@openengio/cli 0.23.3 → 0.24.4

package/bin/public/openeng.js

@@ -98,6 +98,7 @@ var RULE_ENTRIES = {
   "max-session-out-of-range": entry("The sign-in length in the request is outside the allowed range.", FIX_REQUEST),
   "invalid-email": entry("The email address is not one the platform takes: it must have one @, and no space or non-ASCII character, and be at most 254 characters.", FIX_REQUEST),
   "already-invited": entry("The organisation already has a pending invitation to this address.", { option: "List the pending invitations.", read: "listInvitations" }),
+  "no-such-client": entry("The client the request names is not an active client of your organisation.", { option: "List the organisation's clients.", read: "listClients" }),
   "no-such-invitation": entry("The invitation the request names is not one of your organisation.", { option: "List the pending invitations.", read: "listInvitations" }),
   "invitation-not-pending": entry("The invitation was already accepted or revoked.", { option: "List the pending invitations.", read: "listInvitations" }),
   "invalid-domain": entry("A domain in the rule is not a valid domain name: it needs letters, digits, hyphens and at least one dot.", FIX_REQUEST),
@@ -131,6 +132,17 @@ var RULE_ENTRIES = {
   "over-bound": entry("The request is larger than the platform allows.", FIX_REQUEST),
   "malformed-history-request": entry("The history request is not one the platform can run.", FIX_REQUEST),
   "protected-ref": entry("This branch is protected, so an agent cannot write to it.", { option: "Write to another branch." }),
+  immutable: entry("The record's type is immutable, so it cannot be changed or deleted on any branch.", { option: "Leave the record unchanged." }),
+  owned: entry("The record belongs to a connected system, which alone can write it.", { option: "Ask the connected system to make the change." }),
+  frozen: entry("The record is locked; it cannot be changed until someone allowed to lock records lifts the lock.", { option: "Ask someone allowed to lock records to lift the lock." }),
+  protected: entry("A rule protects this record on this branch, so it changes only by a merge from another branch.", { option: "Make the change on another branch and merge it." }),
+  "not-a-ref-head": entry("The commit is not the latest commit of a branch you can use.", { option: "Read the branches you can use and choose one." }),
+  "branch-needs-schema-update": entry("This branch's schema is older than the platform's, so it must be updated before it can be written.", { option: "Request a schema update for the branch." }),
+  "organisation-not-ready": entry("The organisation's trunk is not ready yet.", { option: "Try again shortly." }),
+  "read-only-ref": entry("The branch is read-only, so nothing can be written or merged into it.", { option: "Choose a writable branch." }),
+  "ref-exists": entry("An organisation ref of that name already exists.", { option: "List the organisation's refs.", read: "listOrganisationRefs" }),
+  "concurrent-change": entry("Another write changed the record first, so nothing was applied.", { option: "Try again shortly." }),
+  "lock-unavailable": entry("The lock could not be taken now, so nothing was applied.", { option: "Try again shortly." }),
   "organisation-not-active": entry("The organisation is not active.", ASK_ADMINISTRATOR),
   "duplicate-project": entry("A project with this identifier already exists.", { option: "List the projects.", read: "listProjects" }),
   "duplicate-organisation": entry("An organisation with this identifier already exists.", { option: "Send it again as a new request." }),
@@ -175,11 +187,15 @@ var CLASS_ENTRIES = {
 };
 var API_RULE_ENTRIES = {
   "not-found": KIND_ENTRIES["not-found"],
+  immutable: RULE_ENTRIES.immutable,
+  owned: RULE_ENTRIES.owned,
+  frozen: RULE_ENTRIES.frozen,
+  protected: RULE_ENTRIES.protected,
+  "branch-needs-schema-update": RULE_ENTRIES["branch-needs-schema-update"],
   conflict: entry("A property's current value differs from the 'from' value the request expected; the refusal names each such property and its current value.", { option: "Read the current properties, reconcile the changes and send the update again with the from values you now expect." }),
   "unknown-type": entry("The requested type is not a current object or edge type in this namespace.", { option: "Read the current types and use an object or edge type they contain.", read: "readCatalogue" }),
   "type-version-precondition": entry("The type version the request expected differs from the type's current version.", { option: "Read the type's current version and send the request with that version." }),
   "invalid-properties": entry("The property document failed validation; the violations name each offending path and rule.", { option: "Correct the properties at the paths the violations name and send the request again." }),
-  "trunk-write": entry("The trunk takes changes only by a merge from a branch, so this write was refused.", { option: "Make the change on a branch you can write." }),
   "blocked-by-edge": entry("The object has a link you may not remove, so nothing was deleted.", { option: "Remove that link first, or ask someone who may to remove it." }),
   "endpoint-type-mismatch": entry("An endpoint's object type does not match the source or target type required by the link's type version.", { option: "Use endpoints whose object types match the link's source and target types." }),
   "cross-organisation-edge": entry("The link's endpoints belong to projects in different organisations.", { option: "Choose endpoints whose projects belong to the same organisation." }),
@@ -212,7 +228,11 @@ var API_REFUSAL_RULES = Object.freeze([
   "unknown-type",
   "type-version-precondition",
   "invalid-properties",
-  "trunk-write",
+  "immutable",
+  "owned",
+  "frozen",
+  "protected",
+  "branch-needs-schema-update",
   "blocked-by-edge",
   "write-refused",
   "endpoint-type-mismatch",
@@ -224,9 +244,44 @@ var API_REFUSAL_RULES = Object.freeze([
 var SHIM_COLLIDING_API_RULES = Object.freeze(["write-refused"]);
 
 // packages/api-contract/dist/route-docs.js
+function need(capability, scope) {
+  return Object.freeze({ capability, scope });
+}
+var PROTECTION_ROUTE_CAPABILITIES = Object.freeze({
+  addRefRule: Object.freeze([need("administer projects", "project")]),
+  listRefRules: Object.freeze([need("read", "project")]),
+  removeRefRule: Object.freeze([need("administer projects", "project")]),
+  addOrganisationRule: Object.freeze([need("administer projects", "organisation")]),
+  listOrganisationRules: Object.freeze([need("read", "organisation")]),
+  removeOrganisationRule: Object.freeze([need("administer projects", "organisation")]),
+  createOrganisationRef: Object.freeze([need("administer projects", "organisation")]),
+  listOrganisationRefs: Object.freeze([need("read", "organisation")]),
+  deleteOrganisationRef: Object.freeze([need("administer projects", "organisation")]),
+  markOrganisationRefReadOnly: Object.freeze([need("administer projects", "organisation")]),
+  setObjectLock: Object.freeze([need("lock objects", "project")]),
+  readAgentCeiling: Object.freeze([need("read", "project")]),
+  setAgentCeiling: Object.freeze([need("administer projects", "project")]),
+  requestSchemaUpdate: Object.freeze([
+    need("write ref", "branch-home-project"),
+    need("administer projects", "organisation-ref")
+  ]),
+  readSchemaUpdateRequest: Object.freeze([Object.freeze({ visibility: "requester-in-token-organisation" })])
+});
 var SIGNED_IN = ["unauthenticated", "invalid-request", "bound-exceeded", "internal"];
 var SCOPED = [...SIGNED_IN, "not-found", "not-permitted"];
 var WRITE = [...SCOPED, "in-flight", "unknown-outcome"];
+var REF_READ = [...SCOPED, "organisation-not-ready", "branch-needs-schema-update"];
+var REF_WRITE = [...REF_READ, "in-flight", "unknown-outcome"];
+var OBJECT_WRITE = [
+  ...REF_WRITE,
+  "immutable",
+  "owned",
+  "frozen",
+  "protected",
+  "read-only-ref",
+  "concurrent-change",
+  "lock-unavailable"
+];
 var PUBLIC = ["invalid-request", "bound-exceeded", "internal"];
 var CHANGE_SET = [...SIGNED_IN, "not-permitted", "stale-revision", "not-open"];
 var QUERY_PROJECT_SCOPE = 'Without input.projects, it reads every project the caller can read on the selected ref; selector.projectId does not narrow the set. To limit it to one project, include "projects":["<projectId>"] in input.';
@@ -246,15 +301,15 @@ var ROUTE_DOCS = Object.freeze({
   serviceCredential: doc("Exchanges a service credential for an access token.", [...PUBLIC, "unknown-credential", "secret", "kind", "lifecycle"]),
   registerClient: doc("Registers a third-party application as a client of the caller's organisation.", [...SIGNED_IN, "not-permitted", "capability-missing"]),
   listClients: doc("Lists the clients of the caller's organisation, for a caller who administers them.", SCOPED),
-  revokeClient: doc("Revokes a client; its grants and tokens stop on their next use.", SCOPED),
-  replaceClientKeys: doc("Replaces a confidential client's public key set.", SCOPED),
+  revokeClient: doc("Revokes a client; its grants and tokens stop on their next use.", [...SCOPED, "no-such-client"]),
+  replaceClientKeys: doc("Replaces a confidential client's public key set.", [...SCOPED, "no-such-client"]),
   readConsentRequest: doc("Reads a pending authorization request for the person who signed in inside it.", SCOPED),
   decideConsent: doc("Approves or denies a pending authorization request.", SCOPED),
   listConnectedApps: doc("Lists the applications the caller has connected.", SIGNED_IN),
   revokeConnectedApp: doc("Disconnects an application: every grant the caller holds for it stops.", SCOPED),
-  readObject: doc("Reads one object at a ref.", SCOPED),
+  readObject: doc("Reads one object at a ref.", REF_READ),
   queryObjects: doc(`Runs a filtered, ordered, paged query over the objects of a ref. ${QUERY_PROJECT_SCOPE}`, [
-    ...SCOPED,
+    ...REF_READ,
     "malformed-query",
     "over-bound",
     "text-search-unavailable",
@@ -263,11 +318,11 @@ var ROUTE_DOCS = Object.freeze({
     "stale-continuation",
     "head-moved"
   ]),
-  aggregateObjects: doc(`Runs an aggregate over the objects of a ref: a count, or a minimum, maximum or sum of one numeric property, answered as one value, or, with groupBy, a count or a sum grouped by type or by a property's value, or a count grouped by structural parent, answered as groups. ${QUERY_PROJECT_SCOPE}`, [...SCOPED, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide"]),
-  discoverVerbs: doc("Lists the verbs an object may be given.", SCOPED),
-  readHistory: doc("Reads one object's history of changes.", [...SCOPED, "invalid-continuation", "stale-continuation", "malformed-history-request"]),
-  mutate: doc('Creates, changes or deletes an object on a branch. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...WRITE, "plan-closed", "protected-ref"]),
-  mutateBatch: doc('Applies a list of object and edge operations to a branch in one save, one commit and one audit record, or none of them: a refused operation refuses the whole batch and writes nothing. An edge may name an object created earlier in the same batch. A batch with more operations than the maximum is refused as invalid-request naming input.operations, before any write. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...WRITE, "plan-closed", "protected-ref"]),
+  aggregateObjects: doc(`Runs an aggregate over the objects of a ref: a count, or a minimum, maximum or sum of one numeric property, answered as one value, or, with groupBy, a count or a sum grouped by type or by a property's value, or a count grouped by structural parent, answered as groups. ${QUERY_PROJECT_SCOPE}`, [...REF_READ, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide"]),
+  discoverVerbs: doc("Lists the verbs an object may be given.", REF_READ),
+  readHistory: doc("Reads one object's history of changes.", [...REF_READ, "invalid-continuation", "stale-continuation", "malformed-history-request"]),
+  mutate: doc('Creates, changes or deletes an object on the selected ref. A protected refusal means the change needs a branch and a merge. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...OBJECT_WRITE, "plan-closed"]),
+  mutateBatch: doc('Applies a list of object and edge operations to a branch in one save, one commit and one audit record, or none of them: a refused operation refuses the whole batch and writes nothing. An edge may name an object created earlier in the same batch. A batch with more operations than the maximum is refused as invalid-request naming input.operations, before any write. For a property update, `from` is the value the caller expects now; a mismatch is refused as `conflict`, and `{"absent": true}` clears the property.', [...OBJECT_WRITE, "plan-closed"]),
   createConnection: doc("Creates a connection to an external source system for the signed-in person: its mirror project and its service identity. The connection commits whether or not its types could be drafted, and the answer says which.", [...SIGNED_IN, "not-permitted", "organisation-not-active", "connection-exists"]),
   listConnections: doc("Lists the connections whose mirror project the caller reads, each with its last run and whether the caller may start a run.", SIGNED_IN),
   setConnectionCredential: doc("Stores the credential the connection reads the source system with, after the source system accepts it, and answers the upstream account and the time it was stored. The credential is never answered.", [...SCOPED, "credential-not-valid"]),
@@ -277,36 +332,48 @@ var ROUTE_DOCS = Object.freeze({
   startImportRun: doc("Starts a run that imports the connection's source into its mirror project, and answers the run once its row has committed.", [...SCOPED, "import-running", "connection-revoked", "types-not-approved"]),
   listImportRuns: doc("Lists the runs of a connection, newest first, or the one run named.", SCOPED),
   closeImportRun: doc("Ends a running run: the connection's service identity as succeeded or failed, or the person who started it as failed.", [...SCOPED, "run-not-running"]),
-  previewDelete: doc("Previews deleting an object: the links the delete would remove, or the refusal it would meet. Changes nothing.", [...WRITE, "plan-closed", "protected-ref"]),
-  recover: doc("Finds what an interrupted mutation did and finishes its record.", SCOPED),
-  executeVerb: doc("Runs a verb on an object and records its result.", [...WRITE, "plan-closed", "protected-ref"]),
-  createBranch: doc("Creates a branch from a ref.", [...WRITE, "plan-closed", "duplicate-name", "protected-ref"]),
-  merge: doc("Merges one branch into another.", [...WRITE, "protected-ref"]),
-  readMergeConflicts: doc("Reads the conflicts a merge refused on.", SCOPED),
-  disposeRef: doc("Disposes a branch that is no longer wanted.", [...WRITE, "protected-ref"]),
+  previewDelete: doc("Previews deleting an object: the links the delete would remove, or the refusal it would meet. Changes nothing.", [...OBJECT_WRITE, "plan-closed"]),
+  recover: doc("Finds what an interrupted mutation did and finishes its record.", REF_READ),
+  executeVerb: doc("Runs a verb on an object and records its result.", [...OBJECT_WRITE, "plan-closed"]),
+  createBranch: doc("Creates a branch from a ref or an admitted current ref head.", [
+    ...REF_WRITE,
+    "plan-closed",
+    "ref-exists",
+    "read-only-ref",
+    "concurrent-change",
+    "lock-unavailable",
+    "not-a-ref-head"
+  ]),
+  merge: doc("Merges a reviewed head of a project branch or an organisation-ref source into main, or into the ref the optional target names.", [...REF_WRITE, "read-only-ref", "concurrent-change", "lock-unavailable", "not-a-ref-head"]),
+  readMergeConflicts: doc("Reads the conflicts a merge refused on.", REF_READ),
+  disposeRef: doc("Disposes a branch that is no longer wanted.", [
+    ...WRITE,
+    "concurrent-change",
+    "lock-unavailable"
+  ]),
   listProjects: doc("Lists every project the caller may read in the organisation the session is attached to, with its namespace.", SIGNED_IN),
-  listRefs: doc("Lists the refs of a project, each with its head: readable with a hash, withheld when the caller may not read the ref, or unread past the first 50 refs.", SCOPED),
+  listRefs: doc("Lists the refs of a project, each with its head: readable with a hash, withheld when the caller may not read the ref, or unread past the first 50 refs.", [...SCOPED, "organisation-not-ready"]),
   readCatalogue: doc("Reads the published catalogue of a project's namespace.", SCOPED),
   readPendingProposal: doc("Reads the proposal waiting for review on a branch, if any.", SCOPED),
-  submitProposal: doc("Submits a branch for review.", [...SCOPED, "proposal-open", "no-commits"]),
+  submitProposal: doc("Submits a branch for review.", [...REF_READ, "proposal-open", "no-commits"]),
   createServiceIdentity: doc("Creates a service identity in an organisation.", [...SIGNED_IN, "not-permitted", "capability-missing", "duplicate-name"]),
   revokeServiceIdentity: doc("Revokes a service identity.", [...SIGNED_IN, "not-permitted", "service_identity.revoke"]),
   issueServiceCredential: doc("Issues a credential for a service identity.", [...SIGNED_IN, "not-permitted", "capability-missing"]),
   revokeServiceCredential: doc("Revokes a service identity's credential.", [...SIGNED_IN, "not-permitted", "capability-missing"]),
   grantMembership: doc("Grants a principal a role in a scope.", [...SIGNED_IN, "not-permitted", "above-caller-role", "membership-exists", "no-such-principal"]),
-  revokeMembership: doc("Revokes a principal's membership of a scope.", [...SIGNED_IN, "not-permitted", "last-administrator", "no-such-membership", "erasure-not-permitted"]),
+  revokeMembership: doc("Revokes a principal's membership of a scope; at organisation scope, also revokes their memberships in its projects.", [...SIGNED_IN, "not-permitted", "last-administrator", "no-such-membership", "erasure-not-permitted"]),
   setModelConfiguration: doc("Sets the model configuration an organisation's agents use.", [...SIGNED_IN, "not-permitted", "capability-missing", "window-out-of-range", "max-session-out-of-range"]),
   readDisplayNames: doc("Reads the display names of principals the caller may see.", SIGNED_IN),
   listMembers: doc("Lists the members of a project.", SCOPED),
   changeMembershipRole: doc("Changes a principal's role in a scope.", [...SIGNED_IN, "not-permitted", "above-caller-role", "last-administrator", "no-such-membership"]),
   listOrganisationMembers: doc("Lists the memberships of the caller's organisation and of the projects of it the caller may read.", SCOPED),
   searchPeople: doc("Finds the people of the caller's organisation whose name has a word starting with the query.", [...SIGNED_IN, "invalid-query"]),
-  searchObjectReaders: doc("Finds the people who can read an object on a ref, by a name prefix.", [...SCOPED, "invalid-query", "invalid-ref"]),
-  listSubscribers: doc("Lists the subscriptions on an object.", SCOPED),
-  addSubscriber: doc("Adds a person to an object's subscriptions as owner, approver or watcher, when the type's `subscriptionRoles` admits that role. The declaration may set maxima; owner is limited to one. With no declaration, only watchers are admitted.", [...SCOPED, "limit-reached", "role-not-admitted", "unknown-person", "not-permitted", "invalid-ref"]),
-  removeSubscriber: doc("Removes a person's subscription to an object in a role.", [...SCOPED, "subscription-absent", "not-permitted", "invalid-ref"]),
-  listComments: doc("Lists the comments on an object, oldest first, a page at a time.", [...SCOPED, "invalid-query"]),
-  addComment: doc("Adds a comment to an object, naming the people it mentions.", [...WRITE, "invalid-body", "invalid-mention", "unknown-person", "invalid-ref"]),
+  searchObjectReaders: doc("Finds the people who can read an object on a ref, by a name prefix.", [...REF_READ, "invalid-query", "invalid-ref"]),
+  listSubscribers: doc("Lists the subscriptions on an object.", REF_READ),
+  addSubscriber: doc("Adds a person to an object's subscriptions as owner, approver or watcher, when the type's `subscriptionRoles` admits that role. The declaration may set maxima; owner is limited to one. With no declaration, only watchers are admitted.", [...REF_READ, "limit-reached", "role-not-admitted", "unknown-person", "not-permitted", "invalid-ref"]),
+  removeSubscriber: doc("Removes a person's subscription to an object in a role.", [...REF_READ, "subscription-absent", "not-permitted", "invalid-ref"]),
+  listComments: doc("Lists the comments on an object, oldest first, a page at a time.", [...REF_READ, "invalid-query"]),
+  addComment: doc("Adds a comment to an object, naming the people it mentions.", [...REF_WRITE, "invalid-body", "invalid-mention", "unknown-person", "invalid-ref"]),
   listServiceIdentities: doc("Lists the service identities of the caller's organisation, for a caller who administers them.", SCOPED),
   createInvitation: doc("Invites an email address to the caller's organisation in a role, for a caller who administers its members.", [...SIGNED_IN, "capability-missing", "above-caller-role", "invalid-email", "already-invited", "domain-not-allowed"]),
   listInvitations: doc("Lists the pending invitations of the caller's organisation, for a caller who administers its members.", [...SIGNED_IN, "capability-missing"]),
@@ -320,25 +387,43 @@ var ROUTE_DOCS = Object.freeze({
   reissuePlatformInvitation: doc("Replaces the code and the expiry of a pending platform invitation and answers the new link, for a platform administrator.", [...SIGNED_IN, "capability-missing", "no-such-invitation", "invitation-not-pending"]),
   readWebOrigin: doc("Reads the origin of the deployment's web application, or null when the host is given none.", SIGNED_IN),
   readCallerCapabilities: doc("Lists the capabilities the caller holds in the token's organisation and its projects, and the platform capability for a platform administrator.", [...SIGNED_IN]),
-  queryGraph: doc(`Walks the edges from a start of addresses or an object set, and answers the objects reached with every hop among them. One start address with one hop step of depth 1 answers that object's connections, with a marker for each kind of connection whose far object the caller cannot read, and pages with a continuation. For an object-set start, omitting input.start.set.projects reads every project the caller can read on the selected ref; selector.projectId does not narrow the start set. To limit it to one project, include "projects":["<projectId>"] in input.start.set.`, [...SCOPED, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide", "invalid-continuation", "stale-continuation", "head-moved"]),
+  queryGraph: doc(`Walks the edges from a start of addresses or an object set, and answers the objects reached with every hop among them. One start address with one hop step of depth 1 answers that object's connections, with a marker for each kind of connection whose far object the caller cannot read, and pages with a continuation. For an object-set start, omitting input.start.set.projects reads every project the caller can read on the selected ref; selector.projectId does not narrow the start set. To limit it to one project, include "projects":["<projectId>"] in input.start.set.`, [...REF_READ, "malformed-query", "over-bound", "text-search-unavailable", "search-too-wide", "invalid-continuation", "stale-continuation", "head-moved"]),
   readStructure: doc("Reads the structure of a type's objects as a tree: every root, one object's subtree or one object's ancestors, each placement an occurrence. A chosen relationship or one-step view places the type itself, and the types above it follow their own declared relationships.", [
-    ...SCOPED,
+    ...REF_READ,
     "malformed-query",
     "view-not-drawable",
     "over-bound",
     "head-moved"
   ]),
-  findPaths: doc("Finds every shortest path between two objects within a length, answered as the hops each path follows.", [...SCOPED, "malformed-query", "over-bound", "head-moved"]),
+  findPaths: doc("Finds every shortest path between two objects within a length, answered as the hops each path follows.", [...REF_READ, "malformed-query", "over-bound", "head-moved"]),
   listProposals: doc("Lists the proposals of a project.", SCOPED),
   readProposal: doc("Reads one proposal.", SCOPED),
   refuseProposal: doc("Refuses a proposal and returns its branch to its author.", [...SCOPED, "proposal-not-pending"]),
-  readBranchDiff: doc("Reads what a proposal's branch changes against its target.", SCOPED),
-  diffBranches: doc("Reads what one ref changes against another.", SCOPED),
+  readBranchDiff: doc("Reads what a proposal's branch changes against its target.", REF_READ),
+  diffBranches: doc("Reads what one ref changes against another.", REF_READ),
   readBranchHistory: doc("Reads a branch's history of commits.", [...SCOPED, "invalid-continuation", "stale-continuation", "malformed-history-request"]),
   listAudit: doc("Lists the audit records of a project.", [...SCOPED, "invalid-continuation"]),
-  readRefHead: doc("Reads the head of a ref.", SCOPED),
+  readRefHead: doc("Reads the head of a ref.", REF_READ),
   inspectBranchOperation: doc("Reads the state of a branch operation the caller started.", SCOPED),
-  abandonBranch: doc("Abandons a branch and records why.", [...WRITE, "protected-ref"]),
+  abandonBranch: doc("Refuses branch abandonment because this operation is not available in this release.", [
+    ...WRITE,
+    "not-in-this-release"
+  ]),
+  addRefRule: doc("Adds a ref protection rule to the selected project and answers the full rule. Repeating the same pattern and consequence returns the existing rule, ignoring pattern letter case. Consequences are merge-only and locked-rows-only; an invalid pattern or consequence answers invalid-request naming that field.", SCOPED),
+  listRefRules: doc("Lists only the selected project's visible ref protection rules, including each rule's identifier, pattern and consequence.", SCOPED),
+  removeRefRule: doc("Removes a rule by identifier from the selected project and answers its ruleId. An absent or unreadable identifier, or one belonging to another project, answers not-found.", SCOPED),
+  addOrganisationRule: doc("Adds a ref protection rule in the attached organisation and answers the full rule. Repeating the same pattern and consequence returns the existing rule, ignoring pattern letter case. An invalid pattern or consequence answers invalid-request naming that field.", SCOPED),
+  listOrganisationRules: doc("Lists the attached organisation's visible ref rules, including identifier, pattern and consequence.", SCOPED),
+  removeOrganisationRule: doc("Removes a rule by identifier from the attached organisation and answers its ruleId. An absent, unreadable or project-rule identifier answers not-found.", SCOPED),
+  createOrganisationRef: doc("Creates a ref at the organisation's trunk head and answers its name, readOnly and creation attribution. The optional readOnly flag defaults to false; the name is one non-reserved ref segment.", [...WRITE, "ref-exists", "read-only-ref", "organisation-not-ready"]),
+  listOrganisationRefs: doc("Lists visible refs in the attached organisation, including each name, readOnly and creation attribution.", SCOPED),
+  deleteOrganisationRef: doc("Deletes a writable ref from the attached organisation and answers its name. A read-only ref cannot be deleted.", [...REF_WRITE, "read-only-ref"]),
+  markOrganisationRefReadOnly: doc("Marks a ref in the attached organisation read-only and answers the full ref. An absent or unreadable name answers not-found.", SCOPED),
+  setObjectLock: doc("Sets an object's lock on the selected project ref to none, merge-only or frozen and answers objectId and lock. The lock also applies to its existing structural child edges in that project; none lifts the lock. New children on a live ref are not thereby frozen. Use a read-only organisation ref for a fixed baseline. An unknown lock answers invalid-request at lock.", [...REF_WRITE, "read-only-ref", "concurrent-change", "lock-unavailable"]),
+  readAgentCeiling: doc("Reads the selected project's maximum agent role as { ceiling }: contributor or maintainer. An absent or unreadable project answers not-found.", SCOPED),
+  setAgentCeiling: doc("Sets the selected project's maximum agent role to contributor or maintainer and answers { ceiling }. An unknown role answers invalid-request at ceiling.", SCOPED),
+  requestSchemaUpdate: doc("Records a schema update request for a project branch or organisation ref and answers its state and attribution. Execution is separate. A branch whose name contains a slash cannot request a schema update today. The trunk main answers invalid-request at ref; an unreachable ref answers not-found.", SCOPED),
+  readSchemaUpdateRequest: doc("Reads the caller's latest schema update request for the ref in the token's organisation, or null. Project read access is not required. A branch whose name contains a slash cannot read its request today. The trunk main answers invalid-request at ref.", SCOPED),
   openAgentSession: doc("Opens an agent session on a project.", [...SCOPED, "invalid-configuration"]),
   listAgentSessions: doc("Lists the caller's agent sessions on a project.", SCOPED),
   readAgentSession: doc("Reads one agent session and its runs.", SCOPED),
@@ -416,7 +501,7 @@ var SCHEMAS = {
   recover: { "type": "object", "properties": { "correlationId": { "type": "string" } }, "required": ["correlationId"], "additionalProperties": false },
   executeVerb: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "verb": { "type": "object", "properties": { "typeKey": { "type": "string" }, "typeVersion": { "type": "number" } }, "required": ["typeKey", "typeVersion"], "additionalProperties": false }, "subjectIds": { "type": "array", "items": { "type": "string" } }, "input": {} }, "required": ["correlation", "verb", "subjectIds", "input"], "additionalProperties": false },
   createBranch: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "from": { "oneOf": [{ "type": "object", "properties": { "ref": { "type": "string" } }, "required": ["ref"], "additionalProperties": false }, { "type": "object", "properties": { "hash": { "type": "string" } }, "required": ["hash"], "additionalProperties": false }] } }, "required": ["correlation", "name"], "additionalProperties": false },
-  merge: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "sourceHash": { "type": "string" }, "message": { "type": "string" }, "name": { "type": "string" } }, "required": ["correlation", "sourceHash", "message"], "additionalProperties": false },
+  merge: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "sourceHash": { "type": "string" }, "message": { "type": "string" }, "name": { "type": "string" }, "source": { "type": "string" }, "target": { "type": "string" } }, "required": ["correlation", "sourceHash", "message"], "additionalProperties": false },
   readMergeConflicts: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
   disposeRef: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "atHash": { "type": "string" } }, "required": ["correlation", "name", "atHash"], "additionalProperties": false },
   listProjects: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
@@ -461,6 +546,21 @@ var SCHEMAS = {
   readRefHead: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
   inspectBranchOperation: { "type": "object", "properties": { "correlationId": { "type": "string" } }, "required": ["correlationId"], "additionalProperties": false },
   abandonBranch: { "type": "object", "properties": { "correlation": { "oneOf": [{ "type": "object", "properties": { "kind": { "const": "mint" } }, "required": ["kind"], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "const": "sent" }, "correlationId": { "type": "string" } }, "required": ["kind", "correlationId"], "additionalProperties": false }] }, "name": { "type": "string" }, "atHash": { "type": "string" } }, "required": ["correlation", "name", "atHash"], "additionalProperties": false },
+  addRefRule: { "type": "object", "properties": { "pattern": { "type": "string" }, "consequence": { "enum": ["merge-only", "locked-rows-only"] } }, "required": ["pattern", "consequence"], "additionalProperties": false },
+  listRefRules: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  removeRefRule: { "type": "object", "properties": { "ruleId": { "type": "string" } }, "required": ["ruleId"], "additionalProperties": false },
+  addOrganisationRule: { "type": "object", "properties": { "pattern": { "type": "string" }, "consequence": { "enum": ["merge-only", "locked-rows-only"] } }, "required": ["pattern", "consequence"], "additionalProperties": false },
+  listOrganisationRules: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  removeOrganisationRule: { "type": "object", "properties": { "ruleId": { "type": "string" } }, "required": ["ruleId"], "additionalProperties": false },
+  createOrganisationRef: { "type": "object", "properties": { "name": { "type": "string" }, "readOnly": { "type": "boolean" } }, "required": ["name"], "additionalProperties": false },
+  listOrganisationRefs: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  deleteOrganisationRef: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
+  markOrganisationRefReadOnly: { "type": "object", "properties": { "name": { "type": "string" } }, "required": ["name"], "additionalProperties": false },
+  setObjectLock: { "type": "object", "properties": { "objectId": { "type": "string" }, "lock": { "enum": ["none", "merge-only", "frozen"] } }, "required": ["objectId", "lock"], "additionalProperties": false },
+  readAgentCeiling: { "type": "object", "properties": {}, "required": [], "additionalProperties": false },
+  setAgentCeiling: { "type": "object", "properties": { "ceiling": { "enum": ["contributor", "maintainer"] } }, "required": ["ceiling"], "additionalProperties": false },
+  requestSchemaUpdate: { "type": "object", "properties": { "ref": { "type": "string" } }, "required": ["ref"], "additionalProperties": false },
+  readSchemaUpdateRequest: { "type": "object", "properties": { "ref": { "type": "string" } }, "required": ["ref"], "additionalProperties": false },
   openAgentSession: { "type": "object", "properties": { "agent": { "enum": ["object", "ontology"] } }, "required": ["agent"], "additionalProperties": false },
   listAgentSessions: { "type": "object", "properties": { "agent": { "enum": ["object", "ontology"] } }, "required": ["agent"], "additionalProperties": false },
   readAgentSession: { "type": "object", "properties": { "agentSessionId": { "type": "string" } }, "required": ["agentSessionId"], "additionalProperties": false },
@@ -587,6 +687,21 @@ var EXAMPLES = {
   readRefHead: { "name": "<name>" },
   inspectBranchOperation: { "correlationId": "<correlationId>" },
   abandonBranch: { "correlation": { "kind": "mint" }, "name": "<name>", "atHash": "<atHash>" },
+  addRefRule: { "pattern": "<pattern>", "consequence": "merge-only" },
+  listRefRules: {},
+  removeRefRule: { "ruleId": "<ruleId>" },
+  addOrganisationRule: { "pattern": "<pattern>", "consequence": "merge-only" },
+  listOrganisationRules: {},
+  removeOrganisationRule: { "ruleId": "<ruleId>" },
+  createOrganisationRef: { "name": "<name>" },
+  listOrganisationRefs: {},
+  deleteOrganisationRef: { "name": "<name>" },
+  markOrganisationRefReadOnly: { "name": "<name>" },
+  setObjectLock: { "objectId": "<objectId>", "lock": "none" },
+  readAgentCeiling: {},
+  setAgentCeiling: { "ceiling": "contributor" },
+  requestSchemaUpdate: { "ref": "<ref>" },
+  readSchemaUpdateRequest: { "ref": "<ref>" },
   openAgentSession: { "agent": "object" },
   listAgentSessions: { "agent": "object" },
   readAgentSession: { "agentSessionId": "<agentSessionId>" },
@@ -634,7 +749,7 @@ var EXAMPLES = {
 var ROUTE_INPUT_EXAMPLES = deepFreeze(EXAMPLES);
 
 // packages/api-contract/dist/routes.js
-var PROTOCOL_VERSION = 23;
+var PROTOCOL_VERSION = 24;
 var VERSION_HEADER = "oe2-protocol-version";
 var TOKEN_HEADER = "authorization";
 var IDEMPOTENCY_HEADER = "oe2-idempotency-key";
@@ -734,6 +849,21 @@ var ROUTES = Object.freeze({
   readRefHead: route({ name: "readRefHead", method: "POST", path: "/branches/head", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "run-explore", "run-apply", "run-types", "client"), versioned: true, module: "branches-sdk", capability: "branches.head" }),
   inspectBranchOperation: route({ name: "inspectBranchOperation", method: "POST", path: "/branch-inspections", group: "branch", selector: "project", subject: "project", idempotent: false, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.inspection" }),
   abandonBranch: route({ name: "abandonBranch", method: "POST", path: "/branch-abandonments", group: "branch", selector: "project", subject: "project", idempotent: true, admission: admitting("user", "service", "client"), versioned: true, module: "branches-sdk", capability: "branches.abandonment" }),
+  addRefRule: route({ name: "addRefRule", method: "POST", path: "/ref-rules", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  listRefRules: route({ name: "listRefRules", method: "POST", path: "/projects/ref-rules", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  removeRefRule: route({ name: "removeRefRule", method: "POST", path: "/ref-rule-removals", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.ref-rules" }),
+  addOrganisationRule: route({ name: "addOrganisationRule", method: "POST", path: "/organisation-ref-rules", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  listOrganisationRules: route({ name: "listOrganisationRules", method: "POST", path: "/organisation-ref-rules/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  removeOrganisationRule: route({ name: "removeOrganisationRule", method: "POST", path: "/organisation-ref-rule-removals", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-ref-rules" }),
+  createOrganisationRef: route({ name: "createOrganisationRef", method: "POST", path: "/organisation-refs", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  listOrganisationRefs: route({ name: "listOrganisationRefs", method: "POST", path: "/organisation-refs/list", group: "read", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  deleteOrganisationRef: route({ name: "deleteOrganisationRef", method: "POST", path: "/organisation-ref-deletions", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  markOrganisationRefReadOnly: route({ name: "markOrganisationRefReadOnly", method: "POST", path: "/organisation-ref-read-only", group: "administration", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.organisation-refs" }),
+  setObjectLock: route({ name: "setObjectLock", method: "POST", path: "/object-locks", group: "write", selector: "object", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "objects-sdk", capability: "objects.locks" }),
+  readAgentCeiling: route({ name: "readAgentCeiling", method: "POST", path: "/projects/agent-ceiling", group: "read", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.agent-ceiling" }),
+  setAgentCeiling: route({ name: "setAgentCeiling", method: "POST", path: "/agent-ceiling", group: "administration", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "admin-sdk", capability: "admin.agent-ceiling" }),
+  requestSchemaUpdate: route({ name: "requestSchemaUpdate", method: "POST", path: "/schema-update-requests", group: "branch", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
+  readSchemaUpdateRequest: route({ name: "readSchemaUpdateRequest", method: "POST", path: "/schema-update-requests/read", group: "branch", selector: "none", subject: "none", idempotent: false, admission: admitting("user"), versioned: true, module: "branches-sdk", capability: "branches.schema-update" }),
   openAgentSession: route({ name: "openAgentSession", method: "POST", path: "/agent-sessions", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.session" }),
   listAgentSessions: route({ name: "listAgentSessions", method: "POST", path: "/agent-sessions/list", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.sessionList" }),
   readAgentSession: route({ name: "readAgentSession", method: "POST", path: "/agent-sessions/read", group: "agent", selector: "project", subject: "project", idempotent: false, admission: admitting("user"), versioned: true, module: "agents-sdk", capability: "agents.sessionRead" }),
@@ -853,6 +983,21 @@ var ROUTE_CARRIES_CREDENTIAL = Object.freeze({
   readRefHead: false,
   inspectBranchOperation: false,
   abandonBranch: false,
+  addRefRule: false,
+  listRefRules: false,
+  removeRefRule: false,
+  addOrganisationRule: false,
+  listOrganisationRules: false,
+  removeOrganisationRule: false,
+  createOrganisationRef: false,
+  listOrganisationRefs: false,
+  deleteOrganisationRef: false,
+  markOrganisationRefReadOnly: false,
+  setObjectLock: false,
+  readAgentCeiling: false,
+  setAgentCeiling: false,
+  requestSchemaUpdate: false,
+  readSchemaUpdateRequest: false,
   openAgentSession: false,
   listAgentSessions: false,
   readAgentSession: false,
@@ -908,11 +1053,11 @@ var CLIENT_SCOPES = Object.freeze({
   "objects.write": Object.freeze({ capabilities: Object.freeze(["objects.write", "objects.verb"]), consentLine: "Create, change and delete objects, and run actions on them, as you." }),
   "branches.read": Object.freeze({ capabilities: Object.freeze(["branches.head", "branches.diff", "branches.history", "branches.conflicts", "branches.inspection", "branches.pendingProposal", "branches.proposalList", "branches.proposalRead", "branches.proposalDiff", "branches.list"]), consentLine: "Read your branches, their history and proposals." }),
   "branches.write": Object.freeze({ capabilities: Object.freeze(["branches.create", "branches.abandonment", "branches.proposalSubmit", "branches.proposalRefusal", "branches.head", "branches.diff", "branches.history", "branches.conflicts", "branches.inspection", "branches.pendingProposal", "branches.proposalList", "branches.proposalRead", "branches.proposalDiff", "branches.list"]), consentLine: "Create and abandon branches, submit and refuse proposals, and read your branches, as you." }),
-  "branches.manage": Object.freeze({ capabilities: Object.freeze(["branches.merge", "branches.disposal", "objects.recovery"]), consentLine: "Merge branches into a project's trunk, delete branches and other refs, and recover changes, as you." }),
+  "branches.manage": Object.freeze({ capabilities: Object.freeze(["branches.merge", "branches.disposal", "objects.recovery"]), consentLine: "Merge branches into the branches and trunks you may change, delete branches and other refs, and recover changes, as you." }),
   offline_access: Object.freeze({ capabilities: Object.freeze([]), consentLine: "Stay connected when you are away, until you disconnect it." })
 });
 
-// packages/sdk-core/dist/explain.js
+// packages/sdk-dispatch/dist/explain.js
 function explainKind(kind) {
   if (!Object.hasOwn(BY_KIND, kind)) {
     throw new Error(`the refusal kind ${JSON.stringify(kind)} has no entry in the refusal catalogue`);
@@ -992,10 +1137,10 @@ function unauthenticatedEnvelope() {
   return { version: PROTOCOL_VERSION, refusal: explainedRefusalOf({ kind: "unauthenticated" }), correlationId: null };
 }
 
-// packages/sdk-core/dist/socket-transport.js
+// packages/sdk-dispatch/dist/socket-transport.js
 import { request } from "node:http";
 
-// packages/sdk-core/dist/response.js
+// packages/sdk-dispatch/dist/response.js
 function responseOf(status, text, reason) {
   let read = false;
   const members = {
@@ -1025,7 +1170,7 @@ function responseOf(status, text, reason) {
   });
 }
 
-// packages/sdk-core/dist/socket-transport.js
+// packages/sdk-dispatch/dist/socket-transport.js
 var REQUEST_DEADLINE_MS = 1e4;
 var HostOutcomeUnknown = class extends Error {
   path;
@@ -1120,7 +1265,7 @@ function createHostFetch(socketPath, deadlineMs = REQUEST_DEADLINE_MS) {
       let written = false;
       let settled = false;
       let deadline = null;
-      const settle = (answer) => {
+      const settle2 = (answer) => {
         if (settled) {
           return;
         }
@@ -1131,7 +1276,7 @@ function createHostFetch(socketPath, deadlineMs = REQUEST_DEADLINE_MS) {
         answer();
       };
       const lost = (error) => {
-        settle(() => {
+        settle2(() => {
           reject(written ? new HostOutcomeUnknown(path, "connection-lost", `the connection to the host was lost after the request to ${path} was sent`) : error);
         });
       };
@@ -1152,7 +1297,7 @@ function createHostFetch(socketPath, deadlineMs = REQUEST_DEADLINE_MS) {
           }
           const status = incoming.statusCode;
           const reason = incoming.statusMessage;
-          settle(() => {
+          settle2(() => {
             if (status === void 0) {
               reject(new Error("the host's response carried no status"));
               return;
@@ -1162,7 +1307,7 @@ function createHostFetch(socketPath, deadlineMs = REQUEST_DEADLINE_MS) {
         });
       });
       deadline = setTimeout(() => {
-        settle(() => {
+        settle2(() => {
           reject(new HostOutcomeUnknown(path, "deadline", `the host did not answer ${path} within the deadline of ${String(deadlineMs)} ms`));
         });
         outgoing.destroy();
@@ -1320,7 +1465,7 @@ function createHostStreamFetch(socketPath, headDeadlineMs = REQUEST_DEADLINE_MS)
   };
 }
 
-// packages/sdk-core/dist/call.js
+// packages/sdk-dispatch/dist/call.js
 function isEnvelope(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -1425,7 +1570,7 @@ async function* callStreamed(transport, origin, route2, body, token, signal) {
   }
 }
 
-// packages/sdk-core/dist/module-factory.js
+// packages/sdk-dispatch/dist/module-factory.js
 function freezeDoc(doc2) {
   return Object.freeze({ does: doc2.does, refuses: Object.freeze([...doc2.refuses]) });
 }
@@ -1462,7 +1607,7 @@ function createModuleFactory(entries6, transport, origin, token) {
   return Object.freeze(Object.fromEntries(Object.entries(byCapability).map(([capability, methods]) => [capability, Object.freeze(methods)])));
 }
 
-// packages/sdk-core/dist/typed-client.js
+// packages/sdk-dispatch/dist/typed-client.js
 function createTypedClient(names, entries6, transport, origin, token) {
   const factory = createModuleFactory(entries6, transport, origin, token);
   const byName = new Map(entries6.map((entry2) => [entry2.name, entry2]));
@@ -1481,7 +1626,7 @@ function createTypedClient(names, entries6, transport, origin, token) {
   return Object.freeze(client);
 }
 
-// packages/sdk-core/dist/https-transport.js
+// packages/sdk-dispatch/dist/https-transport.js
 import { request as request2 } from "node:https";
 function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLINE_MS) {
   const originUrl = new URL(origin);
@@ -1498,7 +1643,7 @@ function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLIN
       let settled = false;
       let deadline = null;
       const path = `${url.pathname}${url.search}`;
-      const settle = (answer) => {
+      const settle2 = (answer) => {
         if (settled) {
           return;
         }
@@ -1509,7 +1654,7 @@ function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLIN
         answer();
       };
       const lost = (error) => {
-        settle(() => {
+        settle2(() => {
           reject(written ? new HostOutcomeUnknown(path, "connection-lost", `the connection to the host was lost after the request to ${path} was sent`) : error);
         });
       };
@@ -1529,7 +1674,7 @@ function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLIN
         incoming.on("end", () => {
           const status = incoming.statusCode;
           const reason = incoming.statusMessage;
-          settle(() => {
+          settle2(() => {
             if (status === void 0) {
               reject(new Error("the host's response carried no status"));
               return;
@@ -1539,7 +1684,7 @@ function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLIN
         });
       });
       deadline = setTimeout(() => {
-        settle(() => {
+        settle2(() => {
           reject(new HostOutcomeUnknown(path, "deadline", `the host did not answer ${path} within the deadline of ${String(deadlineMs)} ms`));
         });
         outgoing.destroy();
@@ -1553,7 +1698,7 @@ function createHttpsTransport(origin, options = {}, deadlineMs = REQUEST_DEADLIN
   };
 }
 
-// packages/sdk-core/dist/token-routes.js
+// packages/sdk-dispatch/dist/token-routes.js
 async function redeem(transport, origin, body) {
   return call(transport, origin, "redeem", body, null, null);
 }
@@ -1610,6 +1755,18 @@ var ADMIN_ROUTE_NAMES = Object.freeze([
   "listAudit",
   "createProject",
   "createOrganisation",
+  "addRefRule",
+  "listRefRules",
+  "removeRefRule",
+  "addOrganisationRule",
+  "listOrganisationRules",
+  "removeOrganisationRule",
+  "createOrganisationRef",
+  "listOrganisationRefs",
+  "deleteOrganisationRef",
+  "markOrganisationRefReadOnly",
+  "readAgentCeiling",
+  "setAgentCeiling",
   "createConnection",
   "listConnections",
   "setConnectionCredential",
@@ -1668,7 +1825,9 @@ var BRANCHES_ROUTE_NAMES = Object.freeze([
   "readBranchHistory",
   "readRefHead",
   "inspectBranchOperation",
-  "abandonBranch"
+  "abandonBranch",
+  "requestSchemaUpdate",
+  "readSchemaUpdateRequest"
 ]);
 function entries3() {
   return BRANCHES_ROUTE_NAMES.map((name) => ROUTES[name]);
@@ -1739,7 +1898,15 @@ function exploreViewAddress(address, state) {
 function projectAddress(organisationId, projectId, ref) {
   return withSubject(projectBase(organisationId, projectId), { ref, q: null });
 }
-var ORGANISATION_ADMIN_PAGES = Object.freeze(["members", "service-identities", "clients", "agent-model", "connections", "projects/new"]);
+var ORGANISATION_ADMIN_PAGES = Object.freeze([
+  "members",
+  "service-identities",
+  "clients",
+  "agent-model",
+  "connections",
+  "refs",
+  "projects/new"
+]);
 function organisationAdminAddress(organisationId, page) {
   return `/orgs/${encodeURIComponent(organisationId)}/${page}`;
 }
@@ -1756,6 +1923,12 @@ function branchDiffAddress(organisationId, projectId, ref) {
 
 // packages/addresses/dist/links.js
 var ORGANISATION_PAGES = Object.freeze([...ORGANISATION_ADMIN_PAGES, "settings"]);
+function isLinkRef(ref, projectId) {
+  if (ref === "main")
+    return true;
+  const parts = ref.split("/");
+  return parts.length === 2 && parts[0] !== "" && parts[1] !== "" && (projectId === void 0 || parts[0] === projectId);
+}
 var ADMITTED_PAGES = new Set(ORGANISATION_PAGES);
 function isOrganisationPage(value) {
   return ADMITTED_PAGES.has(value);
@@ -1872,7 +2045,8 @@ var OBJECTS_ROUTE_NAMES = [
   "listComments",
   "addComment",
   "readApp",
-  "listApps"
+  "listApps",
+  "setObjectLock"
 ];
 function entries4() {
   return OBJECTS_ROUTE_NAMES.map((name) => ROUTES[name]);
@@ -2804,14 +2978,14 @@ function explanationLines(heading, explanation) {
   }
   return lines;
 }
-function refusalLines(refusal2, settle, request3, host, reference) {
+function refusalLines(refusal2, settle2, request3, host, reference) {
   const lines = explanationLines(refusalHeading(refusal2), refusal2);
   const allowed = allowedFieldOf(refusal2, request3);
   if (request3 !== void 0 && allowed !== null && allowed.allowedKinds.length > 0 && allowed.discriminator !== void 0) {
     lines.push(`allowed ${allowed.discriminator}: ${allowed.allowedKinds.join(", ")}`, `${request3.command} --help shows each shape`);
   }
   if (refusal2.kind === "unknown-outcome") {
-    lines.push(`The operation may or may not have taken effect, and openeng will not repeat it. Settle it with: ${settle}`);
+    lines.push(`The operation may or may not have taken effect, and openeng will not repeat it. Settle it with: ${settle2}`);
   }
   if (refusal2.kind === "protocol-mismatch" && host !== void 0) {
     const versions = `this CLI speaks protocol ${PROTOCOL_VERSION}; the host at ${host} speaks ${refusal2.versions.host}`;
@@ -2827,13 +3001,13 @@ function refusalLines(refusal2, settle, request3, host, reference) {
   }
   return lines;
 }
-function refusalValue(refusal2, settle, request3, host, reference) {
+function refusalValue(refusal2, settle2, request3, host, reference) {
   const referenced = reference === void 0 ? {} : { reference };
   if (refusal2.kind === "protocol-mismatch") {
     return { ...refusal2, clientVersion: PROTOCOL_VERSION, ...host === void 0 ? {} : { host }, ...referenced };
   }
   const allowed = allowedFieldOf(refusal2, request3);
-  const settled = refusal2.kind === "unknown-outcome" ? { ...refusal2, settle } : refusal2;
+  const settled = refusal2.kind === "unknown-outcome" ? { ...refusal2, settle: settle2 } : refusal2;
   return allowed === null || allowed.allowedKinds.length === 0 ? { ...settled, ...referenced } : { ...settled, allowedKinds: allowed.allowedKinds, ...referenced };
 }
 function jsonLine(value) {
@@ -2937,12 +3111,12 @@ var render = (outcome, json, scope, host) => {
 function failure(kind, exitCode, message, json) {
   return json ? { exitCode, stdout: jsonLine({ error: { kind, message } }), stderr: "" } : { exitCode, stdout: "", stderr: textBlock([message]) };
 }
-var outcomeOfEnvelope = (envelope, settle, text, request3) => {
+var outcomeOfEnvelope = (envelope, settle2, text, request3) => {
   if ("refusal" in envelope) {
     return {
       kind: "refusal",
       refusal: envelope.refusal,
-      settle,
+      settle: settle2,
       ...request3 === void 0 ? {} : { request: request3 },
       ...typeof envelope.correlationId === "string" ? { reference: envelope.correlationId } : {}
     };
@@ -2960,9 +3134,9 @@ var outcomeOfRefusedResult = (result) => isRefusedResult2(result) ? { kind: "ref
 function isRefusedResult2(value) {
   return typeof value === "object" && value !== null && "kind" in value && value.kind === "refused" && "explanation" in value && "explains" in value;
 }
-function outcomeOfRouteRefusal(refusal2, settle, correlationId) {
+function outcomeOfRouteRefusal(refusal2, settle2, correlationId) {
   if ("explanation" in refusal2 && "explains" in refusal2) {
-    return { kind: "refusal", refusal: refusal2, settle, ...correlationId === null ? {} : { reference: correlationId } };
+    return { kind: "refusal", refusal: refusal2, settle: settle2, ...correlationId === null ? {} : { reference: correlationId } };
   }
   return { kind: "internal-failure", message: `the host refused with ${refusal2.kind} and the SDK attached no explanation` };
 }
@@ -2988,18 +3162,18 @@ var STORE_NEXT_STEPS = {
 function storeFailureMessage(store, operation, nextStep) {
   return `the ${STORE_LABELS[store]} session store ${STORE_OPERATION_FAILURES[operation]}; ${STORE_NEXT_STEPS[nextStep]}`;
 }
-var outcomeOfSessionFailure = (failure2, settle) => {
+var outcomeOfSessionFailure = (failure2, settle2) => {
   switch (failure2.reason) {
     case "not-signed-in":
       return { kind: "unauthenticated", message: notSignedInMessage(failure2.hostKey, failure2.store) };
     case "refresh-refused":
-      return outcomeOfRouteRefusal(failure2.refusal, settle, failure2.correlationId);
+      return outcomeOfRouteRefusal(failure2.refusal, settle2, failure2.correlationId);
     case "store-failed":
       return { kind: "client-refusal", message: storeFailureMessage(failure2.store, failure2.operation, failure2.nextStep) };
     case "transport-failed":
       return { kind: "transport-failure", message: failure2.message };
     case "outcome-unknown":
-      return { kind: "unknown-outcome-no-answer", message: failure2.message, settle };
+      return { kind: "unknown-outcome-no-answer", message: failure2.message, settle: settle2 };
   }
 };
 var outcomeOfHostRefusal = (refusal2) => ({
@@ -3051,7 +3225,7 @@ var outcomeOfLogout = (outcome) => {
       return outcomeOfSessionFailure(outcome.failure, "openeng whoami");
   }
 };
-var outcomeOfOrganisationSwitch = (outcome, settle) => {
+var outcomeOfOrganisationSwitch = (outcome, settle2) => {
   switch (outcome.kind) {
     case "switched":
       return {
@@ -3060,9 +3234,9 @@ var outcomeOfOrganisationSwitch = (outcome, settle) => {
         text: outcome.organisation === null ? "detached from its organisation" : `attached to ${outcome.organisation.name} (${outcome.organisation.id})`
       };
     case "refused":
-      return outcomeOfRouteRefusal(outcome.refusal, settle, outcome.correlationId);
+      return outcomeOfRouteRefusal(outcome.refusal, settle2, outcome.correlationId);
     case "failed":
-      return outcomeOfSessionFailure(outcome.failure, settle);
+      return outcomeOfSessionFailure(outcome.failure, settle2);
     case "unexpected":
       return { kind: "internal-failure", message: outcome.message };
   }
@@ -4013,7 +4187,7 @@ async function runGenerated(entry2, context) {
   if (body.correlationMinted) {
     context.note("correlation: minted by the host");
   }
-  const settle = settleOf(entry2, key.key);
+  const settle2 = settleOf(entry2, key.key);
   let run2;
   try {
     run2 = await runAuthenticated(context.host, context.deps, async (clients) => {
@@ -4046,12 +4220,12 @@ async function runGenerated(entry2, context) {
           message: REFRESH_UNANSWERED_ADVICE
         };
       }
-      return { kind: "unknown-outcome-no-answer", message: error.message, settle };
+      return { kind: "unknown-outcome-no-answer", message: error.message, settle: settle2 };
     }
     throw error;
   }
   if (!run2.ok) {
-    return outcomeOfSessionFailure(run2.failure, settle);
+    return outcomeOfSessionFailure(run2.failure, settle2);
   }
   const answer = run2.answer;
   if ("unavailable" in answer && typeof answer.unavailable === "string") {
@@ -4064,7 +4238,7 @@ async function runGenerated(entry2, context) {
   if (replayed) {
     context.note("the host answered a replay of an earlier request that carried this idempotency key");
   }
-  return outcomeOfEnvelope(replayed ? withoutReplay(answer) : answer, settle, (result) => JSON.stringify(result, null, 2), {
+  return outcomeOfEnvelope(replayed ? withoutReplay(answer) : answer, settle2, (result) => JSON.stringify(result, null, 2), {
     command: `openeng ${entry2.module} ${entry2.name}`,
     schemas: schemasOf(entry2),
     sent: body.body
@@ -4166,13 +4340,13 @@ var orgCreate = {
     if (options.idempotencyKey === void 0) {
       note(`idempotency key: ${key}`);
     }
-    const settle = `repeat this command with --idempotency-key ${key}, to retrieve a recorded outcome or retry an attempt that never reached the host`;
+    const settle2 = `repeat this command with --idempotency-key ${key}, to retrieve a recorded outcome or retry an attempt that never reached the host`;
     const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.createOrganisation({ input: { name } }, key));
     if (!run2.ok) {
-      return outcomeOfSessionFailure(run2.failure, settle);
+      return outcomeOfSessionFailure(run2.failure, settle2);
     }
     if ("refusal" in run2.answer) {
-      return outcomeOfRouteRefusal(run2.answer.refusal, settle, run2.answer.correlationId);
+      return outcomeOfRouteRefusal(run2.answer.refusal, settle2, run2.answer.correlationId);
     }
     return { kind: "success", value: run2.answer.result, text: `created organisation ${name} (${run2.answer.result.organisationId})` };
   }
@@ -8357,7 +8531,7 @@ var typesIcons = {
   }
 };
 
-// packages/demo-seed/dist/definition.js
+// packages/demo-player/dist/definition.js
 var STRING = { kind: "string" };
 var NUMBER = { kind: "number" };
 var PERSON = { kind: "person" };
@@ -8672,7 +8846,7 @@ function worldSteps(size, ownerPersonId, data) {
 }
 var DEMO_TYPE_VERSION = 1;
 
-// packages/demo-seed/dist/ocgt-world.js
+// packages/demo-player/dist/ocgt-world.js
 var SYSTEM_TREE = [
   { identifier: "OCGT", name: "Open Cycle Gas Turbine Plant", parent: null },
   { identifier: "GT", name: "Gas Turbine", parent: "OCGT" },
@@ -8897,7 +9071,7 @@ var OCGT_WORLD = {
   })
 };
 
-// packages/demo-seed/dist/player.js
+// packages/demo-player/dist/player.js
 var TRUNK_REF = "main";
 var IDEMPOTENCY_PREFIX = "demo-seed";
 var DemoRouteRefusedError = class extends Error {
@@ -8925,6 +9099,20 @@ var DemoForeignChangeSetError = class extends Error {
     this.name = "DemoForeignChangeSetError";
   }
 };
+var CATALOGUE_CATEGORY_LABELS = {
+  object: "an object type",
+  edge: "an edge type",
+  verb: "a verb type"
+};
+var DemoCatalogueClashError = class extends Error {
+  clashes;
+  constructor(clashes) {
+    const categories = clashes.map(({ typeKey, typeCategory, version }) => `${typeKey} is ${CATALOGUE_CATEGORY_LABELS[typeCategory]} at version ${String(version)}`).join(", ");
+    super(`the organisation's catalogue already holds demo types the demo world cannot play into (${categories}); seed into an organisation whose catalogue does not hold these types`);
+    this.name = "DemoCatalogueClashError";
+    this.clashes = clashes;
+  }
+};
 function demoRailGroups() {
   return DEMO_RAIL_GROUPS.map(({ name }) => name);
 }
@@ -9061,6 +9249,22 @@ async function playDemoWorld(clients, target, size, data) {
     throw new Error("the demo world declares no object type to check for an existing play");
   }
   const published = resultOf(await clients.objects.readCatalogue({ selector: { projectId: target.projectId }, input: {} }), "readCatalogue");
+  const catalogueTypes = [...published.objects, ...published.edges, ...published.verbs];
+  const demoTypes = [
+    ...DEMO_OBJECT_TYPES.map(({ typeKey }) => ({ typeKey, typeCategory: "object" })),
+    ...DEMO_EDGE_TYPES.map(({ typeKey }) => ({ typeKey, typeCategory: "edge" }))
+  ];
+  const clashes = [];
+  for (const demoType of demoTypes) {
+    for (const catalogueType of catalogueTypes) {
+      if (catalogueType.typeKey === demoType.typeKey && (catalogueType.typeCategory !== demoType.typeCategory || catalogueType.version !== DEMO_TYPE_VERSION)) {
+        clashes.push({ typeKey: demoType.typeKey, typeCategory: catalogueType.typeCategory, version: catalogueType.version });
+      }
+    }
+  }
+  if (clashes.length > 0) {
+    throw new DemoCatalogueClashError(clashes);
+  }
   if (!published.objects.some((one) => one.typeKey === firstObjectType.typeKey)) {
     await publishDemoTypes(clients.ontology, target.organisationId);
   }
@@ -9104,10 +9308,10 @@ async function playDemoWorld(clients, target, size, data) {
 // packages/cli/src/commands/demo-shared.ts
 async function runDemoSeed(context, projectId, size, world, data) {
   const { host, deps } = context;
-  const settle = `openeng types list --project ${projectId}, then repeat openeng demo seed, which completes what is left`;
+  const settle2 = `openeng types list --project ${projectId}, then repeat openeng demo seed, which completes what is left`;
   const signedIn = await freshSession(host, deps);
   if (!signedIn.ok) {
-    return outcomeOfSessionFailure(signedIn.failure, settle);
+    return outcomeOfSessionFailure(signedIn.failure, settle2);
   }
   const ownerPersonId = signedIn.session.principalId;
   const run2 = await runAuthenticated(host, deps, async (clients) => {
@@ -9134,15 +9338,18 @@ async function runDemoSeed(context, projectId, size, world, data) {
       if (error instanceof DemoForeignChangeSetError) {
         return { foreignChangeSet: error.message };
       }
+      if (error instanceof DemoCatalogueClashError) {
+        return { catalogueClash: error.message };
+      }
       throw error;
     }
   });
   if (!run2.ok) {
-    return outcomeOfSessionFailure(run2.failure, settle);
+    return outcomeOfSessionFailure(run2.failure, settle2);
   }
   const answer = run2.answer;
   if ("refusal" in answer) {
-    return outcomeOfRouteRefusal(answer.refusal, settle, answer.correlationId);
+    return outcomeOfRouteRefusal(answer.refusal, settle2, answer.correlationId);
   }
   if ("refusedResult" in answer) {
     return outcomeOfRefusedResult(answer.refusedResult);
@@ -9150,6 +9357,9 @@ async function runDemoSeed(context, projectId, size, world, data) {
   if ("foreignChangeSet" in answer) {
     return { kind: "client-refusal", message: answer.foreignChangeSet };
   }
+  if ("catalogueClash" in answer) {
+    return { kind: "client-refusal", message: answer.catalogueClash };
+  }
   if ("absent" in answer) {
     return { kind: "client-refusal", message: `the project ${projectId} is not among the projects you may list; create it with openeng projects create` };
   }
@@ -9216,13 +9426,13 @@ function createSecretPrompt(input, output) {
     return new Promise((resolve, reject) => {
       let value = "";
       let finished = false;
-      const finish = (settle) => {
+      const finish = (settle2) => {
         finished = true;
         input.off("data", onData);
         input.setRawMode(false);
         input.pause();
         output.write("\n");
-        settle();
+        settle2();
       };
       const consume = (text) => {
         const characters = [...text];
@@ -9331,14 +9541,14 @@ var connectorCreate = {
     if (!chosen.ok) {
       return chosen.outcome;
     }
-    const settle = "openeng admin-sdk listConnections, which only reads, shows whether the connection exists";
+    const settle2 = "openeng admin-sdk listConnections, which only reads, shows whether the connection exists";
     context.note(CONNECTOR_DISCLOSURE);
     const run2 = await runAuthenticated(
       context.host,
       context.deps,
       (clients) => clients.admin.createConnection({ input: { name, system, stack, companyId: company === void 0 ? null : company, selection: chosen.selection } })
     );
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, createdText) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, createdText) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 function selectorOf(context) {
@@ -9381,14 +9591,14 @@ var connectorSetCredential = {
     if (secretKey === null || secretKey === "") {
       return { kind: "client-refusal", message: "openeng connector set-credential needs the secret key typed at a terminal prompt" };
     }
-    const settle = "openeng connector set-credential again; a repeat replaces the stored credential";
+    const settle2 = "openeng connector set-credential again; a repeat replaces the stored credential";
     const run2 = await runAuthenticated(
       context.host,
       context.deps,
       (clients) => clients.admin.setConnectionCredential({ selector, input: { credential: { kind: "api-key", accessKey: toCredential(accessKey), secretKey: toCredential(secretKey) } } })
     );
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (set) => `credential set for Onshape account ${set.upstreamIdentity} at ${set.setAt}
-${CONNECTOR_DISCLOSURE}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (set) => `credential set for Onshape account ${set.upstreamIdentity} at ${set.setAt}
+${CONNECTOR_DISCLOSURE}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var connectorDraftTypes = {
@@ -9406,9 +9616,9 @@ var connectorDraftTypes = {
   ],
   run: async (context) => {
     const selector = selectorOf(context);
-    const settle = "openeng types draft current, which only reads, shows whether a change set is open";
+    const settle2 = "openeng types draft current, which only reads, shows whether a change set is open";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.admin.draftConnectorTypes({ selector, input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, typesText) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, typesText) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var connectorRevoke = {
@@ -9427,9 +9637,9 @@ var connectorRevoke = {
   run: async (context) => {
     const selector = selectorOf(context);
     const { connectionId } = selector;
-    const settle = "openeng admin-sdk listConnections, which only reads, shows the connection's state";
+    const settle2 = "openeng admin-sdk listConnections, which only reads, shows the connection's state";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.admin.revokeConnection({ selector, input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, () => `revoked connection ${connectionId}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, () => `revoked connection ${connectionId}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var connectorRun = {
@@ -9448,9 +9658,9 @@ var connectorRun = {
   run: async (context) => {
     const selector = selectorOf(context);
     const { connectionId } = selector;
-    const settle = `openeng connector runs ${connectionId}, which only reads`;
+    const settle2 = `openeng connector runs ${connectionId}, which only reads`;
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.admin.startImportRun({ selector, input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (started) => `started run ${started.runId}: read it with openeng connector runs ${connectionId}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (started) => `started run ${started.runId}: read it with openeng connector runs ${connectionId}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var runText = (record) => {
@@ -9474,9 +9684,9 @@ var connectorRuns = {
   ],
   run: async (context) => {
     const selector = selectorOf(context);
-    const settle = "repeat openeng connector runs, which only reads";
+    const settle2 = "repeat openeng connector runs, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.admin.listImportRuns({ selector, input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (records) => records.length === 0 ? "no runs" : records.map(runText).join("\n")) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (records) => records.length === 0 ? "no runs" : records.map(runText).join("\n")) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 
@@ -9514,6 +9724,9 @@ var SCOPE_OF_KIND = Object.freeze({
 });
 var UNREAD = "";
 function scopeOf2(kind, project, ref) {
+  if (SCOPE_OF_KIND[kind] !== "none" && ref !== void 0 && !isLinkRef(ref, SCOPE_OF_KIND[kind] === "project-and-ref" ? project : void 0)) {
+    return "--ref takes main or <projectId>/<branch>, the ref the platform returns; its project must match --project when given";
+  }
   switch (SCOPE_OF_KIND[kind]) {
     case "project-and-ref":
       return project === void 0 || project === "" || ref === void 0 || ref === "" ? "needs --project <id> and --ref <ref>" : { project, ref };
@@ -9526,6 +9739,64 @@ function scopeOf2(kind, project, ref) {
       return project !== void 0 || ref !== void 0 ? "takes neither --project nor --ref" : { project: UNREAD, ref: UNREAD };
   }
 }
+function checkedRead(pending, reason, contains) {
+  return pending.then((answer) => {
+    if ("refusal" in answer) {
+      return { answer, missing: answer.refusal.kind === "not-found" ? reason : null };
+    }
+    if (answer.replayed === true) return { answer, missing: null };
+    return { answer, missing: contains !== void 0 && !contains(answer.result) ? reason : null };
+  });
+}
+function subjectReads(clients, subject, scope) {
+  const reads = [];
+  if (scope.ref !== "main" && SCOPE_OF_KIND[subject.kind] !== "none") {
+    const slash = scope.ref.indexOf("/");
+    const projectId = scope.ref.slice(0, slash);
+    const name = scope.ref.slice(slash + 1);
+    reads.push(checkedRead(
+      clients.branches.readRefHead({ selector: { projectId }, input: { name } }),
+      `no ref ${scope.ref} in project ${projectId}`
+    ));
+  } else if (SCOPE_OF_KIND[subject.kind] === "project-and-ref") {
+    reads.push(checkedRead(
+      clients.branches.readRefHead({ selector: { projectId: scope.project }, input: { name: "main" } }),
+      `no ref main in project ${scope.project}`
+    ));
+  }
+  switch (subject.kind) {
+    case "object":
+      reads.push(checkedRead(
+        clients.objects.readObject({ selector: { projectId: scope.project, ref: scope.ref }, input: { objectId: subject.objectId } }),
+        `no object ${subject.objectId} in project ${scope.project} on ref ${scope.ref}`
+      ));
+      break;
+    case "type":
+      reads.push(checkedRead(
+        clients.objects.readCatalogue({ selector: { projectId: scope.project }, input: {} }),
+        `no type ${subject.typeKey} in project ${scope.project}`,
+        (catalogue) => catalogue.objects.some((type) => type.typeKey === subject.typeKey)
+      ));
+      break;
+    case "app":
+      reads.push(checkedRead(clients.objects.readApp({ input: { appKey: subject.appKey } }), `no app ${subject.appKey}`));
+      break;
+    case "app-page":
+      reads.push(checkedRead(
+        clients.objects.readApp({ input: { appKey: subject.appKey } }),
+        `no page ${subject.pageKey} in app ${subject.appKey}`,
+        (app) => app.document.pages.some((page) => page.key === subject.pageKey)
+      ));
+      break;
+    case "proposal":
+      reads.push(checkedRead(
+        clients.branches.readProposal({ selector: { projectId: scope.project }, input: { proposalId: subject.proposalId } }),
+        `no proposal ${subject.proposalId} in project ${scope.project}`
+      ));
+      break;
+  }
+  return reads;
+}
 async function link(context) {
   const { host, deps, options, args } = context;
   const read = await readStoredEntry(host, deps.store);
@@ -9567,13 +9838,28 @@ async function link(context) {
     return refusal(`openeng link ${subject.kind} ${scope}`);
   }
   const path = linkPath(organisation.id, scope.project, subject, scope.ref);
-  const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.readWebOrigin({ input: {} }));
+  const run2 = await runAuthenticated(host, deps, async (clients) => {
+    const [origin, checks] = await Promise.all([
+      clients.admin.readWebOrigin({ input: {} }),
+      Promise.all(subjectReads(clients, subject, scope))
+    ]);
+    const blocked = checks.find((check) => check.missing === null && ("refusal" in check.answer || check.answer.replayed === true));
+    if (blocked !== void 0) return blocked.answer;
+    if ("refusal" in origin) {
+      return origin.refusal.kind === "not-found" ? refusal("the host's web application was not found") : origin;
+    }
+    if (origin.replayed === true) return origin;
+    const missing = checks.find((check) => check.missing !== null);
+    if (missing !== void 0 && missing.missing !== null) return refusal(missing.missing);
+    return { kind: "link-ready", webOrigin: origin.result.webOrigin };
+  });
   if (!run2.ok) {
     return outcomeOfSessionFailure(run2.failure, SETTLE2);
   }
   const { answer } = run2;
-  if (!("refusal" in answer) && answer.replayed !== true) {
-    const { webOrigin } = answer.result;
+  if ("kind" in answer) {
+    if (answer.kind === "client-refusal") return answer;
+    const { webOrigin } = answer;
     if (webOrigin === null) {
       return refusal("this host has no web application configured, so it has no page to link to");
     }
@@ -9590,7 +9876,9 @@ var spec = (argumentCount, usage) => ({
   usage,
   help: [
     ...LINK_HELP,
-    "does:    builds the address of a page of the web application for the attached organisation",
+    "does:    reads the page's subject before printing its web address for the attached organisation",
+    "ref:     --ref takes main or <projectId>/<branch>, the ref the platform returns; match --project when given",
+    "refusal: a subject not found by the page's own read prints no address",
     "example: openeng link explore --project proj_abc123 --ref main",
     "output:  the address on one line; under --json an object with link"
   ],
@@ -9649,6 +9937,347 @@ var projectsCreate = {
   }
 };
 
+// packages/cli/src/commands/protection-help.ts
+var SCOPE_LABELS = Object.freeze({
+  project: "on the selected project",
+  organisation: "in the attached organisation",
+  "branch-home-project": "on the branch's home project",
+  "organisation-ref": "for an organisation ref",
+  ref: "on the selected ref"
+});
+function protectionCapabilityHelp(...routes) {
+  const requirements = routes.flatMap((route2) => PROTECTION_ROUTE_CAPABILITIES[route2].map((requirement) => "visibility" in requirement ? "none; only the caller's own requests in the token's organisation; no project read required" : `${requirement.capability} ${SCOPE_LABELS[requirement.scope]}`));
+  return `capability: ${[...new Set(requirements)].join(" or ")}`;
+}
+
+// packages/cli/src/commands/rules.ts
+var CONSEQUENCES = ["merge-only", "locked-rows-only"];
+var settleWith = (project) => project === void 0 ? "repeat openeng rules list --organisation, which only reads" : `repeat openeng rules list --project ${project}, which only reads`;
+var ruleText = (rule) => `rule ${rule.ruleId}  ${rule.pattern}  ${rule.consequence}`;
+var rulesOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
+var scopeMessage = "choose exactly one of --project <id> or --organisation";
+var rulesAdd = {
+  words: ["rules", "add"],
+  organisation: "required",
+  usage: "openeng rules add (--project <id>|--organisation) --pattern <pattern> --consequence <value>",
+  help: [
+    "openeng rules add (--project <id>|--organisation) --pattern <pattern> --consequence <merge-only|locked-rows-only>",
+    "does:    adds a project or organisation ref rule; repeating the same content returns the existing rule",
+    protectionCapabilityHelp("addRefRule", "addOrganisationRule"),
+    "example: openeng rules add --organisation --pattern release-v1 --consequence merge-only",
+    "output:  the rule id, pattern and consequence; under --json { scope, value }, with the full RefRule in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project, organisation, pattern } = options;
+    if (project !== void 0 === organisation) {
+      return { kind: "client-refusal", message: scopeMessage };
+    }
+    if (pattern === void 0 || options.consequence === void 0) {
+      return {
+        kind: "client-refusal",
+        message: "openeng rules add needs --pattern <pattern> and --consequence <merge-only|locked-rows-only>"
+      };
+    }
+    const consequence = CONSEQUENCES.find((value) => value === options.consequence);
+    if (consequence === void 0) {
+      return { kind: "client-refusal", message: "--consequence must be merge-only or locked-rows-only" };
+    }
+    const settle2 = settleWith(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.addOrganisationRule({ input: { pattern, consequence } }) : clients.admin.addRefRule({ selector: { projectId: project }, input: { pattern, consequence } }));
+    return run2.ok ? rulesOutcome(outcomeOfEnvelope(run2.answer, settle2, ruleText)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+var rulesList = {
+  words: ["rules", "list"],
+  organisation: "required",
+  usage: "openeng rules list (--project <id>|--organisation)",
+  help: [
+    "openeng rules list (--project <id>|--organisation)",
+    "does:    lists visible ref protection rules for the project or attached organisation",
+    protectionCapabilityHelp("listRefRules", "listOrganisationRules"),
+    "example: openeng rules list --organisation --json",
+    "output:  id, pattern and consequence per rule, or no rules; --json { scope, value }, value is a RefRule array"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project, organisation } = options;
+    if (project !== void 0 === organisation) {
+      return { kind: "client-refusal", message: scopeMessage };
+    }
+    const settle2 = settleWith(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.listOrganisationRules({ input: {} }) : clients.admin.listRefRules({ selector: { projectId: project }, input: {} }));
+    return run2.ok ? rulesOutcome(outcomeOfEnvelope(
+      run2.answer,
+      settle2,
+      (rules) => rules.length === 0 ? "no rules" : rules.map(ruleText).join("\n")
+    )) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+var rulesRemove = {
+  words: ["rules", "remove"],
+  organisation: "required",
+  usage: "openeng rules remove (--project <id>|--organisation) --rule-id <id>",
+  help: [
+    "openeng rules remove (--project <id>|--organisation) --rule-id <id>",
+    "does:    removes one rule from the project or attached organisation by its identifier",
+    protectionCapabilityHelp("removeRefRule", "removeOrganisationRule"),
+    "example: openeng rules remove --organisation --rule-id rule-one",
+    "output:  the removed rule id; under --json { scope, value }, with { ruleId } in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project, organisation, ruleId } = options;
+    if (project !== void 0 === organisation) {
+      return { kind: "client-refusal", message: scopeMessage };
+    }
+    if (ruleId === void 0) {
+      return { kind: "client-refusal", message: "openeng rules remove needs --rule-id <id>" };
+    }
+    const settle2 = settleWith(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => project === void 0 ? clients.admin.removeOrganisationRule({ input: { ruleId } }) : clients.admin.removeRefRule({ selector: { projectId: project }, input: { ruleId } }));
+    return run2.ok ? rulesOutcome(outcomeOfEnvelope(run2.answer, settle2, (removed) => `removed rule ${removed.ruleId}`)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+
+// packages/cli/src/commands/org-refs.ts
+var settle = "repeat openeng org-refs list, which only reads";
+var refText = (ref) => `ref ${ref.name}  ${ref.readOnly ? "read-only" : "writable"}`;
+var refsOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
+var orgRefsCreate = {
+  words: ["org-refs", "create"],
+  organisation: "required",
+  usage: "openeng org-refs create --name <name> [--read-only]",
+  help: [
+    "openeng org-refs create --name <name> [--read-only]",
+    "does:    creates a ref in the attached organisation, optionally read-only",
+    protectionCapabilityHelp("createOrganisationRef"),
+    "example: openeng org-refs create --name release-v1 --read-only",
+    "output:  the ref name and write state; under --json { scope, value }, with the full OrganisationRef in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { name, readOnly } = options;
+    if (name === void 0) {
+      return { kind: "client-refusal", message: "openeng org-refs create needs --name <name>" };
+    }
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.createOrganisationRef({
+      input: { name, readOnly }
+    }));
+    return run2.ok ? refsOutcome(outcomeOfEnvelope(run2.answer, settle, refText)) : outcomeOfSessionFailure(run2.failure, settle);
+  }
+};
+var orgRefsList = {
+  words: ["org-refs", "list"],
+  organisation: "required",
+  usage: "openeng org-refs list",
+  help: [
+    "openeng org-refs list",
+    "does:    lists visible refs in the attached organisation",
+    protectionCapabilityHelp("listOrganisationRefs"),
+    "example: openeng org-refs list --json",
+    "output:  each ref's name and write state, or no refs; under --json { scope, value }, value is an array"
+  ],
+  run: async ({ host, deps }) => {
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.listOrganisationRefs({ input: {} }));
+    return run2.ok ? refsOutcome(outcomeOfEnvelope(
+      run2.answer,
+      settle,
+      (refs) => refs.length === 0 ? "no refs" : refs.map(refText).join("\n")
+    )) : outcomeOfSessionFailure(run2.failure, settle);
+  }
+};
+var orgRefsDelete = {
+  words: ["org-refs", "delete"],
+  organisation: "required",
+  usage: "openeng org-refs delete --name <name>",
+  help: [
+    "openeng org-refs delete --name <name>",
+    "does:    deletes a writable ref from the attached organisation",
+    protectionCapabilityHelp("deleteOrganisationRef"),
+    "example: openeng org-refs delete --name review",
+    "output:  the deleted ref name; under --json { scope, value }, with { name } in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { name } = options;
+    if (name === void 0) {
+      return { kind: "client-refusal", message: "openeng org-refs delete needs --name <name>" };
+    }
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.deleteOrganisationRef({
+      input: { name }
+    }));
+    return run2.ok ? refsOutcome(outcomeOfEnvelope(run2.answer, settle, (deleted) => `deleted ref ${deleted.name}`)) : outcomeOfSessionFailure(run2.failure, settle);
+  }
+};
+var orgRefsMarkReadOnly = {
+  words: ["org-refs", "mark-read-only"],
+  organisation: "required",
+  usage: "openeng org-refs mark-read-only --name <name>",
+  help: [
+    "openeng org-refs mark-read-only --name <name>",
+    "does:    marks a ref in the attached organisation read-only",
+    protectionCapabilityHelp("markOrganisationRefReadOnly"),
+    "example: openeng org-refs mark-read-only --name release-v1",
+    "output:  the ref name and write state; under --json { scope, value }, with the full OrganisationRef in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { name } = options;
+    if (name === void 0) {
+      return { kind: "client-refusal", message: "openeng org-refs mark-read-only needs --name <name>" };
+    }
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.markOrganisationRefReadOnly({
+      input: { name }
+    }));
+    return run2.ok ? refsOutcome(outcomeOfEnvelope(run2.answer, settle, refText)) : outcomeOfSessionFailure(run2.failure, settle);
+  }
+};
+
+// packages/cli/src/commands/locks.ts
+var LOCKS = ["none", "merge-only", "frozen"];
+var lockOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
+var locksSet = {
+  words: ["locks", "set"],
+  organisation: "required",
+  usage: "openeng locks set --project <id> --ref <ref> --object <objectId> --lock <none|merge-only|frozen>",
+  help: [
+    "openeng locks set --project <id> --ref <ref> --object <objectId> --lock <none|merge-only|frozen>",
+    "does:    sets or lifts an object's lock on the selected project ref",
+    protectionCapabilityHelp("setObjectLock"),
+    "example: openeng locks set --project project-one --ref main --object object-one --lock frozen",
+    "output:  the object identifier and lock; under --json { scope, value }, with { objectId, lock } in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project, ref, object } = options;
+    if (project === void 0 || ref === void 0 || object === void 0 || options.lock === void 0) {
+      return {
+        kind: "client-refusal",
+        message: "openeng locks set needs --project <id>, --ref <ref>, --object <objectId> and --lock <none|merge-only|frozen>"
+      };
+    }
+    const lock = LOCKS.find((value) => value === options.lock);
+    if (lock === void 0) {
+      return { kind: "client-refusal", message: "--lock must be none, merge-only or frozen" };
+    }
+    const selector = { projectId: project, ref };
+    const input = { objectId: object, lock };
+    const settle2 = `repeat openeng locks set --project ${project} --ref ${ref} --object ${object} --lock ${lock}, which sets the same lock again`;
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.objects.setObjectLock({ selector, input }));
+    return run2.ok ? lockOutcome(outcomeOfEnvelope(run2.answer, settle2, (value) => `object ${value.objectId}  lock ${value.lock}`)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+
+// packages/cli/src/commands/ceiling.ts
+var CEILINGS = ["contributor", "maintainer"];
+var settleWith2 = (project) => `repeat openeng ceiling show --project ${project}, which only reads`;
+var ceilingText = (value) => `ceiling ${value.ceiling}`;
+var ceilingOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
+var ceilingShow = {
+  words: ["ceiling", "show"],
+  organisation: "required",
+  usage: "openeng ceiling show --project <id>",
+  help: [
+    "openeng ceiling show --project <id>",
+    "does:    reads the maximum role an agent can hold in the project",
+    protectionCapabilityHelp("readAgentCeiling"),
+    "example: openeng ceiling show --project project-one --json",
+    "output:  the ceiling role; under --json { scope, value }, with { ceiling } in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project } = options;
+    if (project === void 0) {
+      return { kind: "client-refusal", message: "openeng ceiling show needs --project <id>" };
+    }
+    const settle2 = settleWith2(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.readAgentCeiling({
+      selector: { projectId: project },
+      input: {}
+    }));
+    return run2.ok ? ceilingOutcome(outcomeOfEnvelope(run2.answer, settle2, ceilingText)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+var ceilingSet = {
+  words: ["ceiling", "set"],
+  organisation: "required",
+  usage: "openeng ceiling set --project <id> --ceiling <contributor|maintainer>",
+  help: [
+    "openeng ceiling set --project <id> --ceiling <contributor|maintainer>",
+    "does:    sets the maximum role an agent can hold in the project",
+    protectionCapabilityHelp("setAgentCeiling"),
+    "example: openeng ceiling set --project project-one --ceiling contributor",
+    "output:  the ceiling role; under --json { scope, value }, with { ceiling } in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { project } = options;
+    if (project === void 0 || options.ceiling === void 0) {
+      return {
+        kind: "client-refusal",
+        message: "openeng ceiling set needs --project <id> and --ceiling <contributor|maintainer>"
+      };
+    }
+    const ceiling = CEILINGS.find((value) => value === options.ceiling);
+    if (ceiling === void 0) {
+      return { kind: "client-refusal", message: "--ceiling must be contributor or maintainer" };
+    }
+    const settle2 = settleWith2(project);
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.admin.setAgentCeiling({
+      selector: { projectId: project },
+      input: { ceiling }
+    }));
+    return run2.ok ? ceilingOutcome(outcomeOfEnvelope(run2.answer, settle2, ceilingText)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+
+// packages/cli/src/commands/schema-update.ts
+var settleWith3 = (ref) => `repeat openeng schema-update show --ref ${ref}, which only reads`;
+var requestText = (value) => `schema update ${value.ref}  ${value.state}`;
+var schemaOutcome = (outcome) => outcome.kind === "success" ? { ...outcome, value: { value: outcome.value } } : outcome;
+var schemaUpdateRequest = {
+  words: ["schema-update", "request"],
+  organisation: "required",
+  usage: "openeng schema-update request --ref <ref>",
+  help: [
+    "openeng schema-update request --ref <ref>",
+    "does:    records a schema update request for the ref; execution is separate",
+    protectionCapabilityHelp("requestSchemaUpdate"),
+    "example: openeng schema-update request --ref project-one/work",
+    "output:  the ref and request state; under --json { scope, value }, with the full SchemaUpdateRequest in value"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { ref } = options;
+    if (ref === void 0) {
+      return { kind: "client-refusal", message: "openeng schema-update request needs --ref <ref>" };
+    }
+    const settle2 = settleWith3(ref);
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.branches.requestSchemaUpdate({
+      input: { ref }
+    }));
+    return run2.ok ? schemaOutcome(outcomeOfEnvelope(run2.answer, settle2, requestText)) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+var schemaUpdateShow = {
+  words: ["schema-update", "show"],
+  organisation: "required",
+  usage: "openeng schema-update show --ref <ref>",
+  help: [
+    "openeng schema-update show --ref <ref>",
+    "does:    reads the latest visible schema update request for the ref",
+    protectionCapabilityHelp("readSchemaUpdateRequest"),
+    "example: openeng schema-update show --ref project-one/work --json",
+    "output:  the ref and state, or no request; under --json { scope, value }, value is SchemaUpdateRequest or null"
+  ],
+  run: async ({ host, deps, options }) => {
+    const { ref } = options;
+    if (ref === void 0) {
+      return { kind: "client-refusal", message: "openeng schema-update show needs --ref <ref>" };
+    }
+    const settle2 = settleWith3(ref);
+    const run2 = await runAuthenticated(host, deps, (clients) => clients.branches.readSchemaUpdateRequest({
+      input: { ref }
+    }));
+    return run2.ok ? schemaOutcome(outcomeOfEnvelope(
+      run2.answer,
+      settle2,
+      (value) => value === null ? "no request" : requestText(value)
+    )) : outcomeOfSessionFailure(run2.failure, settle2);
+  }
+};
+
 // packages/cli/src/commands/types.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { readFileSync as readFileSync5 } from "node:fs";
@@ -9766,9 +10395,9 @@ var typesList = {
       return flags.outcome;
     }
     const projectId = flags.values.project;
-    const settle = "repeat openeng types list, which only reads";
+    const settle2 = "repeat openeng types list, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.objects.readCatalogue({ selector: { projectId }, input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, catalogueText) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, catalogueText) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var typesDraftOpen = {
@@ -9782,9 +10411,9 @@ var typesDraftOpen = {
     "output:  one line with the change set id and revision; under --json an object with changeSetId and revision"
   ],
   run: async (context) => {
-    const settle = "openeng types draft current";
+    const settle2 = "openeng types draft current";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.openChangeSet({ input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (opened) => `opened change set ${opened.changeSetId} at revision ${opened.revision}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (opened) => `opened change set ${opened.changeSetId} at revision ${opened.revision}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var typesDraftCurrent = {
@@ -9798,9 +10427,9 @@ var typesDraftCurrent = {
     "output:  one line naming the change set and revision, or that none is open; under --json an object with changeSetId, revision and scope, or {scope, value: null} when none is open"
   ],
   run: async (context) => {
-    const settle = "repeat openeng types draft current, which only reads";
+    const settle2 = "repeat openeng types draft current, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.readCurrentChangeSet({ input: {} }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (current) => current === null ? "no change set is open" : `change set ${current.changeSetId} at revision ${current.revision}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (current) => current === null ? "no change set is open" : `change set ${current.changeSetId} at revision ${current.revision}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 function listingOf(catalogue) {
@@ -9869,7 +10498,7 @@ var typesDraftShow = {
     }
     const changeSetId = flags.values.changeSet;
     const projectId = context.options.project;
-    const settle = "repeat openeng types draft show, which only reads";
+    const settle2 = "repeat openeng types draft show, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, async (clients) => {
       const read2 = await clients.ontology.readChangeSet({ input: { changeSetId } });
       if ("refusal" in read2) {
@@ -9891,11 +10520,11 @@ var typesDraftShow = {
       return { read: read2.result, catalogue: catalogue2.result };
     });
     if (!run2.ok) {
-      return outcomeOfSessionFailure(run2.failure, settle);
+      return outcomeOfSessionFailure(run2.failure, settle2);
     }
     const answer = run2.answer;
     if ("refusal" in answer) {
-      return outcomeOfRouteRefusal(answer.refusal, settle, answer.correlationId);
+      return outcomeOfRouteRefusal(answer.refusal, settle2, answer.correlationId);
     }
     const { read, catalogue } = answer;
     if (catalogue === null) {
@@ -9944,14 +10573,14 @@ var typesExport = {
       return flags.outcome;
     }
     const projectId = flags.values.project;
-    const settle = "repeat openeng types export, which only reads";
+    const settle2 = "repeat openeng types export, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.objects.readCatalogue({ selector: { projectId }, input: {} }));
     if (!run2.ok) {
-      return outcomeOfSessionFailure(run2.failure, settle);
+      return outcomeOfSessionFailure(run2.failure, settle2);
     }
     const envelope = run2.answer;
     if ("refusal" in envelope) {
-      return outcomeOfRouteRefusal(envelope.refusal, settle, envelope.correlationId);
+      return outcomeOfRouteRefusal(envelope.refusal, settle2, envelope.correlationId);
     }
     if (envelope.replayed === true) {
       return { kind: "internal-failure", message: "the host answered a replay to a read that carried no idempotency key" };
@@ -9980,9 +10609,9 @@ var typesDraftState = {
       return flags.outcome;
     }
     const changeSetId = flags.values.changeSet;
-    const settle = "repeat openeng types draft state, which only reads";
+    const settle2 = "repeat openeng types draft state, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.readChangeSetState({ input: { changeSetId } }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (state) => `change set ${changeSetId} is ${state.state} at revision ${state.revision}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (state) => `change set ${changeSetId} is ${state.state} at revision ${state.revision}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 function changesOfFile(path) {
@@ -10056,13 +10685,13 @@ var typesDraftRevise = {
       return groups.outcome;
     }
     const { railGroups } = groups;
-    const settle = settleChangeSet(changeSetId);
+    const settle2 = settleChangeSet(changeSetId);
     const run2 = await runAuthenticated(
       context.host,
       context.deps,
       (clients) => clients.ontology.reviseChangeSet({ input: { changeSetId, expectedRevision, changes, ...railGroups === void 0 ? {} : { railGroups } } })
     );
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (revised) => `revised change set ${changeSetId} to revision ${revised.revision}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (revised) => `revised change set ${changeSetId} to revision ${revised.revision}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var typesDraftValidate = {
@@ -10081,13 +10710,13 @@ var typesDraftValidate = {
       return flags.outcome;
     }
     const { changeSet: changeSetId, revision } = flags.values;
-    const settle = "repeat openeng types draft validate, which only reads";
+    const settle2 = "repeat openeng types draft validate, which only reads";
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.validateChangeSet({ input: { changeSetId, revision } }));
     if (!run2.ok) {
-      return outcomeOfSessionFailure(run2.failure, settle);
+      return outcomeOfSessionFailure(run2.failure, settle2);
     }
     let violated = false;
-    const outcome = outcomeOfEnvelope(run2.answer, settle, (validated) => {
+    const outcome = outcomeOfEnvelope(run2.answer, settle2, (validated) => {
       violated = validated.violations.length > 0;
       return violated ? [`${String(validated.violations.length)} ${validated.violations.length === 1 ? "violation" : "violations"}`, ...validated.violations.map((violation) => `  ${JSON.stringify(violation)}`)].join("\n") : `change set ${changeSetId} at revision ${revision} has no violations`;
     });
@@ -10110,9 +10739,9 @@ var typesDraftDiscard = {
       return flags.outcome;
     }
     const changeSetId = flags.values.changeSet;
-    const settle = settleChangeSet(changeSetId);
+    const settle2 = settleChangeSet(changeSetId);
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.discardChangeSet({ input: { changeSetId } }));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, () => `discarded change set ${changeSetId}`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, () => `discarded change set ${changeSetId}`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 var typesDraftAccept = {
@@ -10131,10 +10760,10 @@ var typesDraftAccept = {
       return flags.outcome;
     }
     const { changeSet: changeSetId, revision } = flags.values;
-    const settle = settleChangeSet(changeSetId);
+    const settle2 = settleChangeSet(changeSetId);
     const key = randomUUID4();
     const run2 = await runAuthenticated(context.host, context.deps, (clients) => clients.ontology.acceptChangeSet({ input: { changeSetId, revision } }, key));
-    return run2.ok ? outcomeOfEnvelope(run2.answer, settle, (accepted) => `accepted change set ${changeSetId}: ${String(accepted.versionIds.length)} type versions published`) : outcomeOfSessionFailure(run2.failure, settle);
+    return run2.ok ? outcomeOfEnvelope(run2.answer, settle2, (accepted) => `accepted change set ${changeSetId}: ${String(accepted.versionIds.length)} type versions published`) : outcomeOfSessionFailure(run2.failure, settle2);
   }
 };
 
@@ -10200,6 +10829,18 @@ var PUBLIC_HAND_WRITTEN_COMMANDS = [
   orgCurrent,
   projectsList,
   projectsCreate,
+  rulesAdd,
+  rulesList,
+  rulesRemove,
+  orgRefsCreate,
+  orgRefsList,
+  orgRefsDelete,
+  orgRefsMarkReadOnly,
+  locksSet,
+  ceilingShow,
+  ceilingSet,
+  schemaUpdateRequest,
+  schemaUpdateShow,
   typesList,
   typesExport,
   typesDraftOpen,
@@ -10240,6 +10881,14 @@ var CLI_OPTIONS = {
   json: { type: "boolean" },
   "no-open": { type: "boolean" },
   project: { type: "string" },
+  organisation: { type: "boolean" },
+  "read-only": { type: "boolean" },
+  object: { type: "string" },
+  lock: { type: "string" },
+  ceiling: { type: "string" },
+  pattern: { type: "string" },
+  consequence: { type: "string" },
+  "rule-id": { type: "string" },
   ref: { type: "string" },
   name: { type: "string" },
   "change-set": { type: "string" },
@@ -10263,7 +10912,7 @@ var CLI_OPTIONS = {
 };
 
 // packages/cli/src/cli-version.ts
-var PATCH_VERSION = 3;
+var PATCH_VERSION = 4;
 var CLI_VERSION = `0.${PROTOCOL_VERSION}.${PATCH_VERSION}`;
 
 // packages/cli/src/environment.ts
@@ -10377,6 +11026,14 @@ function parseInvocation(argv) {
         json: values.json === true,
         open: values["no-open"] !== true,
         project: values.project,
+        organisation: values.organisation === true,
+        readOnly: values["read-only"] === true,
+        object: values.object,
+        lock: values.lock,
+        ceiling: values.ceiling,
+        pattern: values.pattern,
+        consequence: values.consequence,
+        ruleId: values["rule-id"],
         ref: values.ref,
         name: values.name,
         changeSet: values["change-set"],