@oxagen/cli 2.1.4-380 → 2.1.4-383

package/oxagen.mjs

@@ -11122,17 +11122,93 @@ var init_frame_body = __esm({
   }
 });
 
-// ../../packages/tacho/src/claude-code/hooks.ts
+// ../../packages/tacho/src/claude-code/payload-members.ts
 function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function scalar(value) {
+  if (typeof value === "string") {
+    const redacted = redactText(value);
+    return redacted.length > MEMBER_MAX ? cutAt(redacted, MEMBER_MAX) : redacted;
+  }
+  if (typeof value === "number")
+    return Number.isFinite(value) ? value : void 0;
+  if (typeof value === "boolean") return value;
+  return void 0;
+}
+function pick2(value, members2) {
+  const out = {};
+  for (const member2 of members2) {
+    const kept = scalar(value[member2]);
+    if (kept !== void 0) out[member2] = kept;
+  }
+  return out;
+}
+function pickEach(value, members2) {
+  if (!Array.isArray(value)) return void 0;
+  return value.map((entry2) => isRecord4(entry2) ? pick2(entry2, members2) : {});
+}
+function promptOriginOf(value) {
+  if (!isRecord4(value)) return void 0;
+  const kind = value["kind"];
+  if (typeof kind !== "string" || kind.length === 0) return void 0;
+  const origin = pick2(value, ORIGIN_MEMBERS);
+  const hops = value[ORIGIN_HOP_CHAIN];
+  if (Array.isArray(hops)) {
+    origin[ORIGIN_HOP_CHAIN] = hops.slice(0, HOP_CHAIN_MAX).map(scalar).filter((hop) => typeof hop === "string");
+  }
+  return origin;
+}
+function backgroundTasksOf(value) {
+  return pickEach(value, BACKGROUND_TASK_MEMBERS);
+}
+function sessionCronsOf(value) {
+  return pickEach(value, SESSION_CRON_MEMBERS);
+}
+var ORIGIN_MEMBERS, ORIGIN_HOP_CHAIN, BACKGROUND_TASK_MEMBERS, SESSION_CRON_MEMBERS, MEMBER_MAX, HOP_CHAIN_MAX;
+var init_payload_members = __esm({
+  "../../packages/tacho/src/claude-code/payload-members.ts"() {
+    "use strict";
+    init_redaction();
+    init_tools();
+    ORIGIN_MEMBERS = [
+      "kind",
+      "producer",
+      "from",
+      "name",
+      "msg_id",
+      "fromSession",
+      "fromMode",
+      "senderTaskId",
+      "verifiedPeerPid"
+    ];
+    ORIGIN_HOP_CHAIN = "hopChain";
+    BACKGROUND_TASK_MEMBERS = [
+      "id",
+      "type",
+      "status",
+      "agent_type",
+      "server",
+      "tool",
+      "name"
+    ];
+    SESSION_CRON_MEMBERS = ["id", "schedule", "recurring"];
+    MEMBER_MAX = 512;
+    HOP_CHAIN_MAX = 32;
+  }
+});
+
+// ../../packages/tacho/src/claude-code/hooks.ts
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function kindOf(value) {
   if (value === null) return "null";
   if (Array.isArray(value)) return "a list";
   return typeof value === "object" ? "an object" : `a ${typeof value}`;
 }
 function payloadRepairs(raw) {
-  if (!isRecord4(raw)) return void 0;
+  if (!isRecord5(raw)) return void 0;
   const notes = [];
   const setAside = (key, value) => `${key}: ${kindOf(value)}, left out: ${JSON.stringify(value)}`;
   for (const [key, type] of TYPED_MEMBERS) {
@@ -11146,7 +11222,7 @@ function payloadRepairs(raw) {
   }
   const input = raw["tool_input"];
   if (input === null) notes.push("tool_input: null, read as absent");
-  else if (input !== void 0 && !isRecord4(input))
+  else if (input !== void 0 && !isRecord5(input))
     notes.push(`tool_input: ${kindOf(input)}, kept as {"value": ...}`);
   const duration = raw["duration_ms"];
   if (duration !== void 0 && !(typeof duration === "number" && Number.isFinite(duration)))
@@ -11323,11 +11399,11 @@ function normalizeHook(raw, env, options) {
     case "UserPromptExpansion": {
       const prompt = str3(input["prompt"]) ?? str3(input["user_input"]);
       const promptSource = str3(input["prompt_source"]);
-      const promptOrigin = input["prompt_origin"];
+      const promptOrigin = promptOriginOf(input["prompt_origin"]);
       const body2 = {
         ...prompt !== void 0 ? { prompt_digest: digestText(prompt), prompt_length: prompt.length } : {},
         ...promptSource !== void 0 && promptSource.length <= 512 ? { prompt_source: promptSource } : {},
-        ...isRecord4(promptOrigin) ? { prompt_origin: promptOrigin } : {},
+        ...promptOrigin !== void 0 ? { prompt_origin: promptOrigin } : {},
         ...str3(input["command_name"]) !== void 0 ? { command_name: str3(input["command_name"]) } : {},
         ...str3(input["command_input"]) !== void 0 ? {
           command_input_digest: digestText(
@@ -11463,11 +11539,13 @@ function normalizeHook(raw, env, options) {
     case "Stop":
     case "SubagentStop": {
       const last = str3(input["last_assistant_message"]);
+      const backgroundTasks = backgroundTasksOf(input["background_tasks"]);
+      const sessionCrons = sessionCronsOf(input["session_crons"]);
       const common = {
         ...last !== void 0 ? { last_assistant_message_digest: digestText(last) } : {},
         ...bool2(input["stop_hook_active"]) !== void 0 ? { stop_hook_active: bool2(input["stop_hook_active"]) } : {},
-        ...input["background_tasks"] !== void 0 ? { background_tasks: input["background_tasks"] } : {},
-        ...input["session_crons"] !== void 0 ? { session_crons: input["session_crons"] } : {}
+        ...backgroundTasks !== void 0 ? { background_tasks: backgroundTasks } : {},
+        ...sessionCrons !== void 0 ? { session_crons: sessionCrons } : {}
       };
       if (input.hook_event_name === "Stop") {
         return [
@@ -11706,6 +11784,7 @@ var init_hooks = __esm({
     init_redaction();
     init_wire();
     init_context2();
+    init_payload_members();
     init_tools();
     textMember = external_exports.preprocess((value) => {
       if (typeof value === "number" || typeof value === "boolean")
@@ -11730,7 +11809,7 @@ var init_hooks = __esm({
       // A string or a list is kept whole under `value`, the way the Cursor and
       // Stella adapters already keep one.
       tool_input: external_exports.preprocess(
-        (value) => value === null || value === void 0 ? void 0 : isRecord4(value) ? value : { value },
+        (value) => value === null || value === void 0 ? void 0 : isRecord5(value) ? value : { value },
         external_exports.record(external_exports.unknown()).optional()
       ),
       tool_use_id: textMember,
@@ -15267,7 +15346,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname7, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-380";
+  if (true) return "2.1.4-383";
   try {
     const here = dirname7(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -15314,14 +15393,14 @@ function configPicker(env, home) {
   return (flag, envKey, configKey) => flag ?? env[envKey] ?? (typeof config[configKey] === "string" ? config[configKey] : void 0);
 }
 function resolveApiUrl(options, env, home) {
-  const pick2 = configPicker(env, home);
-  return (pick2(options.apiUrl, "OXAGEN_API_URL", "apiUrl") ?? "https://api.oxagen.sh").replace(/\/+$/, "");
+  const pick3 = configPicker(env, home);
+  return (pick3(options.apiUrl, "OXAGEN_API_URL", "apiUrl") ?? "https://api.oxagen.sh").replace(/\/+$/, "");
 }
 function resolveCredentials(options, env, home) {
-  const pick2 = configPicker(env, home);
-  const token = pick2(options.token, "OXAGEN_API_TOKEN", "token");
-  const org = pick2(options.org, "OXAGEN_ORG_ID", "orgSlug");
-  const workspace = pick2(
+  const pick3 = configPicker(env, home);
+  const token = pick3(options.token, "OXAGEN_API_TOKEN", "token");
+  const org = pick3(options.org, "OXAGEN_ORG_ID", "orgSlug");
+  const workspace = pick3(
     options.workspace,
     "OXAGEN_WORKSPACE_ID",
     "workspaceSlug"
@@ -23541,12 +23620,13 @@ function normalizeTranscriptLine(line, fallbackTs) {
       const content = message?.["content"];
       const drafts = [];
       if (typeof content === "string") {
+        const origin = promptOriginOf(record["origin"]);
         drafts.push({
           ...draft("oxagen:message", {
             prompt_digest: digestText(content),
             prompt_length: content.length,
             ...s3(record["promptSource"]) !== void 0 ? { prompt_source: s3(record["promptSource"]) } : {},
-            ...record["origin"] !== void 0 ? { prompt_origin: record["origin"] } : {},
+            ...origin !== void 0 ? { prompt_origin: origin } : {},
             ...b3(record["isMeta"]) !== void 0 ? { is_meta: b3(record["isMeta"]) } : {},
             ...b3(record["isSidechain"]) !== void 0 ? { is_sidechain: b3(record["isSidechain"]) } : {},
             ...s3(record["interruptedMessageId"]) !== void 0 ? { interrupted_message_id: s3(record["interruptedMessageId"]) } : {},
@@ -23753,6 +23833,7 @@ var init_transcript = __esm({
     init_frame_body();
     init_redaction();
     init_context2();
+    init_payload_members();
     init_tools();
     SESSION_TITLE_MAX = 512;
     INTERRUPT_MARKER = "[Request interrupted by user";
@@ -25428,8 +25509,8 @@ function optionalFacts(facts) {
     ...facts.baselineRoot !== void 0 ? { baselineRoot: facts.baselineRoot } : {},
     ...facts.baselines !== void 0 ? { baselines: { ...facts.baselines } } : {},
     ...typeof facts.gitFirstReadAt === "number" && Number.isFinite(facts.gitFirstReadAt) ? { gitFirstReadAt: facts.gitFirstReadAt } : {},
-    ...isRecord5(facts.preexistingPaths) ? { preexistingPaths: { ...facts.preexistingPaths } } : {},
-    ...isRecord5(facts.sessionCommits) ? { sessionCommits: { ...facts.sessionCommits } } : {},
+    ...isRecord6(facts.preexistingPaths) ? { preexistingPaths: { ...facts.preexistingPaths } } : {},
+    ...isRecord6(facts.sessionCommits) ? { sessionCommits: { ...facts.sessionCommits } } : {},
     ...facts.workDir !== void 0 ? { workDir: facts.workDir } : {},
     ...facts.closedIdle === true ? { closedIdle: true } : {}
   };
@@ -25468,7 +25549,7 @@ function isTombstone(value) {
 function earlierOf(seenAt, now) {
   return seenAt !== void 0 && Date.parse(seenAt) < Date.parse(now) ? seenAt : now;
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function rememberForRoot(map, root, value) {
@@ -37559,8 +37640,8 @@ function pickPypiFile(urls) {
     if (file?.yanked === true) return [];
     return [{ name, url, type: file?.packagetype }];
   });
-  const pick2 = files2.find((file) => file.type === "bdist_wheel" && UNIVERSAL_WHEEL.test(file.name)) ?? files2.find((file) => file.type === "sdist");
-  return pick2 === void 0 ? void 0 : { name: pick2.name, url: pick2.url };
+  const pick3 = files2.find((file) => file.type === "bdist_wheel" && UNIVERSAL_WHEEL.test(file.name)) ?? files2.find((file) => file.type === "sdist");
+  return pick3 === void 0 ? void 0 : { name: pick3.name, url: pick3.url };
 }
 function pypiFromUrl(args) {
   const at = args.indexOf("--from");
@@ -40347,12 +40428,75 @@ function createModelProxy(deps) {
       [TACHO_ENFORCEMENT_TIER_ATTR]: TACHO_GATEWAY_TIER,
       "oxagen.model_api": route.api,
       "oxagen.correlation": how,
-      [TACHO_CREDENTIAL_BASIS_ATTR]: credential.basis,
+      ...credential !== void 0 ? { [TACHO_CREDENTIAL_BASIS_ATTR]: credential.basis } : {},
       // The id names the token on the record; the token itself is never
       // written anywhere, and a refused token's id is read off it unverified.
-      ...credential.claims !== void 0 ? { [TACHO_RUN_TOKEN_ATTR]: credential.claims.tid } : {}
+      ...credential?.claims !== void 0 ? { [TACHO_RUN_TOKEN_ATTR]: credential.claims.tid } : {}
+    };
+  }
+  function attributeByHeaders(req, route) {
+    let found;
+    try {
+      found = correlate(req, route, () => void 0);
+    } catch {
+      found = { how: "unattributed" };
+    }
+    return {
+      recorder: found.record?.recorder ?? deps.hostRecorder(),
+      how: found.how,
+      attrs: attrsFor(route, found.how)
     };
   }
+  function sealNotForwarded(req, route, attempt, reason3, status2) {
+    if (attempt.done) return;
+    attempt.done = true;
+    if (route.api === "other") return;
+    let recorder;
+    let mark;
+    try {
+      const attribution2 = attempt.attribution ?? attributeByHeaders(req, route);
+      const chain = attribution2.recorder;
+      recorder = chain;
+      mark = chain.markChain();
+      const at = deps.now();
+      deps.record([
+        chain.sealCollectorEvent(
+          "error",
+          {
+            provider: route.provider,
+            ...attempt.model !== void 0 ? { model: attempt.model.slice(0, 512) } : {},
+            ...status2 !== void 0 ? { api_status_code: status2 } : {},
+            api_error_class: reason3,
+            api_duration_ms: Math.max(0, at - attempt.startedAt)
+          },
+          {
+            ts: toProtocolTimestamp(at),
+            fidelity: "proxy",
+            attrs: {
+              ...attribution2.attrs,
+              [NOT_FORWARDED_ATTR]: reason3,
+              "oxagen.provider": route.provider,
+              "oxagen.request_bytes_read": String(attempt.bytesRead),
+              ...attempt.request !== void 0 ? { "oxagen.request_digest": digestBytes(attempt.request) } : {}
+            }
+          }
+        )
+      ]);
+    } catch (error) {
+      if (recorder !== void 0 && mark !== void 0) {
+        try {
+          recorder.rollbackChain(mark);
+        } catch (rollbackError) {
+          deps.log(
+            `model proxy: rolling the chain back after a failed frame failed too: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`
+          );
+        }
+      }
+      deps.log(
+        `model proxy: sealing the frame of a call it did not forward (${reason3}) failed: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
   function sendProviderError(res, route, status2, code, message, retryable = false) {
     if (res.headersSent) {
       res.destroy();
@@ -40372,7 +40516,7 @@ function createModelProxy(deps) {
     });
     res.end(error.body);
   }
-  function readBody3(req) {
+  function readBody3(req, attempt) {
     return new Promise((resolve19, reject) => {
       const chunks = [];
       let size = 0;
@@ -40380,6 +40524,7 @@ function createModelProxy(deps) {
       req.on("data", (chunk2) => {
         if (over) return;
         size += chunk2.length;
+        attempt.bytesRead = size;
         if (size > maxRequestBytes) {
           over = true;
           chunks.length = 0;
@@ -40674,10 +40819,17 @@ function createModelProxy(deps) {
     }
     return usage3.cacheReadTokens ?? 0;
   }
-  async function forward(req, res, route, admitted) {
+  async function forward(req, res, route, admitted, attempt) {
     const startedAt = deps.now();
-    const received = await readBody3(req);
+    let received;
+    try {
+      received = await readBody3(req, attempt);
+    } catch (error) {
+      sealNotForwarded(req, route, attempt, "client_aborted");
+      throw error;
+    }
     if (received === "too_large") {
+      sealNotForwarded(req, route, attempt, "request_too_large", 413);
       sendProviderError(
         res,
         route,
@@ -40688,6 +40840,7 @@ function createModelProxy(deps) {
       return;
     }
     let body2 = received;
+    attempt.request = received;
     const encoding = header(req, "content-encoding");
     let decoded = null;
     const readable = () => {
@@ -40705,11 +40858,13 @@ function createModelProxy(deps) {
     const sessionKey = record?.recorder.sessionUuid ?? HOST_KEY;
     const credential = resolveCredential(req, route);
     const attrs2 = attrsFor(route, how, credential);
+    attempt.attribution = { recorder, how, attrs: attrs2 };
     const metered = route.api !== "other";
     const { model: askedModel, ambiguous: modelAmbiguous } = modelOf(
       readable,
       json2
     );
+    if (askedModel !== void 0) attempt.model = askedModel;
     const refusal = refusalFor(record, askedModel, modelAmbiguous, metered) ?? (credential.refusal !== void 0 ? {
       ...credential.refusal,
       source: "bundle",
@@ -40757,6 +40912,7 @@ function createModelProxy(deps) {
         recorder.rollbackChain(mark);
         throw error;
       }
+      attempt.done = true;
       deps.log(
         `model proxy: refused ${route.provider} ${route.api} (${refusal.code})`
       );
@@ -40902,6 +41058,7 @@ function createModelProxy(deps) {
     const settle3 = (errorClass) => {
       if (settled2) return;
       settled2 = true;
+      attempt.done = true;
       set.delete(entry2);
       if (set.size === 0) inFlight.delete(sessionKey);
       const mark = recorder.markChain();
@@ -41246,6 +41403,7 @@ function createModelProxy(deps) {
       return;
     }
     upstreamReq = openUpstream(false);
+    attempt.done = true;
   }
   return {
     handle: (req, res) => {
@@ -41309,13 +41467,19 @@ function createModelProxy(deps) {
           return;
         }
         const admitted = {};
+        const attempt = {
+          startedAt: deps.now(),
+          bytesRead: 0,
+          done: false
+        };
         try {
-          await forward(req, res, route, admitted);
+          await forward(req, res, route, admitted, attempt);
         } catch (error) {
           admitted.release?.();
           deps.log(
             `model proxy: ${req.method ?? "?"} ${route.provider} ${route.api} failed: ${error instanceof Error ? error.message : String(error)}`
           );
+          sealNotForwarded(req, route, attempt, "gateway_error", 502);
           sendProviderError(
             res,
             route,
@@ -41355,7 +41519,7 @@ function createModelProxy(deps) {
     }
   };
 }
-var DEFAULT_MAX_REQUEST_BYTES, DEFAULT_UPSTREAM_IDLE_MS, DEFAULT_BEFORE_FORWARD_TIMEOUT_MS, DEFAULT_UPSTREAM_CONNECT_MS, FREE_SOCKET_TIMEOUT_MS, KEEP_ALIVE_TIMEOUT_MS, KEEP_ALIVE_MAX_RESPONSE_BYTES, BodyCapture, REQUEST_EFFORT_MAX, CREDENTIAL_MESSAGES;
+var DEFAULT_MAX_REQUEST_BYTES, NOT_FORWARDED_ATTR, DEFAULT_UPSTREAM_IDLE_MS, DEFAULT_BEFORE_FORWARD_TIMEOUT_MS, DEFAULT_UPSTREAM_CONNECT_MS, FREE_SOCKET_TIMEOUT_MS, KEEP_ALIVE_TIMEOUT_MS, KEEP_ALIVE_MAX_RESPONSE_BYTES, BodyCapture, REQUEST_EFFORT_MAX, CREDENTIAL_MESSAGES;
 var init_model_proxy = __esm({
   "../../packages/tacho/src/collector/model-proxy.ts"() {
     "use strict";
@@ -41379,6 +41543,7 @@ var init_model_proxy = __esm({
     init_model_usage();
     init_registry();
     DEFAULT_MAX_REQUEST_BYTES = 64 * 1024 * 1024;
+    NOT_FORWARDED_ATTR = "oxagen.not_forwarded";
     DEFAULT_UPSTREAM_IDLE_MS = 10 * 6e4;
     DEFAULT_BEFORE_FORWARD_TIMEOUT_MS = 250;
     DEFAULT_UPSTREAM_CONNECT_MS = 3e4;
@@ -48070,7 +48235,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-380",
+      version: "2.1.4-383",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -51369,23 +51534,23 @@ function hookConfigPath(projectRoot, harness, env = process.env, home = homedir1
 function stellaJsonPath(env, home) {
   return join38(env["STELLA_HOME"] ?? join38(home, ".stella"), "settings.json");
 }
-function isRecord6(v) {
+function isRecord7(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
 function readConfig2(text4) {
   try {
     const parsed = JSON.parse(text4);
-    if (!isRecord6(parsed)) return null;
+    if (!isRecord7(parsed)) return null;
     if (parsed["hooks"] === void 0) return parsed;
     const hooks = parsed["hooks"];
-    if (!isRecord6(hooks)) return null;
+    if (!isRecord7(hooks)) return null;
     for (const groups of Object.values(hooks)) {
       if (!Array.isArray(groups)) return null;
       for (const group of groups) {
-        if (!isRecord6(group)) return null;
+        if (!isRecord7(group)) return null;
         if (group["hooks"] === void 0) continue;
         if (!Array.isArray(group["hooks"])) return null;
-        if (!group["hooks"].every(isRecord6)) return null;
+        if (!group["hooks"].every(isRecord7)) return null;
       }
     }
     return parsed;
@@ -51517,12 +51682,12 @@ async function groupHookInstalled(path2, io) {
 function readCursorConfig(text4) {
   try {
     const parsed = JSON.parse(text4);
-    if (!isRecord6(parsed)) return null;
+    if (!isRecord7(parsed)) return null;
     if (parsed["hooks"] === void 0) return parsed;
     const hooks = parsed["hooks"];
-    if (!isRecord6(hooks)) return null;
+    if (!isRecord7(hooks)) return null;
     for (const entries2 of Object.values(hooks)) {
-      if (!Array.isArray(entries2) || !entries2.every(isRecord6)) return null;
+      if (!Array.isArray(entries2) || !entries2.every(isRecord7)) return null;
     }
     return parsed;
   } catch {
@@ -59387,13 +59552,13 @@ var require_resolve_block_scalar = __commonJS({
   "../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/dist/compose/resolve-block-scalar.js"(exports) {
     "use strict";
     var Scalar = require_Scalar();
-    function resolveBlockScalar(ctx, scalar, onError) {
-      const start = scalar.offset;
-      const header2 = parseBlockScalarHeader(scalar, ctx.options.strict, onError);
+    function resolveBlockScalar(ctx, scalar2, onError) {
+      const start = scalar2.offset;
+      const header2 = parseBlockScalarHeader(scalar2, ctx.options.strict, onError);
       if (!header2)
         return { value: "", type: null, comment: "", range: [start, start, start] };
       const type = header2.mode === ">" ? Scalar.Scalar.BLOCK_FOLDED : Scalar.Scalar.BLOCK_LITERAL;
-      const lines = scalar.source ? splitLines2(scalar.source) : [];
+      const lines = scalar2.source ? splitLines2(scalar2.source) : [];
       let chompStart = lines.length;
       for (let i2 = lines.length - 1; i2 >= 0; --i2) {
         const content = lines[i2][1];
@@ -59405,12 +59570,12 @@ var require_resolve_block_scalar = __commonJS({
       if (chompStart === 0) {
         const value2 = header2.chomp === "+" && lines.length > 0 ? "\n".repeat(Math.max(1, lines.length - 1)) : "";
         let end2 = start + header2.length;
-        if (scalar.source)
-          end2 += scalar.source.length;
+        if (scalar2.source)
+          end2 += scalar2.source.length;
         return { value: value2, type, comment: header2.comment, range: [start, end2, end2] };
       }
-      let trimIndent = scalar.indent + header2.indent;
-      let offset = scalar.offset + header2.length;
+      let trimIndent = scalar2.indent + header2.indent;
+      let offset = scalar2.offset + header2.length;
       let contentStart = 0;
       for (let i2 = 0; i2 < chompStart; ++i2) {
         const [indent, content] = lines[i2];
@@ -59488,7 +59653,7 @@ var require_resolve_block_scalar = __commonJS({
         default:
           value += "\n";
       }
-      const end = start + header2.length + scalar.source.length;
+      const end = start + header2.length + scalar2.source.length;
       return { value, type, comment: header2.comment, range: [start, end, end] };
     }
     function parseBlockScalarHeader({ offset, props }, strict, onError) {
@@ -59571,8 +59736,8 @@ var require_resolve_flow_scalar = __commonJS({
     "use strict";
     var Scalar = require_Scalar();
     var resolveEnd = require_resolve_end();
-    function resolveFlowScalar(scalar, strict, onError) {
-      const { offset, type, source, end } = scalar;
+    function resolveFlowScalar(scalar2, strict, onError) {
+      const { offset, type, source, end } = scalar2;
       let _type;
       let value;
       const _onError = (rel, code, msg) => onError(offset + rel, code, msg);
@@ -59591,7 +59756,7 @@ var require_resolve_flow_scalar = __commonJS({
           break;
         /* istanbul ignore next should not happen */
         default:
-          onError(scalar, "UNEXPECTED_TOKEN", `Expected a flow scalar value, but found: ${type}`);
+          onError(scalar2, "UNEXPECTED_TOKEN", `Expected a flow scalar value, but found: ${type}`);
           return {
             value: "",
             type: null,
@@ -59806,26 +59971,26 @@ var require_compose_scalar = __commonJS({
         tag = findScalarTagByTest(ctx, value, token, onError);
       else
         tag = ctx.schema[identity.SCALAR];
-      let scalar;
+      let scalar2;
       try {
         const res = tag.resolve(value, (msg) => onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg), ctx.options);
-        scalar = identity.isScalar(res) ? res : new Scalar.Scalar(res);
+        scalar2 = identity.isScalar(res) ? res : new Scalar.Scalar(res);
       } catch (error) {
         const msg = error instanceof Error ? error.message : String(error);
         onError(tagToken ?? token, "TAG_RESOLVE_FAILED", msg);
-        scalar = new Scalar.Scalar(value);
+        scalar2 = new Scalar.Scalar(value);
       }
-      scalar.range = range;
-      scalar.source = value;
+      scalar2.range = range;
+      scalar2.source = value;
       if (type)
-        scalar.type = type;
+        scalar2.type = type;
       if (tagName)
-        scalar.tag = tagName;
+        scalar2.tag = tagName;
       if (tag.format)
-        scalar.format = tag.format;
+        scalar2.format = tag.format;
       if (comment)
-        scalar.comment = comment;
-      return scalar;
+        scalar2.comment = comment;
+      return scalar2;
     }
     function findScalarTagByName(schema, value, tagName, tagToken, onError) {
       if (tagName === "!")
@@ -61653,37 +61818,37 @@ var require_parser = __commonJS({
           };
         }
       }
-      *scalar(scalar) {
+      *scalar(scalar2) {
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
           let sep8;
-          if (scalar.end) {
-            sep8 = scalar.end;
+          if (scalar2.end) {
+            sep8 = scalar2.end;
             sep8.push(this.sourceToken);
-            delete scalar.end;
+            delete scalar2.end;
           } else
             sep8 = [this.sourceToken];
           const map = {
             type: "block-map",
-            offset: scalar.offset,
-            indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep8 }]
+            offset: scalar2.offset,
+            indent: scalar2.indent,
+            items: [{ start, key: scalar2, sep: sep8 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map;
         } else
-          yield* this.lineEnd(scalar);
+          yield* this.lineEnd(scalar2);
       }
-      *blockScalar(scalar) {
+      *blockScalar(scalar2) {
         switch (this.type) {
           case "space":
           case "comment":
           case "newline":
-            scalar.props.push(this.sourceToken);
+            scalar2.props.push(this.sourceToken);
             return;
           case "scalar":
-            scalar.source = this.source;
+            scalar2.source = this.source;
             this.atNewLine = true;
             this.indent = 0;
             if (this.onNewLine) {
@@ -66174,6 +66339,60 @@ var init_settings_baseline = __esm({
   }
 });
 
+// ../../packages/oxagen/src/steering-repo/steering-tools.ts
+var STEERING_SEARCH_DEFAULT_LIMIT, STEERING_SEARCH_MAX_LIMIT, steeringSearchInputSchema, steeringSearchHitSchema, steeringSearchOutputSchema, steeringReadInputSchema, steeringReadOutputSchema;
+var init_steering_tools = __esm({
+  "../../packages/oxagen/src/steering-repo/steering-tools.ts"() {
+    "use strict";
+    init_zod();
+    init_common();
+    init_record_kind();
+    STEERING_SEARCH_DEFAULT_LIMIT = 10;
+    STEERING_SEARCH_MAX_LIMIT = 50;
+    steeringSearchInputSchema = external_exports.object({
+      query: external_exports.string().max(500).optional().describe("Words to look for in each record's label, description, and lineage."),
+      kind: recordKindSchema.optional().describe("Only records of this kind, such as skill."),
+      repository: repoRefSchema.optional().describe("Only records that reach a run on this code repository, such as github.com/a-intel/platform."),
+      limit: external_exports.number().int().min(1).max(STEERING_SEARCH_MAX_LIMIT).optional().describe(`How many to return. ${STEERING_SEARCH_DEFAULT_LIMIT} when unset.`)
+    }).strict();
+    steeringSearchHitSchema = external_exports.object({
+      lineage: external_exports.string(),
+      label: external_exports.string(),
+      description: external_exports.string().optional(),
+      kind: external_exports.string(),
+      force: external_exports.string(),
+      /**
+       * True for a record the always-on block of a run on the repository holds:
+       * the version's block for that repository, else its block for every other
+       * repository. With no repository, that second block.
+       */
+      always_on: external_exports.boolean(),
+      source: external_exports.enum(["workspace", "organization"]),
+      line: external_exports.string().describe("The record's index line.")
+    }).strict();
+    steeringSearchOutputSchema = external_exports.object({
+      workspace_version: external_exports.number().int().nullable(),
+      organization_version: external_exports.number().int().nullable(),
+      hits: external_exports.array(steeringSearchHitSchema),
+      /** How many matched before the limit. */
+      total: external_exports.number().int().min(0)
+    }).strict();
+    steeringReadInputSchema = external_exports.object({
+      lineage: lineageSchema.describe("The record or skill to read, such as a-intel.domain.refund."),
+      file: external_exports.string().min(1).max(512).optional().describe("A file in the skill's folder, such as words.md. Unset, the record itself.")
+    }).strict();
+    steeringReadOutputSchema = external_exports.object({
+      lineage: external_exports.string(),
+      label: external_exports.string(),
+      kind: external_exports.string(),
+      source: external_exports.enum(["workspace", "organization"]),
+      version: external_exports.number().int().min(1),
+      path: external_exports.string(),
+      text: external_exports.string()
+    }).strict();
+  }
+});
+
 // ../../packages/oxagen/src/steering-repo/templates.ts
 function managedBlockHash(content) {
   return sha256Digest(new TextEncoder().encode(content)).slice(7, 23);
@@ -66271,6 +66490,7 @@ var init_steering_repo = __esm({
     init_schema_ids();
     init_schemas();
     init_settings_baseline();
+    init_steering_tools();
     init_templates();
     init_tokens();
     init_toolbelt();
@@ -66279,7 +66499,7 @@ var init_steering_repo = __esm({
 });
 
 // ../../packages/steering-check/src/repo.ts
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isString(value) {
@@ -66404,14 +66624,14 @@ function parseTomlLoose(text4) {
   if (text4 === void 0) return null;
   try {
     const value = parse(text4);
-    return isRecord7(value) ? value : null;
+    return isRecord8(value) ? value : null;
   } catch {
     return null;
   }
 }
 function canonicalJson(value) {
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  if (isRecord7(value)) {
+  if (isRecord8(value)) {
     const keys = Object.keys(value).sort();
     return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
   }
@@ -66421,7 +66641,7 @@ function parseJsonLoose(text4) {
   if (text4 === void 0) return null;
   try {
     const value = JSON.parse(text4);
-    return isRecord7(value) ? value : null;
+    return isRecord8(value) ? value : null;
   } catch {
     return null;
   }
@@ -66435,9 +66655,9 @@ function workspaceRepositories(tree) {
 }
 function entries(value) {
   const found = /* @__PURE__ */ new Map();
-  if (!isRecord7(value)) return found;
+  if (!isRecord8(value)) return found;
   for (const [key, entry2] of Object.entries(value)) {
-    if (isRecord7(entry2)) found.set(key, entry2);
+    if (isRecord8(entry2)) found.set(key, entry2);
   }
   return found;
 }
@@ -66601,14 +66821,14 @@ function isPositiveInteger(value) {
 }
 function alwaysOnBudget(tree) {
   const steering = parseTomlLoose(tree?.get(GOVERNANCE_TOML_PATH))?.steering;
-  const value = isRecord7(steering) ? steering.always_on_tokens : void 0;
+  const value = isRecord8(steering) ? steering.always_on_tokens : void 0;
   if (value === "off") return "off";
   if (isPositiveInteger(value)) return { tokens: value, source: "governance.toml" };
   return { tokens: DEFAULT_ALWAYS_ON_TOKENS, source: "Oxagen's default" };
 }
 function definitionBudget(tree) {
   const tools = parseTomlLoose(tree?.get(WORKSPACE_TOML_PATH))?.tools;
-  const value = isRecord7(tools) ? tools.definition_budget : void 0;
+  const value = isRecord8(tools) ? tools.definition_budget : void 0;
   return isPositiveInteger(value) ? { tokens: value, source: "workspace.toml" } : { tokens: DEFAULT_WORKSPACE_DEFINITION_BUDGET, source: "Oxagen's default" };
 }
 function repositoryName(repository) {
@@ -66698,12 +66918,12 @@ function directDefinitions(tree) {
   const servers = [];
   for (const [name, folder] of serverFolders(tree)) {
     const exposure = folder.server?.exposure;
-    if (!isRecord7(exposure) || exposure.mode !== "direct") continue;
+    if (!isRecord8(exposure) || exposure.mode !== "direct") continue;
     let tokens = 0;
     let tools = 0;
     for (const [key, entry2] of folder.tools) {
       const upstream = folder.locked.get(key)?.upstream;
-      if (!isRecord7(upstream)) continue;
+      if (!isRecord8(upstream)) continue;
       const description = isString(entry2.description) ? entry2.description : upstream.description;
       const definition = {
         name: `${name}__${key}`,
@@ -67353,7 +67573,7 @@ function credentialFields(value, prefix = "") {
       (item, n4) => credentialFields(item, prefix === "" ? String(n4) : `${prefix}.${n4}`)
     );
   }
-  if (!isRecord7(value)) return [];
+  if (!isRecord8(value)) return [];
   return Object.entries(value).flatMap(
     ([key, item]) => credentialFields(item, prefix === "" ? key : `${prefix}.${key}`)
   );
@@ -67388,7 +67608,7 @@ function groupFindings(tree, context) {
   const reviewers = parsed.reviewers;
   const findings = [];
   reviewers.forEach((entry2, n4) => {
-    if (!isRecord7(entry2) || !isString(entry2.group) || context.groups.includes(entry2.group)) return;
+    if (!isRecord8(entry2) || !isString(entry2.group) || context.groups.includes(entry2.group)) return;
     const field = `reviewers.${n4}.group`;
     findings.push(
       find8({
@@ -74072,7 +74292,7 @@ var init_registry_launch = __esm({
 function messageOf2(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isList(value) {
@@ -74083,7 +74303,7 @@ function jsonEqual(a, b5) {
   if (Array.isArray(a)) {
     return Array.isArray(b5) && a.length === b5.length && a.every((item, index) => jsonEqual(item, b5[index]));
   }
-  if (isRecord8(a) && isRecord8(b5)) {
+  if (isRecord9(a) && isRecord9(b5)) {
     const keys = Object.keys(a);
     return keys.length === Object.keys(b5).length && keys.every((key) => Object.hasOwn(b5, key) && jsonEqual(a[key], b5[key]));
   }
@@ -74092,16 +74312,16 @@ function jsonEqual(a, b5) {
 function valueAt2(value, path2) {
   let current = value;
   for (const step of path2.split(".")) {
-    if (step.endsWith("[]") || !isRecord8(current) || !Object.hasOwn(current, step)) return void 0;
+    if (step.endsWith("[]") || !isRecord9(current) || !Object.hasOwn(current, step)) return void 0;
     current = current[step];
   }
   return current;
 }
 function withValueAt(value, path2, replacement) {
   const [step, ...rest] = path2.split(".");
-  if (step === void 0 || !isRecord8(value)) return value;
+  if (step === void 0 || !isRecord9(value)) return value;
   const inner = Object.hasOwn(value, step) ? value[step] : void 0;
-  if (rest.length > 0 && !isRecord8(inner)) return value;
+  if (rest.length > 0 && !isRecord9(inner)) return value;
   const next = rest.length === 0 ? replacement : withValueAt(inner, rest.join("."), replacement);
   return { ...value, [step]: next };
 }
@@ -74776,11 +74996,11 @@ var init_openapi = __esm({
 });
 
 // ../../packages/mcp-studio/src/compile/json-schema.ts
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function propertiesOf(schema) {
-  return isRecord10(schema.properties) ? schema.properties : {};
+  return isRecord11(schema.properties) ? schema.properties : {};
 }
 function requiredOf(schema) {
   if (!Array.isArray(schema.required)) return [];
@@ -76146,8 +76366,8 @@ function checkSingular(field, value) {
   }
   return isReflectMessage(value, field.message);
 }
-function checkScalarValue(value, scalar) {
-  switch (scalar) {
+function checkScalarValue(value, scalar2) {
+  switch (scalar2) {
     case ScalarType.DOUBLE:
       return typeof value == "number";
     case ScalarType.FLOAT:
@@ -76284,8 +76504,8 @@ function formatReflectMap(field) {
       return `ReflectMap (${ScalarType[field.mapKey]}, ${ScalarType[field.scalar]})`;
   }
 }
-function scalarTypeDescription(scalar) {
-  switch (scalar) {
+function scalarTypeDescription(scalar2) {
+  switch (scalar2) {
     case ScalarType.STRING:
       return "string";
     case ScalarType.BOOL:
@@ -86706,7 +86926,7 @@ function shapeInput(key, entry2, upstream, supplied, issues) {
   for (const [name, value] of defaults) {
     if (!usable("defaults", name)) continue;
     const property = shaped[name];
-    shaped[name] = { ...isRecord10(property) ? property : {}, default: value };
+    shaped[name] = { ...isRecord11(property) ? property : {}, default: value };
     required = required.filter((other) => other !== name);
   }
   const renamed = /* @__PURE__ */ new Map();
@@ -86752,7 +86972,7 @@ function selectTree(paths) {
   return root;
 }
 function trimObject(schema, children) {
-  if (!isRecord10(schema.properties)) return schema;
+  if (!isRecord11(schema.properties)) return schema;
   const properties = schema.properties;
   const kept = {};
   for (const [name, node2] of children) {
@@ -86766,9 +86986,9 @@ function trimObject(schema, children) {
   return out;
 }
 function trimNode(schema, node2) {
-  if (node2.whole || !isRecord10(schema)) return schema;
+  if (node2.whole || !isRecord11(schema)) return schema;
   if (!node2.array) return trimObject(schema, node2.children);
-  return isRecord10(schema.items) ? { ...schema, items: trimObject(schema.items, node2.children) } : schema;
+  return isRecord11(schema.items) ? { ...schema, items: trimObject(schema.items, node2.children) } : schema;
 }
 function selectOutput(outputSchema, select) {
   if (select.length === 0) return outputSchema;
@@ -87440,12 +87660,12 @@ function walkSchemas(root, at, visit2) {
       node2.forEach((item, index) => walk(item, `${path2}[${index}]`, depth + 1));
       return;
     }
-    if (!isRecord10(node2) || above.has(node2)) return;
+    if (!isRecord11(node2) || above.has(node2)) return;
     visit2(node2, path2);
     above.add(node2);
     for (const [key, value] of Object.entries(node2)) {
       if (DATA.has(key)) continue;
-      if (SCHEMA_MAPS.has(key) && isRecord10(value)) {
+      if (SCHEMA_MAPS.has(key) && isRecord11(value)) {
         for (const [name, child] of Object.entries(value)) walk(child, `${path2}.${key}.${name}`, depth + 1);
       } else {
         walk(value, `${path2}.${key}`, depth + 1);
@@ -87456,14 +87676,14 @@ function walkSchemas(root, at, visit2) {
   walk(root, at, 0);
 }
 function tagOf(schema) {
-  if (!isRecord10(schema)) return void 0;
+  if (!isRecord11(schema)) return void 0;
   if (Object.hasOwn(schema, "const")) return JSON.stringify(schema.const);
   if (Array.isArray(schema.enum) && schema.enum.length === 1) return JSON.stringify(schema.enum[0]);
   return void 0;
 }
 function distinguishable(branches) {
   if (branches.length < 2) return true;
-  const records = branches.filter(isRecord10);
+  const records = branches.filter(isRecord11);
   const [first] = records;
   if (first === void 0 || records.length < branches.length) return false;
   const types = records.map((branch) => branch.type);
@@ -87554,7 +87774,7 @@ function shapedInput(entry2, upstream) {
   for (const [name, value] of defaults) {
     if (!Object.hasOwn(shaped, name)) continue;
     const property = shaped[name];
-    shaped[name] = { ...isRecord10(property) ? property : {}, default: value };
+    shaped[name] = { ...isRecord11(property) ? property : {}, default: value };
     required = required.filter((other) => other !== name);
   }
   const renamed = new Map(rename3.filter(([from]) => Object.hasOwn(shaped, from)));
@@ -87584,7 +87804,7 @@ function selectTree2(paths) {
   return root;
 }
 function trimObject2(schema, children) {
-  if (!isRecord10(schema.properties)) return schema;
+  if (!isRecord11(schema.properties)) return schema;
   const properties = schema.properties;
   const kept = {};
   for (const [name, node2] of children) {
@@ -87598,9 +87818,9 @@ function trimObject2(schema, children) {
   return out;
 }
 function trimNode2(schema, node2) {
-  if (node2.whole || !isRecord10(schema)) return schema;
+  if (node2.whole || !isRecord11(schema)) return schema;
   if (!node2.array) return trimObject2(schema, node2.children);
-  return isRecord10(schema.items) ? { ...schema, items: trimObject2(schema.items, node2.children) } : schema;
+  return isRecord11(schema.items) ? { ...schema, items: trimObject2(schema.items, node2.children) } : schema;
 }
 function servedOutput(outputSchema, select) {
   if (select.length === 0) return outputSchema;
@@ -87650,7 +87870,7 @@ function quoted(values) {
   return orList2(values.map((value) => JSON.stringify(value)));
 }
 function isArraySchema(schema) {
-  if (!isRecord10(schema)) return false;
+  if (!isRecord11(schema)) return false;
   return schema.type === "array" || Array.isArray(schema.type) && schema.type.includes("array");
 }
 function lintTools(folder, context, report) {
@@ -87827,7 +88047,7 @@ function lintUpstream(folder, context, key, entry2, upstream, report) {
     });
   }
   const oneOf2 = (node2, at) => {
-    if (!Array.isArray(node2.oneOf) || isRecord10(node2.discriminator) || distinguishable(node2.oneOf)) return;
+    if (!Array.isArray(node2.oneOf) || isRecord11(node2.discriminator) || distinguishable(node2.oneOf)) return;
     report("undiscriminated_one_of", {
       tool: key,
       field: `${at}.oneOf`,
@@ -88437,7 +88657,7 @@ function upstreamError(response, bytes) {
   let problem;
   if (text4 !== "" && isJsonMediaType(headerValue(response.headers, "content-type"))) {
     const parsed = parseJson3(text4);
-    if (parsed.ok && isRecord8(parsed.value)) problem = parsed.value;
+    if (parsed.ok && isRecord9(parsed.value)) problem = parsed.value;
   }
   const title = problem === void 0 ? void 0 : firstText(problem, ["title"]);
   const detail = problem === void 0 ? text4.trim() === "" ? void 0 : text4 : firstText(problem, ["detail", "message", "error_description", "error"]);
@@ -88621,11 +88841,11 @@ var init_apply_credential = __esm({
 
 // ../../packages/mcp-studio/src/execute/mcp.ts
 function toolResult(value) {
-  if (!isRecord8(value)) return { ok: false, detail: "The tools/call result is not an object." };
+  if (!isRecord9(value)) return { ok: false, detail: "The tools/call result is not an object." };
   if (!isList(value.content)) return { ok: false, detail: "The tools/call result has no content list." };
   const content = [];
   for (const [index, item] of value.content.entries()) {
-    if (!isRecord8(item) || typeof item.type !== "string") {
+    if (!isRecord9(item) || typeof item.type !== "string") {
       return { ok: false, detail: `Content item ${index} is not an object with a string type.` };
     }
     content.push({ ...item, type: item.type });
@@ -88633,7 +88853,7 @@ function toolResult(value) {
   const result2 = { content };
   const structured = value.structuredContent;
   if (structured !== void 0 && structured !== null) {
-    if (!isRecord8(structured)) return { ok: false, detail: "The tools/call result's structuredContent is not an object." };
+    if (!isRecord9(structured)) return { ok: false, detail: "The tools/call result's structuredContent is not an object." };
     result2.structuredContent = structured;
   }
   const isError = value.isError;
@@ -88752,7 +88972,7 @@ function rejectedAttempt(response, failure2) {
 function findResponse(value, id) {
   const messages = isList(value) ? value : [value];
   for (const message of messages) {
-    if (isRecord8(message) && message.id === id && !Object.hasOwn(message, "method")) return message;
+    if (isRecord9(message) && message.id === id && !Object.hasOwn(message, "method")) return message;
   }
   return void 0;
 }
@@ -88802,8 +89022,8 @@ async function readReply(session, response, id, what) {
   return { ok: true, value: message };
 }
 function rpcError2(error) {
-  const message = isRecord8(error) && typeof error.message === "string" ? error.message : JSON.stringify(error);
-  const code = isRecord8(error) && typeof error.code === "number" ? ` (code ${error.code})` : "";
+  const message = isRecord9(error) && typeof error.message === "string" ? error.message : JSON.stringify(error);
+  const code = isRecord9(error) && typeof error.code === "number" ? ` (code ${error.code})` : "";
   return { title: "MCP error", detail: cutDetail(`${message}${code}`), status: void 0 };
 }
 async function initialize(session) {
@@ -88830,7 +89050,7 @@ async function initialize(session) {
   if (!reply2.ok) return reply2;
   if (Object.hasOwn(reply2.value, "error")) return { ok: false, error: rpcError2(reply2.value.error) };
   const result2 = reply2.value.result;
-  if (!isRecord8(result2)) return invalidResponse("The MCP server's initialize result is not an object.", response.status);
+  if (!isRecord9(result2)) return invalidResponse("The MCP server's initialize result is not an object.", response.status);
   const version2 = result2.protocolVersion;
   session.protocol = typeof version2 === "string" && PROTOCOL_VERSION2.test(version2) ? version2 : MCP_PROTOCOL_VERSION2;
   return { ok: true, value: void 0 };
@@ -89032,8 +89252,8 @@ function firstPosition(paging, args, options) {
   if (paging.style === "offset") return 0;
   const properties = options.inputSchema.properties;
   const name = options.agentName(paging.input);
-  const property = isRecord8(properties) && Object.hasOwn(properties, name) ? properties[name] : void 0;
-  if (isRecord8(property)) {
+  const property = isRecord9(properties) && Object.hasOwn(properties, name) ? properties[name] : void 0;
+  if (isRecord9(property)) {
     const fallback = wholeNumber(property.default) ?? wholeNumber(property.minimum);
     if (fallback !== void 0) return fallback;
   }
@@ -89183,7 +89403,7 @@ function graphqlDocument(template, args) {
   return { query, variables: Object.fromEntries(present.map((a) => [a.name, args[a.property]])) };
 }
 function errorMessages(errors) {
-  return errors.map((entry2) => isRecord8(entry2) && typeof entry2.message === "string" ? entry2.message : JSON.stringify(entry2)).join("; ");
+  return errors.map((entry2) => isRecord9(entry2) && typeof entry2.message === "string" ? entry2.message : JSON.stringify(entry2)).join("; ");
 }
 function invalidResponse2(detail, status2) {
   return { ok: false, error: { title: "Invalid response", detail, status: status2 } };
@@ -89194,14 +89414,14 @@ function interpret(template) {
     const status2 = response.status;
     const parsed = bytes.byteLength === 0 ? void 0 : parseJson3(decodeText2(bytes));
     const body2 = parsed?.ok === true ? parsed.value : void 0;
-    if (isRecord8(body2) && isList(body2.errors) && body2.errors.length > 0) {
+    if (isRecord9(body2) && isList(body2.errors) && body2.errors.length > 0) {
       return { ok: false, error: { title: "GraphQL error", detail: cutDetail(errorMessages(body2.errors)), status: status2 } };
     }
     if (status2 < 200 || status2 >= 300) return { ok: false, error: upstreamError(response, bytes) };
     if (parsed === void 0) return invalidResponse2(`The upstream answered ${status2} with no body.`, status2);
     if (!parsed.ok) return invalidResponse2(`The upstream answered ${status2} with JSON that does not parse: ${parsed.message}`, status2);
-    const data = isRecord8(body2) ? body2.data : void 0;
-    if (!isRecord8(data)) return invalidResponse2(`The upstream answered ${status2} with no data object.`, status2);
+    const data = isRecord9(body2) ? body2.data : void 0;
+    if (!isRecord9(data)) return invalidResponse2(`The upstream answered ${status2} with no data object.`, status2);
     if (!Object.hasOwn(data, field)) return invalidResponse2(`The response's data has no ${field} field.`, status2);
     const value = data[field];
     return { ok: true, value: isList(value) ? { items: value } : value };
@@ -107496,7 +107716,7 @@ function scalarText(value, name) {
 }
 function shapeOf(value, name) {
   if (isList(value)) return { kind: "list", items: value.map((item) => scalarText(item, name)) };
-  if (isRecord8(value)) {
+  if (isRecord9(value)) {
     return {
       kind: "object",
       entries: Object.entries(value).filter(([, item]) => item !== void 0).map(([key, item]) => [key, scalarText(item, name)])
@@ -107617,7 +107837,7 @@ function formText(value) {
   throw invalidArguments(`A form body cannot carry a ${typeof value} value.`);
 }
 function formBody(value) {
-  if (!isRecord8(value)) throw invalidArguments("A form body takes an object.");
+  if (!isRecord9(value)) throw invalidArguments("A form body takes an object.");
   const form = new URLSearchParams();
   for (const [key, item] of Object.entries(value)) {
     const items = (isList(item) ? item : [item]).filter((one) => one !== void 0);
@@ -107845,7 +108065,7 @@ function project(value, at) {
     const each = at.each;
     return value.map((item) => project(item, each)).filter((item) => item !== ABSENT);
   }
-  if (isRecord8(value) && at.fields.size > 0) {
+  if (isRecord9(value) && at.fields.size > 0) {
     const kept = [];
     for (const [name, child] of at.fields) {
       if (!Object.hasOwn(value, name)) continue;
@@ -107862,7 +108082,7 @@ function remove(value, at) {
     const each = at.each;
     return value.map((item) => remove(item, each)).filter((item) => item !== ABSENT);
   }
-  if (isRecord8(value) && at.fields.size > 0) {
+  if (isRecord9(value) && at.fields.size > 0) {
     const kept = [];
     for (const [name, item] of Object.entries(value)) {
       const child = at.fields.get(name);
@@ -107898,10 +108118,10 @@ function shapeRecord(value, rules, isError) {
   let out = value;
   if (rules.select !== void 0 && !isError) out = project(out, rules.select);
   if (rules.redact !== void 0) out = remove(out, rules.redact);
-  return isRecord8(out) ? out : {};
+  return isRecord9(out) ? out : {};
 }
 function shapeJson(value, rules) {
-  return isRecord8(value) ? shapeRecord(value, rules, false) : value;
+  return isRecord9(value) ? shapeRecord(value, rules, false) : value;
 }
 function byteLength(text4) {
   return encodeText(text4).byteLength;
@@ -107928,7 +108148,7 @@ function resultBytes(content, structured) {
 }
 function jsonResult(value, text4) {
   const result2 = { content: [textItem(text4)] };
-  if (isRecord8(value)) result2.structuredContent = value;
+  if (isRecord9(value)) result2.structuredContent = value;
   return result2;
 }
 function fitsCap(result2, rules) {
@@ -107983,7 +108203,7 @@ function shapeTextItem(item, rules, isError) {
   const text4 = item.text;
   if (typeof text4 !== "string") return item;
   const parsed = parseJson3(text4);
-  if (!parsed.ok || !isRecord8(parsed.value)) return item;
+  if (!parsed.ok || !isRecord9(parsed.value)) return item;
   return { ...item, text: JSON.stringify(shapeRecord(parsed.value, rules, isError)) };
 }
 function shapeToolResult(result2, rules, notes) {
@@ -108048,7 +108268,7 @@ function hasType(type, value) {
     case "boolean":
       return typeof value === "boolean";
     case "object":
-      return isRecord8(value);
+      return isRecord9(value);
     case "array":
       return isList(value);
     default:
@@ -108120,7 +108340,7 @@ function resolveRef(root, ref2) {
       const index = Number(token);
       if (!Number.isInteger(index) || index < 0 || index >= current.length) return void 0;
       current = current[index];
-    } else if (isRecord8(current) && Object.hasOwn(current, token)) {
+    } else if (isRecord9(current) && Object.hasOwn(current, token)) {
       current = current[token];
     } else {
       return void 0;
@@ -108130,7 +108350,7 @@ function resolveRef(root, ref2) {
 }
 function canonical2(value) {
   if (isList(value)) return `[${value.map(canonical2).join(",")}]`;
-  if (isRecord8(value)) {
+  if (isRecord9(value)) {
     const keys = Object.keys(value).sort();
     return `{${keys.map((key) => `${JSON.stringify(key)}:${canonical2(value[key])}`).join(",")}}`;
   }
@@ -108174,7 +108394,7 @@ var init_validate = __esm({
         this.steps += 1;
         if (depth > MAX_DEPTH2 || this.steps > MAX_STEPS) return [];
         if (schema === false) return [`${path2} is not allowed.`];
-        if (!isRecord8(schema)) return [];
+        if (!isRecord9(schema)) return [];
         if (value === null && schema.nullable === true) return [];
         const issues = [];
         if (typeof schema.$ref === "string") {
@@ -108192,7 +108412,7 @@ var init_validate = __esm({
         if (typeof value === "string") issues.push(...checkString(schema, value, path2));
         else if (typeof value === "number") issues.push(...checkNumber(schema, value, path2));
         else if (isList(value)) issues.push(...this.checkArray(schema, value, path2, depth));
-        else if (isRecord8(value)) issues.push(...this.checkObject(schema, value, path2, depth));
+        else if (isRecord9(value)) issues.push(...this.checkObject(schema, value, path2, depth));
         issues.push(...this.checkCombinators(schema, value, path2, depth));
         return issues;
       }
@@ -108242,8 +108462,8 @@ var init_validate = __esm({
         if (typeof schema.maxProperties === "number" && present.length > schema.maxProperties) {
           issues.push(`${path2} must have at most ${schema.maxProperties} ${plural4(schema.maxProperties, "property", "properties")}.`);
         }
-        const properties = isRecord8(schema.properties) ? schema.properties : {};
-        const patterns = isRecord8(schema.patternProperties) ? Object.entries(schema.patternProperties) : [];
+        const properties = isRecord9(schema.properties) ? schema.properties : {};
+        const patterns = isRecord9(schema.patternProperties) ? Object.entries(schema.patternProperties) : [];
         for (const key of present) {
           const at = propertyPath(path2, key);
           let known = false;
@@ -108523,7 +108743,7 @@ function differenceAt(path2, expected, actual) {
     if (expected.length === actual.length) return void 0;
     return { path: `${path2}[${shared}]`, expected: expected[shared], actual: actual[shared] };
   }
-  if (isRecord8(expected) && isRecord8(actual)) {
+  if (isRecord9(expected) && isRecord9(actual)) {
     for (const key of Object.keys(expected)) {
       const found = differenceAt(keyPath(path2, key), expected[key], Object.hasOwn(actual, key) ? actual[key] : void 0);
       if (found !== void 0) return found;
@@ -108601,7 +108821,7 @@ function rpcMessage(request3) {
   const parsed = parseJson3(decodeText2(request3.body));
   if (!parsed.ok) return void 0;
   const value = isList(parsed.value) ? parsed.value[0] : parsed.value;
-  return isRecord8(value) ? value : void 0;
+  return isRecord9(value) ? value : void 0;
 }
 function replayTransport(exchanges, route) {
   let next = 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxagen/cli",
-  "version": "2.1.4-380",
+  "version": "2.1.4-383",
   "description": "Oxagen governance CLI — spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
   "type": "module",
   "bin": {