@odla-ai/cli 0.27.3 → 0.27.5

package/dist/bin.cjs

@@ -32,6 +32,7 @@ var import_node_process7 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
+var import_node_crypto = require("crypto");
 var import_node_process4 = __toESM(require("process"), 1);
 
 // src/handshake-approval.ts
@@ -386,6 +387,7 @@ async function freshHandshake(ctx, waitMs) {
       endpoint: ctx.cfg.platformUrl,
       email: ctx.email,
       label: `${ctx.cfg.app.id} provisioner`,
+      agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
       fetch: ctx.doFetch,
       waitMs,
@@ -421,6 +423,12 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
+function projectAgentHandle(appId) {
+  const candidate = /^[a-z]/.test(appId) ? appId : `app-${appId}`;
+  if (candidate.length <= 32) return candidate;
+  const digest = (0, import_node_crypto.createHash)("sha256").update(appId).digest("hex").slice(0, 8);
+  return `${candidate.slice(0, 23).replace(/-+$/, "")}-${digest}`;
+}
 function stillPending(pending, email) {
   return new import_db.OdlaError(
     "handshake_pending",
@@ -993,6 +1001,32 @@ var import_node_path4 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
 
+// src/ai-config-validation.ts
+function validateAiConfig(cfg, path) {
+  if (cfg.ai === void 0) return;
+  if (!isRecord4(cfg.ai)) throw new Error(`${path}: ai must be an object`);
+  assertOnly(cfg.ai, ["mode", "provider", "model", "keyEnv", "secretName"], `${path}: ai`);
+  if (cfg.ai.mode !== void 0 && cfg.ai.mode !== "hosted" && cfg.ai.mode !== "byok") {
+    throw new Error(`${path}: ai.mode must be hosted or byok`);
+  }
+  if (cfg.ai.mode === "byok" && !safeText(cfg.ai.provider, 100)) {
+    throw new Error(`${path}: ai.provider is required when ai.mode is byok`);
+  }
+  if (cfg.ai.mode === "hosted" && (cfg.ai.provider || cfg.ai.keyEnv || cfg.ai.secretName)) {
+    throw new Error(`${path}: hosted ai cannot configure a provider, keyEnv, or secretName`);
+  }
+}
+function assertOnly(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function safeText(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
+}
+
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
   if (cfg.integrations === void 0) return;
@@ -1000,16 +1034,16 @@ function validateIntegrations(cfg, path, defaultServices) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, integration] of cfg.integrations.entries()) {
     const at = `${path}: integrations[${index}]`;
-    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!isRecord5(integration)) throw new Error(`${at} must be an object`);
     if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
     if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
     ids.add(integration.id);
-    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
-    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
-    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+    if (!safeText2(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText2(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord5(integration.schema) || !isRecord5(integration.schema.entities))) {
       throw new Error(`${at}.schema must contain an entities object`);
     }
-    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    if (integration.rules !== void 0 && !isRecord5(integration.rules)) throw new Error(`${at}.rules must be an object`);
     validateSeeds(integration, at);
     validateProbes(integration, at);
   }
@@ -1023,13 +1057,13 @@ function validateSeeds(integration, at) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, seed] of integration.seeds.entries()) {
     const sat = `${at}.seeds[${index}]`;
-    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (!isRecord5(seed) || !safeText2(seed.id, 200) || !safeText2(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
     if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
     ids.add(seed.id);
-    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+    if (!isRecord5(seed.key) || !safeText2(seed.key.attr, 200) || !safeText2(seed.key.value, 2048)) {
       throw new Error(`${sat}.key requires string attr and value`);
     }
-    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (!isRecord5(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
     if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
       throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
     }
@@ -1040,16 +1074,16 @@ function validateProbes(integration, at) {
   if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
   for (const [index, probe] of integration.probes.entries()) {
     const pat = `${at}.probes[${index}]`;
-    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!isRecord5(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
     if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
       throw new Error(`${pat}.expectedStatus must be an HTTP status`);
     }
   }
 }
-function isRecord4(value2) {
+function isRecord5(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText(value2, max) {
+function safeText2(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeProbePath(value2) {
@@ -1179,6 +1213,7 @@ function validateRawConfig(raw, path) {
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateAiConfig(cfg, path);
   validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
@@ -1187,11 +1222,11 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
-  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord6(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord6(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(
+  assertOnly2(
     google,
     ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
     `${path}: calendar.google`
@@ -1201,7 +1236,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
     throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
   }
   const availability = google[availabilityKey];
-  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
   const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
@@ -1212,22 +1247,22 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText2(id, 1024))) {
+    if (ids.some((id) => !safeText3(id, 1024))) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
     }
   }
   if (google.bookingCalendar !== void 0) {
-    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
     const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
-      if (!safeText2(value2, 1024)) {
+      if (!safeText3(value2, 1024)) {
         throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
       }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
@@ -1250,14 +1285,14 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly(value2, allowed, label) {
+function assertOnly2(value2, allowed, label) {
   const extra = Object.keys(value2).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord5(value2) {
+function isRecord6(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value2, max) {
+function safeText3(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeHttpsUrl(value2) {
@@ -2633,8 +2668,8 @@ async function calendarCalendars(options) {
 async function calendarConnect(options) {
   const { cfg, ctx, out } = await lifecycleContext(options);
   productionConsent(ctx.env, options.yes, "connect calendar");
-  const page = calendarBookingPageUrl(cfg, ctx.env);
-  const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
+  const page2 = calendarBookingPageUrl(cfg, ctx.env);
+  const applied = page2 === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page2);
   const connectOptions = connectionOptions(options, out);
   return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
@@ -2883,12 +2918,12 @@ var import_apps3 = require("@odla-ai/apps");
 var import_node_fs10 = require("fs");
 
 // src/config-reconcile-digest.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 function canonicalJson(value2) {
   return JSON.stringify(canonicalValue(value2));
 }
 function configDigest(value2) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
 }
 function canonicalValue(value2) {
   if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
@@ -3054,7 +3089,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
 }
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -3062,7 +3097,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -3075,7 +3110,7 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -4057,18 +4092,18 @@ function assertSeedContracts(integrations, schema) {
   }
 }
 function isUniqueAttr(schema, ns, attr) {
-  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  if (!isRecord7(schema) || !isRecord7(schema.entities)) return false;
   const entity = schema.entities[ns];
-  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  if (!isRecord7(entity) || !isRecord7(entity.attrs)) return false;
   const definition = entity.attrs[attr];
-  return isRecord6(definition) && definition.unique === true;
+  return isRecord7(definition) && definition.unique === true;
 }
 function normalizeSchema(value2) {
   if (value2 === void 0 || value2 === null) return { entities: {}, links: {} };
-  if (!isRecord6(value2) || !isRecord6(value2.entities)) {
+  if (!isRecord7(value2) || !isRecord7(value2.entities)) {
     throw new Error("db schema must be a serialized schema object with an entities map");
   }
-  if (value2.links !== void 0 && !isRecord6(value2.links)) throw new Error("db schema links must be an object");
+  if (value2.links !== void 0 && !isRecord7(value2.links)) throw new Error("db schema links must be an object");
   return {
     entities: { ...value2.entities },
     links: { ...value2.links ?? {} }
@@ -4082,7 +4117,7 @@ function mergeMap(target, fragment, label) {
     target[name] = value2;
   }
 }
-function isRecord6(value2) {
+function isRecord7(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -4101,7 +4136,7 @@ async function doctor(options) {
   out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4122,7 +4157,9 @@ async function doctor(options) {
     }
   }
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.services.includes("ai") && cfg.ai?.mode === "byok" && !cfg.ai.provider) {
+    warnings.push("ai.mode is byok but ai.provider is not set");
+  }
   if (cfg.auth?.clerk) {
     for (const [env, value2] of Object.entries(cfg.auth.clerk)) {
       if (typeof value2 === "string" && value2.startsWith("$") && !process.env[value2.slice(1)]) {
@@ -4202,7 +4239,7 @@ function initProject(options) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
-  const aiProvider = options.aiProvider ?? "anthropic";
+  const aiProvider = options.aiProvider;
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
@@ -4229,6 +4266,15 @@ function configTemplate(input) {
     },
   },
 ` : "";
+  const ai = input.aiProvider ? `  ai: {
+    mode: "byok",
+    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
+    // Optional: set this env var while running provision to store the provider
+    // key in the app vault for each tenant.
+    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
+  },` : `  // Hosted AI uses admin-approved models and central cost tracking.
+  // Pass --ai-provider during init only when this app must use BYOK.
+  ai: { mode: "hosted" },`;
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -4247,12 +4293,7 @@ function configTemplate(input) {
     // When rules is omitted, the CLI generates deny-all rules from schema.
     defaultRules: "deny",
   },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
-    // Optional: set this env var while running provision to store the provider
-    // key in the platform vault for each tenant.
-    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
-  },
+${ai}
 ${calendar}
   auth: {
     clerk: {
@@ -4461,9 +4502,10 @@ For work that creates an odla app or adds odla services, read and follow
 \`.agents/skills/odla-migrate/SKILL.md\`. For production telemetry triage, use
 \`.agents/skills/odla-o11y-debug/SKILL.md\`.
 
-Track the work in odla's PM as you go \u2014 record decisions when you make them, file
-bugs when you notice them, and move tasks when the work moves
-(\`npx @odla-ai/cli pm task list\`). The conventions and the full command set are
+Track the work in odla's PM as you go. Before project-mutating work, run
+\`npx @odla-ai/cli pm next --app <appId>\`, confirm alignment to an open goal,
+and atomically claim a refined Ready task. Record decisions when you make them
+and file bugs when you notice them. The conventions and the full command set are
 in \`.agents/skills/odla/references/pm.md\`.
 
 The setup runbooks and their references are installed in this repository, pinned
@@ -4747,12 +4789,16 @@ async function smoke(options) {
   out.log(`  tenant: ${entry.tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
-  if (cfg.ai?.provider) {
+  if (cfg.services.includes("ai") && cfg.ai?.provider) {
     const provider = publicConfig.ai?.provider ?? null;
     if (provider !== cfg.ai.provider) {
       throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
     }
-    out.log(`  ai: ${provider}`);
+    out.log(`  ai: byok/${provider}`);
+  } else if (cfg.services.includes("ai")) {
+    const mode = publicConfig.ai?.mode;
+    if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
+    out.log("  ai: hosted");
   }
   if (hasO11y) out.log(`  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
@@ -4830,7 +4876,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -4839,7 +4885,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -4847,7 +4893,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -5687,7 +5733,7 @@ function dependenciesOf(values, influence = "data") {
   return [...unique3.values()];
 }
 
-// ../camel/dist/chunk-S7EVNA2U.js
+// ../camel/dist/chunk-4DQ6BIHP.js
 var camelValueBrand = /* @__PURE__ */ Symbol("@odla-ai/camel/value");
 var authenticCamelValues = /* @__PURE__ */ new WeakSet();
 function isCamelValue(value2) {
@@ -5699,13 +5745,13 @@ function isSafe(value2) {
 function isUnsafe(value2) {
   return isCamelValue(value2) && value2.label.promptSafety === "unsafe";
 }
-function createSafeInternal(value2, safeBasis, metadata2) {
+function createSafeInternal(value2, safeBasis, metadata2, extra) {
   return createValue(value2, {
     schemaVersion: 1,
     promptSafety: "safe",
     safeBasis,
     ...copyMetadata(metadata2)
-  });
+  }, extra);
 }
 function createUnsafeInternal(value2, metadata2) {
   return createValue(value2, {
@@ -5714,8 +5760,8 @@ function createUnsafeInternal(value2, metadata2) {
     ...copyMetadata(metadata2)
   });
 }
-function createValue(value2, label) {
-  const result = { value: value2, label: Object.freeze(label) };
+function createValue(value2, label, extra) {
+  const result = { value: value2, label: Object.freeze(label), ...extra };
   Object.defineProperty(result, camelValueBrand, { value: label.promptSafety, enumerable: false });
   authenticCamelValues.add(result);
   return Object.freeze(result);
@@ -5976,7 +6022,7 @@ var import_path8 = require("path");
 var import_promises10 = require("fs/promises");
 var import_path9 = require("path");
 
-// ../camel/dist/chunk-LAXU2AVK.js
+// ../camel/dist/chunk-4EIRFS3A.js
 function conversionPolicyDigest(policy) {
   return sha256Hex(canonicalJson2(policy));
 }
@@ -6064,10 +6110,18 @@ async function convert(source, policy, value2, counts) {
   const count = counts.get(countKey) ?? 0;
   if (count >= policy.maximumOutputsPerArtifact) throw new CamelError("limit_exceeded", "Conversion output count exceeds its per-source bound.");
   counts.set(countKey, count + 1);
+  const conversionRecordId = await sha256Hex(canonicalJson2({ conversionId: policy.conversionId, digest: policy.digest, source: sourceKey, ordinal: count }));
+  const datumId = await sha256Hex(canonicalJson2({ conversionRecordId, value: value2 }));
   return createSafeInternal(value2, "atomic_conversion", {
     readers: source.label.readers,
     provenance: [...source.label.provenance, { kind: "converter", id: policy.conversionId, digest: policy.digest }],
     dependencies: dependenciesOf([source])
+  }, {
+    datumId,
+    kind: policy.output.kind,
+    conversionId: policy.conversionId,
+    conversionDigest: policy.digest,
+    conversionRecordId
   });
 }
 function validatePolicyShape(policy) {
@@ -6132,7 +6186,7 @@ function missingPolicy() {
   throw new CamelError("conversion_rejected", "Conversion policy is not registered.");
 }
 
-// ../camel/dist/chunk-P2WQIAG6.js
+// ../camel/dist/chunk-VEAUXH4F.js
 function createCamelIngress(constants2 = []) {
   const byId = /* @__PURE__ */ new Map();
   for (const item of constants2) {
@@ -8122,7 +8176,7 @@ async function defaultReadOrigin(cwd) {
 
 // src/code-local-source.ts
 var import_node_child_process5 = require("child_process");
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
 async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
   const headCommitSha = await readHead(cwd);
@@ -8173,12 +8227,12 @@ async function readGitHead(cwd) {
   return value2;
 }
 function digestText(value2) {
-  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto3.createHash)("sha256").update(value2).digest("hex")}`;
 }
 
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_promises11 = require("fs/promises");
 var import_node_os3 = require("os");
 var import_node_path14 = require("path");
@@ -8264,7 +8318,7 @@ async function embeddedPiImageName() {
   const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
-  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
+  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto4.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
   const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
@@ -8669,7 +8723,7 @@ Start here:
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
@@ -8692,16 +8746,22 @@ Usage:
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
-  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm task add --app <id> --title <t> [--column <backlog|ready|doing|review|done>] [--goal <id>|--alignment-decision <id>] [--assignee <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm next --app <id> [--json]
+  odla-ai pm watch --app <id> [--cursor <cursor>] [--entity goal|task|decision|bug] [--action created|updated|deleted|comment.created|comment.updated] [--state <state>] [--by <principalId>] [--self <principalId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
+  odla-ai pm task ready <id> --expected-revision <n> [--goal <id>|--alignment-decision <id>] [--description <text>|--body <text>] [--acceptance <text>] [--execution <human|agent|either>] [--mutation-id <id>] [--json]
+  odla-ai pm task claim <id> --expected-revision <n> [--mutation-id <id>] [--json]
+  odla-ai pm task release <id> --expected-revision <n> [--mutation-id <id>] [--json]
   odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
   odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm <goal|task|decision|bug> ref <id> [--json]
   odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
-  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
+  odla-ai pm task set <id> [--title <t>|--column <backlog|ready|doing|review|done>|--rank <n>|--goal <id>|--no-goal|--alignment-decision <id>|--no-alignment-decision|--execution <human|agent|either>|--assignee <id>|--no-assignee|--description <text>|--body <text>|--acceptance <text>|--no-acceptance|--due <epoch-ms>|--no-due|--expected-revision <n>] [--mutation-id <id>] [--json]
   odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
   odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
   odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
@@ -9020,11 +9080,11 @@ async function discussList(ctx, parsed) {
     if (value2) query.set(param, value2);
   }
   const qs = query.toString();
-  const page = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
-  emit(ctx, page, () => {
-    ctx.out.log(`topics \u2014 ${page.topics.length} of ${page.total}`);
+  const page2 = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
+  emit(ctx, page2, () => {
+    ctx.out.log(`topics \u2014 ${page2.topics.length} of ${page2.total}`);
     ctx.out.log("id	state	app	replies	subject");
-    for (const topic of page.topics) {
+    for (const topic of page2.topics) {
       ctx.out.log(
         `${topic.id}	${state(topic)}	${topic.appId ?? ""}	${topic.replyCount}	${topic.subject}`
       );
@@ -9039,11 +9099,11 @@ async function discussRead(ctx, id, parsed) {
       limit: requestedLimit ?? "200",
       offset: requestedOffset ?? "0"
     });
-    const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
+    const page2 = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
     emit(
       ctx,
-      page,
-      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+      page2,
+      () => renderDiscussRead(ctx, page2.topic, page2.posts, page2)
     );
     return;
   }
@@ -9056,20 +9116,20 @@ async function discussRead(ctx, id, parsed) {
     let topic = null;
     let offset = 0;
     for (; ; ) {
-      const page = await request(
+      const page2 = await request(
         ctx,
         "GET",
         `/topics/${encodeURIComponent(id)}?limit=200&offset=${offset}`
       );
-      topic = page.topic;
-      for (const post of page.posts) posts.set(post.id, post);
-      mergeDiscussPrincipals(projection, page);
+      topic = page2.topic;
+      for (const post of page2.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page2);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
-      if (!page.page?.hasMore) break;
-      if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
+      if (!page2.page?.hasMore) break;
+      if (page2.page.nextOffset === null || page2.page.nextOffset <= offset) {
         throw new Error("discuss read failed: registry returned a non-advancing post page");
       }
-      offset = page.page.nextOffset;
+      offset = page2.page.nextOffset;
     }
     const ordered = [...posts.values()].sort(
       (a, b) => a.createdAt - b.createdAt || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0)
@@ -9237,9 +9297,9 @@ async function discussWatch(ctx, topicId, parsed) {
   let firstSuccess = true;
   let consecutiveFailures = 0;
   for (; ; ) {
-    let page;
+    let page2;
     try {
-      page = await getWatchPage(ctx, requestPath(topicId, app, cursor));
+      page2 = await getWatchPage(ctx, requestPath(topicId, app, cursor));
       consecutiveFailures = 0;
     } catch (error) {
       if (!(error instanceof WatchRequestError) || !error.retryable) {
@@ -9275,25 +9335,25 @@ async function discussWatch(ctx, topicId, parsed) {
       await sleep(deadline === void 0 ? backoff : Math.min(backoff, Math.max(0, deadline - now())));
       continue;
     }
-    cursor = page.cursor;
-    const baseline = firstSuccess && page.events.length === 0;
+    cursor = page2.cursor;
+    const baseline = firstSuccess && page2.events.length === 0;
     if (baseline) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     }
     firstSuccess = false;
-    const matching = page.events.filter((event) => {
+    const matching = page2.events.filter((event) => {
       if (topicId && (event.type !== "message" || event.action !== "created")) return false;
       return (!by || event.actor.id === by) && (!self || event.actor.id !== self);
     });
     for (const event of matching) {
       jsonl(ctx, parsed, {
         type: "event",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         eventId: event.id,
         cursor: event.cursor,
         event
@@ -9302,9 +9362,9 @@ async function discussWatch(ctx, topicId, parsed) {
     if (matching.length > 0) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
@@ -9312,28 +9372,28 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
-        ...page.authors ? { authors: page.authors } : {},
-        ...page.principals ? { principals: page.principals } : {},
+        ...page2.authors ? { authors: page2.authors } : {},
+        ...page2.principals ? { principals: page2.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
     }
-    if (page.events.length > 0) {
+    if (page2.events.length > 0) {
       jsonl(ctx, parsed, {
         type: "checkpoint",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     } else if (!baseline) {
       jsonl(ctx, parsed, {
         type: "heartbeat",
-        streamId: page.streamId,
+        streamId: page2.streamId,
         cursor,
-        serverTime: page.serverTime
+        serverTime: page2.serverTime
       });
     }
-    if (page.hasMore) continue;
+    if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
       return report2(ctx, parsed, { found: false, cursor });
     }
@@ -9452,7 +9512,13 @@ async function discussCommand(parsed, deps = {}) {
   }
 }
 
-// src/pm-actions.ts
+// src/pm-action-core.ts
+var DONE = {
+  goal: { status: "met", currentPct: 100 },
+  task: { column: "done" },
+  decision: { status: "accepted" },
+  bug: { status: "fixed" }
+};
 var writeMutationId2 = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 var FIELD_MAP = {
   title: { key: "title" },
@@ -9468,22 +9534,27 @@ var FIELD_MAP = {
   body: { key: "body" },
   target: { key: "targetPct", num: true },
   description: { key: "description" },
-  desc: { key: "description" }
-};
-var DONE = {
-  goal: { status: "met", currentPct: 100 },
-  task: { column: "done" },
-  decision: { status: "accepted" },
-  bug: { status: "fixed" }
+  desc: { key: "description" },
+  acceptance: { key: "acceptanceCriteria" },
+  "alignment-decision": { key: "alignmentDecisionId" },
+  execution: { key: "executionMode" },
+  "expected-revision": { key: "expectedRevision", num: true }
 };
 async function pmRequest(ctx, method, path, body) {
-  const res = await ctx.doFetch(`${ctx.platformUrl}/registry/pm${path}`, {
+  const response2 = await ctx.doFetch(`${ctx.platformUrl}/registry/pm${path}`, {
     method,
-    headers: { authorization: `Bearer ${ctx.token}`, "content-type": "application/json" },
+    headers: {
+      authorization: `Bearer ${ctx.token}`,
+      "content-type": "application/json"
+    },
     body: body === void 0 ? void 0 : JSON.stringify(body)
   });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) throw new Error(`pm ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);
+  const data = await response2.json().catch(() => ({}));
+  if (!response2.ok) {
+    throw new Error(
+      `pm ${method} ${path} failed: ${data.error ?? `registry returned ${response2.status}`}`
+    );
+  }
   return data;
 }
 function collectFields(parsed, allowClear) {
@@ -9506,20 +9577,32 @@ function collectEntityFields(entity, parsed, allowClear) {
     if (fields.description === void 0) fields.description = fields.body;
     delete fields.body;
   }
+  if (entity === "task" && fields.column === "ready") fields.column = "todo";
   return fields;
 }
-function statusCol(entity, r) {
-  if (entity === "bug") return `${r.status ?? ""}/${r.severity ?? ""}`;
-  if (entity === "task") return String(r.column ?? "");
-  return String(r.status ?? "");
+function statusCol(entity, record10) {
+  if (entity === "bug") return `${record10.status ?? ""}/${record10.severity ?? ""}`;
+  if (entity === "task") {
+    const state2 = record10.column === "todo" ? "ready" : String(record10.column ?? "");
+    return record10.revision ? `${state2}; r${record10.revision}` : state2;
+  }
+  return String(record10.status ?? "");
 }
-function printRecord(ctx, entity, r) {
-  ctx.out.log(`${r.id}	[${statusCol(entity, r)}]	${r.appId}	${r.title ?? ""}`);
+function referenceMarkup(entity, record10) {
+  const label = (record10.title?.trim() || `${entity} ${record10.id}`).replaceAll("]", ")");
+  return `@[${label}](pm:${entity}/${record10.id})`;
+}
+function printRecord(ctx, entity, record10) {
+  ctx.out.log(
+    `${record10.id}	[${statusCol(entity, record10)}]	${record10.appId}	${record10.title ?? ""}`
+  );
 }
 function emit2(ctx, value2, human) {
   if (ctx.json) ctx.out.log(JSON.stringify(value2, null, 2));
   else human();
 }
+
+// src/pm-actions.ts
 async function pmList(ctx, entity, parsed) {
   const q = new URLSearchParams();
   const filters = {
@@ -9533,7 +9616,8 @@ async function pmList(ctx, entity, parsed) {
   const app = stringOpt(parsed.options.app) ?? ctx.appId;
   if (app) q.set("app", app);
   for (const [flag, param] of Object.entries(filters)) {
-    const v = stringOpt(parsed.options[flag]);
+    const raw = stringOpt(parsed.options[flag]);
+    const v = entity === "task" && flag === "column" && raw === "ready" ? "todo" : raw;
     if (v) q.set(param, v);
   }
   for (const opt of ["q", "limit", "offset"]) {
@@ -9541,11 +9625,11 @@ async function pmList(ctx, entity, parsed) {
     if (v) q.set(opt, v);
   }
   const qs = q.toString();
-  const page = await pmRequest(ctx, "GET", `/${entity}${qs ? `?${qs}` : ""}`);
-  emit2(ctx, page, () => {
-    ctx.out.log(`${entity} \u2014 ${page.records.length} of ${page.total}`);
+  const page2 = await pmRequest(ctx, "GET", `/${entity}${qs ? `?${qs}` : ""}`);
+  emit2(ctx, page2, () => {
+    ctx.out.log(`${entity} \u2014 ${page2.records.length} of ${page2.total}`);
     ctx.out.log("id	state	app	title");
-    for (const r of page.records) printRecord(ctx, entity, r);
+    for (const r of page2.records) printRecord(ctx, entity, r);
   });
 }
 async function pmAdd(ctx, entity, parsed) {
@@ -9566,6 +9650,17 @@ async function pmGet(ctx, entity, id) {
   const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
   emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
+async function pmReference(ctx, entity, id) {
+  const { record: record10 } = await pmRequest(
+    ctx,
+    "GET",
+    `/${entity}/${encodeURIComponent(id)}`
+  );
+  const markup = referenceMarkup(entity, record10);
+  emit2(ctx, { kind: `pm:${entity}`, id: record10.id, label: record10.title ?? "", markup }, () => {
+    ctx.out.log(markup);
+  });
+}
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
   if (Object.keys(patch2).length === 0)
@@ -9586,6 +9681,36 @@ async function pmDone(ctx, entity, id, parsed) {
   });
   emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
 }
+async function pmTaskLifecycle(ctx, id, action2, parsed) {
+  const rawRevision = stringOpt(parsed.options["expected-revision"]);
+  const expectedRevision = Number(rawRevision);
+  if (!rawRevision || !Number.isSafeInteger(expectedRevision) || expectedRevision < 1) {
+    throw new Error(`pm task ${action2} needs --expected-revision <n>`);
+  }
+  const mutationId = writeMutationId2(parsed);
+  const res = action2 === "ready" ? await pmRequest(
+    ctx,
+    "PATCH",
+    `/task/${encodeURIComponent(id)}`,
+    {
+      patch: {
+        ...collectEntityFields("task", parsed, true),
+        column: "todo",
+        expectedRevision
+      },
+      mutationId
+    }
+  ) : await pmRequest(
+    ctx,
+    "POST",
+    `/task/${encodeURIComponent(id)}/${action2}`,
+    { expectedRevision, mutationId }
+  );
+  emit2(ctx, res, () => {
+    const state2 = res.record ? statusCol("task", res.record) : action2;
+    ctx.out.log(`task ${id} \u2192 ${state2}`);
+  });
+}
 async function allRecords(ctx, entity, appId) {
   const records = [];
   for (; ; ) {
@@ -9594,11 +9719,48 @@ async function allRecords(ctx, entity, appId) {
       limit: "100",
       offset: String(records.length)
     });
-    const page = await pmRequest(ctx, "GET", `/${entity}?${q}`);
-    records.push(...page.records);
-    if (records.length >= page.total || page.records.length === 0) return records;
+    const page2 = await pmRequest(ctx, "GET", `/${entity}?${q}`);
+    records.push(...page2.records);
+    if (records.length >= page2.total || page2.records.length === 0) return records;
   }
 }
+async function pmNext(ctx, parsed) {
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (!appId) throw new Error("pm next needs --app <appId>");
+  const [goals, tasks] = await Promise.all([
+    allRecords(ctx, "goal", appId),
+    allRecords(ctx, "task", appId)
+  ]);
+  const result = {
+    appId,
+    openGoals: goals.filter((record10) => record10.status === "open"),
+    doing: tasks.filter((record10) => record10.column === "doing"),
+    ready: tasks.filter((record10) => record10.column === "todo")
+  };
+  emit2(ctx, result, () => {
+    ctx.out.log(`${appId}: goal-aligned work intake (read only)`);
+    for (const [label, records] of [
+      ["doing", result.doing],
+      ["ready", result.ready],
+      ["open goals", result.openGoals]
+    ]) {
+      ctx.out.log(`${label}:`);
+      if (!records.length) ctx.out.log("- (none)");
+      else for (const record10 of records) printRecord(
+        ctx,
+        label === "open goals" ? "goal" : "task",
+        record10
+      );
+    }
+    if (!result.openGoals.length) {
+      ctx.out.log("next: discuss alignment with the user before creating or claiming project work");
+    } else if (!result.ready.length) {
+      ctx.out.log("next: refine a linked Backlog task and mark it Ready");
+    } else {
+      ctx.out.log("next: review a Ready task, then claim it with its revision");
+    }
+  });
+}
 async function pmHandoff(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("pm handoff needs --app <appId>");
@@ -9638,6 +9800,12 @@ async function pmHandoff(ctx, parsed) {
     }
   });
 }
+async function pmRemove(ctx, entity, id) {
+  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id)}`);
+  ctx.out.log(`deleted ${entity} ${id}`);
+}
+
+// src/pm-comments.ts
 async function pmComment(ctx, entity, id, parsed) {
   const body = stringOpt(parsed.options.body);
   if (!body) throw new Error('pm comment needs --body "..."');
@@ -9648,19 +9816,218 @@ async function pmComment(ctx, entity, id, parsed) {
   ctx.out.log(`commented on ${entity} ${id}`);
 }
 async function pmComments(ctx, entity, id) {
-  const { messages } = await pmRequest(
-    ctx,
-    "GET",
-    `/${entity}/${encodeURIComponent(id)}/comments`
-  );
+  const { messages } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}/comments`);
   emit2(ctx, messages, () => {
     if (messages.length === 0) ctx.out.log("(no comments)");
-    else for (const m of messages) ctx.out.log(`[${m.authorId ?? "?"}] ${m.body ?? ""}`);
+    else for (const message2 of messages) {
+      ctx.out.log(
+        `[${message2.authorId ?? "?"}] ${message2.markup ?? message2.body ?? ""}`
+      );
+    }
   });
 }
-async function pmRemove(ctx, entity, id) {
-  await pmRequest(ctx, "DELETE", `/${entity}/${encodeURIComponent(id)}`);
-  ctx.out.log(`deleted ${entity} ${id}`);
+
+// src/pm-watch-types.ts
+var PmWatchCheckpointError = class extends Error {
+  constructor(cursor, streamId) {
+    super("PM work cursor requires a new checkpoint");
+    this.cursor = cursor;
+    this.streamId = streamId;
+    this.name = "PmWatchCheckpointError";
+  }
+  cursor;
+  streamId;
+  code = "checkpoint_required";
+};
+var PmWatchRequestError = class extends Error {
+  constructor(message2, retryable, status) {
+    super(message2);
+    this.retryable = retryable;
+    this.status = status;
+    this.name = "PmWatchRequestError";
+  }
+  retryable;
+  status;
+};
+
+// src/pm-watch.ts
+var DEFAULT_INTERVAL_MS2 = 15e3;
+var MAX_CONSECUTIVE_FAILURES2 = 5;
+var MAX_BACKOFF_MS2 = 3e4;
+function positiveNumber(parsed, flag, fallback) {
+  const raw = stringOpt(parsed.options[flag]);
+  const value2 = raw == null ? NaN : Number(raw);
+  return Number.isFinite(value2) && value2 > 0 ? value2 : fallback;
+}
+function jsonl2(ctx, parsed, value2) {
+  if (parsed.options.jsonl === true) ctx.out.log(JSON.stringify({ v: 1, ...value2 }));
+}
+async function page(ctx, appId, cursor) {
+  const params = new URLSearchParams({ app: appId });
+  if (cursor) params.set("cursor", cursor);
+  let response2;
+  try {
+    response2 = await ctx.doFetch(`${ctx.platformUrl}/registry/pm/work/watch?${params}`, {
+      headers: { authorization: `Bearer ${ctx.token}` }
+    });
+  } catch (error) {
+    throw new PmWatchRequestError(
+      `pm watch request failed: ${error instanceof Error ? error.message : String(error)}`,
+      true
+    );
+  }
+  const data = await response2.json().catch(() => ({}));
+  if (response2.status === 409 && data.code === "checkpoint_required") {
+    throw new PmWatchCheckpointError(data.cursor, data.streamId);
+  }
+  if (!response2.ok) {
+    throw new PmWatchRequestError(
+      `pm watch failed: ${data.error ?? `registry returned ${response2.status}`}`,
+      response2.status === 429 || response2.status >= 500,
+      response2.status
+    );
+  }
+  return data;
+}
+function recordState(record10) {
+  if (record10.column) return record10.column === "todo" ? "ready" : record10.column;
+  return String(record10.status ?? "");
+}
+function eventRecord(event) {
+  return event.payload.payload;
+}
+function eventLabel(event) {
+  const record10 = eventRecord(event);
+  if (record10) return String(record10.title ?? event.payload.entityId);
+  const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
+  return body || event.payload.entityId;
+}
+function report3(ctx, parsed, result) {
+  if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
+  else if (parsed.options.jsonl !== true && result.found) {
+    for (const event of result.events ?? []) {
+      const record10 = eventRecord(event);
+      const state2 = record10 ? recordState(record10) : "comment";
+      ctx.out.log(
+        `${event.id}	${event.type}	${state2}${record10?.revision ? `; r${record10.revision}` : ""}	${eventLabel(event)}`
+      );
+    }
+  }
+  return result;
+}
+async function pmWatch(ctx, parsed) {
+  if (ctx.json && parsed.options.jsonl === true) {
+    throw new Error("--json and --jsonl cannot be combined");
+  }
+  const appId = stringOpt(parsed.options.app) ?? ctx.appId;
+  if (!appId) throw new Error("pm watch needs --app <appId>");
+  const sleep = ctx.sleep ?? ((ms) => new Promise((resolve13) => setTimeout(resolve13, ms)));
+  const now = ctx.now ?? Date.now;
+  const intervalMs = (positiveNumber(parsed, "interval", DEFAULT_INTERVAL_MS2 / 1e3) ?? DEFAULT_INTERVAL_MS2 / 1e3) * 1e3;
+  const timeoutSeconds = positiveNumber(parsed, "timeout");
+  const deadline = timeoutSeconds === void 0 ? void 0 : now() + timeoutSeconds * 1e3;
+  const entity = stringOpt(parsed.options.entity);
+  const action2 = stringOpt(parsed.options.action);
+  const wantedState = stringOpt(parsed.options.state)?.toLowerCase();
+  const by = stringOpt(parsed.options.by);
+  const self = stringOpt(parsed.options.self);
+  let cursor = stringOpt(parsed.options.cursor);
+  let firstSuccess = true;
+  let consecutiveFailures = 0;
+  for (; ; ) {
+    let current;
+    try {
+      current = await page(ctx, appId, cursor);
+      consecutiveFailures = 0;
+    } catch (error) {
+      if (error instanceof PmWatchCheckpointError) {
+        jsonl2(ctx, parsed, {
+          type: "status",
+          state: "checkpoint_required",
+          retryable: false,
+          ...error.cursor ? { cursor: error.cursor } : {},
+          ...error.streamId ? { streamId: error.streamId } : {}
+        });
+        throw error;
+      }
+      if (!(error instanceof PmWatchRequestError) || !error.retryable) throw error;
+      consecutiveFailures++;
+      jsonl2(ctx, parsed, {
+        type: "status",
+        state: "degraded",
+        retryable: true,
+        attempt: consecutiveFailures,
+        ...cursor ? { cursor } : {},
+        ...error.status ? { status: error.status } : {}
+      });
+      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
+      if (deadline !== void 0 && now() >= deadline) {
+        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+      }
+      const backoff = Math.min(
+        MAX_BACKOFF_MS2,
+        Math.min(intervalMs, 1e3) * 2 ** (consecutiveFailures - 1)
+      );
+      await sleep(deadline === void 0 ? backoff : Math.min(backoff, Math.max(0, deadline - now())));
+      continue;
+    }
+    cursor = current.cursor;
+    const baseline = firstSuccess && current.events.length === 0;
+    if (baseline) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    }
+    firstSuccess = false;
+    const matching = current.events.filter((event) => {
+      const record10 = eventRecord(event);
+      const state2 = record10 ? recordState(record10).toLowerCase() : "";
+      return (!entity || event.payload.entityKind === entity) && (!action2 || event.payload.action === action2) && (!wantedState || state2 === wantedState || wantedState === "todo" && state2 === "ready") && (!by || event.actor.id === by) && (!self || event.actor.id !== self);
+    });
+    for (const event of matching) {
+      jsonl2(ctx, parsed, {
+        type: "event",
+        streamId: current.streamId,
+        eventId: event.id,
+        cursor: event.cursor,
+        event
+      });
+    }
+    if (matching.length > 0) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+      return report3(ctx, parsed, { found: true, cursor, events: matching });
+    }
+    if (current.events.length > 0) {
+      jsonl2(ctx, parsed, {
+        type: "checkpoint",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    } else if (!baseline) {
+      jsonl2(ctx, parsed, {
+        type: "heartbeat",
+        streamId: current.streamId,
+        cursor,
+        serverTime: current.serverTime
+      });
+    }
+    if (current.hasMore) continue;
+    if (deadline !== void 0 && now() >= deadline) {
+      return report3(ctx, parsed, { found: false, cursor });
+    }
+    await sleep(
+      deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
+    );
+  }
 }
 
 // src/pm-command.ts
@@ -9681,7 +10048,11 @@ var ACTION_OPTIONS = {
   done: ["mutation-id"],
   comment: ["body", "mutation-id"],
   comments: [],
-  rm: []
+  rm: [],
+  ready: ["goal", "alignment-decision", "execution", "description", "desc", "body", "acceptance", "expected-revision", "mutation-id"],
+  claim: ["expected-revision", "mutation-id"],
+  release: ["expected-revision", "mutation-id"],
+  ref: []
 };
 var ENTITY_OPTIONS = {
   goal: {
@@ -9692,8 +10063,8 @@ var ENTITY_OPTIONS = {
   },
   task: {
     list: ["column", "goal", "assignee"],
-    add: ["column", "goal", "assignee", "due", "description", "desc", "body"],
-    set: ["title", "column", "rank", "goal", "assignee", "due", "description", "desc", "body"],
+    add: ["column", "goal", "alignment-decision", "execution", "assignee", "due", "description", "desc", "body", "acceptance"],
+    set: ["title", "column", "rank", "goal", "alignment-decision", "execution", "assignee", "due", "description", "desc", "body", "acceptance", "expected-revision"],
     done: []
   },
   decision: {
@@ -9744,11 +10115,33 @@ async function buildContext2(parsed, deps) {
     json: parsed.options.json === true,
     // Preserve PM's existing cross-project default when a config is present;
     // only an explicit remote-agent environment or profile selects an app.
-    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0
+    appId: context.app.source === "environment" || context.app.source === "profile" ? context.app.value ?? void 0 : void 0,
+    ...deps.sleep ? { sleep: deps.sleep } : {},
+    ...deps.now ? { now: deps.now } : {}
   };
 }
 async function pmCommand(parsed, deps = {}) {
   const word = parsed.positionals[1] ?? "";
+  if (word === "next") {
+    assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
+    return pmNext(await buildContext2(parsed, deps), parsed);
+  }
+  if (word === "watch") {
+    assertArgs(parsed, [
+      ...COMMON_OPTIONS,
+      "app",
+      "cursor",
+      "interval",
+      "timeout",
+      "jsonl",
+      "entity",
+      "action",
+      "state",
+      "by",
+      "self"
+    ], 2);
+    return pmWatch(await buildContext2(parsed, deps), parsed).then(() => void 0);
+  }
   if (word === "handoff") {
     assertArgs(parsed, [...COMMON_OPTIONS, "app"], 2);
     return pmHandoff(await buildContext2(parsed, deps), parsed);
@@ -9759,6 +10152,9 @@ async function pmCommand(parsed, deps = {}) {
   const action2 = canonicalAction(requestedAction);
   if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
   assertArgs(parsed, allowedOptions(entity, action2), 4);
+  if ((action2 === "ready" || action2 === "claim" || action2 === "release") && entity !== "task") {
+    throw new Error(`pm ${action2} is only valid for tasks`);
+  }
   const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
   switch (action2) {
@@ -9778,6 +10174,12 @@ async function pmCommand(parsed, deps = {}) {
       return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
       return pmRemove(ctx, entity, requireId2(id, action2));
+    case "ref":
+      return pmReference(ctx, entity, requireId2(id, action2));
+    case "ready":
+    case "claim":
+    case "release":
+      return pmTaskLifecycle(ctx, requireId2(id, action2), action2, parsed);
   }
 }
 
@@ -10314,7 +10716,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
       const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
-      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      const rows = isRecord8(payload) && isRecord8(payload.result) ? payload.result[seed.ns] : void 0;
       if (!Array.isArray(rows)) {
         throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
       }
@@ -10346,7 +10748,7 @@ async function postJson3(doFetch, url, bearer, body) {
   if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
   return res.json().catch(() => ({}));
 }
-function isRecord7(value2) {
+function isRecord8(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 async function responseText(res) {
@@ -10416,14 +10818,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -10439,12 +10841,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -10487,7 +10889,7 @@ async function provision(options) {
       const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
       out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
     }
-    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "hosted" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
@@ -10538,11 +10940,11 @@ async function provision(options) {
     for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
-          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
-          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
+          await apps.setAi(cfg.app.id, env, { mode: "byok", provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (byok ${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
         } else {
-          await apps.setService(cfg.app.id, "ai", true, { env });
-          out.log(`${env}: ai enabled`);
+          await apps.setAi(cfg.app.id, env, { mode: "hosted", ...cfg.ai?.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (hosted${cfg.ai?.model ? `/${cfg.ai.model}` : ""})`);
         }
       } else {
         const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;
@@ -10667,12 +11069,23 @@ var PM_ACTIONS = {
   done: {},
   comment: {},
   comments: {},
+  ref: {},
   rm: {},
   delete: {}
 };
-var PM_ENTITIES = Object.fromEntries(
-  ["goal", "conformance", "task", "kanban", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
-);
+var PM_TASK_ACTIONS = {
+  ...PM_ACTIONS,
+  ready: {},
+  claim: {},
+  release: {}
+};
+var PM_ENTITIES = {
+  ...Object.fromEntries(
+    ["goal", "conformance", "decision", "bug"].map((entity) => [entity, PM_ACTIONS])
+  ),
+  task: PM_TASK_ACTIONS,
+  kanban: PM_TASK_ACTIONS
+};
 var COMMAND_SURFACE = {
   agent: { jobs: {}, retry: {} },
   admin: {
@@ -10725,7 +11138,9 @@ var COMMAND_SURFACE = {
   },
   pm: {
     ...PM_ENTITIES,
-    handoff: {}
+    handoff: {},
+    next: {},
+    watch: {}
   },
   provision: {},
   runbook: {
@@ -10889,12 +11304,12 @@ async function call(ctx, method, path, body) {
   throw new Error(message2);
 }
 async function bySlug(ctx, slug) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   return found;
 }
@@ -10908,11 +11323,11 @@ async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
   if (query) params.set("q", query);
-  const page = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
-  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));
-  if (!page.records.length) return ctx.out.log("(no runbooks)");
+  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
+  if (!page2.records.length) return ctx.out.log("(no runbooks)");
   ctx.out.log(["SLUG", "STATUS", "V", "SCOPE", "UPDATED", "TITLE"].join("	"));
-  for (const r of page.records)
+  for (const r of page2.records)
     ctx.out.log(
       [r.slug, r.status, `v${r.version}`, r.appId === PLATFORM_SCOPE ? "platform" : r.appId, stamp(r.updatedAt), r.title].join("	")
     );
@@ -10967,12 +11382,12 @@ async function runbookVisibility(ctx, slug, visibility) {
 }
 async function runbookHistory(ctx, slug) {
   const runbook = await bySlug(ctx, slug);
-  const page = await call(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
-  if (ctx.json) return ctx.out.log(JSON.stringify(page, null, 2));
+  const page2 = await call(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
+  if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
   ctx.out.log(`${slug} is at v${runbook.version}`);
-  if (!page.records.length) return ctx.out.log("(no earlier versions)");
+  if (!page2.records.length) return ctx.out.log("(no earlier versions)");
   ctx.out.log(["V", "WHEN", "BY", "NOTE"].join("	"));
-  for (const r of page.records)
+  for (const r of page2.records)
     ctx.out.log([`v${r.version}`, stamp(r.createdAt), r.ownerEmail ?? "", r.note ?? ""].join("	"));
 }
 async function runbookRevert(ctx, slug, version) {
@@ -11047,12 +11462,12 @@ ${counts.created} created, ${counts.updated} updated, ${counts.unchanged} unchan
   );
 }
 async function upsert(ctx, r, visibility) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(r.slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) {
     await call(ctx, "POST", "/runbook", {
       appId: ctx.appId,
@@ -11308,7 +11723,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report3(ctx, impacts) {
+function report4(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -11346,7 +11761,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report3(ctx, impacts);
+  report4(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -11384,17 +11799,17 @@ function lintRunbook(runbook, installed) {
 async function runbookLint(ctx, all) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
-  const page = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
   const installed = { "@odla-ai/cli": cliVersion() };
-  const findings = page.records.flatMap((runbook) => lintRunbook(runbook, installed));
-  if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page.records.length, findings }, null, 2));
-  if (!page.records.length) return ctx.out.log("(no runbooks in scope)");
+  const findings = page2.records.flatMap((runbook) => lintRunbook(runbook, installed));
+  if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page2.records.length, findings }, null, 2));
+  if (!page2.records.length) return ctx.out.log("(no runbooks in scope)");
   if (!findings.length) {
     return ctx.out.log(
-      `${page.records.length} runbook${page.records.length === 1 ? "" : "s"} checked; every command they name is real for @odla-ai/cli ${cliVersion()}.`
+      `${page2.records.length} runbook${page2.records.length === 1 ? "" : "s"} checked; every command they name is real for @odla-ai/cli ${cliVersion()}.`
     );
   }
-  ctx.out.log(`${findings.length} finding${findings.length === 1 ? "" : "s"} across ${page.records.length} runbooks:`);
+  ctx.out.log(`${findings.length} finding${findings.length === 1 ? "" : "s"} across ${page2.records.length} runbooks:`);
   for (const finding of findings) {
     const scope = finding.appId === PLATFORM_SCOPE ? "" : ` --app ${finding.appId}`;
     ctx.out.log("");
@@ -11457,12 +11872,12 @@ async function runbookAsk(ctx, question, all) {
   ctx.out.log(JSDOC_POINTER);
 }
 async function runbookComment(ctx, slug, body) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   await call(ctx, "POST", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });
   ctx.out.log(`commented on ${slug} (v${found.version})`);
@@ -11514,12 +11929,12 @@ var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
 
 // src/runbook-edit-flow.ts
 async function editRunbook(ctx, slug, deps = {}) {
-  const page = await call(
+  const page2 = await call(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page.records[0];
+  const found = page2.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
   const body = await editText(found.body, slug, deps);
@@ -11940,31 +12355,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report4) {
-  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
-  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
-  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
-  for (const finding of report4.findings) {
+function printHostedReport(out, report5) {
+  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
+  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
+  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
+  for (const finding of report5.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12047,17 +12462,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report4);
-  const reportDigest = await (0, import_security.securityFingerprint)(report4);
+  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report5);
+  const reportDigest = await (0, import_security.securityFingerprint)(report5);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report4.coverageStatus,
-    confirmed: report4.metrics.confirmed,
-    candidates: report4.metrics.candidates
+    coverageStatus: report5.coverageStatus,
+    confirmed: report5.metrics.confirmed,
+    candidates: report5.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
-  return Object.freeze({ report: report4, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
+  return Object.freeze({ report: report5, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -12083,14 +12498,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report4, output) {
-  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report5, output) {
+  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
-  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
+  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
+  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -12326,13 +12741,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report4);
+    printHostedReport(context.stdout, report5);
   }
-  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12399,13 +12814,13 @@ async function runLocalSecurityCommand(parsed, dependencies) {
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report4, parsed) {
+function enforceLocalGate(report5, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report5, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -12444,9 +12859,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report4 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
-    else printHostedReport(context.stdout, report4);
+    const report5 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
+    else printHostedReport(context.stdout, report5);
     return;
   }
   if (sub !== "run") {