463,7 @@ async function runbookComment(ctx, slug, body) {
 var import_node_child_process8 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = import_node_process12.default.env) {
@@ -11337,8 +11489,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path17.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path17.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path18.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -11680,7 +11832,7 @@ async function runbookCommand(parsed, deps = {}) {
 }
 
 // src/security-command-context.ts
-var import_promises11 = require("readline/promises");
+var import_promises12 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -11706,7 +11858,7 @@ async function hostedSecurityContext(parsed, dependencies) {
 async function interactiveConfirmation(message2, dependencies) {
   if (dependencies.confirm) return dependencies.confirm(message2);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises11.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises12.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question(`${message2} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
@@ -11833,7 +11985,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path18 = require("path");
+var import_node_path19 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -11845,9 +11997,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path18.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path18.resolve)(options.out ?? (0, import_node_path18.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path18.relative)(target, output).split(import_node_path18.sep).join("/");
+  const target = (0, import_node_path19.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path19.resolve)(options.out ?? (0, import_node_path19.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path19.relative)(target, output).split(import_node_path19.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -11859,7 +12011,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path18.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path19.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -11877,7 +12029,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path18.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path19.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -11901,7 +12053,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path18.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path19.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -11930,7 +12082,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path18.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -12431,6 +12583,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await securityCommand(parsed, runtime);
     return;
   }
+  if (command === "brand") {
+    await brandCommand(parsed, runtime);
+    return;
+  }
   if (command === "pm") {
     await pmCommand(parsed, runtime);
     return;